Carnegie Mellon researchers note that the cheaper the after market device, the easier it can be hacked.

Steve Zurier, Contributing Writer, Dark Reading

June 3, 2016

7 Slides

Computing in cars today has become a standard item. When buying a new car people expect Bluetooth, Wi-Fi and advanced navigation systems. They also expect to connect aftermarket onboard devices through the vehicle’s OBD-II port that do everything from usage-based insurance to tracking the overall energy management of the vehicle.

Popular products include Snapshot by Progressive Insurance, Verizon’s Hum and Automatic from Automatic Labs.

Unfortunately, these new aftermarket products can also be hacked, so the Department of Homeland Security’s US-CERT asked Carnegie-Mellon’s CERT Coordination Center to perform an initial security analysis of these devices to determine their common vulnerabilities, security controls and risks.

In their report, Vulnerability Analysts Christopher King and Daniel Klinedinst say in most instances, the hackers are more than likely local to a targeted vehicle, generally within Wi-Fi or Bluetooth range. This doesn’t rule out remote attacks, as a compromised mobile device with Internet connectivity could be connected to the car via an onboard device, USB, Bluetooth or Wi-Fi.

Through their research King and Klinedinst found the following vulnerabilities: insecure firmware updates; hardcoded or non-existent Bluetooth PINs; weak WPA2 passwords; hardcoded credentials; and an internet-enabled administrative interface.

King and Klinedinst offer the following six checklist items for people looking to install one of these auto aftermarket devices into their cars.

About the Author(s)

Steve Zurier

Contributing Writer, Dark Reading

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights