It's fast becoming apparent that the CAN bus network—used by cars for the last two decades—can become a real liability once it's connected to the Internet. Such hacks were demonstrated years ago, and the latest piece of evidence has been supplied by some security researchers at the University of California San Diego (UCSD). At a security conference, the group showed how a telematics device (that insurance companies and commercial fleets use to manage their vehicles) could be hacked to send rogue commands through the CAN bus.
All CAN bus-equipped cars have a standard diagnostics port called OBD2. If a device plugged into the CAN has a modem, it's possible to remotely read and transmit CAN data, which is how (for example) OnStar knows when your airbag has gone off and how to remotely unlock your doors. The device in question this time is a French-made OBD2 dongle made by a company called Mobile Devices. Mobile Devices sell their OBD2 dongles to lots of other companies, in this case a startup called Metromile, which uses it to monitors one's driving for pay-per-mile insurance.
According to Wired, the UCSD researchers hacked the Mobile Devices dongle via SMS and used it to turn on a car's windscreen wipers as well as messing with the brakes (although this only functioned at low speed given the nature of the car's braking assist technology). The researchers also notified Metromile and Mobile Devices in June regarding the vulnerability, resulting in over-the-air updates that should prevent this exploit.
Read on Ars Technica | Comments