How To Take Control of a Car's Electronics, Cheap 109
mspohr writes with this excerpt from The Register: "Spanish hackers have been showing off their latest car-hacking creation; a circuit board using untraceable, off-the-shelf parts worth $20 that can give wireless access to the car's controls while it's on the road. The device, which will be shown off at next month's Black Hat Asia hacking conference, uses the Controller Area Network (CAN) ports car manufacturers build into their engines for computer-system checks. Once assembled, the smartphone-sized device can be plugged in under some vehicles, or inside the bonnet of other models, and give the hackers remote access to control systems. 'A car is a mini network,' security researcher Alberto Garcia Illera told Forbes. 'And right now there's no security implemented.'"
wait, the subject isn't autofilled in the beta? al (Score:1, Insightful)
Plenty of people have offered criticism. Hold on, let me check the current beta and see how much of it has been taken...
Oh, look, it's all been ignored. There's still a massive block of whitespace at the top of the page for no apparent reason. The comment box is still so narrow it looks like I've written several pages of text when in reality it's more like three sentences. They "fixed" the sidebar along the side of the screen, though, in that instead of being a giant empty space it's plastered with ads. So
Re: (Score:1)
Here you go spaz retard (Score:5, Insightful)
Taken from the wise wjwln
http://slashdot.org/comments.pl?sid=4761849&cid=46192975
You're obviously not paying attention then. Plenty of people have posted *exactly* what's wrong with the comment system in beta. Maybe you haven't seen them because you're actually using beta?
Look, you have to understand something: Slashdot discussions generate interesting content by allowing tons of garbage to be posted, mixed around, and evolved. Part of the evolution comes from the interactive nature of community discussion, and part of it comes from the moderation process. For this evolution process to work properly, you have to be able to see a lot of posts at once, all in one shot. You need to be able to see some contextual information about the people posting comments. When you post your own comments, you need to be able to quote or link to other posts easily. When you want to moderate, you need to be able to do it in place, at the comment you intend to moderate.
Beta breaks all of these vital features; without them, the nature of Slashdot discussion changes completely. People will read fewer comments because the new layout hinders rapid seeking, scanning, and comprehension of potentially valuable posts... all while making it much more difficult to skim past the stuff that doesn't interest you. When people read fewer comments, they post fewer comments. When the total number of comments starts to drop, the exploration of the discussion space becomes much less thorough. Potentially valuable or interesting discussion paths will be missed. Those rare, but highly sought after gems of insight and wisdom borne from the cesspool of chaos will become much more scarce.
You want to know why people hate the beta so much? It's because it kills the evolutionary discussion dynamic that makes this community what it is. There's nothing else like it, and many of us do not want to lose it.
Re: (Score:2)
Slashcode is open source, ya? Can't we just "fork" the site?
In SlashDot Beta, Site Forks You!
Re: (Score:1)
Considering the fact that nobody is ddosing or hacking slashdot, I would say things are actually quite civil.
Re: (Score:1)
Re: (Score:3)
If you need physical access then it's not a hack and doesn't show lack of security.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
well, it's as much as a hack as hacking the breaklines into pieces is.
but, eh, this is hardly worth of a blog post and not worth of a black hat speech. it's a fucking easy subject to go for if you just want to hold a black hat presentation I give him that though. but if the presentation doesn't do something really interesting like controlling steering on the new car that has servo steering(when powered off the steering connects physically) then gtfos.
Re: (Score:2)
Even if this allows servo control of steering, it's a simpler "hack" than what has been done 20 year
Re: (Score:3)
A simple way to improve security somewhat would be to require CAN devices to be paired with the car's computer. IIRC Volvo used to do this; installing a CD player on the CAN bus required
Re: (Score:1)
but they've since disabled this security as it was "too troublesome".
Exactly that. You have to see the pro/cons of security. If someone has physical access to your car and wants to mess with you, all the CAN-bus security in the world won't prevent him from snipping the break lines, drilling a hole in the bottom of your tank, or loosening the tire nuts.
