I’ve been saying for a while now that car companies have to get serious about security in cars in the light of some high profile hacks in the last year that show that cars are very vulnerable to being pwned by hackers. I’ve even proposed a “Patch Tuesday” type of scheme to make sure that security fixes and improvements get into the hands of drivers. Here’s another example of why this is required:
ADAC, the German Automobile Club, is sort of the AAA of Germany. Recently, the group revealed the findings of some auto security tests they’d run to bring attention to how easy it is for thieves to exploit keyless entry systems and steal cars, despite the fact that the vulnerability has been known for years.
The technique involves cars equipped with keyless entry transmitter keys. Normally the key, which uses a radio signal, must be just a few feet away from the vehicle. The ADAC researchers figured out that with some inexpensive equipment, they could pick up the radio signal from a nearby keyless entry fob and extend it several hundred feet. The equipment cost ADAC roughly $225.
Once inside, the researchers (or thieves) would be able to start and drive the car away, as most automakers allow the engine to keep running and the car to drive even after the keyless entry fob goes out of range. ADAC used the technique on several cars in Europe, including Audis, BMWs, GM products, Fords, Kias, and Toyotas.
I’ll add Hyundai to the list as my 2016 Tucson will stay running if the key fob is removed from the car and you can drive away with it. That seems to me to be a #fail as I cannot think of a use case where this should be the desired behavior. I would be very interested to see what, if anything car companies do to address this issue as clearly this is something that needs to be addressed and soon.
#Fail: Bluetooth Car Add-On Doesn’t Require Verification
Posted in Commentary with tags Cars on April 11, 2016 by itnerdOne topic that I keep coming back to is the fact that the security of cars is something that seems to be lacking. I highlighted this last week and today I found a new reason to bring this topic up again. There’s an aftermarket device called the Lemur Vehicle Monitors BlueDriver that that connects to a vehicle’s OBD-II port and provides information about the vehicle’s performance. You pair said device to your smart phone via Bluetooth and you can get all sorts of interesting data. That’s cool, except for the fact that anyone can access the device over Bluetooth as it doesn’t require any sort of authentication such as a PIN code. That means that anyone can have access to whatever your car might be doing and in theory attack the car and take control of it. There is a CERT Vulnerability Note that gives the details as well as their recommendation which is not to use the device. I cannot find a response from the company as to what they plan to do about this. That does not inspire confidence.
This is yet another example of why automotive security needs to be taken seriously as sooner or later, we will go from seeing theoretical risks to real ones. By then it may be too late to do anything about them.
Leave a comment »