Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/30/2015
10:00 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

State Trooper Vehicles Hacked

Car-hacking research initiative in Virginia shows how even older vehicles could be targeted in cyberattacks.

A state trooper responding to a call starts his vehicle, but is unable to shift the gear from park to drive. The engine RPMs suddenly spike and the engine accelerates, no foot on the pedal. Then the engine cuts off on its own.

The unmarked 2012 Chevrolet Impala from the Virginia State Police's (VSP) fleet has been hacked -- but luckily, by good hackers.

This is what police officers could someday face in the age of car hacking. It's just one in a series of cyberattacks waged on the VSP's Impala and on one of its 2013 Ford Taurus marked patrol cars as part of an experiment by a public-private partnership to test how state trooper vehicles could be sabotaged via cyberattacks. Virginia Governor Terry McAuliffe in May first announced the initiative, which was aimed at protecting the state's public safety agencies and citizens from vehicle-hacking.

Among the organizations that worked on the project were the Virginia State Police, the University of Virginia, Mitre Corp., Mission Secure Inc. (MSi), Kaprica Security, Spectrum, Johns Hopkins Applied Physics Lab, Digital Bond Labs, the Aerospace Corporation, and the Virginia Department of Motor Vehicles. The research was conducted in coordination with the US Department of Homeland Security's Science and Technology division and the US Department of Transportation's Volpe Transportation Systems Center.

Car-hacking has shifted into overdrive this past year, mainly thanks to research by famed car hackers Charlie Miller and Chris Valasek, who this summer demonstrated how they were able to remotely control a 2014 Jeep Cherokee's steering, braking, high beams, turn signals, windshield wipers and fluid, and door locks, as well as reset the speedometer and tachometer, kill the engine, and disengage the transmission so the accelerator pedal failed.

There were no state troopers driving into ditches or rolling into highway exit ramps after losing control of the gas pedal: unlike Miller and Valasek's video demonstration of those hacks with a journalist behind the wheel, the VSP research didn't hack moving vehicles. But the Virginia project demonstrated how even non-networked, older-model vehicles are also susceptible to cyberattacks.

The hacks of the VSP cruisers require initial physical tampering of the vehicle as well. The researchers inserted rogue devices in the two police vehicles to basically reprogram some of the car's electronic operations, or to wage the attacks via mobile devices, which they demonstrated.

The project evolved out of concerns by security experts as well as police officials of the dangers of criminal or terror groups tampering with state police vehicles to sabotage investigations or assist in criminal acts. And unlike most car-hacking research to date, it includes the creation of prototype solutions for blocking cyberattacks as well as data-gathering for forensics purposes.

Perhaps a bigger surprise than the car hacks themselves was that a police department would agree to participate in potentially sensitive cyberattack research. But Capt. Jerry L. Davis of the Virginia State Police's Bureau of Criminal Investigation, says there was no hesitation by law enforcement officials in the state when the project was first proposed. "Our executive staff was aware of the issue in the arena and some of the cascading effects that could occur if we didn't start to take a proactive" approach, Davis says.

The VSP even tested out some of the attacks on its students. "We wanted to be able to convey that message to them: you need to consider [cyberattacks] as you respond to incidents," he says. While he says there's been no confirmed cyberattacks on VSP vehicles thus far, "then again, we don't know what we don't know."

The VSP has around 155 2012 Chevrolet Impalas in its fleet, and 427 2013 Ford Tauruses, as well as a mix of other vehicle makes and models. Neither Ford nor GM worked directly on the project, but both carmakers were apprised of it. They also provided rare public statements about vehicle cybersecurity when contacted by Dark Reading.

"The University of Virginia study is helpful to remind industry, regulators, law enforcement and consumers that cybersecurity is an issue that requires focused attention. The staged cyber-attack on a Ford vehicle required unrestricted physical access to the interior to install a device that provided remote access to the electronic control module. This study does not simulate any immediate real-world risk," Ford said in its statement. "It highlights the need to be vigilant about vehicle security and to avoid plugging in devices or technologies that do not have proper security safeguards. And, it serves as a reminder that all connected computing systems should have appropriate safeguards in place to mitigate the threat of cyber-attacks."

