There are lots of papers concerning car hacking. It is often done with physical access (by the OBD interface for example), sometimes without (Remote Exploitation of an Unaltered Passenger Vehicle).

The only case of exploitation I've read about is the theft of BMW cars. Are there some other cases of exploitation in real life by villains (or by governments, which can be pretty much the same)?

  • 5
    It also depends on how you define the word "hacked". Researchers found a lot of Chrysler vehicles simply by scanning Sprint's IP space and were able to retrieve a lot of information about the cars using their research techniques. They were also able to reprogram their own jeep, over the air, to break through the security functionality and get complete control over the car remotely: blog.kaspersky.com/blackhat-jeep-cherokee-hack-explained/9493 – Mark Henderson Jun 27 '16 at 15:27
  • There are few instances that are known to be related to hackers, either because maybe that many people aren't pricks looking to wreak havoc, or because the people and/or media expect that one-off instances are human error. It is technically possible that isolated instances that look like accidents were in fact assassinations where a car hacker(s) was involved, but it wasn't portrayed as such. – Signus Jun 27 '16 at 19:19
  • I think the main limiting factors are: A) remote hacking a car still requires a fair bit of expert level know how, B) except if you're stealing the car (which is unlikely in a remote attack) there is no real monetary incentive... I.e. high cost, low benefits; thus a lower interest from the criminal world. – fgysin reinstate Monica Jun 28 '16 at 12:04

As reported on Wired in March 2010:

More than 100 drivers in Austin, Texas found their cars disabled or the horns honking out of control, after an intruder ran amok in a web-based vehicle-immobilization system normally used to get the attention of consumers delinquent in their auto payments.

Other than that, not much, as Sophos says:

The dangers of cyber attacks on cars has all been theoretical so far: at this point, there’ve been no real-world attacks, as far as we know. Only security researchers have managed to send cars into the weeds.

  • 22
    a dealership had the power to remotely disable cars? that sounds wildly dangerous, even if used by the dealership rather than an intruder! – Woodrow Barlow Jun 27 '16 at 15:34
  • 4
    The problem here is "as far as we know." I don't think any of the police or even insurance people are set up to identify car hacking issues. – NotMe Jun 27 '16 at 15:47
  • 6
    The remote disable systems used by lenders only disable when the ignition is off. So if the car is running/moving when the lender sends the command, the car will keep working until it's turned off. – longneck Jun 27 '16 at 17:09
  • 4
    @longneck: Um, consider the case where the engine stalls in a railroad crossing... – R.. GitHub STOP HELPING ICE Jun 27 '16 at 20:14
  • 5
    @MartinCarney: Assuming time for driver/passengers to do anything, of course they can just get out, so the main risk of a vehicle stuck in a railroad crossing is damaging/derailing the train. And "you're no worse off than running out of gas" is not an argument when a malicious party introduced a new, additional dangerous failure case for their own greedy purposes. – R.. GitHub STOP HELPING ICE Jun 27 '16 at 21:18

Yes, they can. My Jeep Cherokee was vulnerable. They even ran a segment on TV and I immediately went on line and found it to be true. I was referred to a Jeep website where I was able to download the patch to a thumb drive which I plugged in my car and started it up. It recognized the patch and installed it to the Jeep's computer. There is even a recall on this issue.

  • 11
    "I immediately went on line and found it to be true" then could you please add a source to your answer to back up your claim? – hd. Jun 27 '16 at 16:29
  • 3
    Where did you download the patch from? – user2320464 Jun 27 '16 at 16:47
  • The patch can be found at driveuconnect.com – Devin Jun 27 '16 at 17:34
  • 9
    You missed the point of the question. A security researcher demonstrated the flaw in the Jeep setup. However, there is no evidence of anyone actually using the flaw to do anything (steal a car, cause an accident, etc.) other than demonstrating the flaw. That is what is being asked: has the flaw been exploited? – longneck Jun 27 '16 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.