3

Recently two researchers working with a Wired Magazine reporter have demonstrated a serious vulnerability in UConnect, the software that powers the onboard entertainment systems of all Chrysler group cars manufactured after 2013: http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

This does sound scary, but in the article it is stated that

Uconnect’s cellular connection also lets anyone who knows the car’s IP address gain access from anywhere in the country.

which is quite logical, I need to know where to send my payload, but doesn't this decrease the severity of the attack by orders of magnitude? It isn't easy to get a particular car's IP, definitely without physical access, and that's assuming it's constant, which it likely isn't since it's using cellular connectivity. Apparently the car belonged to one of the researchers, so I imagine they found out what the IP was before performing the attack.

Am I missing something? Is it easier than I think to grab the IP of a car I spot in the street?

2

Here is the copy of the paper they wrote on this topic, linked directly to the section on "Cellular Exploitation":

http://www.ioactive.com/pdfs/IOActive_Remote_Car_Hacking.pdf#page=42&zoom=auto,61,288

As you can see, it was not necessarily trivial to discover the method. However, now that it has been done, you can see that this was the way to find vulnerable cars:

To find vulnerable vehicles you just need to scan on port 6667 from a Sprint device on the IP addresses 21.0.0.0/8 and 25.0.0.0/8. Anything that responds is a vulnerable Uconnect system (or an IRC server). To know for sure, you can try to telnet to the device and look for the ERROR “Unknown command” string.

Now, linking the IP to a "car I see on the street" is a much more difficult task. The authors write this:

If you knew the VIN or GPS, you could scan the IP ranges where vehicles are known to reside until you found one with corresponding VIN or GPS. Due to the slow speed of devices on the Sprint network, to make this practical, you’d probably need many devices to parallelize the scan, possibly up to a few hundred.

Earlier in the paper, they detail methods of accessing information like the VIN or GPS coordinates.

Of course, you can't do this particular technique anymore, because changes have been made. The vehicles have (nominally) been patched, and more importantly, the sprint network no longer allows it.

The authors used a hacked femtocell in their research, and I suspect that method is still a viable way to do this.

1

Well, in general companies are assigned blocks of Internet facing IP addresses, so once you know the netblock you're looking for (e.g. looking up Chrysler) it may be possible to scan for "live" IP addresses in that netblock to attack, which is a relatively fast process.

This is assuming that you're carrying out an untargeted attack (i.e. you don't care which car you compromise) as opposed to a targeted attack (i.e. you want to compromise a specific jeep) which might require additional information.

In the case of the Jeep hack, IIRC Chrysler implemented filters to prevent that kind of scanning, but it was initially possible.

  • In this case the internet service is provided by Autonet Mobile (source: en.wikipedia.org/wiki/In-car_Internet ), so I'm assuming that should be the company one would want to look up, and not Chrysler, right? But thanks, that's something I haven't thought about. – user4520 Nov 2 '15 at 22:24
1

Here are some steps to figure it out:

  1. Let's say you know the name of the company that provides internet services, Autonet Mobile. Let's google their website:

    Results: www.autonetmobile.com

    And you do an nslookup on the website name:

    ec2-50-112-136-240.us-west-2-compute-amazonaws.com = 50.112.136.240

    Now if you "scan" that block, you see this is only pointing to the Amazon cloud. In fact, the whole block is amazon cloud. It's not likely linked to the rest of their corporate "stuff."

    So how do we find out if they have other stuff? We can try common names like mail.autonetmobile.com, which returns 74.125.202.121, a separate cloud service from 1e100.net. Hey wait a minute! That belongs to Google. Are they the ones behind this technology?

    Now let's see if there's any relation if we scan 74.125.202.*. We aren't getting anything really useful right now, but we did find some "related" IP addresses. Now this probably isn't what we're looking for. Or is it?

    According to Rory, Chrysler did apparently implement filters to prevent this kind of scanning. That doesn't matter if you already know where the IP addresses are. What matters is if they stopped the exploit that allowed remote control of the jeeps.

  2. So now, you want to find the car's IP address after the above method failed. You probably haven't found many useful things by scanning their blocks. Let's think about something else. Are you able to connect to any websites with the vehicle? If so, create a fake website page that only you know about, and have it collect the IP addresses of the visitors. Once you look at the visitor log, look at the IP address. Are you able to just find the IP address within the car's network settings? Even easier.

    Take the IP address and scan the block, and all the other blocks like so with a general programming language:

    String ip = "127.0.0"; // It's 127.0.0.1, but remove '.1' for simplicity of this answer
    
    for (int i = 0; i < 256; i++) // Get everything from 0-255; 127.0.0.0-255.
    {
        dnsLookup(ip + "." + i);
    }
    

    Or in Linux:

    ip="127.0.0"
    
    range="1 254"
    for NET in $ip; do
      for n in $(seq $range); do
        ADDR=${NET}.${n}
        echo "${ADDR},`nslookup ${ADDR} | awk -F "=" '{ print $2 }'| sed 's/^[ t]*//' | sed '/^$/d' | |sed 's/.$//'`"
      done
    done
    

    That's a simple way to get all IPs in a block.

  3. You can then use geolocation to see if the similar IP addresses belong to the car-internet-providing company in question. There's nothing they can really do to prevent figuring that out.

  4. Now let's talk about IP blocks. Usually, companies assign IP blocks to the same general area. Let's pretend Area 1 shows up as hsd1-499.la.autonetmobile.com, you could probably eventually figure it out. You know where someone bought their car, right? It's probably shown on the back of their vehicle. "I'm a VIP at Hulkalo Chrysler!" So what do you do next? Pay a visit to Hulkalo Chrysler and take the same model for a ride. Get the IP address of that vehicle if you are able to.

  5. Now that you have the IP address for the test drive vehicle, you can scan the range using the aforementioned methods. You'll likely find the vehicles at that point. But is it the right one? Unless you're able to capture packets being sent wirelessly, you may have a hard time, though you'll likely figure it out eventually with trial and error. You may be able to ping each vehicle IP to see if it's online.

I realize this may sound like a jumbled, convoluted mess, but since I am not a vehicle hacker, there may be a lot of things I'm missing. These are simply methods I'd take to figure it out if I were.

As for how dangerous it is? The hack is extremely dangerous. A vehicle's controls should NEVER be accessible via the internet. If I didn't know any better, I'd go out on a limb to say this type of accessibility exploit was required of Chrysler by a certain alphabet agency, and it makes me wonder what other vehicles they're in...

  • 1
    That makes sense, +1. When I asked how dangerous it was, I meant how feasible such an attack is given that the IP has to be known, not what consequences there are once the attacker gains control of the vehicle since they're obviously horrible. And your last suggestion is not unlikely given what we know about some other mainstream software ;) – user4520 Nov 3 '15 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.