Fuel Economy, Hypermiling, EcoModding News and Forum - EcoModder.com - Hacking a Jeep's electronic control systems

EcoModder.com (https://ecomodder.com/forum/)

- The Lounge (https://ecomodder.com/forum/lounge.html)

- - Hacking a Jeep's electronic control systems (https://ecomodder.com/forum/showthread.php/hacking-jeeps-electronic-control-systems-32418.html)

California98Civic

07-22-2015 02:34 AM

Hacking a Jeep's electronic control systems

A few years ago these same hackers did this same thing with a Prius, but at that time they had to be in the car, plugged into the system. This attack was wireless.

Hackers Remotely Kill a Jeep on the Highway

j

gone-ot

07-23-2015 05:10 PM

...and they (those guys) probably *learned* the trick from their NSA "handlers" (wink,wink).

darcane

07-23-2015 07:07 PM

Quote:

Originally Posted by Old Tele man (Post 487805)

...and they (those guys) probably *learned* the trick from their NSA "handlers" (wink,wink).

Right, because it's a complicated feat to hack into a modern car's CANbus, requiring expensive tools.

jamesqf

07-24-2015 01:24 PM

Quote:

Originally Posted by darcane (Post 487817)

Right, because it's a complicated feat to hack into a modern car's CANbus, requiring expensive tools.

I really like the way the spokesperson claims that it's impossible to prevent remote hacking. I'd bet quite a large sum that it's impossible to remotely hack my Insight, and I'm absolutely certain that it couldn't be done to my '88 Toyota pickup.

freebeard

07-24-2015 02:42 PM

Fiat Chrysler Recalls 1.4 Million Autos To Fix Remote Hack - Slashdot

Quote:

Originally Posted by MrL0G1C on Slashdot.org

How massively ironic is it that they can't fix these cars remotely when the vulnerability is due to remote hacking.

Fiat Chrysler recalls 1.4 million cars over remote hack vulnerability | Ars Technica

Quote:

Originally Posted by paergrin on Cars Technica

Basically the CAN bus is how all car systems talk to each other. It's just one bus for the car and it's kind of neat in its implementation: each message contains its own priority and that's used for bus conflicts. MessageIDs are either 11 or 29-bit numbers and lower numbers are higher priority. AIRBAG_WLAMP is 0x12 so it's quite high priority, to light up an airbag malfunction. 0s on the bus take priority and transmitting devices also listen at the same time, and if what they see on the bus isn't what they are transmitting they stop for the higher priority message to go through.

What makes this function is that per the standards, only one device is allowed to send any given message ID. Your brake system can't send an AIRBAG_WLAMP, and your entertainment system sure as hell can't tell the brakes that the radar detects an imminent collision please press the brakes hard as hell. This is normally fine because yeah, the uConnect doesn't know how to send those messages so no problem, right?

The remotely accessible nature of the system combined with a vulnerability in the system combine to allow the attacker to overwrite the firmware of the entertainment system, teaching it how to send all these nifty CAN bus messages, thus allowing this.

https://news.ycombinator.com/item?id=9324191
Many vehicles have multiple CAN buses, looking at you Tesla Model S.

darcane

07-24-2015 03:56 PM

Quote:

Originally Posted by jamesqf (Post 487903)

Absolutely true.

But as more and more cars are moving towards being connected ("That's the dream, to have wifi in the car") it will become increasingly difficult to find cars that are immune to hacking...

I think all critical functions (powertrain, brakes, steering, etc) need to be on their own separate CAN bus that is air-gapped from any other CAN bus in the car. Simply having multiple CAN buses doesn't fix the problem if they can still communicate with each other.

freebeard

07-24-2015 04:10 PM

I'm such a paranoid that when I got my 1971 VW Superbeetle, I took the AM radio out. :) ...but true.

This is fascinating. From the 30th Chaos Communication Conference, this guy just wanted to add his own menu to the dashboard of his VAG car.

https://www.youtube.com/watch?v=7h7LWeET1fI

It's an hour long, but from 22:11 to 23:43 there is a good CAN Bus Crash Course. There are dominate and recessive bits; collisions aren't detected, they are arbitrated.

After that there is a lot of hackers laughing in the audience and it goes right down the rabbit hole.

jamesqf

07-24-2015 08:56 PM

Quote:

Originally Posted by darcane (Post 487917)

But as more and more cars are moving towards being connected ("That's the dream, to have wifi in the car") it will become increasingly difficult to find cars that are immune to hacking...

But it's certainly not my dream. I have absolutely zero use for WiFi in a car, and a lot of reasons - hackability is only one - why I wouldn't want it. I don't suppose I'm alone, so I wonder if any manufacturers are going to address this market segment.

If not... Well, at least it's likely to save me quite a bit of money I otherwise might spend on buying newer cars :-)

gone-ot

07-24-2015 11:32 PM

FYI...ANY system that permits external INPUT via ANY communication link (hard- or soft-wired) is susceptible to hacking. And, this is especially true of 'new' car technologies designed to enable the manufactures to 'listen' to vehicles as they're being driven for (supposedly) "engineering" analyses only (sure!)...because the SAME commands they use to 'test' subsystems (brakes, steering, ignition, lights, etc.) can be likewise "controlled" by a hacker. And, most car companies (currently) use NO security protection against "outside" takeover and control by hackers...all it's ALL done via satellite link!

freebeard

07-25-2015 06:02 AM

Here is a DIY approach to threat assessment:
Car Hacker's Handbook

And here's what the manufacturers are doing:
Firewalls can't protect today's connected cars | Computerworld

http://images.techhive.com/images/ar...large.idge.png

There's your problem. This diagram from the above link disagrees with the above video, which at 5:00 shows a similar block diagram that inserts a CAN Gateway before the OBDII port.

gone-ot

07-25-2015 08:13 PM

Since nobody writes 100% perfect software code to begin with -- and such 'half-donkey-ed' code is *HOW* hackers gain entry & control -- that is *why* self-driving autonomous vehicles will NEVER grace my garage...nor will I knowingly ride in one.

me and my metro

07-25-2015 11:13 PM

That is why I own a 1984 Gmc Diesel pickup. There is nothing computerized on that truck. I also have a point ignition 68 Chevy pickup. Two fuel choices and no computer!

freebeard

07-26-2015 12:17 AM

Quote:

Originally Posted by Old Tele man

Since nobody writes 100% perfect software code to begin with -- and such 'half-donkey-ed' code is *HOW* hackers gain entry & control -- that is *why* self-driving autonomous vehicles will NEVER grace my garage

It's an interesting problem. Software written by hoo-mans is suspect of course, but genetic algorithms can be applied to software bred for fitness for purpose. If you look at the Computerworld article, they discuss a 'hypervisor' to sanity-check the performance of the code in real time. Hackers rely on operating systems, and communication protocols. Embedded code running close to the metal has a minimal attack surface.

Quote:

...nor will I knowingly ride in one.

Did you see the story where someone demoed the pedestrian safety feature in the new Volvo?

Fail! Demo of Volvo pedestrian safety system goes terribly wrong | www.krmg.com

Motto: know what's under your hood. Meanwhile I have a mechanical fuel pump, cable-driven speedometer and electrical gas gauge and warning lights. The speedometer and gas gauge are both inaccurate.

Xist	07-26-2015 01:28 AM

I do not know how anyone could hack my Civic. I am more worried about Frank Lee figuring out where I live and asking to borrow a cup of sugar.

freebeard

07-26-2015 02:23 PM

If he showed up at my door wearing that Ed Roth hat, it would be worth a cup of sugar.

California98Civic

07-26-2015 04:37 PM

Quote:

Originally Posted by Xist (Post 488057)

I do not know how anyone could hack my Civic. I am more worried about Frank Lee figuring out where I live and asking to borrow a cup of sugar.

Quote:

Originally Posted by freebeard (Post 488075)

If he showed up at my door wearing that Ed Roth hat, it would be worth a cup of sugar.

Frank Lee for EM patron saint of cheap travel. St. Cheapstopher. :thumbup:

Wait... what was the topic of this thread again? :)

freebeard

07-26-2015 06:07 PM

From http://thehackernews.com/2015/07/car-hacking-jeep.html

2013-2015 MY Dodge Viper specialty vehicles
2013-2015 Ram 1500, 2500 and 3500 pickups
2013-2015 Ram 3500, 4500, 5500 Chassis Cabs
2014-2015 Jeep Grand Cherokee and Cherokee SUVs
2014-2015 Dodge Durango SUVs 2015 MY Chrysler 200, Chrysler 300 and Dodge Charger sedans
2015 Dodge Challenger Sports coupes

Edit: I watched the Script Your Car video again and learned some new things.

In a non-OBDII RV, like a cedar cabin on an old log truck or even a 'tiny house', rather than plug in an old PC; you could get a VAG CAN bus controller for 200(euros? plus a daughtercard upgrade and added USB port) and have a CPU from a Nokia smart phone and another CPU from an Android tablet running Linux in OEM-grade automotive components. He demonstrates this running on the podium from a regulated 12v power supply—3G, Wi-fi hotspot, audio streaming over Bluetooth, voice synthesis and recognition, &etc.

