Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News

8/6/2015
12:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Jeep Hack 0Day: An Exposed Port

Researchers at Black Hat USA gave details on how they were able to remotely hack and control a Jeep Cherokee.

BLACK HAT USA -- Las Vegas -- In the end, it was an unnecessarily open port that led to the infamous -- and road-tested -- hack of the 2014 Jeep Cherokee by famed car hackers Charlie Miller and Chris Valasek.

Miller and Valasek here yesterday in their presentation on their remote hack of the vehicle revealed the "vulnerability" -- a wide open port 6667 -- that ultimately led to their ability to control the Jeep's steering, braking, high beams, turn signals, windshield wipers and fluid, and door locks, as well as reset the speedometer and tachometer, kill the engine, and disengage the transmission so the accelerator pedal failed.

After studying ways to hack via the car's optional WiFi service, the researchers discovered that the Harman uConnect infotainment system's built-in cellular connection from Sprint left Port 6667 open, which  gave them a connection to the car via their smartphones on the cellular network. The researchers employed a femtocell, and after testing various distances, found they could access the vehicle some 70 miles away via the cell connection. They were able to grab the Jeep's VIN number as well.

Miller and Valasek will publish a research paper on Monday with details on exactly what they found and how they were able to wrest control of the Jeep remotely.

But their attack is now basically history--Sprint since has locked down the exposed communications port.

"There's no way to use the attack … now," Valasek said in a press briefing. "We hope other researchers will take a look at other cards" for vulnerabilities, he said.

Miller and Valasek's groundbreaking and somewhat unnerving research and live demonstration of their hack with a driver on an open highway sent a ripple effect through the automobile industry. Fiat Chrysler last month issued a patch, and then a recall of some 1.4 million vehicles affected by the security flaw --  2013 to 2015 Dodge Vipers and Ram pickups; 2014 to 2015 Jeep Grand Cherokee, Cherokees and Dodge Durango SUVs; and 2015 Chrysler 200, Chrysler 300 and Dodge Chargers and Challengers.

Car hackers Charlie Miller and Chris Valasek 
Image Source: Black Hat Events
Car hackers Charlie Miller and Chris Valasek
Image Source: Black Hat Events

The National Highway Traffic Safety Administration (NHTSA), meanwhile, is investigating the effectiveness of the recall.

The researchers had kept Chrysler updated on their findings along the way, including in March when they were able to send their own CAN messages to the vehicle.

"Cars got recalled. That's cool -- hackers did something" to make that happen, Miller said in their presentation.

But they say the security flaws they found in the infotainment system are not just a Fiat Chrysler issue: suppliers and telecommunications companies need to work with the automakers in these cases, they said.

Meanwhile, another pair of researchers was able to hack a Tesla S, but the attack required some physical tampering with the vehicle. The researchers will present their findings here this week at DEF CON, according to a Wired report.

Black Hat USA is happening! Check it out here.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
theb0x
100%
0%
theb0x,
User Rank: Ninja
8/13/2015 | 9:40:37 AM
Port 6667
Now you can host your very own IRC channel on port 6667! Chat with other Jeep owners in realtime! Simply amazing!

 

Features coming soon:

 

XDCC File Transfers and Private Chat.

 
rrahmanov
50%
50%
rrahmanov,
User Rank: Apprentice
8/11/2015 | 3:49:59 PM
It only takes 1 (!!!) port
It is as simple as it sounds. One port and a person that knows what to do with it. 
It is interesting, I've just read about Tesla's Model S reporting 6 vulnerabilities related to a similar issue - old browser, outdated services (DNS proxy, HTTP Service) - basically indicating a lack of the up-to-date patching. 
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19040
PUBLISHED: 2019-11-17
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
CVE-2019-19041
PUBLISHED: 2019-11-17
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by th...
CVE-2019-19012
PUBLISHED: 2019-11-17
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or ...
CVE-2019-19022
PUBLISHED: 2019-11-17
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git r...
CVE-2019-19035
PUBLISHED: 2019-11-17
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.