Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:00 AM
Connect Directly

State Trooper Vehicles Hacked

Car-hacking research initiative in Virginia shows how even older vehicles could be targeted in cyberattacks.

A state trooper responding to a call starts his vehicle, but is unable to shift the gear from park to drive. The engine RPMs suddenly spike and the engine accelerates, no foot on the pedal. Then the engine cuts off on its own.

The unmarked 2012 Chevrolet Impala from the Virginia State Police's (VSP) fleet has been hacked -- but luckily, by good hackers.

This is what police officers could someday face in the age of car hacking. It's just one in a series of cyberattacks waged on the VSP's Impala and on one of its 2013 Ford Taurus marked patrol cars as part of an experiment by a public-private partnership to test how state trooper vehicles could be sabotaged via cyberattacks. Virginia Governor Terry McAuliffe in May first announced the initiative, which was aimed at protecting the state's public safety agencies and citizens from vehicle-hacking.

Among the organizations that worked on the project were the Virginia State Police, the University of Virginia, Mitre Corp., Mission Secure Inc. (MSi), Kaprica Security, Spectrum, Johns Hopkins Applied Physics Lab, Digital Bond Labs, the Aerospace Corporation, and the Virginia Department of Motor Vehicles. The research was conducted in coordination with the US Department of Homeland Security's Science and Technology division and the US Department of Transportation's Volpe Transportation Systems Center.

Car-hacking has shifted into overdrive this past year, mainly thanks to research by famed car hackers Charlie Miller and Chris Valasek, who this summer demonstrated how they were able to remotely control a 2014 Jeep Cherokee's steering, braking, high beams, turn signals, windshield wipers and fluid, and door locks, as well as reset the speedometer and tachometer, kill the engine, and disengage the transmission so the accelerator pedal failed.

There were no state troopers driving into ditches or rolling into highway exit ramps after losing control of the gas pedal: unlike Miller and Valasek's video demonstration of those hacks with a journalist behind the wheel, the VSP research didn't hack moving vehicles. But the Virginia project demonstrated how even non-networked, older-model vehicles are also susceptible to cyberattacks.

The hacks of the VSP cruisers require initial physical tampering of the vehicle as well. The researchers inserted rogue devices in the two police vehicles to basically reprogram some of the car's electronic operations, or to wage the attacks via mobile devices, which they demonstrated.

The project evolved out of concerns by security experts as well as police officials of the dangers of criminal or terror groups tampering with state police vehicles to sabotage investigations or assist in criminal acts. And unlike most car-hacking research to date, it includes the creation of prototype solutions for blocking cyberattacks as well as data-gathering for forensics purposes.

Perhaps a bigger surprise than the car hacks themselves was that a police department would agree to participate in potentially sensitive cyberattack research. But Capt. Jerry L. Davis of the Virginia State Police's Bureau of Criminal Investigation, says there was no hesitation by law enforcement officials in the state when the project was first proposed. "Our executive staff was aware of the issue in the arena and some of the cascading effects that could occur if we didn't start to take a proactive" approach, Davis says.

The VSP even tested out some of the attacks on its students. "We wanted to be able to convey that message to them: you need to consider [cyberattacks] as you respond to incidents," he says. While he says there's been no confirmed cyberattacks on VSP vehicles thus far, "then again, we don't know what we don't know."

The VSP has around 155 2012 Chevrolet Impalas in its fleet, and 427 2013 Ford Tauruses, as well as a mix of other vehicle makes and models. Neither Ford nor GM worked directly on the project, but both carmakers were apprised of it. They also provided rare public statements about vehicle cybersecurity when contacted by Dark Reading.

"The University of Virginia study is helpful to remind industry, regulators, law enforcement and consumers that cybersecurity is an issue that requires focused attention. The staged cyber-attack on a Ford vehicle required unrestricted physical access to the interior to install a device that provided remote access to the electronic control module. This study does not simulate any immediate real-world risk," Ford said in its statement. "It highlights the need to be vigilant about vehicle security and to avoid plugging in devices or technologies that do not have proper security safeguards. And, it serves as a reminder that all connected computing systems should have appropriate safeguards in place to mitigate the threat of cyber-attacks."

GM declined to comment directly on the project, but noted that it's working on securing its vehicles from cyberattacks: "GM takes matters such as potential cyber threats, which affect our customers’ safety and security very seriously. We are taking a layered approach to in-vehicle cybersecurity and are designing many vehicle systems so that they can be updated with enhanced security measures as potential threats evolve," GM said in its statement. "We recently created an integrated organization, Vehicle and Vehicle Services Cybersecurity, which consists of internal experts who work with outside specialists, and is actively working to minimize risks of unauthorized access to vehicles and customer data."

