Black Hat USA 2015: The full story of how that Jeep was hacked

https://blog.kaspersky.com/blackhat-jeep-cherokee-hack-explained/

by mzs • 11 years ago

322 133 11 years ago

blog.kaspersky.com

mzs5• 11 years ago

Remote Exploitation of an Unaltered Passenger Vehicle

Dr. Charlie Miller

Chris Valasek

August 10, 2015

http://illmatics.com/Remote%20Car%20Hacking.pdf

ghuntley• 11 years ago

    While some of the research could proceed without the diagnostic equipment, many
    active tests and ECU unlocking require an analysis of the mechanic’s tools.
    After both authors of this paper sold plasma for several weeks, we were finally
    able to afford the system required to do diagnostics on the Jeep Cherokee (and
    all other Fiat-Chrysler vehicles)

rasz_pl2• 11 years ago

Its a joke. Miller is loaded, and alibaba is full of cheap clones of diagnostic tools (and 'special' dongles that do magical things like cloning BMW keys, or bypassing Mazda 6 security in 4 seconds)

spudlyo• 11 years ago

This was an excellent read, and had the technical meat I was looking for. Too much actually, my eyes started glazing over during the CAN protocol checksum part.

It was a hair-raising experience learning that up until recently thousands of cars' head units could be controlled remotely at any given time by telneting to port 6667 (irc, hah!) and sending unauthenticated D-Bus commands over the Sprint 3G IP network.

aembleton• 11 years ago

I'm not so worried about hackers gaining access to change radio stations, but writing to the CANBus is concerning.

It sounds like the weak point in this was the ability to rewrite the firmware of the V850 controller. If that could somehow signed then I'd feel safer.

cryptoz• 11 years ago

Even changing radio stations could be very dangerous, especially if access is also granted to audio controls (which it is). Attackers could easily cause accidents by creating distractions like rapidly changing, loud radio stations.

bronson• 11 years ago

The Wired video is a good example. It impaired communication, making that situation even more dangerous.

(shouting) "Guys, I'm stuck on the highway."

"What'd he say?" "Dunno, I think he's panicking."

"Guys, I need the accelerator to work again!"

"Accelerator? It won't work. Ha ha!"

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-high...

Asbostos2• 11 years ago

Don't forget an FM radio signal itself is trivial to hack. I did this when I was a kid so that's not a new problem at all, and probably not a danger. If the driver is going to crash because of a sound on the radio, they probably aren't safe to be driving in the first place.

stevecalifornia• 11 years ago

A simple fix would be to allow me, the owner, to turn off the wifi device and the connection to Sprint. I am not using those features and don't wish to have them.

adrianb• 11 years ago

The connection is probably at least used to crowd-source live traffic information. Most people would like this feature.

mhurron• 11 years ago

That doesn't justify not giving the option to disable it.

teacup50• 11 years ago

Most people would like live traffic information.

Most people would not like to feed their location data to "the cloud", or open their car to anyone with an exploit in their pocket.

Traffic information can be distributed to cars via one-way mechanisms without sacrificing privacy -- using mechanisms such as FM RDS and Satellite Radio.

scintill76• 11 years ago

Uh, are you saying s/he should keep the network connected because other people want the data s/he will provide by driving around with the network on?

imglorp• 11 years ago

You need to neuter the digital broadcast radio also. There was another way in there. And check the bluetooth and the keyless entry fobs also.

NickNameNick• 11 years ago

And disable the receivers for the tire pressure monitoring system.

rasz_pl2• 11 years ago

You the owner? HAHA you are NOT the owner, GM is.

'In Copyright Dispute, GM Attorney Says Customers Just License Vehicle Use' http://www.autoblog.com/2015/05/20/general-motors-says-owns-...

Wingman4l7• 11 years ago

I'd like to see GM's lawyer explain that to a judge when the plaintiff is holding the vehicle's title papers.

rthomas6• 11 years ago

GM doesn't own Jeep.

lelandbatey• 11 years ago

This is the thing that all the manufacturers always refer back to when it comes to IT-security of cyber-physical systems: there is an isolation they say, the air gap between connected and physical parts of these systems.
[the] multimedia system’s controller itself can’t communicate directly with CAN bus, it actually can communicate with another component which is connected to CAN bus, the V850 controller

That... that's not what an air gap is. Usually I'm forgiving about security that's fudged, since it's hard and marketing and higher-ups rarely understand. That's the entire point of an air gap: there isn't anything to understand, it's a physical disconnection. It's either plugged in or it's not.

When asked "is there an air gap", if the answer is no and you answer yes then you're lying in the most blatant and bare-faced way I can imagine. It's like saying "that car is four wheel drive" when it's only two wheel drive, or saying "that car has an 18 gallon tank" when it has a 7 gallon tank.

jMyles• 11 years ago

It's really shocking how blatant and dramatic an official corporate or government statement has to be before we're prepared to call it a lie.

sitkack2• 11 years ago

Basically if you are high up enough, the only way to get caught in a lie to to admit that it was a lie, and that you meant to lie.

