Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
State Trooper Vehicles Hacked
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
theb0x
theb0x,
 User Rank: Ninja
10/10/2015 | 7:46:45 AM
Re: THESE ARTICLES ARE SO DECEVING
Speaking of tampering and shielding, a well constructed EMP would make a perfect firmware upgrade.
OBD Engineer
OBD Engineer,
 User Rank: Apprentice
10/8/2015 | 2:25:23 PM
Re: THESE ARTICLES ARE SO DECEVING
Yes much less severe. The threat they exposed is eliminated by using an OBDII device that occupies the port.  Its the wireless OEM and telematics access they should be more worried about.     
GeorgeAS
GeorgeAS,
 User Rank: Strategist
10/8/2015 | 11:30:49 AM
Re: THESE ARTICLES ARE SO DECEVING
As the article stated: "The hacks of the VSP cruisers require initial physical tampering of the vehicle as well." So, yeah... I think we can downgrade the severity category here. Don't even need an OBD device to cause havoc with the electronics.
MajV212
MajV212,
 User Rank: Apprentice
10/7/2015 | 5:28:50 PM
Re: THESE ARTICLES ARE SO DECEVING
Agreed.  If you can leave a device in a car... well, boom.  

Or stuck underneath the car :-)

And you're worried about ODBC / CAN bus physical hacks?
OBD Engineer
OBD Engineer,
 User Rank: Apprentice
10/7/2015 | 1:18:05 PM
Re: THESE ARTICLES ARE SO DECEVING
Unless you prevent physical access and armor the cabin of the vehicle and the underhood of the vehicle you cannot fix this problem of tampering with vehicles.  I can always tap or cut wires to gain acess.  With respect to OBD though there are other ways to make a device smarter for almost no additional cost to sense someone tampering with the port to prevent what you bring up.  There is no sense in killing the OBDII system at great expense to consumers and the publice unless you fix physcial acess to the car.  A simple solution prevents the methods discussed in the article     
theb0x
theb0x,
 User Rank: Ninja
10/7/2015 | 1:01:18 PM
Re: THESE ARTICLES ARE SO DECEVING
That is an excellent suggestion. However it is possible to pin out the OBD II connector, tap the wires utilizing alligator clips and without removing any shielding.  The connector would not have to be removed in order to bypass the security.
OBD Engineer
OBD Engineer,
 User Rank: Apprentice
10/7/2015 | 12:39:56 PM
Re: THESE ARTICLES ARE SO DECEVING
Your post makes sense and no I am not suggesting that they dont leave their doors unlocked.  However with physical access to the inside of the cars or under the hood I can do so many thinds to the car in many different ways if I study the car and understand it.  I can cut sensors, replace components, replace connectors, tap into things, reporgraom the ECU, replace the ECU, mess wiht the throttle, ect.  Its impossible to prevent this and preventing physicall access of changing the OBDII would add  huge unnecessary cost to the cars for the general public.   Unless the car is wireless, there is not an easy way in as is the scare tactic used by the article.  You cant prevent physical access to car systems .  Relocating the OBDII port somehwere else would require changing the adopted OBDII laws across the country and would require all vehicle manufactures to change their standard design as all vehicles built since 1996 have the connector in the same location with the same access.  The emissions tests would also have to be changed and would be much more complicated.  This would all be huge expense for a problem that doesnt exist.  The OEMS would like this because they would own the diagnostic market more than they already do.  If you want to protect the police cars from access to the OBDII port just simply get an obdii device that plugs into the OBDII port that notifies the police when it is disconnected.  This is a far simpler and cost effective approach.   Once the device is plugged in, everything they are worried about in the article goes away.  We could easily make this device.
theb0x
theb0x,
 User Rank: Ninja
10/7/2015 | 9:54:55 AM
Re: THESE ARTICLES ARE SO DECEVING
Are you suggesting that law enforcement do not ever leave their doors unlocked? 

My vehicle has an OBD I and has no emission requirments. The connection is located under the hood, not under the dash which I find many technicians unable determine. Physical access to the vehicle must first be obtained to pop the hood. However they would have to of located the battery kill switch, and ignition kill switch which are both hidden. I do not have ABS brakes, Power Locks, Bluetooth, or Electronic Parking Break...

And the best part is, it's a manual transmission.

What would be so difficult with relocating the OBD connections somewhere more nondiscrete? Access could be granted via laser cut key, biometric fingerprint, or facebook.

 

 

 
TejGandhi1986
TejGandhi1986,
 User Rank: Apprentice
10/5/2015 | 9:12:29 PM
Vehicles compromised
Considering the vehicles getting compromised.There was also an investigation raised regarding Malaysian Airlines plane being being cyber hijacked through mobile phone.

Cyber security needs to come to the forefront and addressed cause to ensure that users with malicious intent cannot exploit these vulnerabilities.
TCRUSE762
TCRUSE762,
 User Rank: Apprentice
10/3/2015 | 10:55:37 AM
Cars and Smart Guns
We have been hearing a lot about "Smart Guns" as the answer to gun theif and unauthorized use.  The problem with cars being hacked is just one more example of why it is not a good idea to have you gun tied to a wireless connection.

Both a car and a gun can cause the "good guy" to be killed.  However, in a car the electronics and external connections serve a useful purpose.  For the Smart Gun they serve only a made up political agenda item.
Page 1 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172
PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469
PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466
PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467
PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468
PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipula...