Comment by joshe
7 years ago
Just want confirm that vehicle security is a trash fire.
The CAN bus [1] has no security, you just put packets on it and read packets off it. Like "tell me the speedometer reading" or "activate the brakes" and CAN bus does it. You and I might think, gosh those are radically different things. Well the CAN bus disagrees.
Did I mention that there is no encryption? There isn't. To the CAN bus, the packets from the GPS tracker that say "tell me the speedometer reading" and the packets from the manufacturer created by pressing the brake are treated with the same authority.
Does vehicle electronics firmware use a weird 20 year old non ANSI version of C? Well of course it does. Does it require signed firmware? Hah!
Do most vehicle electronics suppliers not have the top quality security people they need? They do not. Do they have management support for making security conscious decisions? They don't.
Anything that can put packets on the CAN bus can completely control the car. So anything that connects the the CAN bus, through bluetooth, wifi, cell service, or a plug needs to be completely secure.
I'm a little distrustful of On Star and the like, because I don't think GM is security conscious enough to manage it perfectly. I'd be very distrustful of a company that let you keep a default password for your GPS tracker. Instead purchase the GPS tracker that does NOT read info about the vehicle, the only plug should be for power.
Here's a story about hacking Chrysler's Uconnect, with good details.
https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...
If you are writing software/firmware that will control a vehicle, you should hard code the packets it can write and never include dangerous ones. Even though it might seem cool to be able to "stop the vehicle" in an "emergency". If you want to use dangerous commands, you need to level up your security org to google/facebook levels. If you are talking to management that means spending $50 million a year just on security.
These are not attacks that require state level NSA/Chinese/Russian attackers. This is well within the reach of an advanced individual. It is very lucky indeed that there is no monetary or other advantage to this, if actuating brakes in cars produced social security numbers we'd have hundreds of excess deaths a year.
Yeah, firmware is another issue. You read and flash firmware or parameters often directly over that CAN bus. There is nothing to validate that, for one manufacturer, I needed passwords (casually handed out to every supplier, the same for every unit), for one, the "encryption" was a XOR with the same number that had been used for every model for years. I didn't know why they even bothered. One of the manufacturers at least stopped you from flashing new software to an ECU more than 3 times.
Did I mention that we had incredibly high fluctuation (at least production line test benches - brutal deadlines and 2am deployments, working in loud production halls, lots of travel, no technical innovation,..). We basically hired anyone who was alive and somewhat skilled. I don't think anybody ever talked to me about security - ever.
What these articles are showing, is amateurs' work. I'm terrified by the idea of what a disgruntled / crazy / .. person with experience in the field could do.