-1

Please if you cant answer this question, don't down vote it and the let others to discuss their opinions instead of closing it.

Yesterday I watched a collection of videos at YouTube for people who can hack a car which is parked 200 meter away from them, they can turn the car on/off and even use the benzene pedal or turn the steering wheel right and left even this car does not belong to any of them, what I want to know how such a thing can happened ?! it is possible to anyone to hack such a thing ? These people also have a video which they hack the main big display in train station which has all the information about coming and going trains in that area and they replaced it with another picture by his mobile.

An explanation of what is happening is really appreciated :) Thanks

4
  • Why wouldn't it be possible? Cars and displays in train stations can have security bugs. By the way, we don't discuss opinions here, this is a questions and answers site, not a discussion forum. Your question, if it can be considered a question rather than a discussion starter, is far too vague to be answerable. Aug 8 '14 at 13:52
  • This is an interesting question. Another case of people abusing their mod power...
    – Gudradain
    Aug 8 '14 at 17:22
  • Imho there is a valid question here, but the OP had formulated the question as a discussion starter. Please edit the question to phrase a clear question instead of a discussion.
    – agtoever
    Aug 9 '14 at 15:33
  • I don't need any specific details, only overview as @AJ Henderson wrote is enought to get the whole idea about the idea. Aug 12 '14 at 12:02
0

The first thing you need to be able to hack a car is access to it. In most cases, this means physical access to the wires inside the car that interface with the car's internal computer (often via a diagnostics connection either under the hood or inside the car interior.)

However, on a growing number of vehicles, there are potentially insecure wireless networks being connected to devices that also connect with the car's internal control network. The most common issue is radios with bluetooth functionality that also have features that require communication with the car, such as providing song data or getting information about the speed of the car to adjust volume.

The process for compromising such a system is complex and still relatively non-trivial, but is doable in many cases. First the attacker has to connect to the wireless network, they then have to compromise the device being connected to (the car radio or A/V system) and then from there, they have to utilize the radio itself to attack the car's internal network.

Once you are on the car's internal diagnostics network, there is a whole lot you can. The commands aren't particularly well documented, but most controls for your vehicle use this network. Engine timing, gear shifting, unlocking and locking doors, opening windows, turning on and off lights, cruise control, etc all are often controlled on this network, so an attacker with access to the internal network can do a whole lot if they have the needed information and skill.

Now practically, unless you are particularly targeted or mass market tools become widely available, the chances of falling victim to such an attack are currently pretty limited, but if someone had a reason to attack you, then the odds could improve dramatically of falling victim to such an attack.

The main point of releasing information like is being released now is to point out to manufacturers that what they thought were acceptable risks are not. A lot of this can be pretty easily fixed by doing things like better securing the hardware and isolating the bluetooth network from being able to interface with the internal network as well as better security on the bluetooth network itself.

Overall, I doubt it should be an immediate cause of concern for you, but disabling bluetooth and other forms of wireless connectivity that can interface with your car would be the first step in ensuring that such attacks would be more difficult to perform, but they would still only require adding a device to your vehicle in order to be able to do something.

1
  • such a great explaniation, thnaks Aug 12 '14 at 9:03
4

It is certainly possible to hack a car but it very much depends on the complexity, level of connectivity, and architecture of the technology in the car. The same is true for any other embedded technology such as a road sign.

There are two possibilities w.r.t. the car hacks you watched:

  1. It's a prank - there's plenty of these on the internet - check Snopes
  2. The car in question has an onboard computer with the capability to do the things described and technical vulnerabilities that attackers were able to exploit.

It seems unlikely but not impossible that car manufacturers on non-self-driving, steering, parking cars would build the capability into either the onboard computer or the car to do the things you've described. As cars become more autonomous and connected the risk / likelihood of this sort of attack increases.

So for this sort of attack the following must be true:

  • There must be some form of connectivity, wireless, or wired
  • There must be a vulnerability in the API / interface such as weak or missing authentication or a software vulnerability
  • The software once under control of the attacker must have the capability to carry out the action
2
  • Don't forget about the hacking of apps like the one Tesla gives out with their car. These have poor password policy and are relative easy to hack. With this app you can locate and open the car.
    – BadSkillz
    Aug 8 '14 at 14:00
  • @BadSkillz absolutely - the app has connectivity to the car and therefore depending on the API and app security it could become an entry point. I wouldn't expect it to (currently) expose the steering though...with self-parking cars and power assist steering / drive-by-wire it's possible though.
    – Andy Boura
    Aug 8 '14 at 16:04
1

Definitely. Automotive security is a major concern for OEMs (car manufacturers) as well as suppliers of electronics for cars. The SAE (Society for Automotive Engineers) has dedicated a working group to honor the importance of that topic (http://www.sae.org/works/committeeHome.do?comtID=TEVEES18).

The basic state of the art of automotive computer systems is that of the internet at the end of the nineties: communication is plaintext, no standard authentication mechanisms, etc. What has to be done to secure a car is subject of current research efforts.

Like the poster above pointed out, the (software) complexity in cars in increasing rapidly. Therefore, security issues are increasing at the same time. Connectivity of the control computers to external systems (car-to-car, car-to-infrastructure) increases the attack surface as well.

However, current car systems do not expose a critical risk to hackers. Right now, it is more the hobbyist and semi-professional (car tuner) who launches attacks. This will most likely change for future car generations and the automotive industry is challenged to keep up with present and evolving threats.

0

I wanted to drop this as a comment, as probably it's not one of the bes answers, but I don't have the rep.

Cars are becoming more and more complex in terms of connectivity with other systems. ECUs are used to performs various tasks for cars and most of the time they are connected together. ECU can perform things such as start whipping your windshield, park the car for you, break automatically, etc. Most of these things are connected to each other in various forms. For example:

  • When you slow down, the volume on your stereo volume will turn down too.
  • This means that the ECU controlling the speed, or reading the speed is controlled to your stereo.
  • If your stereo is connected to your phone or to the internet, there is a "path" for someone to follow that would grant them access.

Keep in mind that there are also physical ways of getting access to some of those electronic control units as a lot of the show stuff in the dashboard.

There is even an article about "The World's most hackable cars". which can be found here: http://www.darkreading.com/vulnerabilities---threats/advanced-threats/the-worlds-most-hackable-cars/d/d-id/1297753?wc=4&_mc=sm_tw_edt_dr

According to this :http://www.informationisbeautiful.net/visualizations/million-lines-of-code/ a car has about 100m lines of code, which is more than an F-35 Fighter Jet.

Not the answer you're looking for? Browse other questions tagged or ask your own question.