Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
State Trooper Vehicles Hacked
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/10/2015 | 7:46:45 AM
Re: THESE ARTICLES ARE SO DECEVING
Speaking of tampering and shielding, a well constructed EMP would make a perfect firmware upgrade.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/8/2015 | 2:25:23 PM
Re: THESE ARTICLES ARE SO DECEVING
Yes much less severe. The threat they exposed is eliminated by using an OBDII device that occupies the port.  Its the wireless OEM and telematics access they should be more worried about.     
GeorgeAS
100%
0%
GeorgeAS,
User Rank: Strategist
10/8/2015 | 11:30:49 AM
Re: THESE ARTICLES ARE SO DECEVING
As the article stated: "The hacks of the VSP cruisers require initial physical tampering of the vehicle as well." So, yeah... I think we can downgrade the severity category here. Don't even need an OBD device to cause havoc with the electronics.
MajV212
50%
50%
MajV212,
User Rank: Apprentice
10/7/2015 | 5:28:50 PM
Re: THESE ARTICLES ARE SO DECEVING
Agreed.  If you can leave a device in a car... well, boom.  

Or stuck underneath the car :-)

And you're worried about ODBC / CAN bus physical hacks?
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 1:18:05 PM
Re: THESE ARTICLES ARE SO DECEVING
Unless you prevent physical access and armor the cabin of the vehicle and the underhood of the vehicle you cannot fix this problem of tampering with vehicles.  I can always tap or cut wires to gain acess.  With respect to OBD though there are other ways to make a device smarter for almost no additional cost to sense someone tampering with the port to prevent what you bring up.  There is no sense in killing the OBDII system at great expense to consumers and the publice unless you fix physcial acess to the car.  A simple solution prevents the methods discussed in the article     
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 1:01:18 PM
Re: THESE ARTICLES ARE SO DECEVING
That is an excellent suggestion. However it is possible to pin out the OBD II connector, tap the wires utilizing alligator clips and without removing any shielding.  The connector would not have to be removed in order to bypass the security.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 12:39:56 PM
Re: THESE ARTICLES ARE SO DECEVING
Your post makes sense and no I am not suggesting that they dont leave their doors unlocked.  However with physical access to the inside of the cars or under the hood I can do so many thinds to the car in many different ways if I study the car and understand it.  I can cut sensors, replace components, replace connectors, tap into things, reporgraom the ECU, replace the ECU, mess wiht the throttle, ect.  Its impossible to prevent this and preventing physicall access of changing the OBDII would add  huge unnecessary cost to the cars for the general public.   Unless the car is wireless, there is not an easy way in as is the scare tactic used by the article.  You cant prevent physical access to car systems .  Relocating the OBDII port somehwere else would require changing the adopted OBDII laws across the country and would require all vehicle manufactures to change their standard design as all vehicles built since 1996 have the connector in the same location with the same access.  The emissions tests would also have to be changed and would be much more complicated.  This would all be huge expense for a problem that doesnt exist.  The OEMS would like this because they would own the diagnostic market more than they already do.  If you want to protect the police cars from access to the OBDII port just simply get an obdii device that plugs into the OBDII port that notifies the police when it is disconnected.  This is a far simpler and cost effective approach.   Once the device is plugged in, everything they are worried about in the article goes away.  We could easily make this device.
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 9:54:55 AM
Re: THESE ARTICLES ARE SO DECEVING
Are you suggesting that law enforcement do not ever leave their doors unlocked? 

My vehicle has an OBD I and has no emission requirments. The connection is located under the hood, not under the dash which I find many technicians unable determine. Physical access to the vehicle must first be obtained to pop the hood. However they would have to of located the battery kill switch, and ignition kill switch which are both hidden. I do not have ABS brakes, Power Locks, Bluetooth, or Electronic Parking Break...

And the best part is, it's a manual transmission.

What would be so difficult with relocating the OBD connections somewhere more nondiscrete? Access could be granted via laser cut key, biometric fingerprint, or facebook.

 

 

 
TejGandhi1986
50%
50%
TejGandhi1986,
User Rank: Apprentice
10/5/2015 | 9:12:29 PM
Vehicles compromised
Considering the vehicles getting compromised.There was also an investigation raised regarding Malaysian Airlines plane being being cyber hijacked through mobile phone.

Cyber security needs to come to the forefront and addressed cause to ensure that users with malicious intent cannot exploit these vulnerabilities.
TCRUSE762
50%
50%
TCRUSE762,
User Rank: Apprentice
10/3/2015 | 10:55:37 AM
Cars and Smart Guns
We have been hearing a lot about "Smart Guns" as the answer to gun theif and unauthorized use.  The problem with cars being hacked is just one more example of why it is not a good idea to have you gun tied to a wireless connection.

Both a car and a gun can cause the "good guy" to be killed.  However, in a car the electronics and external connections serve a useful purpose.  For the Smart Gun they serve only a made up political agenda item.
Page 1 / 3   >   >>


Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-20001
PUBLISHED: 2021-03-07
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
CVE-2021-27363
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...