Hacker shows he can locate, unlock and remote start GM vehicles

Re:Hacker shows he can locate, unlock and remote start GM ve... by laumars on Wednesday August 05, 2015 @08:04AM (#10009123)

It is partly by design since the ECU is physically connected to the infotainment system for diagnostics / user configuration. If ever there was an example of when systems should be airgapped, this should be one of them.

ECU's have no business being integrated into infotainment systems. It's fine to have a physical wire that can be connected for diagnostics, but don't have then permanently connected by default. Just don't.

edit: just read the article (doh for commenting before reading) and this attack is different from the previous ones. This one uses a feature that was built into the cars purposely for unlocking the vehicle and controlling the engine. That feature seems monumentally dumb from the outset - and very much implemented by design.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by MichaelApproved on Wednesday August 05, 2015 @08:11AM (#10009147)

> There is no money in exploiting these bugs

- Murder for hire. - Killing political opponents. - Another country could use it to kill our leaders.

I'm looking forward to self-driving cards but my only real fear is a bug being used to kill people in the manner I just described.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by JoeAltmaier on Wednesday August 05, 2015 @08:12AM (#10009150)

Or this: http://www.xkcd.com/1559/

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by pavel_lishin on Wednesday August 05, 2015 @09:27AM (#10009518)

I'm not afraid of being killed because someone hates me, I'm afraid of being killed because a 12 year old with a laptop may not have a fully developed moral sense of right and wrong.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by MichaelApproved on Wednesday August 05, 2015 @12:05PM (#10010751)

I'm not afraid of being killed either. I'm mostly worried about politicians and powers that be killing others to stay in power. It's much easier to keep your hands clean as a government hacker than as a government hit-man.

Even if the hardware is secure against a script kiddie hacker, it'll never be secure against a government backdoor.

Imagine the power that someone like Nixon would have as president today. It's scary.

"When the president does something, that means that it is not illegal" https://www.youtube.com/watch?v=tYdJqSG3K6c

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by dublinben on Wednesday August 05, 2015 @10:19AM (#10009825)

I fully expect a new genre of prank videos to emerge. Self-driving cars with cameras make for perfect targets. Innocent people will be involuntary passengers for a Grand Theft Auto style rampage that is livestreamed for the world to see.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by grkvlt on Wednesday August 05, 2015 @05:03PM (#10012851)

Really? Do you imagine the only thing stopping people from trying to kill random strangers is the fact they currently have to get up out of bed to do it? Because it can't be the fear of getting caught, since the perpetrators of any vehicular malware that kills people will be caught...

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by pavel_lishin on Wednesday August 05, 2015 @05:49PM (#10013131)

If the fear of getting caught prevented people from committing crimes, jails would be empty.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by grkvlt on Wednesday August 05, 2015 @07:31PM (#10013618)

Exactly, so according to the people worried about killer malware, the only thing stopping our population of latent murdering sociopaths is the fact that it's currently too much physical effort to go and sabotage some sandom vehicle? As I said, this seems unlikely to me...

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by rwmj on Wednesday August 05, 2015 @08:41AM (#10009283)

On the bright side, these cars can now be used as an open platform for developing open source driverless car software. You can even use the stereo to run the control software. (I'm only being slightly flippant)

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by laumars on Wednesday August 05, 2015 @08:12AM (#10009149)

You're replying to the wrong post. That should have been to my parent commenter.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by MichaelApproved on Wednesday August 05, 2015 @12:03PM (#10010733)

You're right. Thankfully, I had a quote to give some context to what I was trying to rebut. It'd be great if a mod could change the location of the reply.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by tomp on Wednesday August 05, 2015 @08:03AM (#10009119)

It is by design, it must be.

There is the acceleration module, then there is a wireless networking me dule, and there is a physical wire connecting them.

Very shitty, very dangerous design.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by TeMPOraL on Wednesday August 05, 2015 @08:44AM (#10009303)

More like, there is this acceleration module and there is this pedal that must hook into it, and there is this handy bus going through the car that you can connect the two systems to in order to make them talk with each other.

And then you add a radio, and a knob under the steering wheel to control it, and think - hey, I have this handy bus I can reuse so that they talk with each other. And suddenly, your radio talks to your brakes.

