Connected Cars: 6 Tips For Riding Safely With Onboard Devices
Carnegie Mellon researchers note that the cheaper the after market device, the easier it can be hacked.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt86875e15badaa9fe/64f0daca00d62114515f49bf/AutoOnboardAftermarektCoverArt.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Computing in cars today has become a standard item. When buying a new car people expect Bluetooth, Wi-Fi and advanced navigation systems. They also expect to connect aftermarket onboard devices through the vehicle’s OBD-II port that do everything from usage-based insurance to tracking the overall energy management of the vehicle.
Popular products include Snapshot by Progressive Insurance, Verizon’s Hum and Automatic from Automatic Labs.
Unfortunately, these new aftermarket products can also be hacked, so the Department of Homeland Security’s US-CERT asked Carnegie-Mellon’s CERT Coordination Center to perform an initial security analysis of these devices to determine their common vulnerabilities, security controls and risks.
In their report, Vulnerability Analysts Christopher King and Daniel Klinedinst say in most instances, the hackers are more than likely local to a targeted vehicle, generally within Wi-Fi or Bluetooth range. This doesn’t rule out remote attacks, as a compromised mobile device with Internet connectivity could be connected to the car via an onboard device, USB, Bluetooth or Wi-Fi.
Through their research King and Klinedinst found the following vulnerabilities: insecure firmware updates; hardcoded or non-existent Bluetooth PINs; weak WPA2 passwords; hardcoded credentials; and an internet-enabled administrative interface.
King and Klinedinst offer the following six checklist items for people looking to install one of these auto aftermarket devices into their cars.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024