GM declined to comment directly on the project, but noted that it's working on securing its vehicles from cyberattacks: "GM takes matters such as potential cyber threats, which affect our customers’ safety and security very seriously. We are taking a layered approach to in-vehicle cybersecurity and are designing many vehicle systems so that they can be updated with enhanced security measures as potential threats evolve," GM said in its statement. "We recently created an integrated organization, Vehicle and Vehicle Services Cybersecurity, which consists of internal experts who work with outside specialists, and is actively working to minimize risks of unauthorized access to vehicles and customer data."

The Hacks

In addition to the gearshift, instrument panel, and engine hacks, researchers from Mitre Corp. also wrote attack code that opened the trunk, unlocked the passenger doors and locked the driver's door, and ran the windshield wipers and wiper fluid.

"We think this is really not about car hacking as it is about coming up with strategies" to protect vehicles from attack, says Brian Barrios, portfolio director of Mitre's National Cybersecurity FFRDC.

The first set of attacks by Mitre occurs via a smartphone app connected via Bluetooth to a hacking device planted  in the vehicle, he says. "This car [the Impala] doesn't have Bluetooth or cellular" connectivity  built in, he says, so connectivity was provided via the Mitre device.

"This is custom software we" wrote for the attacks, Barrios says. The attacks would require some knowledge of the car model's electronics, he notes, so it's not an attack "the average person" could pull off.

"But it's not so advanced that it's outside the realm of possibility," he says.

Kaprica Security built a real-time device to thwart such attacks and to gather forensic data from an attack.  Sagar Momin, engineer and co-founder of Kaprica, says his proof-of-concept tool could be plugged into the car's so-called On Board Diagnostic s (OBD) II in the form of a dongle. "It will record any forensics or other issues," he says. "It knows when there are abnormal messages [to the car]" and blocks them, he says.

The processor is faster than the car's own network, aka the CAN (Controller Area Network) bus, so it's able to determine whether to block or allow a message to pass to the car's controls. Data is written to an SD card, where it's stored for forensics investigation purposes. A state trooper could plug in the device when he got into the vehicle, Momin says.

MSi performed its own set of attacks on the VSP's marked Ford Taurus cruiser. One attack basically performs a denial-of-service hack that blocks the car from starting. The researchers also were able to remotely start up the car from a smartphone-borne attack, and lock and unlock the car such that the driver would be trapped in the vehicle unless he or she rolled down the window to manually open the door.

"A policeman would get out of the car to see what's wrong, he looks under the hood and the car starts itself and the dashboard is going crazy. Horns blow, lights blink, and he decides this car is no good," says Barry Horowitz, chair of the systems and information engineering department at the University of Virginia and one of the leaders of the VSP project. "That could take a half hour or 45 minutes and delay his mission."

The researchers also used a device placed in the vehicle that monitors the ODB II port and detects any hacking tools plugged into the car's port, as well as any attacks over the CAN bus. Like the Kaprica tool, it stops any attacks and collects attack information for forensic analysis afterward.

---Video credit: Justin Naumann, Red Titan Films. Video edit by Dave Harding

 

The Endgame

VSP's Davis says the new age of car hacking means law enforcement will be faced with considering the cybersecurity of its fleet. "We understand with vehicles that not being connected [to the Internet] is a good thing. Taking a look at systems and components embedded in there and how they communicate together: is this something I need to consider in my purchase?"

He says VSP already has in place technicians who investigate computer fraud, so forensics analysis out of a potential car hack would be another aspect of their duties.

"Police cars are less equipped with electronics, and police communicate through private networks so they are not as vulnerable as a consumer. But the [cruisers] have many of the same features as a consumer car has," and are potentially hackable, UVA's Horowitz says.

