Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News

8/6/2015
12:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Jeep Hack 0Day: An Exposed Port

Researchers at Black Hat USA gave details on how they were able to remotely hack and control a Jeep Cherokee.

BLACK HAT USA -- Las Vegas -- In the end, it was an unnecessarily open port that led to the infamous -- and road-tested -- hack of the 2014 Jeep Cherokee by famed car hackers Charlie Miller and Chris Valasek.

Miller and Valasek here yesterday in their presentation on their remote hack of the vehicle revealed the "vulnerability" -- a wide open port 6667 -- that ultimately led to their ability to control the Jeep's steering, braking, high beams, turn signals, windshield wipers and fluid, and door locks, as well as reset the speedometer and tachometer, kill the engine, and disengage the transmission so the accelerator pedal failed.

After studying ways to hack via the car's optional WiFi service, the researchers discovered that the Harman uConnect infotainment system's built-in cellular connection from Sprint left Port 6667 open, which  gave them a connection to the car via their smartphones on the cellular network. The researchers employed a femtocell, and after testing various distances, found they could access the vehicle some 70 miles away via the cell connection. They were able to grab the Jeep's VIN number as well.

Miller and Valasek will publish a research paper on Monday with details on exactly what they found and how they were able to wrest control of the Jeep remotely.

But their attack is now basically history--Sprint since has locked down the exposed communications port.

"There's no way to use the attack … now," Valasek said in a press briefing. "We hope other researchers will take a look at other cards" for vulnerabilities, he said.

Miller and Valasek's groundbreaking and somewhat unnerving research and live demonstration of their hack with a driver on an open highway sent a ripple effect through the automobile industry. Fiat Chrysler last month issued a patch, and then a recall of some 1.4 million vehicles affected by the security flaw --  2013 to 2015 Dodge Vipers and Ram pickups; 2014 to 2015 Jeep Grand Cherokee, Cherokees and Dodge Durango SUVs; and 2015 Chrysler 200, Chrysler 300 and Dodge Chargers and Challengers.

Car hackers Charlie Miller and Chris Valasek 
Image Source: Black Hat Events
Car hackers Charlie Miller and Chris Valasek
Image Source: Black Hat Events

The National Highway Traffic Safety Administration (NHTSA), meanwhile, is investigating the effectiveness of the recall.

The researchers had kept Chrysler updated on their findings along the way, including in March when they were able to send their own CAN messages to the vehicle.

"Cars got recalled. That's cool -- hackers did something" to make that happen, Miller said in their presentation.

But they say the security flaws they found in the infotainment system are not just a Fiat Chrysler issue: suppliers and telecommunications companies need to work with the automakers in these cases, they said.

Meanwhile, another pair of researchers was able to hack a Tesla S, but the attack required some physical tampering with the vehicle. The researchers will present their findings here this week at DEF CON, according to a Wired report.

Black Hat USA is happening! Check it out here.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
rrahmanov
50%
50%
rrahmanov,
User Rank: Apprentice
8/11/2015 | 3:49:59 PM
It only takes 1 (!!!) port
It is as simple as it sounds. One port and a person that knows what to do with it. 
It is interesting, I've just read about Tesla's Model S reporting 6 vulnerabilities related to a similar issue - old browser, outdated services (DNS proxy, HTTP Service) - basically indicating a lack of the up-to-date patching. 
theb0x
100%
0%
theb0x,
User Rank: Ninja
8/13/2015 | 9:40:37 AM
Port 6667
Now you can host your very own IRC channel on port 6667! Chat with other Jeep owners in realtime! Simply amazing!

 

Features coming soon:

 

XDCC File Transfers and Private Chat.

 
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9405
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
CVE-2020-9406
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
CVE-2020-9407
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.
CVE-2020-9398
PUBLISHED: 2020-02-25
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
CVE-2015-5201
PUBLISHED: 2020-02-25
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows r...