I don't think it's malicious design. More likely stupid one, or just a result of people being used to treating car hardware as trusted environment - where obsessing over security is just a waste of resources. It's just that when you introduce an Internet-connected device to that environment, it's not trusted anymore.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by tomp on Wednesday August 05, 2015 @09:13AM (#10009447)

I'd still argue that anyone who connects radio, travel computer or air condition systems (non-critical, not real time) with breaking, acceleration and external lightning systems (mission-critical, realtime, potentially lethal) is maliciously stupid.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by alienasa on Wednesday August 05, 2015 @12:43PM (#10011019)

In almost all cars there are in fact two CAN buses - a high speed, low security bus that connects the radio to the entertainment system and so on, and a low-speed, high security (in terms of components, not actual security) but that connects the brakes to the ECU and so forth.

The issue is that frequently systems like OnStar sit on both buses, because they are used for things like engine diagnostics. If you investigate you'll notice that every single one of these car hacking attacks starts somewhere, pivots to an OnStar like system, then can control the car.

Doesn't really make your point less true, but fits perfectly in the features over security mindset.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by Too on Friday August 07, 2015 @04:04AM (#10021366)

Two CAN buses is a quite low number. Last system i saw, which was pretty old, had at least half a dozen from what i could tell from my end of the system, probably even more internally inside or behind other components. Modern cars also use flexray, LIN, MOST and all other kinds of buses. The reason for this is safety, bandwidth and that the delay jitter on a highly loaded can bus can be relatively unpredictable for high frequency control requirements like suspension, traction and other engine related control.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by Lawtonfogle on Wednesday August 05, 2015 @01:54PM (#10011538)

Or there is always the chance of management overriding building a separate system due to higher costs. The gains in safety did not justify the costs to them.

Don't contribute to malice what could be explained by stupidity. Don't contribute to stupidity what could be explained by greed.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by cjrp on Wednesday August 05, 2015 @10:08AM (#10009761)

Add to that the fact that some cars, like a Mercedes C-Class I rented recently, allow you to change the 'agility' setting from the entertainment screen (changing throttle response, steering and suspension).

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by andygates on Wednesday August 05, 2015 @09:32AM (#10009538)

There is a common bus, and there are reasons for it existing, but the fault is with an internet-connected module being able to break out of its role. Fixing that is the traditional game of whac-a-mole that we have in IT every day, at least until a secure-by-design Bus 2 comes along.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by toyg on Wednesday August 05, 2015 @08:49AM (#10009326)

> There is no money in exploiting these bugs and even so-called script kiddies will probably not want to risk killing anyone.

I'm sure plenty of international "agencies" would pay very good money to be able to exploit these bugs. Gotta take out somebody driving a GM car? No sweat!

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by TeMPOraL on Wednesday August 05, 2015 @08:48AM (#10009318)

> There is no money in exploiting these bugs

There's such an obvious way to make money on them I'm surprised it isn't happening yet - if you have a zero-day for a car, just make a deal with your lawyer friend, that you'll crash some poor schmuck's car and your friend will help the victim sue car manufacturer for $shitton, which you'll split between the two of you.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by brandonwamboldt on Wednesday August 05, 2015 @08:43AM (#10009292)

There is no money in swatting either, but yet it's becoming a growing problem for popular streamers (and police departments).

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by balabaster on Wednesday August 05, 2015 @09:28AM (#10009521)

There may be no money in exploiting these bugs, but it's bugs like these that make a police state even closer to possible... if these bugs aren't found and squashed, they can and will be exploited by anyone who decides they need to coerce and control whatever they need to. One more tool for to be used against... whoever.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by fnordfnordfnord on Wednesday August 05, 2015 @10:02AM (#10009727)

If this kind of exploit could be exploited en masse it could wreak huge economic havoc in addition to the life safety issues. Even if the attackers were warm and fuzzy types and they only took control of cars that were stationary. Forgetting about the safety problems for a moment it's kind of amusing to imagine thousands of logo-turtle-cars ambling around parking lots, clogging up traffic, making unprotected left-turns, etc.

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by balabaster on Wednesday August 05, 2015 @11:10AM (#10010300)

Hahaha @ Logo Turtle... that brought back memories long since suppressed/forgotten from back in primary school

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by na85 on Wednesday August 05, 2015 @10:50AM (#10010102)

You don't think "Send bitcoin to this address or your daughter's car will suffer an unexpected malfunction" will be a thing?

[ Parent | on HN ]

Re:Hacker shows he can locate, unlock and remote start GM ve... by mtgx on Wednesday August 05, 2015 @08:57AM (#10009366)

What about the NSA, CIA, Russia, China or drug cartels. Do you think they will want to "risk" killing anyone like this?

[ Parent | on HN ]