"The next question is what do you do about it? What kind of data can be extracted from a car and at the scene of an accident? These attacks [demonstrated] are based on putting devices on the car. You could have an inspection procedure when you get into the car, and at an incident, [the police] would check the consumer's car" for such devices, he says. If the cars have built-in forensics gathering capabilities, that data could be analyzed to confirm whether a traffic incident was due to a cyberattack, he notes.

"There are crashes every day" and it's impossible to tell if a cyberattack was the cause, says Frank Byrum, chief scientist for Defense contractor Spectrum. "Someday someone will claim responsibility for something. Then what do the automakers do? This is an engineering problem."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/30/2015 | 2:03:58 PM
Nice to See
It's nice to see that cyber security is becoming more prevalent at the law enforcement level in terms of the police and special task forces because they are the closest link to the general populous when something nefarious is occuring. Before, there were specialists that needed to be consulted, and there still are but I think that general population didn't know the proper protocols and so it made it difficult to gather data and spread awareness.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/30/2015 | 2:17:40 PM
Re: Nice to See
This was a pretty interesting project, with some key players. It's also really amazing that both Ford and GM would comment when I contacted them. This is the first I've seen them say much if anything about car hacking and cybersecurity for vehicles. 
StaceyE
50%
50%
StaceyE,
User Rank: Apprentice
9/30/2015 | 7:39:10 PM
Re: Nice to See
Wow. The thought if cars being hacked makes me glad I still drive a car from the 20th century.
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
10/1/2015 | 2:45:51 PM
Re: Nice to See
StaceyE

Sometimes the only way to be safe from the grid is to get off it entirely. :)
Blog Voyage
50%
50%
Blog Voyage,
User Rank: Strategist
10/3/2015 | 9:14:01 AM
Re: Nice to See
Yes, absolutely stunning
StaceyE
50%
50%
StaceyE,
User Rank: Apprentice
9/30/2015 | 8:07:06 PM
Re: Nice to See
Wow. The thought if cars being hacked makes me glad I still drive a car from the 20th century.
carmicheals
50%
50%
carmicheals,
User Rank: Apprentice
10/1/2015 | 1:15:06 AM
OBD, not ODB!
"Sagar Momin, engineer and co-founder of Kaprica, says his proof-of-concept tool could be plugged into the car's so-called On Board Diagnostic s (ODB) II in the form of a dongle."

On-Board (Vehicle) Diagnostics is OBD II.  ODB (RIP) generally refers to the late Ol' Dirty Bastard of Wu-Tang Clan fame...

I see this mislabeling quite frequently in articles that discuss On-Board (Vehicle) Diagnostics.

The devil is indeed in the details!  
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/1/2015 | 12:38:18 PM
Re: OBD, not ODB!
Thanks for the typo catch--we fixed it this AM. =)
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/1/2015 | 10:53:19 AM
THESE ARTICLES ARE SO DECEVING
I am an OBDII expert. These articles about hacking into cars are so deceiving.  In order to hack most cars, physical access to the cars diagnostics port in the interior of the car is required.  Want to stop a hack, unplug the device in the cars port.  One would have to break into a cop car first in order to HACK it.   People saying they need a solution right away are just trying to generate business for themselves.  NO SOLUTION is needed and as a matter of fact, solutions will kill legitimate business that plug dongles into cars for monitoring.  Its simple, dont buy an OBDII piece from someone without testing it first or without a reputation.  ANYBODY can hack your pc if they sell you a harddrive or flash memory stick that has physcial access.   There is no reason for this and they are asking to add cost to a vehicle for nothing.  Again it requires physical access to the car.  Nothing should be done to limit the access on the OBDII port.  This would also drastically intefere with vehicle emissions inspections as well. Cars with wireless connections or wireless OBDII dongles that allow commands to be sent to car are a different sotry.  We purposely do not allow commands to be sent to a car through our wireless OBD dongle for that reason.  We control the commands .

 
mwalker871
50%
50%
mwalker871,
User Rank: Guru
10/1/2015 | 12:23:34 PM
Re: THESE ARTICLES ARE SO DECEVING
Do you really think it is so very difficult to gain surrepticious physical access? Where are these cars serviced? Are there any mechanics there who could be bribed/threatened. That's usually how "security" is thwarted, from the inside.

As soon as the word "can't" comes out of your mouth, or off your fingers, know you too will be pwned.

We're easily 2 years into solid awareness on this issue: arstechnica -- disabling-a-cars-brakes-and-speed-by-hacking-its-computers-a-new-how-to

It's pretty clear that not just the OBD II port is at risk.

This cracking example is just one more case of security as an afterthought, and a consequence of "we can do it, so we will do it" in design/engineering.

I'm kinda surprised we haven't seen a OnStar crack.
mwalker871
50%
50%
mwalker871,
User Rank: Guru
10/1/2015 | 12:36:27 PM
Re: THESE ARTICLES ARE SO DECEVING
Maybe that's more like 5 years: autosec.org -- faq.html

And maybe OnStar has been targeted.

Anyone that thinks they are going to beat the distributed efforts of a fraction of the intellectual resources of the internet has an idiot for an advisor.

Also don't forget the internet runs on internet time, not your wallclock time or your calendar time.
OBD Engineer
100%
0%
OBD Engineer,
User Rank: Apprentice
10/1/2015 | 12:50:50 PM
Re: THESE ARTICLES ARE SO DECEVING
Yes it is very difficult to gain physical access.    Again just check the port and if there is no device there there is no access.  Its that simple.  Look at the study.  They had to go through the port.  Nothing you can do will prevent someone from going under the hood and installing wires or changing components.   No matter how ridicualously expensive you make it, if I can modify parts, I can get in or simply replace them.  The article used physical access to the OBDII port.   If you make using the OBDII port harder, the end result is that diagnsotics information will be only owned by the CAR MANUFACTURERS.  Thats what they want.  I am guessing thats who financed the study.  If the study was done proper, it would be done to prevent access through telematics and WIFI systems like ONSTAR and not worry about physcial access. Worrying about hacking through physical access is a waste of consumer money.  Imagine if I had to protect a computer from physical access that was not connected to anything IE no internet.  The cost to design slots and electronics that could not be physically modified would be extreme.  THE OBDII PORT IS NOT A PROBLEM.  NO DEVICE PLUGGED IN - NO PROBLEM.  As soon as you give wireless access outside the vehicle then it becomes a problem unless the device plugged into the OBDII port allows CAN (or other communication protocols)  commands to be sent direclty to the car.     
GeorgeAS
100%
0%
GeorgeAS,
User Rank: Strategist
10/8/2015 | 11:30:49 AM
Re: THESE ARTICLES ARE SO DECEVING
As the article stated: "The hacks of the VSP cruisers require initial physical tampering of the vehicle as well." So, yeah... I think we can downgrade the severity category here. Don't even need an OBD device to cause havoc with the electronics.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/8/2015 | 2:25:23 PM
Re: THESE ARTICLES ARE SO DECEVING
Yes much less severe. The threat they exposed is eliminated by using an OBDII device that occupies the port.  Its the wireless OEM and telematics access they should be more worried about.     
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/10/2015 | 7:46:45 AM
Re: THESE ARTICLES ARE SO DECEVING
Speaking of tampering and shielding, a well constructed EMP would make a perfect firmware upgrade.
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 9:54:55 AM
Re: THESE ARTICLES ARE SO DECEVING
Are you suggesting that law enforcement do not ever leave their doors unlocked? 

My vehicle has an OBD I and has no emission requirments. The connection is located under the hood, not under the dash which I find many technicians unable determine. Physical access to the vehicle must first be obtained to pop the hood. However they would have to of located the battery kill switch, and ignition kill switch which are both hidden. I do not have ABS brakes, Power Locks, Bluetooth, or Electronic Parking Break...

