24

There are lots of papers concerning car hacking. It is often done with physical access (by the OBD interface for example), sometimes without (Remote Exploitation of an Unaltered Passenger Vehicle).

The only case of exploitation I've read about is the theft of BMW cars. Are there some other cases of exploitation in real life by villains (or by governments, which can be pretty much the same)?

Improve this question
3
  • 5
    It also depends on how you define the word "hacked". Researchers found a lot of Chrysler vehicles simply by scanning Sprint's IP space and were able to retrieve a lot of information about the cars using their research techniques. They were also able to reprogram their own jeep, over the air, to break through the security functionality and get complete control over the car remotely: blog.kaspersky.com/blackhat-jeep-cherokee-hack-explained/9493
    – Mark Henderson
    Jun 27, 2016 at 15:27
  • There are few instances that are known to be related to hackers, either because maybe that many people aren't pricks looking to wreak havoc, or because the people and/or media expect that one-off instances are human error. It is technically possible that isolated instances that look like accidents were in fact assassinations where a car hacker(s) was involved, but it wasn't portrayed as such.
    – signus
    Jun 27, 2016 at 19:19
  • I think the main limiting factors are: A) remote hacking a car still requires a fair bit of expert level know how, B) except if you're stealing the car (which is unlikely in a remote attack) there is no real monetary incentive... I.e. high cost, low benefits; thus a lower interest from the criminal world.
    – fgysin
    Jun 28, 2016 at 12:04

2 Answers 2

Reset to default
25

As reported on Wired in March 2010:

More than 100 drivers in Austin, Texas found their cars disabled or the horns honking out of control, after an intruder ran amok in a web-based vehicle-immobilization system normally used to get the attention of consumers delinquent in their auto payments.

Other than that, not much, as Sophos says:

The dangers of cyber attacks on cars has all been theoretical so far: at this point, there’ve been no real-world attacks, as far as we know. Only security researchers have managed to send cars into the weeds.

Improve this answer
13
  • 22
    a dealership had the power to remotely disable cars? that sounds wildly dangerous, even if used by the dealership rather than an intruder!
    – Woodrow Barlow
    Jun 27, 2016 at 15:34
  • 4
    The problem here is "as far as we know." I don't think any of the police or even insurance people are set up to identify car hacking issues.
    – NotMe
    Jun 27, 2016 at 15:47
  • 6
    The remote disable systems used by lenders only disable when the ignition is off. So if the car is running/moving when the lender sends the command, the car will keep working until it's turned off.
    – longneck
    Jun 27, 2016 at 17:09
  • 4
    @longneck: Um, consider the case where the engine stalls in a railroad crossing...
    – R.. GitHub STOP HELPING ICE
    Jun 27, 2016 at 20:14
  • 5
    @MartinCarney: Assuming time for driver/passengers to do anything, of course they can just get out, so the main risk of a vehicle stuck in a railroad crossing is damaging/derailing the train. And "you're no worse off than running out of gas" is not an argument when a malicious party introduced a new, additional dangerous failure case for their own greedy purposes.
    – R.. GitHub STOP HELPING ICE
    Jun 27, 2016 at 21:18
-4

Yes, they can. My Jeep Cherokee was vulnerable. They even ran a segment on TV and I immediately went on line and found it to be true. I was referred to a Jeep website where I was able to download the patch to a thumb drive which I plugged in my car and started it up. It recognized the patch and installed it to the Jeep's computer. There is even a recall on this issue.

Improve this answer
4
  • 11
    "I immediately went on line and found it to be true" then could you please add a source to your answer to back up your claim?
    – hd.
    Jun 27, 2016 at 16:29
  • 3
    Where did you download the patch from?
    – user2320464
    Jun 27, 2016 at 16:47
  • The patch can be found at driveuconnect.com
    – Devin
    Jun 27, 2016 at 17:34
  • 9
    You missed the point of the question. A security researcher demonstrated the flaw in the Jeep setup. However, there is no evidence of anyone actually using the flaw to do anything (steal a car, cause an accident, etc.) other than demonstrating the flaw. That is what is being asked: has the flaw been exploited?
    – longneck
    Jun 27, 2016 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .