Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
State Trooper Vehicles Hacked
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/10/2015 | 7:46:45 AM
Re: THESE ARTICLES ARE SO DECEVING
Speaking of tampering and shielding, a well constructed EMP would make a perfect firmware upgrade.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/8/2015 | 2:25:23 PM
Re: THESE ARTICLES ARE SO DECEVING
Yes much less severe. The threat they exposed is eliminated by using an OBDII device that occupies the port.  Its the wireless OEM and telematics access they should be more worried about.     
GeorgeAS
100%
0%
GeorgeAS,
User Rank: Strategist
10/8/2015 | 11:30:49 AM
Re: THESE ARTICLES ARE SO DECEVING
As the article stated: "The hacks of the VSP cruisers require initial physical tampering of the vehicle as well." So, yeah... I think we can downgrade the severity category here. Don't even need an OBD device to cause havoc with the electronics.
MajV212
50%
50%
MajV212,
User Rank: Apprentice
10/7/2015 | 5:28:50 PM
Re: THESE ARTICLES ARE SO DECEVING
Agreed.  If you can leave a device in a car... well, boom.  

Or stuck underneath the car :-)

And you're worried about ODBC / CAN bus physical hacks?
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 1:18:05 PM
Re: THESE ARTICLES ARE SO DECEVING
Unless you prevent physical access and armor the cabin of the vehicle and the underhood of the vehicle you cannot fix this problem of tampering with vehicles.  I can always tap or cut wires to gain acess.  With respect to OBD though there are other ways to make a device smarter for almost no additional cost to sense someone tampering with the port to prevent what you bring up.  There is no sense in killing the OBDII system at great expense to consumers and the publice unless you fix physcial acess to the car.  A simple solution prevents the methods discussed in the article     
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 1:01:18 PM
Re: THESE ARTICLES ARE SO DECEVING
That is an excellent suggestion. However it is possible to pin out the OBD II connector, tap the wires utilizing alligator clips and without removing any shielding.  The connector would not have to be removed in order to bypass the security.
OBD Engineer
50%
50%
OBD Engineer,
User Rank: Apprentice
10/7/2015 | 12:39:56 PM
Re: THESE ARTICLES ARE SO DECEVING
Your post makes sense and no I am not suggesting that they dont leave their doors unlocked.  However with physical access to the inside of the cars or under the hood I can do so many thinds to the car in many different ways if I study the car and understand it.  I can cut sensors, replace components, replace connectors, tap into things, reporgraom the ECU, replace the ECU, mess wiht the throttle, ect.  Its impossible to prevent this and preventing physicall access of changing the OBDII would add  huge unnecessary cost to the cars for the general public.   Unless the car is wireless, there is not an easy way in as is the scare tactic used by the article.  You cant prevent physical access to car systems .  Relocating the OBDII port somehwere else would require changing the adopted OBDII laws across the country and would require all vehicle manufactures to change their standard design as all vehicles built since 1996 have the connector in the same location with the same access.  The emissions tests would also have to be changed and would be much more complicated.  This would all be huge expense for a problem that doesnt exist.  The OEMS would like this because they would own the diagnostic market more than they already do.  If you want to protect the police cars from access to the OBDII port just simply get an obdii device that plugs into the OBDII port that notifies the police when it is disconnected.  This is a far simpler and cost effective approach.   Once the device is plugged in, everything they are worried about in the article goes away.  We could easily make this device.
theb0x
50%
50%
theb0x,
User Rank: Ninja
10/7/2015 | 9:54:55 AM
Re: THESE ARTICLES ARE SO DECEVING
Are you suggesting that law enforcement do not ever leave their doors unlocked? 

My vehicle has an OBD I and has no emission requirments. The connection is located under the hood, not under the dash which I find many technicians unable determine. Physical access to the vehicle must first be obtained to pop the hood. However they would have to of located the battery kill switch, and ignition kill switch which are both hidden. I do not have ABS brakes, Power Locks, Bluetooth, or Electronic Parking Break...

And the best part is, it's a manual transmission.

What would be so difficult with relocating the OBD connections somewhere more nondiscrete? Access could be granted via laser cut key, biometric fingerprint, or facebook.

 

 

 
TejGandhi1986
50%
50%
TejGandhi1986,
User Rank: Apprentice
10/5/2015 | 9:12:29 PM
Vehicles compromised
Considering the vehicles getting compromised.There was also an investigation raised regarding Malaysian Airlines plane being being cyber hijacked through mobile phone.

Cyber security needs to come to the forefront and addressed cause to ensure that users with malicious intent cannot exploit these vulnerabilities.
TCRUSE762
50%
50%
TCRUSE762,
User Rank: Apprentice
10/3/2015 | 10:55:37 AM
Cars and Smart Guns
We have been hearing a lot about "Smart Guns" as the answer to gun theif and unauthorized use.  The problem with cars being hacked is just one more example of why it is not a good idea to have you gun tied to a wireless connection.

Both a car and a gun can cause the "good guy" to be killed.  However, in a car the electronics and external connections serve a useful purpose.  For the Smart Gun they serve only a made up political agenda item.
Page 1 / 3   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/1/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Attacker Dwell Time: Ransomware's Most Important Metric
Ricardo Villadiego, Founder and CEO of Lumu,  9/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15664
PUBLISHED: 2020-10-01
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extensi...
CVE-2020-15665
PUBLISHED: 2020-10-01
Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect URL being shown when used in conjunction with other unexpected browser behaviors. This vulnerability affects Firefox < 80.
CVE-2020-15666
PUBLISHED: 2020-10-01
When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status t...
CVE-2020-15667
PUBLISHED: 2020-10-01
When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla, this issue is only exploitable with the Mozilla-controlled ...
CVE-2020-15668
PUBLISHED: 2020-10-01
A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and Firefox for Android < 80.