A couple of white hat security experts have shown how hackers could take control of an automobile's steering, braking and other operations through the vehicle's on-board computer.
Charlie Miller, a security engineer at Twitter, and Chris Valasek of security firm IOActive, demonstrated how they could control the brakes, steering, horn and more in a Toyota Prius.
Computerized Vehicles
Today's vehicles are more computerized than ever, with seemingly unrelated technologies such as CD players, Bluetooth hands-free phone systems and GPS units integrated. Systems such as OnStar and other roadside services already access vehicles remotely, suggesting that the type of gizmo utilized by Miller and Valasek might not even be required to hack its innards.
"When you get the OnStar links, the computer systems in the car and you add all this in, it is pretty simple to hack in," Justin Cupler, editor-in-chief of automotive review siteTopSpeed.com, told TechNewsWorld. "There should be checks and balances to keep this from happening -- but clearly there is a way to hack around."
Today's cars are as much rolling computers as modes of transportation.
"There are as many as 100 microprocessors in a car," said Egil Juliussen, director and principal analyst at IHS Automotive.
"It hasn't been a problem before, as there wasn't an easy connection -- but as you get more communication links, you start having potential problems," he told TechNewsWorld. "With the telematics, Bluetooth and wireless connections, the system needs some security that you didn't need to do before. The automobile manufacturer is just starting to do this. We'll see more security going forward."
More-Secure Vehicles
The white hat hack of the Toyota Prius, plus a similar demonstration with a Ford Escape, were not the first indications that vehicles could be subject to a hack attack.
The Center for Automotive Embedded Systems Security, which is a collaboration between researchers at the University of California San Diego and the University of Washington, have been looking closely at the many possible ways an automobile might be hacked remotely or its systems otherwise compromised.
"The risks today are probably pretty low, in that it takes significant technical sophistication to be able to compromise a vehicle remotely," said Tadayoshi Kohno, professor at the University of Washington's Department of Computer Science and Engineering.
"Following our experimental studies in 2010 and 2011, automobile manufactures and the U.S. government have been focusing significant efforts on improving the computer security of automobiles," he told TechNewsWorld.
In fact, since the publication of CAESS' studies in 2010 and 2011, the automotive industry has reportedly made great strides, but the researchers admit there is a long road ahead to fix everything.
"There are two classes of problems: the first being that an attacker who gains access to the CAN bus -- either via a compromised component, via a wireless vulnerability or via a third-party device like the Progressive dongle -- is able to have far-reaching effects on the car's functionality," said Stefan Savage, a professor in the Department of Computer Science and Engineering at the University of California San Diego.
That is essentially what Miller and Valasek were able to do with the Prius and the Ford, Savage added.
"The second issue is around the difficulty in planting such malicious software without having direct physical access to the vehicle," Savage told TechNewsWorld. "We demonstrated multiple such avenues in our 2011 paper. While we have worked with the manufacturers and/or vendors to fix or mitigate all the precise problems we identified in our work, it is extremely likely that other such avenues for attack still exist."
