Vulnerabilities / Threats
8/12/2010
01:14 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Hackers Deflate Auto Tire-Pressure Sensors

Monitors in fast-moving cars can be damaged using spoofed wireless signals, leading to security, privacy, and safety threats.

The wireless systems that monitor tire pressure in modern cars can be spoofed remotely or even damaged, according to a team of Rutgers University and the University of South Carolina computer scientists.

In particular, when driving two cars next to each other, the researchers could trigger a "low tire pressure" warning at 35 miles per hour, and a "check tire pressure" warning at 65 miles per hour. In addition, they found that at least one type of tire pressure system -- not disclosed -- "could be damaged through spoofed wireless signals."

The researchers plan to present their in-car wireless network security and privacy vulnerability findings Thursday at the Usenix conference in Washington.

"We have not heard of any security compromises to date, but it's our mission as privacy and security researchers to identify potential problems before they become widespread and serious," said Marco Gruteser, associate professor of electrical and computer engineering at Rutgers, in a statement.

While in-car wireless networks are meant to be shielded, researchers could still eavesdrop on communications from 30 feet away using a simple antenna, and 120 feet away when using an amplifier. In addition, according to their research, "reverse-engineering of the underlying protocols revealed static 32-bit identifiers and that messages can be easily triggered remotely, which raises privacy concerns as vehicles can be tracked through these identifiers."

The researchers studied two systems identified only as "commonly used in vehicles manufactured during the past three years" and found that neither performed authentication or input validation. As a result, the researchers were able to spoof the sensor messages. "We validated this experimentally by triggering tire pressure warning messages in a moving vehicle from a customized software radio attack platform located in a nearby vehicle," they said.

What does it take to hack a car's wireless network? Try college-level engineering expertise and a few thousand dollars' worth of publicly available radio and computer equipment. The researchers also used their own cars.

Spurred by the Firestone tire recall in the 2000, in 2003, the U.S. Department of Transportation began requiring a phase-in of tire pressure monitoring systems. By September 2007, all light vehicles -- 26,000 pounds or less -- sold in the United States contained either wired or wireless versions of such systems.

According to Wade Trappe, an associate professor of electrical and computer engineering at Rutgers who worked on the project, "while we agree this technology is essential for driver safety, more can be done to improve security, such as using input validation or encryption."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web