Hackers Expose New Method For Disabling VehiclesBy Kevin Samson The main culprit that was addressed by Fiat-Chrysler, which led to the voluntary recall of 1.4 million vehicles, was any car that came equipped with an 8.4-inch touchscreen as part of the vehicles audio/video system. Wired writer Andy Greenberg is back today with more information from security researchers who were able to show an even easier method to cause a potentially fatal crash in their Corvette test vehicle. It appears that todays interconnected smart gadgets and modern computing applications are making cars one of the more vulnerable everyday items open to life-changing hacks. Like cutting the brakes. As youll see in this video, it only takes a smartphone for an outside operator to take full remote control. As Greenberg reports: At the Usenix security conference today, a group of researchers from the University of California at San Diego plan to reveal a technique they could have used to wirelessly hack into any of thousands of vehicles through a tiny commercial device: A 2-inch-square gadget thats designed to be plugged into cars and trucks dashboards and used by insurance firms and trucking fleets to monitor vehicles location, speed and efficiency. By sending carefully crafted SMS messages to one of those cheap dongles connected to the dashboard of a Corvette, the researchers were able to transmit commands to the cars CAN busthe internal network that controls its physical driving componentsturning on the Corvettes windshield wipers and even enabling or disabling its brakes. [] The device that the UCSD researchers exploited for those attacks was a so-called OBD2 dongle built by the France-based firm Mobile Devices, but distributed by corporate customers like the San Francisco-based insurance startup Metromile. Metromile, the only one of those corporate distributors whose devices the researchers fully analyzed, is an insurance company that gives its customers the cellular-enabled devices, branded as the Metromile Pulse, to plug into a port on their dashboards as a means of tracking cars and charging drivers on a per-mile basis. The company has even partnered with Uber to offer the devices to its contract drivers as part of a discount insurance program. (emphasis added) Similar to the response by Chrysler-Fiat, the researchers said that once alerted to the problem, the company quickly offered a security patch. However, according to the statements above, Metromile clearly isnt the only distributor. They also used the same deflection as Chrysler-Fiat by saying that no one had reported the issue out in the field. But why wouldnt these companies be properly testing in advance for these vulnerabilities? This is where the problem still remains according to researchers: the larger problem of wirelessly hackable dongles plugged into cars networks is far from solved. They say they also notified Mobile Devices of its hardwares insecurity, and were told that the latest versions of the companys dongles werent vulnerable to their attack. But the researchers nonetheless found in scans of the Internet using the search tool Shodan that in addition to the Metromile device, thousands of still-hackable Mobile Devices dongles were visible, mostly in Spainpossibly those used by the Spanish fleet management firm and Mobile Devices customer Coordina. Mobile Devices hasnt responded to WIREDs request for comment or for a list of its main customers. [] the problem is hardly limited to Metromile, Coordina, or even their device supplier Mobile Devices. The insurance company Progressive also offers so-called telematics-based insurance using a similar OBD2 plug-in it calls the Snapshot. Earlier this year security researcher Corey Thuen found that the Progressive Snapshot device had its own serious vulnerabilities, though Thuen didnt demonstrate a proof-of-concept attack. And researchers at the cybersecurity firm Argus found that the Zubie, an OBD2 device for personal tracking of driving efficiency, had hackable flaws, too. (emphasis added) And for those who might feel comfortable that this appears not to be a potentially widespread problem contained with other autos, Wired was quick to point out that it wasnt a Corvette vulnerability, nor something only used in commercial transit: UCSD researchers say they could have hijacked the steering or brakes of just about any modern vehicle with the Mobile Devices dongle plugged into its dash. Its not just this car thats vulnerable, says UCSD researcher Karl Koscher. He points to the work of researchers Charlie Miller and Chris Valasek, who revealed and published the code for a wide array of attacks on a Toyota Prius and Ford Escape in 2013 that required only access to a vehicles OBD2 port. If you put this into a Prius, there are libraries of attacks ready to use online. (emphasis added) Hackers are often maligned by media and governments as anarcho-terrorists who aim to bring nothing but disorder and destruction to the world, but fortunately some of them are doing the work that our supposedly trusted corporations should be doing. This is a story worth paying attention to; it is most assuredly just the tip of the iceberg. It is also a useful topic to offer to those who would knee-jerk shout conspiracy theory! when presented with the strange events surrounding the fatal car crash of journalist Michael Hastings, for example. Perhaps we can now start taking a much closer look at boats, planes, GPS-driven munitions, unmanned vehicles and even smart homes that also can be taken over via remote control. And let us take another look back to 2012 when DARPA itself went on record with these very same concerns: Image Credit: C3 Group, appearing on Forbes Kevin Samson writes for selfnews Post. You can find his other articles HERE. This why I drive a 1971 Dodge Demon. Researchers who were able to show an even EASIER method to cause a potentially fatal crash in their Corvette test vehicle. Ask Michael Hastings about remote controlled murder by hacked automobile controls. The libs all wanted to holler conspiracy theory when Hastings car went off on its own and evidence showed the engine in left the car before hitting the tree. They were too stupid and uninformed to know or recognize that the concept of external control has been around for a lot longer than they thought. I dont buy a car which becomes useless or unrepairable, because some Advanced control panel does not work anymore. The new gimmick cars are getting annoying. That is why we see the return of old clunkers and even see f. e. Toyota Corollas from the 80s back on the street. R.I.P. Auto industry. So much for the slobbering, egotistical, toy-nerds that want all the electronics in their cars. Theyve set them up to spy on you just like your cell phone, but unlike the phone, they can run you off the road if you piss them off. Who says extortion doesnt work? Well this should boost sale for classical cars! 