And seeing how "security" at my computer sometimes prevents the legitimate user from doing stuff, I would really hate to get a "unauthorized brake attempt detected" error message when I slam on the breaks while seeing the tanke
Re: (Score:2)
I wouldn't mind notification as I slide the key in, such as "Would you like to remove the device from the diagnostic port before driving?".
I'm sure the technician with a legitimate purpose will be able to handle a few extra steps in activating diagnostic systems.
Re: (Score:2)
Re: (Score:2)
Having to go to the dealer to pair a device means saying goodbye to your affordable OBD-II scanner and ECU flasher.
Re: (Score:2)
Say what? (Score:2)
Re: (Score:3)
Re: (Score:2)
"If you're not paying for the product, you are the product."
Not a totally remote exploit. (Score:4, Insightful)
Re: (Score:2)
Re: (Score:3)
Yes, but they'll do it anyways
Bluetooth ODB-II? (Score:5, Informative)
And how does this differ from the Bluetooth ODB-II connector I use to stream car data to my cell phone? That is wireless and also requires being plugged into the diagnostic port on the car.
I can pull all sorts of data from that. If I spend a little more, I can get a full CAN-bus connection and actually *send* information and control things.
This isn't hacking. It is a product demo for VW.
Re: (Score:2)
The different buses... (Score:3)
Most cars have a high speed CAN, for all functions needing messages at a rate of about 10 or 20 ms like Abs, engine, etc. There is also a low speed CAN, which is used for things like heating, and low rate signals of about 100 and 200 ms. The advantage of low speed CAN is that it can be put into low power and use it to wake up devices, like a wake up on LAN. I Then there is the LIN bus. This is a low speed, single wire cheap bus. It is used for things like wipers. These are the basic three buses.
Cars like BM
No, you can't send. (Score:2)
I spend a little more, I can get a full CAN-bus connection and actually *send* information and control things.
No, you can't send over CAN this way, at least not without risking messing up the core structure of your network. Most nodes in vehicle CAN send messages periodically. Each message type has a unique id, and sending two messages with the same id at the same time can result in collisions. But even if these don't collide, they will get overwritten right after by the next real message. If the inconsistencies are bad enough, the safety fuses will catch them and shut the system down. Any respected automotive OEM
Physical Access (Score:5, Interesting)
Re: (Score:2)
"This issue surrounds physical access to the vehicle, at which point no amount of security is going to be able to protect it (it will only make it more difficult to do). Adding security would make it significantly more difficult for mechanics and enthusiasts to work with their vehicles."
But "more difficult" might be the right thing to do.
It's true that it might make mechanics' jobs slightly more difficult. But what you said is kind of like saying locks on doors are pointless "because no amount of security is enough if you have physical access". In truth, there are few locks that a skilled locksmith can't pick open given a little time. But that doesn't mean a lock that can be picked in 5 seconds or no lock at all is a good solution in most cases.
Re: (Score:2)
The better solution is, eliminate the motivation to break in, in the first place.
Step one: have the government serve as an ethical example; so instead of exploiting vulnerabilities that exist in the wild, it fixes them.
Re: (Score:1)
own and drive a really crappy car? done!
Re: (Score:2)
Mo' money, mo' problems.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The thing about script kiddies is that they don't need to know much because they use other people's scripts and efforts.
Here is a more illustrating example. Most people who have rooted android phones have no idea how to actually root a phone. Instead, they either (themselves or pay someone to do it) use scripts and procedures developed by others in order to gain root access and do as they please. So someone set up a side business rooting phones and to the average user, they look like a hacker. To someone w
Wireless access, once you've got wired access (Score:2)
"Spanish hackers have been showing off their latest car-hacking creation; a circuit board using untraceable, off-the-shelf parts worth $20 that can give wireless access to the car's controls while it's on the road... the smartphone-sized device can be plugged in under some vehicles, or inside the bonnet of other models, and give the hackers remote access to control systems.
