There now exists the potential for malware, via audio CD, to disable your car... or worse.

[thewayne]

Scientists have been working on ways to hack car security systems. Increasingly, lots of things in new cars tie in to a central bus: engine control unit, anti-lock brakes, air bags, transmission, door locks. And the car stereo. The scientists have found a way to create a specially-crafted MP3 which, if played on certain models, lets them take control of the car, potentially by bluetooth or the car's celllular system.

Older cars without centralized buses would be immune, as would installing your own stereo. The sad thing is that car makers do not seem to be doing much to create a reasonably secure system, you'd think they'd learn with the news of all the systems being exploited out in the world.

(Speaking of which, my favorite recent hack is HB Gary Federal going against Anonymous: they totally pwnd their CEO, up to and including remote-wiping the guy's iPad!)

http://www.itworld.com/print/139794

http://it.slashdot.org/story/11/03/12/0114219/Hacking-a-Car-With-Music

Comments

[silveradept]

...because they think nobody will bother to try and attack cars with electronics in them to create a terrorism event, or what?

[thewayne.livejournal.com]

There were some interesting points as to what could be done in the article and Slashdot thread: disable a car's brakes, make alterations to throttle and transmission, disable it by making it think it's been stolen, etc. Another possibility is theft: convince the car it isn't stolen, have it report it's location as somewhere other than where it's at, change the VIN number that it reports.

How to? Find a dealership selling models that Hacker X has an exploit for. Get with a local band of reasonable quality, offer to make them a demo disc for free. Make a nice marketing package of the band with the car, offer to give them to the dealership for free as it only has 4 tracks or so with an offer to buy a full CD for a low rate. Discs go out to dealership employees which frequently drive the cars they're selling, they also give them to people buying new cars. Instant ability to steal a dozen cars or so. You could do the same thing at a car rental company. You might even be able to have the infected car report where it's at to you so you could go and steal it then reprogram it.

There was an incident in Florida last year (IIRC) where a guy who used to work at a 'low/no credit' car company, they always installed LoJack's in their cars to make repossessing them easy. The guy got fired, remoted in to their control console, and tripped every car to disable them and sound the horn continuously. He was easily identified and arrested.

[thewayne.livejournal.com]

Terrorism, no. Chaos and theft and major safety issues, easily. I'd sue the maker's ass off if I had an accident and my car's brakes had been disabled due to a hack.

[silveradept]

That's something that's always disturbed me about OnStar and the like - if there's the technology in it for remote control, then there's the technology in it for remote control and not everyone who can access that has such nice ideas in mind.

Still, why are we developing cars with a CPU and not apparently taking concerns that such a thing is a vulnerability seriously?