Researchers reveal methods behind car hack at Defcon

They plan to release a research paper and all the custom tools they developed

Two security researchers at Defcon on Friday revealed the methods they used to hack into car computers and take over the steering, acceleration, brakes and other important functions.

Security researchers Charlie Miller (left) and Chris Valasek (right) explaining how they hacked into car computersSecurity researchers Charlie Miller (left) and Chris Valasek (right) explaining how they hacked into car computers

Charlie Miller, a security engineer at Twitter, and Chris Valasek, director of security intelligence at IOActive, spent 10 months researching how they could hack into the network of embedded computer systems called electronic control units (ECUs) used in modern cars and see what they could do once they gained access to it.

Their test cars were a 2010 Ford Escape and a 2010 Toyota Prius.

Some of the things they were able to achieve by hooking a laptop to the ECU communications network and injecting rogue signals into it included disabling the brakes while the car was in motion, jerking the steering wheel, accelerating, killing the engine, yanking the seat belt, displaying bogus speedometer and fuel gauge readings, turning on and off the car's lights, and blasting the horn.

The researchers also found a way to achieve persistent attacks by modifying the ECU firmware to send rogue signals even when they were no longer physically connected to the control units.

A research paper explaining how the hacking was done was shared with Ford and Toyota a few weeks before the Defcon presentation, the researchers said.

Toyota responded that it didn't consider this to be car hacking and that the company's security efforts are focused on preventing remote attacks from outside the car, not those that involve physically accessing the control system, Miller and Valasek said.

The goal of the research was to see what could be done when hackers gain access to the ECU network, known as the controller area network bus, the researchers said. It doesn't matter if it's done locally or remotely; access to a single ECU provides access to the whole network and gives the ability to inject commands, they said.

Miller is certain that other researchers will find ways to remotely attack the systems in the future. The software industry hasn't figured out how to write secure software yet, so there's no reason to believe car makers have figured it out either, he said.

The code in systems that can be accessed remotely -- telematics units, tire sensors, those using Bluetooth and Wi-Fi -- might have a lot of vulnerabilities, he said. "I'm sure that if people start looking, they would will start finding vulnerabilities."

That's part of the reason Miller and Valasek decided to make the details of their research public, including what kind of equipment, cables and software they used.

The full research paper and the custom software tools that were written to interact with the ECUs, as well as the code used to inject particular commands, will be released this weekend, Miller said.

"We want other researchers to keep working on this; on other cars or on the same cars," Miller said. "It took us ten months to do this project, but if we had the tools that we have now, we would have done it in two months. We want to make it easy for everyone else to get involved in this kind of research."

Concerns that the tools could enable people to hack car systems for malicious purposes are valid, the researcher said. However, if it's that easy to do, then they could do it anyway; it would just take them a bit more time, he said.

"If the only thing that keeps our cars safe is that no one bothers to do this kind of research, then they're not really secure," Miller said. "I think it's better to lay it all out, find the problems and start talking about them."

However, fixing the issues won't be easy because most of them are there by design, according to Miller.

Car manufacturers won't be able to just issue a patch, the researcher said. "They'll have to change the way these systems are made."

Right now, there's no authentication when car computers communicate with each other, because they need to react and send signals quickly in potentially dangerous situations, the researcher said. Adding authentication will introduce latency, so the systems will need faster processors to make up for that. Those processors would cost more, so car prices would rise, he said.

Toyota Motor Sales and Ford Motor Co. in the U.S. did not immediately respond to requests for comments.

Tags: Ford Motor Company, physical security, security, Access control and authentication, twitter, encryption, Exploits / vulnerabilities, Toyota Motor Sales, IOActive

Heartbleed panic drives flood of enquiries to Symantec's Melbourne CA

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Endpoint Management Solutions

Endpoint Security Management

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.