Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
State Trooper Vehicles Hacked
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/10/2015 | 7:46:45 AM
Re: THESE ARTICLES ARE SO DECEVING
Speaking of tampering and shielding, a well constructed EMP would make a perfect firmware upgrade.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/8/2015 | 2:25:23 PM
Re: THESE ARTICLES ARE SO DECEVING
Yes much less severe. The threat they exposed is eliminated by using an OBDII device that occupies the port.  Its the wireless OEM and telematics access they should be more worried about.     
GeorgeAS
100%
0%
GeorgeAS,
User Rank: Strategist
10/8/2015 | 11:30:49 AM
Re: THESE ARTICLES ARE SO DECEVING
As the article stated: "The hacks of the VSP cruisers require initial physical tampering of the vehicle as well." So, yeah... I think we can downgrade the severity category here. Don't even need an OBD device to cause havoc with the electronics.
MajV212
50%
50%
MajV212,
User Rank: Apprentice
10/7/2015 | 5:28:50 PM
Re: THESE ARTICLES ARE SO DECEVING
Agreed.  If you can leave a device in a car... well, boom.  

Or stuck underneath the car :-)

And you're worried about ODBC / CAN bus physical hacks?
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 1:18:05 PM
Re: THESE ARTICLES ARE SO DECEVING
Unless you prevent physical access and armor the cabin of the vehicle and the underhood of the vehicle you cannot fix this problem of tampering with vehicles.  I can always tap or cut wires to gain acess.  With respect to OBD though there are other ways to make a device smarter for almost no additional cost to sense someone tampering with the port to prevent what you bring up.  There is no sense in killing the OBDII system at great expense to consumers and the publice unless you fix physcial acess to the car.  A simple solution prevents the methods discussed in the article     
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 1:01:18 PM
Re: THESE ARTICLES ARE SO DECEVING
That is an excellent suggestion. However it is possible to pin out the OBD II connector, tap the wires utilizing alligator clips and without removing any shielding.  The connector would not have to be removed in order to bypass the security.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 12:39:56 PM
Re: THESE ARTICLES ARE SO DECEVING
Your post makes sense and no I am not suggesting that they dont leave their doors unlocked.  However with physical access to the inside of the cars or under the hood I can do so many thinds to the car in many different ways if I study the car and understand it.  I can cut sensors, replace components, replace connectors, tap into things, reporgraom the ECU, replace the ECU, mess wiht the throttle, ect.  Its impossible to prevent this and preventing physicall access of changing the OBDII would add  huge unnecessary cost to the cars for the general public.   Unless the car is wireless, there is not an easy way in as is the scare tactic used by the article.  You cant prevent physical access to car systems .  Relocating the OBDII port somehwere else would require changing the adopted OBDII laws across the country and would require all vehicle manufactures to change their standard design as all vehicles built since 1996 have the connector in the same location with the same access.  The emissions tests would also have to be changed and would be much more complicated.  This would all be huge expense for a problem that doesnt exist.  The OEMS would like this because they would own the diagnostic market more than they already do.  If you want to protect the police cars from access to the OBDII port just simply get an obdii device that plugs into the OBDII port that notifies the police when it is disconnected.  This is a far simpler and cost effective approach.   Once the device is plugged in, everything they are worried about in the article goes away.  We could easily make this device.
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 9:54:55 AM
Re: THESE ARTICLES ARE SO DECEVING
Are you suggesting that law enforcement do not ever leave their doors unlocked? 

My vehicle has an OBD I and has no emission requirments. The connection is located under the hood, not under the dash which I find many technicians unable determine. Physical access to the vehicle must first be obtained to pop the hood. However they would have to of located the battery kill switch, and ignition kill switch which are both hidden. I do not have ABS brakes, Power Locks, Bluetooth, or Electronic Parking Break...

And the best part is, it's a manual transmission.

What would be so difficult with relocating the OBD connections somewhere more nondiscrete? Access could be granted via laser cut key, biometric fingerprint, or facebook.

 

 

 
TejGandhi1986
50%
50%
TejGandhi1986,
User Rank: Apprentice
10/5/2015 | 9:12:29 PM
Vehicles compromised
Considering the vehicles getting compromised.There was also an investigation raised regarding Malaysian Airlines plane being being cyber hijacked through mobile phone.

Cyber security needs to come to the forefront and addressed cause to ensure that users with malicious intent cannot exploit these vulnerabilities.
TCRUSE762
50%
50%
TCRUSE762,
User Rank: Apprentice
10/3/2015 | 10:55:37 AM
Cars and Smart Guns
We have been hearing a lot about "Smart Guns" as the answer to gun theif and unauthorized use.  The problem with cars being hacked is just one more example of why it is not a good idea to have you gun tied to a wireless connection.

Both a car and a gun can cause the "good guy" to be killed.  However, in a car the electronics and external connections serve a useful purpose.  For the Smart Gun they serve only a made up political agenda item.
Page 1 / 3   >   >>


News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21273
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key va...
CVE-2021-21274
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to...
CVE-2021-23345
PUBLISHED: 2021-02-26
All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/passwd'>.
CVE-2021-21297
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default beh...
CVE-2021-21298
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via th...