ImJasonH• 11 years ago

Remote control of steering wheel, engine, breaks? Free OTA driverless car update!

x0054• 11 years ago

Wow, that's some good spin! Not sure what you are doing now, but I am sure Chrysler can use you in their PR department!

krupan2• 11 years ago

Land Rover is way ahead of you. "It's not a bug, it's a feature" https://www.youtube.com/watch?v=gw0zRdlhI8M

morsch• 11 years ago

Employing this trick you can find all of Chrysler’s cars equipped with this kind of head unit. Over a million of them were actually recalled by Fiat Chrysler. After that all you need is to choose the right one. Funny thing is that it’s rather hard to do, “it’s much easier to hack all the Jeeps than the certain one,” as the researchers say.

However, picking the wanted Jeep is doable as well, thanks to the option of the GPS tracker.

Better double check that you're not crashing another Jeep which is in the wrong place at the wrong time...

Thriptic• 11 years ago

If you're doing it for nefarious purposes, all you need to know is that the target vehicle in is on the road. You could have every active vehicle crash at the same time. While doing so blows the hack for good, it would make the motive incredibly difficult to determine.

NeutronBoy• 11 years ago

You're sorely mistaken if you think Jeep is the only car manufacturer with this setup. I'd bet that most cars produced within the last few years don't have airgapped CANBus systems. By definition, any car with 'drive' settings you can adjust by the headunit console (suspension, sport modes, charging status, etc) is not airgapped. I mean, in a Tesla you have the option to change suspension settings based on location from a Google Maps -based GPS system. It also can drive itself from your garage to your front door based on meetings scheduled in your calendar.

We literally have the same information for any auto manufacturer that we have from Jeep - empty assurances that 'we design our cars with the utmost cyber-security protections, trust us'.

bliti2• 11 years ago

Car nut here: Your assumption is correct. The system is not air gapped. Even racing control systems suffer from this (except some really expensive ones, although they use commonly sourced sensors with various form of shielding).

jessaustin3• 11 years ago

Hmmm this could lead to some unconventional race techniques.

simoncion• 11 years ago

...in a Tesla you have the option to change suspension settings based on location from a Google Maps -based GPS system.

Given Musk's technical background, one would expect Tesla to understand that they're building a network-connected computer-controlled two-ton missile and to have both the desire and know how to properly secure such a thing.

But yeah, AFAIK, all we have from any manufacturer is assurances of security. :(

forgottenpass2• 11 years ago

Tesla takes their security pretty seriously. There were at DEF CON, both in the contest area and the front row of the talk where someone dumped their firmware. The presenter was overall pleased with their design. Expect to see something on 60 Minutes in the coming months.

mikeash4• 11 years ago

Nitpick on the Tesla: the "drive itself from your garage to your front door" thing is a hypothetical future scenario with no proposed implementation timeframe, and not something you can do right now.

But it's just a nitpick, because the basic controls are certainly all there. The feature doesn't exist yet just because it's hard to do it safely and legally.

itengelhardt• 11 years ago

There is at least the suggestions that this will roll out in the next few weeks to a subset of Tesla owners (not to call them beta testers... but beta testers). https://twitter.com/elonmusk/status/627040381729906688

Matthias247• 11 years ago

I'm in the industry. The setup described in the article (multimedia CPU plus connected vehicle controller (V850) which supports the CAN connection) is pretty much the standard headunit architecture. What is different from OEM to OEM is to which kind of CAN bus the system is attached and therefore which signals you can change.

For other OEMs it e.g. might not be possible to directly send brake signals from there, as a gateway connects and filters the different CAN networks.

But of course, once you figure out how to remote update individual ECUs then you might also be able to modifiy the gateways and do all kind of bad stuff.

hmmmmmmmmm• 11 years ago

Could this have happened in a Mercedes as well? http://www.occupy.com/article/exclusive-who-killed-michael-h...

krupan2• 11 years ago

well, there's this: https://www.youtube.com/watch?v=k_o-H1j4zZs

sprite• 11 years ago

This is the recall text from Jeep:

Safety Defect/Non Compliance Description and Safety Risk:

SOME 2013-2015 MY VEHICLES EQUIPPED WITH SPECIFIC RADIOS HAVE CERTAIN SOFTWARE SECURITY VULNERABILITIES WHICH COULD ALLOW UNAUTHORIZED THIRD-PARTY ACCESS TO SOME NETWORKED VEHICLE CONTROL SYSTEMS. A SUCCESSFUL EXPLOIT OF THIS SECURITY VULNERABILITY COULD RESULT IN UNAUTHORIZED REMOTE MODIFICATION AND CONTROL OF VEHICLE SYSTEMS. FCA US HAS NOT MADE A DETERMINATION THAT THIS SECURITY VULNERABILITY CONSTITUTES A DEFECT. ALTHOUGH FCA US HAS NOT DETERMINED THAT A DEFECT EXISTS, IT HAS DECIDED TO CONDUCT A REMEDIAL CAMPAIGN AS A SAFETY RECALL IN THE INTEREST OF PROTECTING ITS CUSTOMERS. EXPLOITATION OF THE SOFTWARE SECURITY VULNERABILITIES COULD LEAD TO EXPOSING THE DRIVER, THE VEHICLE OCCUPANTS OR ANY OTHER INDIVIDUAL OR VEHICLE WITH PROXIMITY TO THE AFFECTED VEHICLE TO A POTENTIAL RISK OF INJURY.