The CAN bus controller runs Linux, but they never delivered the source code with the car—a clear violation of the GPL. Lots of hacker mirth at that.

There's a lot about the BAP (display controller) and something called D-Bus I still don't get.

jamesqf

07-27-2015 12:56 AM

Quote:

Originally Posted by Old Tele man (Post 488047)

Since nobody writes 100% perfect software code to begin with -- and such 'half-donkey-ed' code is *HOW* hackers gain entry & control...

Not in this case, if I understand correctly. The problem was not that buggy code allowed a hack, it was that there was no barrier to gaining access at all, other than needing to understand the system.

And if the software in cars bothers you, don't even think about the typical commercial airliner :-)

gone-ot

07-27-2015 05:15 PM

...yeah, I know, I was a "flyer" in USN...but my planes all used reciprocating engines and NO computers except us human-cargo "computers" (ha,ha).

Fat Charlie

08-12-2015 11:29 AM

It's just too easy.

Corvette's brakes hacked via insurance company device

Insurance dongle frequently used by Uber could be hacked regardless of vehicle make

freebeard

08-12-2015 06:24 PM

Jack Rickard puts the whole Jeep thing down to an attack on your right to repair your own vehicle:

Quote:

In the month when the copyright office is expected to issue a waiver of the Digital Millineum Copyright Act for those seeking to learn about and repair their own automobiles, would you believe that two notorious “hackers” have successfully hacked into a Jeep Cherokee in St. Louis and posed a grave threat to life and limb of the driver by completely taking over control of the vehicle. And two congressmen, also supported by Chrysler, are introducing legislation to address this severe threat to the cyber security of our nation of people hacking into cars? The article appeared in Wired Magazine and they didn’t even bother to hide the fact that the genius hackers had direct access to the vehicle for months and indeed had installed different firmware in the vehicle? Or that they were paid by Chrysler? And that Chrysler had issued a recall just hours before the event assuring all owners they could be secured from the security breach at no cost? There is so much wrong with this story that I scarce know where to begin, but due to the George Carlin effect no doubt a sufficient number of innocents will buy into this manufactured pap as to pose a real problem.

http://evtv.me/2015/07/weve-gone-plaid/

He was amused by the Tesla hack because they went in through an Ethernet port in the infotainment subsystem to get to the CANbus and then couldn't do much; while two feet away is a port with CAN high and low and he sells the tool to read and inject any CAN messaging you choose.

Right now he's working on smoothing out the regen at differing speeds.

freebeard

08-24-2015 02:03 PM

Replying to myself to bump the thread.

Highway to hack: Why we’re just at the beginning of the auto-hacking era

Ars Technica on the institutional impediments to good security in moving vehicles. It highlights how Tesla's outsider status allows it to re-imagine how security works.

Quote:

These are just the attack approaches that are being tried now. Corman said he believes, as In-Q-Tel Chief Information Security Officer Dan Geer has suggested, that "bugs are dense"—meaning there are sure to be a given number of potentially exploitable defects in every thousand lines of code. "The total number of bugs will go up as the total number of lines of code goes up," he said. "The total number of access points to the exploitable codes go up as the number of devices on the network go up. And the total number of adversaries go up because now we've taken car hacks from theoretical to demonstrable." Car companies, Corman said, have to be prepared for software failures, because it's not a question of if they will happen, but when. The more important question becomes how car makers will respond.

Running the article through Mac OSX Summarize:

Quote:

This month at three separate security conferences, five sets of researchers presented proof-of-concept attacks on vehicles from multiple manufacturers plus an add-on device that spies on drivers for insurance companies, taking advantage of always-on cellular connectivity and other wireless vehicle communications to defeat security measures, gain access to vehicles, and—in three cases—gain access to the car’s internal network in a way that could take remote control of the vehicle in frightening ways.

...No one at Ford, GM, and Chrysler would talk with Ars about their strategy for uncovering potential security issues in software that could be used for "cyber-physical" attacks—hacks that could have an impact in the physical world by interfering with the operation of cars.

...The “attack surfaces” of cars that get the most attention are the ones designed to keep people from driving away with cars they don’t own—electronic keyless entry systems or locks and vehicle immobilizers that use low-power radio to detect the presence of a valid car key before allowing a car to start for example.

...But connected car services such as GM’s OnStar, Fiat Chrysler’s Uconnect, Ford’s Sync, and add-on services such as those based on Mobile Devices’ C4 OBD2 “dongle” greatly extend the range of a potential attack—especially if the attacker’s goal is to do damage by interfering with the driver’s ability to operate the vehicle.

All times are GMT -4. The time now is 03:27 AM.