That's like saying I can get wireless access to your server, provided you let me have physical access first so I can plug in my wireless NIC.
Re: (Score:1)
To be fair, you don't keep your server in your driveway. Or maybe you do? :)
I don't know how easy it is to find the connector though. In theory, cars should be able to tell if external devices are connected.
Re: (Score:2)
"To be fair, you don't keep your server in your driveway. Or maybe you do? :)"
With the temperatures we have in Montreal, it would make a hell of an overclock...
Not with a bang, but with a Beta. (Score:2, Insightful)
What company directs 25% of its users to a partially-working, not-ready-for-production website? Please realize that Beta will not have the features that we want, because it goes against Dice's plans for Slashdot. To their advertisers, Dice presents Slashdot as a "Social Media for B2B Technology" [slashdotmedia.com] platform. B2B - that's the reason Beta looks like a generic wordpress-based news site. A large precentage of the current userbase might be in IT, but /. is most certainly not a B2B site.
Nevertheless, Dice is despera
Re: (Score:2)
Mod this up.
Re: (Score:1)
What is $6.3 million of goodwill, anyway?
Re: Not with a bang, but with a Beta. (Score:1)
"Goodwill" is an accounting term for the amount paid for the purchase of a company above the total value of the physical parts of the company. It's the premium one pays for the "name value".
For example, a bakery buying the "Hostess" brand name would buying "goodwill", since the brand name has no tangible value.
"Writing down" the goodwill means admitting that it isn't worth what they paid for it, either because they paid too much or because they did silo etching to make it less valuable.
Dice apparently is gu
Re: (Score:2)
amazing (Score:2)
Just imagine all the chemical and physics hacks you can do once gain access to a car's hardware!
Re: (Score:1)
Yeah, I've heard you can hack the tires to no longer hold air, by using a tool as simple as a knife! And what's worse, you need not even access to the inner parts of the car. The vulnerable part is right on the surface!
I've also heard that cars get regularly hacked by martens. This includes quite dangerous hacks like killing the brakes.
Re: (Score:2)
lol.. That reminds me of a situation about 20 years ago or so. Locked the keys in the car in the middle of nowhere and hacked the door lock with a rock through the window.
No Wifi, No Beta (Score:1)
Seems my comment is a reaction to the useless Slashdot-Beta.
Security? (Score:2)
I'm really not too worried about it, so long as any wireless connectivity is secured.
Old cars had zilch for security. Wanted to take off with it? On really old cars, just cut and twist a few wires, cross two more momentarily, and you're off. Not even a column lock to get in the way.
More recent cars? Hmm, prior to electronic keys (and keys with resistor values, i.e., GM ignition keys), slide-hammer the ignition and use a screwdriver to turn it, or if the column under the dash is acceptable, just pull and jum
So, this is a test (Score:2)
And then type another line, followed by another paragraph code here:
This will prove to myself whether or not Beta, in all of it's innovative wonder, will finally allow Slashdot to recognise a return command.
That is all.
Oh FFS. That's terrible. (Score:2)
Physical access (Score:2)
Wait, someone can control something by physically plugging something into a control port designed for that purpose?
It's a neat trick, but if the bad guy has physical access, it doesn't take a wireless dongle in the CAN port to mess shit up...
So the solution is DRM for cars? (Score:2)
Am I the only one that thinks car manufacturers reactions to these "hacks" is just going to be heavy DRM on the bus, more nickel-and-diming for unlocking features, and more expensive parts because third parties are locked out because of the DMCA?
Right now in agriculture, everything is quite proprietary on the bus, but having it free and open would be a huge boon. There is no DRM at this time, but the protocols themselves are closely guarded secrets. In an ideal world, one companies' GPS receiver should wo
In other news (Score:1)
Micharl Hastings was murdered (Score:1)
Just relax (Score:1)