Attacks/Breaches
9/30/2015
10:00 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

State Trooper Vehicles Hacked

Car-hacking research initiative in Virginia shows how even older vehicles could be targeted in cyberattacks.

A state trooper responding to a call starts his vehicle, but is unable to shift the gear from park to drive. The engine RPMs suddenly spike and the engine accelerates, no foot on the pedal. Then the engine cuts off on its own.

The unmarked 2012 Chevrolet Impala from the Virginia State Police's (VSP) fleet has been hacked -- but luckily, by good hackers.

This is what police officers could someday face in the age of car hacking. It's just one in a series of cyberattacks waged on the VSP's Impala and on one of its 2013 Ford Taurus marked patrol cars as part of an experiment by a public-private partnership to test how state trooper vehicles could be sabotaged via cyberattacks. Virginia Governor Terry McAuliffe in May first announced the initiative, which was aimed at protecting the state's public safety agencies and citizens from vehicle-hacking.

Among the organizations that worked on the project were the Virginia State Police, the University of Virginia, Mitre Corp., Mission Secure Inc. (MSi), Kaprica Security, Spectrum, Johns Hopkins Applied Physics Lab, Digital Bond Labs, the Aerospace Corporation, and the Virginia Department of Motor Vehicles. The research was conducted in coordination with the US Department of Homeland Security's Science and Technology division and the US Department of Transportation's Volpe Transportation Systems Center.

Car-hacking has shifted into overdrive this past year, mainly thanks to research by famed car hackers Charlie Miller and Chris Valasek, who this summer demonstrated how they were able to remotely control a 2014 Jeep Cherokee's steering, braking, high beams, turn signals, windshield wipers and fluid, and door locks, as well as reset the speedometer and tachometer, kill the engine, and disengage the transmission so the accelerator pedal failed.

There were no state troopers driving into ditches or rolling into highway exit ramps after losing control of the gas pedal: unlike Miller and Valasek's video demonstration of those hacks with a journalist behind the wheel, the VSP research didn't hack moving vehicles. But the Virginia project demonstrated how even non-networked, older-model vehicles are also susceptible to cyberattacks.

The hacks of the VSP cruisers require initial physical tampering of the vehicle as well. The researchers inserted rogue devices in the two police vehicles to basically reprogram some of the car's electronic operations, or to wage the attacks via mobile devices, which they demonstrated.

The project evolved out of concerns by security experts as well as police officials of the dangers of criminal or terror groups tampering with state police vehicles to sabotage investigations or assist in criminal acts. And unlike most car-hacking research to date, it includes the creation of prototype solutions for blocking cyberattacks as well as data-gathering for forensics purposes.

Perhaps a bigger surprise than the car hacks themselves was that a police department would agree to participate in potentially sensitive cyberattack research. But Capt. Jerry L. Davis of the Virginia State Police's Bureau of Criminal Investigation, says there was no hesitation by law enforcement officials in the state when the project was first proposed. "Our executive staff was aware of the issue in the arena and some of the cascading effects that could occur if we didn't start to take a proactive" approach, Davis says.

The VSP even tested out some of the attacks on its students. "We wanted to be able to convey that message to them: you need to consider [cyberattacks] as you respond to incidents," he says. While he says there's been no confirmed cyberattacks on VSP vehicles thus far, "then again, we don't know what we don't know."

The VSP has around 155 2012 Chevrolet Impalas in its fleet, and 427 2013 Ford Tauruses, as well as a mix of other vehicle makes and models. Neither Ford nor GM worked directly on the project, but both carmakers were apprised of it. They also provided rare public statements about vehicle cybersecurity when contacted by Dark Reading.

"The University of Virginia study is helpful to remind industry, regulators, law enforcement and consumers that cybersecurity is an issue that requires focused attention. The staged cyber-attack on a Ford vehicle required unrestricted physical access to the interior to install a device that provided remote access to the electronic control module. This study does not simulate any immediate real-world risk," Ford said in its statement. "It highlights the need to be vigilant about vehicle security and to avoid plugging in devices or technologies that do not have proper security safeguards. And, it serves as a reminder that all connected computing systems should have appropriate safeguards in place to mitigate the threat of cyber-attacks."

GM declined to comment directly on the project, but noted that it's working on securing its vehicles from cyberattacks: "GM takes matters such as potential cyber threats, which affect our customers’ safety and security very seriously. We are taking a layered approach to in-vehicle cybersecurity and are designing many vehicle systems so that they can be updated with enhanced security measures as potential threats evolve," GM said in its statement. "We recently created an integrated organization, Vehicle and Vehicle Services Cybersecurity, which consists of internal experts who work with outside specialists, and is actively working to minimize risks of unauthorized access to vehicles and customer data."

