The IT Nerd

Last week, I suggested that car manufacturers needed a “Patch Tuesday” to ensure that the driving public is safe(er) because of some high profile recalls due to software bugs that were safety related. I didn’t address security and given this video from Wired Magazine, I perhaps should have. In short, a couple of security experts have shown how easy it is to hack into a car from miles away. In this case a Jeep Cherokee via the Uconnect system in the car. What they managed to do should scare you. But I won’t spoil the surprise. Watch this video to see what they did:

As you can see, they were able to control, steering, brakes and the engine among other things.

Here’s why it should scare you:

1. Software companies for the most part are used to responding to people finding security holes in their software. But this is a new concept to car companies.
2. Car companies are also not used to hunting for these sorts of bugs. Thus it is likely all sorts of vulnerabilities like this exist. Which means that it is likely that in the era of the connected car that any car can be pwned.
3. Let’s pretend for a second that car companies are able to respond to issues like these. How do they get patches to end users? Tesla does over the air updates. But no other car company comes close.

Now the people who found these holes in Uconnect reported these holes to Chrysler and gave them time to fix their issues via a software update which you can likely find here (have your VIN number handy). But the only people who will know to upgrade their Uconnect systems are those who are aware of this issue. That’s why the “Patch Tuesday” article that I wrote is so timely. The car industry needs to get something like this out to drivers quickly given the scope of the issue. There’s also one other issue. Someone with less honorable intentions could cause a lot of mayhem via exploits like this. Thus one wonders what the car industry is doing to protect drivers. That’s something that I really would like to know and the car industry needs to articulate that sooner rather than later.

This entry was posted on July 22, 2015 at 1:09 pm and is filed under Commentary with tags hack, Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.