Feature ArticlesInternet Security

Hackable Cars: Overhyped?



The internet went into an uproar last month, as Wired, in conjunction with security experts Charlie Miller and Chris Valaskek, demonstrated a hack that could take control of a Jeep Cherokee mid-drive. The researchers completely owned the car, taking control of the radio, windshield wipers, transmission, steering, and brakes.

What’s more, they did it all without modifying any of the vehicle’s computer systems beforehand, leveraging their exploit via Wi-Fi. The story was widely followed on national media, and prompted Fiat to recall 1.4 million vehicles. The ball hasn’t stopped rolling since, with Reuters reporting that a vast number of additional vehicles may remain vulnerable.

Essentially, this moment represents a bit of a watershed—it’s the first time any automaker has recalled any of its cars based on a software exploit. However, this isn’t the first time a car has been hacked, and it isn’t even the first time a car has been hacked remotely. Is this story as big of a deal as people are saying? Is your car really at risk of being hacked?

Car hacking is nothing new. As early as 2010, a disgruntled car dealership employee named Omar Ramos-Lopez remotely disabled the cars of over a hundred customers. This hack involved a preinstalled device on every customer’s car, meant to render the vehicles un-drivable if their owners got behind on their car payments. In 2011, a team from iSec Partners was able to demonstrate the capability to hack a car remotely via text message, opening doors, disabling alarms, and starting the engine.

Lastly, the same team behind the most recent story of hackable cars, security experts Charlie Miller and Chris Valaskek, was able to demonstrate the same exploit as early as 2013. In this early demonstration, they were also able to remotely steer and brake a car, a Ford Escape this time, but in this instance they were only able take control after first wiring a transmitter directly into the car’s entertainment system — not exactly practical for a real-world attack.

Although attackers have been able to hack cars for at least four years, the Jeep hacking exploit is the apparently the first to combine numerous factors: comprehensive control of a car, wireless capabilities, and no hardware modification required.

So, the answer to our first question is yes, this is kind of a big deal. Now we have to ask ourselves how this happened, and if the general population is in danger.

Although exact details of the exploit used on the Jeep won’t become available until the researchers’ BlackHat talk this week, details of the recall suggest that the vulnerability lives in the Jeep’s radio. From the radio, the hackers pivot to the in-car entertainment system, overwriting its firmware until the computer can control the rest of the car’s systems.

While the researchers have only tested their exploits on one model of Jeep, they feel confident that it will work on other Chrysler models using the same entertainment system. As manufacturers continue to integrate electronics into their vehicle platforms, especially those designed to integrate with or augment the capacity of a smartphone, it is likely that their cars will become more vulnerable to intrusion over time. As revelations and analysis continue to fall out of the story, this might prompt an industry-wide reevaluation of that particular strategy.

Although Chrysler is taking an important step by actually acknowledging that their vehicles are actually hackable and recalling them, the methods of the recall could actually use some improvement. For example, customers who bring their Jeeps to the dealership will receive a physical USB key containing the patch.

How many people who receive the notification will actually bring their cars into the dealership? How many people who receive the USB key will actually stick it into their car? In a recall affecting 1.4 million people, there are bound to be some who will do neither.  If the recall widens to include those with similar versions of the same entertainment system, there will certainly be more missed spots. A wireless, over-the-air patch would certainly not be unfeasible — Tesla has been doing this since 2012.

Hackable cars have been in and out of the news since the beginning of the decade, but this latest exploit has opened up a can of worms that probably won’t go away. Less than a week after the first car hacking story broke, Wired followed up with yet another exploit, this time involving OnStar, which would allow an attacker to unlock a car’s doors, start the ignition, and derive personal information about the owner.

In short, for every devices that interfaces with a car’s electronics, there’s about to be an exploit that allows an attacker to take control of the vehicle. Vital software patches to fix these exploits probably aren’t going to make it to every consumer. Verdict: if you want to drive something that can’t be hacked, it’s probably time to invest in a bike.

Andrew Sanders

Andrew is a writer and editor based out of New England. He specializes in technology and information security.