Attacks/Breaches

1/11/2019
02:35 PM
50%
50%

SCOTUS Says Suit Over Fiat-Chrysler Hack Can Move Forward

A class-action suit over a 2015 attack demonstration against a Jeep Cherokee can move forward, US Supreme Court rules.

The US Supreme Court, this week, enabled a class action cybersecurity-related lawsuit against Fiat-Chrysler to proceed, after refusing to hear the auto company's appeal. 

In 2015, security researchers Charlie Miller and Chris Valasek showed that they could remotely take over a Jeep Cherokee's control systems by hacking through the SUV's infotainment system. In 2016, they showed they could do it again.

Even though no examples of the hack have been seen in the wild, and Fiat-Chrysler issued a recall affecting more than a million cars in order to patch the vulnerability, a class-action suit was filed against the company.

The plaintiffs say Fiat-Chrysler knew about the vulnerability as early as 2011 but did nothing about it until the public demonstration. They contend that, had they known of the issue, they might have chosen to purchase different vehicles.

Fiat-Chrysler had filed an appeal asking that the suit be dismissed because the vulnerability has been patched. Now, the US Supreme Court says that the suit can go forward, remediation notwithstanding. Arguments in the suit are scheduled to be heard beginning in October.

For more, read here and here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 9:38:30 AM
Re: Might have is not the basis for lawsuit
Thats not really what I was positing. My assertion that other individuals will fall under this category of owning a vulnerable Jeep. If they fall under the use case and it is determined that Fiat-Chrysler does have to pay out then they may be able to collect utilizing that lawsuit as a citation. It happens all the time from a medical perspective. "If you've been exposed to x, then you could be entitled to appropriations." Law offices advertise from this angle quite a bit. So not sure why its such a ludicrous assertion when it happens quite often.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/14/2019 | 3:21:56 PM
Might have is not the basis for lawsuit
Gee, I worked on the 101st floor of the south tower and had I known that one day in September it would be lowered from 101 to the ground floor level, I might have chosen a different job, so WHO can i sue over a decision I MIGHT have made.  Lawsuits don't work that way.  Ever.  And it gets into Minority report territory.  What I am arrested for something I MIGHT have done or MIGHT do.  Well there is some social media in that one but even so suing a company for something that might have influenced a purchase decision?????  HEY, WHAT ABOUT VOLKSWAGEN???   Lets take them down too, lousy Germans!!!
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/14/2019 | 2:37:36 PM
Scope of Lawsuit
What is the reach of this lawsuit? By this I mean, if it turns out that Fiat-Chrysler needs to pay the accusers, could other vulnerable Jeep users jump on the band wagon and file ancillary lawsuits if the company still refuses to patch?
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8980
PUBLISHED: 2019-02-21
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVE-2019-8979
PUBLISHED: 2019-02-21
Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.
CVE-2013-7469
PUBLISHED: 2019-02-21
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2018-20146
PUBLISHED: 2019-02-21
An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
CVE-2019-5727
PUBLISHED: 2019-02-21
Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.