And the best part is, it's a manual transmission.

What would be so difficult with relocating the OBD connections somewhere more nondiscrete? Access could be granted via laser cut key, biometric fingerprint, or facebook.

 

 

 
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 12:39:56 PM
Re: THESE ARTICLES ARE SO DECEVING
Your post makes sense and no I am not suggesting that they dont leave their doors unlocked.  However with physical access to the inside of the cars or under the hood I can do so many thinds to the car in many different ways if I study the car and understand it.  I can cut sensors, replace components, replace connectors, tap into things, reporgraom the ECU, replace the ECU, mess wiht the throttle, ect.  Its impossible to prevent this and preventing physicall access of changing the OBDII would add  huge unnecessary cost to the cars for the general public.   Unless the car is wireless, there is not an easy way in as is the scare tactic used by the article.  You cant prevent physical access to car systems .  Relocating the OBDII port somehwere else would require changing the adopted OBDII laws across the country and would require all vehicle manufactures to change their standard design as all vehicles built since 1996 have the connector in the same location with the same access.  The emissions tests would also have to be changed and would be much more complicated.  This would all be huge expense for a problem that doesnt exist.  The OEMS would like this because they would own the diagnostic market more than they already do.  If you want to protect the police cars from access to the OBDII port just simply get an obdii device that plugs into the OBDII port that notifies the police when it is disconnected.  This is a far simpler and cost effective approach.   Once the device is plugged in, everything they are worried about in the article goes away.  We could easily make this device.
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 1:01:18 PM
Re: THESE ARTICLES ARE SO DECEVING
That is an excellent suggestion. However it is possible to pin out the OBD II connector, tap the wires utilizing alligator clips and without removing any shielding.  The connector would not have to be removed in order to bypass the security.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 1:18:05 PM
Re: THESE ARTICLES ARE SO DECEVING
Unless you prevent physical access and armor the cabin of the vehicle and the underhood of the vehicle you cannot fix this problem of tampering with vehicles.  I can always tap or cut wires to gain acess.  With respect to OBD though there are other ways to make a device smarter for almost no additional cost to sense someone tampering with the port to prevent what you bring up.  There is no sense in killing the OBDII system at great expense to consumers and the publice unless you fix physcial acess to the car.  A simple solution prevents the methods discussed in the article     
MajV212
50%
50%
MajV212,
User Rank: Apprentice
10/7/2015 | 5:28:50 PM
Re: THESE ARTICLES ARE SO DECEVING
Agreed.  If you can leave a device in a car... well, boom.  

Or stuck underneath the car :-)

And you're worried about ODBC / CAN bus physical hacks?
TCRUSE762
50%
50%
TCRUSE762,
User Rank: Apprentice
10/3/2015 | 10:55:37 AM
Cars and Smart Guns
We have been hearing a lot about "Smart Guns" as the answer to gun theif and unauthorized use.  The problem with cars being hacked is just one more example of why it is not a good idea to have you gun tied to a wireless connection.

Both a car and a gun can cause the "good guy" to be killed.  However, in a car the electronics and external connections serve a useful purpose.  For the Smart Gun they serve only a made up political agenda item.
TejGandhi1986
50%
50%
TejGandhi1986,
User Rank: Apprentice
10/5/2015 | 9:12:29 PM
Vehicles compromised
Considering the vehicles getting compromised.There was also an investigation raised regarding Malaysian Airlines plane being being cyber hijacked through mobile phone.

Cyber security needs to come to the forefront and addressed cause to ensure that users with malicious intent cannot exploit these vulnerabilities.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25514
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php.
CVE-2020-25515
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?page=books.
CVE-2020-14022
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality (E.g. the "Application Star...
CVE-2020-14023
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS.
CVE-2020-14024
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining address lists configuratio...