Carnegie Mellon researchers note that the cheaper the after market device, the easier it can be hacked.
Computing in cars today has become a standard item. When buying a new car people expect Bluetooth, Wi-Fi and advanced navigation systems. They also expect to connect aftermarket onboard devices through the vehicle’s OBD-II port that do everything from usage-based insurance to tracking the overall energy management of the vehicle.
Popular products include Snapshot by Progressive Insurance, Verizon’s Hum and Automatic from Automatic Labs.
Unfortunately, these new aftermarket products can also be hacked, so the Department of Homeland Security’s US-CERT asked Carnegie-Mellon’s CERT Coordination Center to perform an initial security analysis of these devices to determine their common vulnerabilities, security controls and risks.
In their report, Vulnerability Analysts Christopher King and Daniel Klinedinst say in most instances, the hackers are more than likely local to a targeted vehicle, generally within Wi-Fi or Bluetooth range. This doesn’t rule out remote attacks, as a compromised mobile device with Internet connectivity could be connected to the car via an onboard device, USB, Bluetooth or Wi-Fi.
Through their research King and Klinedinst found the following vulnerabilities: insecure firmware updates; hardcoded or non-existent Bluetooth PINs; weak WPA2 passwords; hardcoded credentials; and an internet-enabled administrative interface.
King and Klinedinst offer the following six checklist items for people looking to install one of these auto aftermarket devices into their cars.
About the Author(s)
You May Also Like
The fuel in the new AI race: Data
April 23, 2024Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024