The Hacks

In addition to the gearshift, instrument panel, and engine hacks, researchers from Mitre Corp. also wrote attack code that opened the trunk, unlocked the passenger doors and locked the driver's door, and ran the windshield wipers and wiper fluid.

"We think this is really not about car hacking as it is about coming up with strategies" to protect vehicles from attack, says Brian Barrios, portfolio director of Mitre's National Cybersecurity FFRDC.

The first set of attacks by Mitre occurs via a smartphone app connected via Bluetooth to a hacking device planted  in the vehicle, he says. "This car [the Impala] doesn't have Bluetooth or cellular" connectivity  built in, he says, so connectivity was provided via the Mitre device.

"This is custom software we" wrote for the attacks, Barrios says. The attacks would require some knowledge of the car model's electronics, he notes, so it's not an attack "the average person" could pull off.

"But it's not so advanced that it's outside the realm of possibility," he says.

Kaprica Security built a real-time device to thwart such attacks and to gather forensic data from an attack.  Sagar Momin, engineer and co-founder of Kaprica, says his proof-of-concept tool could be plugged into the car's so-called On Board Diagnostic s (OBD) II in the form of a dongle. "It will record any forensics or other issues," he says. "It knows when there are abnormal messages [to the car]" and blocks them, he says.

The processor is faster than the car's own network, aka the CAN (Controller Area Network) bus, so it's able to determine whether to block or allow a message to pass to the car's controls. Data is written to an SD card, where it's stored for forensics investigation purposes. A state trooper could plug in the device when he got into the vehicle, Momin says.

MSi performed its own set of attacks on the VSP's marked Ford Taurus cruiser. One attack basically performs a denial-of-service hack that blocks the car from starting. The researchers also were able to remotely start up the car from a smartphone-borne attack, and lock and unlock the car such that the driver would be trapped in the vehicle unless he or she rolled down the window to manually open the door.

"A policeman would get out of the car to see what's wrong, he looks under the hood and the car starts itself and the dashboard is going crazy. Horns blow, lights blink, and he decides this car is no good," says Barry Horowitz, chair of the systems and information engineering department at the University of Virginia and one of the leaders of the VSP project. "That could take a half hour or 45 minutes and delay his mission."

The researchers also used a device placed in the vehicle that monitors the ODB II port and detects any hacking tools plugged into the car's port, as well as any attacks over the CAN bus. Like the Kaprica tool, it stops any attacks and collects attack information for forensic analysis afterward.

---Video credit: Justin Naumann, Red Titan Films. Video edit by Dave Harding

 

The Endgame

VSP's Davis says the new age of car hacking means law enforcement will be faced with considering the cybersecurity of its fleet. "We understand with vehicles that not being connected [to the Internet] is a good thing. Taking a look at systems and components embedded in there and how they communicate together: is this something I need to consider in my purchase?"

He says VSP already has in place technicians who investigate computer fraud, so forensics analysis out of a potential car hack would be another aspect of their duties.

"Police cars are less equipped with electronics, and police communicate through private networks so they are not as vulnerable as a consumer. But the [cruisers] have many of the same features as a consumer car has," and are potentially hackable, UVA's Horowitz says.

"The next question is what do you do about it? What kind of data can be extracted from a car and at the scene of an accident? These attacks [demonstrated] are based on putting devices on the car. You could have an inspection procedure when you get into the car, and at an incident, [the police] would check the consumer's car" for such devices, he says. If the cars have built-in forensics gathering capabilities, that data could be analyzed to confirm whether a traffic incident was due to a cyberattack, he notes.

"There are crashes every day" and it's impossible to tell if a cyberattack was the cause, says Frank Byrum, chief scientist for Defense contractor Spectrum. "Someday someone will claim responsibility for something. Then what do the automakers do? This is an engineering problem."

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/10/2015 | 7:46:45 AM
Re: THESE ARTICLES ARE SO DECEVING
Speaking of tampering and shielding, a well constructed EMP would make a perfect firmware upgrade.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/8/2015 | 2:25:23 PM
Re: THESE ARTICLES ARE SO DECEVING
Yes much less severe. The threat they exposed is eliminated by using an OBDII device that occupies the port.  Its the wireless OEM and telematics access they should be more worried about.     
GeorgeAS
100%
0%
GeorgeAS,
User Rank: Strategist
10/8/2015 | 11:30:49 AM
Re: THESE ARTICLES ARE SO DECEVING
As the article stated: "The hacks of the VSP cruisers require initial physical tampering of the vehicle as well." So, yeah... I think we can downgrade the severity category here. Don't even need an OBD device to cause havoc with the electronics.
MajV212
50%
50%
MajV212,
User Rank: Apprentice
10/7/2015 | 5:28:50 PM
Re: THESE ARTICLES ARE SO DECEVING
Agreed.  If you can leave a device in a car... well, boom.  

Or stuck underneath the car :-)

And you're worried about ODBC / CAN bus physical hacks?
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 1:18:05 PM
Re: THESE ARTICLES ARE SO DECEVING
Unless you prevent physical access and armor the cabin of the vehicle and the underhood of the vehicle you cannot fix this problem of tampering with vehicles.  I can always tap or cut wires to gain acess.  With respect to OBD though there are other ways to make a device smarter for almost no additional cost to sense someone tampering with the port to prevent what you bring up.  There is no sense in killing the OBDII system at great expense to consumers and the publice unless you fix physcial acess to the car.  A simple solution prevents the methods discussed in the article     
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 1:01:18 PM
Re: THESE ARTICLES ARE SO DECEVING
That is an excellent suggestion. However it is possible to pin out the OBD II connector, tap the wires utilizing alligator clips and without removing any shielding.  The connector would not have to be removed in order to bypass the security.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 12:39:56 PM
Re: THESE ARTICLES ARE SO DECEVING
Your post makes sense and no I am not suggesting that they dont leave their doors unlocked.  However with physical access to the inside of the cars or under the hood I can do so many thinds to the car in many different ways if I study the car and understand it.  I can cut sensors, replace components, replace connectors, tap into things, reporgraom the ECU, replace the ECU, mess wiht the throttle, ect.  Its impossible to prevent this and preventing physicall access of changing the OBDII would add  huge unnecessary cost to the cars for the general public.   Unless the car is wireless, there is not an easy way in as is the scare tactic used by the article.  You cant prevent physical access to car systems .  Relocating the OBDII port somehwere else would require changing the adopted OBDII laws across the country and would require all vehicle manufactures to change their standard design as all vehicles built since 1996 have the connector in the same location with the same access.  The emissions tests would also have to be changed and would be much more complicated.  This would all be huge expense for a problem that doesnt exist.  The OEMS would like this because they would own the diagnostic market more than they already do.  If you want to protect the police cars from access to the OBDII port just simply get an obdii device that plugs into the OBDII port that notifies the police when it is disconnected.  This is a far simpler and cost effective approach.   Once the device is plugged in, everything they are worried about in the article goes away.  We could easily make this device.
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 9:54:55 AM
Re: THESE ARTICLES ARE SO DECEVING
Are you suggesting that law enforcement do not ever leave their doors unlocked? 

My vehicle has an OBD I and has no emission requirments. The connection is located under the hood, not under the dash which I find many technicians unable determine. Physical access to the vehicle must first be obtained to pop the hood. However they would have to of located the battery kill switch, and ignition kill switch which are both hidden. I do not have ABS brakes, Power Locks, Bluetooth, or Electronic Parking Break...

And the best part is, it's a manual transmission.

What would be so difficult with relocating the OBD connections somewhere more nondiscrete? Access could be granted via laser cut key, biometric fingerprint, or facebook.

 

 

 
TejGandhi1986
50%
50%
TejGandhi1986,
User Rank: Apprentice
10/5/2015 | 9:12:29 PM
Vehicles compromised
Considering the vehicles getting compromised.There was also an investigation raised regarding Malaysian Airlines plane being being cyber hijacked through mobile phone.

Cyber security needs to come to the forefront and addressed cause to ensure that users with malicious intent cannot exploit these vulnerabilities.
TCRUSE762
50%
50%
TCRUSE762,
User Rank: Apprentice
10/3/2015 | 10:55:37 AM
Cars and Smart Guns
We have been hearing a lot about "Smart Guns" as the answer to gun theif and unauthorized use.  The problem with cars being hacked is just one more example of why it is not a good idea to have you gun tied to a wireless connection.

Both a car and a gun can cause the "good guy" to be killed.  However, in a car the electronics and external connections serve a useful purpose.  For the Smart Gun they serve only a made up political agenda item.
Page 1 / 3   >   >>
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Cybercrime has become a well-organized business, complete with job specialization, funding, and online customer service. Dark Reading editors speak to cybercrime experts on the evolution of the cybercrime economy and the nature of today's attackers.