The Hacks

In addition to the gearshift, instrument panel, and engine hacks, researchers from Mitre Corp. also wrote attack code that opened the trunk, unlocked the passenger doors and locked the driver's door, and ran the windshield wipers and wiper fluid.

"We think this is really not about car hacking as it is about coming up with strategies" to protect vehicles from attack, says Brian Barrios, portfolio director of Mitre's National Cybersecurity FFRDC.

The first set of attacks by Mitre occurs via a smartphone app connected via Bluetooth to a hacking device planted  in the vehicle, he says. "This car [the Impala] doesn't have Bluetooth or cellular" connectivity  built in, he says, so connectivity was provided via the Mitre device.

"This is custom software we" wrote for the attacks, Barrios says. The attacks would require some knowledge of the car model's electronics, he notes, so it's not an attack "the average person" could pull off.

"But it's not so advanced that it's outside the realm of possibility," he says.

Kaprica Security built a real-time device to thwart such attacks and to gather forensic data from an attack.  Sagar Momin, engineer and co-founder of Kaprica, says his proof-of-concept tool could be plugged into the car's so-called On Board Diagnostic s (OBD) II in the form of a dongle. "It will record any forensics or other issues," he says. "It knows when there are abnormal messages [to the car]" and blocks them, he says.

The processor is faster than the car's own network, aka the CAN (Controller Area Network) bus, so it's able to determine whether to block or allow a message to pass to the car's controls. Data is written to an SD card, where it's stored for forensics investigation purposes. A state trooper could plug in the device when he got into the vehicle, Momin says.

MSi performed its own set of attacks on the VSP's marked Ford Taurus cruiser. One attack basically performs a denial-of-service hack that blocks the car from starting. The researchers also were able to remotely start up the car from a smartphone-borne attack, and lock and unlock the car such that the driver would be trapped in the vehicle unless he or she rolled down the window to manually open the door.

"A policeman would get out of the car to see what's wrong, he looks under the hood and the car starts itself and the dashboard is going crazy. Horns blow, lights blink, and he decides this car is no good," says Barry Horowitz, chair of the systems and information engineering department at the University of Virginia and one of the leaders of the VSP project. "That could take a half hour or 45 minutes and delay his mission."

The researchers also used a device placed in the vehicle that monitors the ODB II port and detects any hacking tools plugged into the car's port, as well as any attacks over the CAN bus. Like the Kaprica tool, it stops any attacks and collects attack information for forensic analysis afterward.

---Video credit: Justin Naumann, Red Titan Films. Video edit by Dave Harding


The Endgame

VSP's Davis says the new age of car hacking means law enforcement will be faced with considering the cybersecurity of its fleet. "We understand with vehicles that not being connected [to the Internet] is a good thing. Taking a look at systems and components embedded in there and how they communicate together: is this something I need to consider in my purchase?"

He says VSP already has in place technicians who investigate computer fraud, so forensics analysis out of a potential car hack would be another aspect of their duties.

"Police cars are less equipped with electronics, and police communicate through private networks so they are not as vulnerable as a consumer. But the [cruisers] have many of the same features as a consumer car has," and are potentially hackable, UVA's Horowitz says.

"The next question is what do you do about it? What kind of data can be extracted from a car and at the scene of an accident? These attacks [demonstrated] are based on putting devices on the car. You could have an inspection procedure when you get into the car, and at an incident, [the police] would check the consumer's car" for such devices, he says. If the cars have built-in forensics gathering capabilities, that data could be analyzed to confirm whether a traffic incident was due to a cyberattack, he notes.

"There are crashes every day" and it's impossible to tell if a cyberattack was the cause, says Frank Byrum, chief scientist for Defense contractor Spectrum. "Someday someone will claim responsibility for something. Then what do the automakers do? This is an engineering problem."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 3 / 3
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/30/2015 | 2:17:40 PM
Re: Nice to See
This was a pretty interesting project, with some key players. It's also really amazing that both Ford and GM would comment when I contacted them. This is the first I've seen them say much if anything about car hacking and cybersecurity for vehicles. 
User Rank: Ninja
9/30/2015 | 2:03:58 PM
Nice to See
It's nice to see that cyber security is becoming more prevalent at the law enforcement level in terms of the police and special task forces because they are the closest link to the general populous when something nefarious is occuring. Before, there were specialists that needed to be consulted, and there still are but I think that general population didn't know the proper protocols and so it made it difficult to gather data and spread awareness.
<<   <   Page 3 / 3
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-03-07
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...