Repair Description:

CUSTOMERS AFFECTED BY THE RECALL WILL RECEIVE A USB DRIVE WHICH THEY MAY USE TO UPGRADE VEHICLE SOFTWARE, PROVIDING ADDITIONAL SECURITY FEATURES INDEPENDENT OF THE NETWORK-LEVEL MEASURES. ALTERNATELY, CUSTOMERS MAY VISIT HTTP://WWW.DRIVEUCONNECT.COM/SOFTWARE-UPDATE/ TO INPUT THEIR VEHICLE IDENTIFICATION NUMBERS (VINS) AND DETERMINE IF THEIR VEHICLES ARE INCLUDED IN THE RECALL. IF SO, THEY MAY DOWNLOAD THE SOFTWARE THEMSELVES, OR VISIT THEIR DEALERS, WHERE TECHNICIANS WILL PERFORM THE INSTALLATION. THERE IS NO CHARGE FOR THE SOFTWARE OR, IN THE CASE OF DEALER VISIT, INSTALLATION.

I'm getting a 404 on the update page [nevermind it's case sensitive and needs to be downcased]. Does anyone know if this update actually fixes the issue? From reading the exploit details it seems more like a systems design issue that can't easily be patched in software.

prothid• 11 years ago

Chrysler worked with the guys that discovered the vulnerability and no doubt simply patched the current known bug allowing exploit from the cellular uplink. The system could be vulnerable again if a new exploit is discovered. I updated my Jeep a week or so ago and haven't had any issues -- yet.

Edit: After reading the paper it looks like the update from Chrysler blocks inbound tcp/ip now, and Sprint is also filtering traffic more aggressively.

ChuckMcM3• 11 years ago

The sad thing for me, and I see this way too often, is that someone, somewhere, no doubt said "Of course its secure, you can only READ the CANbus, the software doesn't even HAVE a write capability!" and everyone in the room nodded and went on with the rest of the review.

Manufacturers and engineers have to get it through their head that IF you can change the firmware ANYONE can change the firmware. If the firmware is SECURITY CRITICAL then the only way to change it can be through physical presence, loading encrypted and and signed firmware, with external validation. (something like the car asking for a third party to authenticate the operation ala nuclear launch codes). You can still get screwed but it will be hard enough to do that otherwise low value targets will remain relatively safe.

csours• 11 years ago

And when manufacturers start doing that, people will complain that they don't "own" their cars anymore. [1]

1: http://boingboing.net/2015/05/21/gm-says-you-dont-own-your-c...

Disclaimer: I work for GM.

saulrh• 11 years ago

Keep a suitable private key for signing firmware in the car, locked in a secure box that can only be unlocked with two copies of the car's ignition keys? I'd call that sufficient security, but it'd also clearly allow me to get to the keys if I want.

matteotom• 11 years ago

There is probably a middle ground here. For example, lock it down like the parent comment suggested, but have a process to unlock it, requiring (for example) physical access and some vehicle specific file from the manufacturer requiring proof of ownership and a scary warning. (I believe some phone manufacturers had a similar process for unlocking bootloaders a while back.)

This would still allow enthusiasts and security researchers to "own" their vehicle and would keep malicious actors out (for the most part).

krasin2• 11 years ago

There's still the right and secure way to go:

1) By default the cat is "locked", and uses a manufacturer-issued public key to verify the signature of updates

2) A car owner can "unlock" the car, by creating a key pair, and asking the manufacturer to add / replace (debatable) the new public key to the car. Right after that, the owner has an ability to modify the firmware, but everything is still secure. And it's up to the adult owners to manage their private keys and be careful with updates.

3) There should be a simple way to factory-reset the car (with either the owner, or the manufacturer signature).

peterwwillis• 11 years ago

We (consumers) had to deal with that over 10 years ago. My old Lexus still has some kind of proprietary diagnostic system that only dealerships can access, and we get stuck with dinky ODB2. Did manufacturers suddenly start getting more transparent and compatible with their vehicle diagnostic and control systems?

Also: virtually every consumer in the world would choose safety from some 'evil hacker force' rather than the ability to maintain their factory entertainment system themselves. There's really zero reason the nav/entertainment system should be on the same communications network as the engine and brakes, anyway.

snowwrestler2• 11 years ago

Put a key on a piece of hardware and provide it with the car. The firmware will not update without that key. Now the owner can update their firmware, or hand the key to their mechanic to do it for them. If they lose the key, they get to pay their mechanic to source and install a new controller that comes with a new key.

Or heck, just put a switch on the controller that must be manually closed for a firmware update to proceed. What matters most is preventing quiet firmware updates over the air.

Qantourisc2• 11 years ago

You could for example hook up the radio to a CANbus that has a minifirewall/proxy in it, allowing only read from the radio and write/read to the radio.

PhasmaFelis• 11 years ago

I had thought the firmware already required physical presence to alter? As per the recall notice, Jeep is mailing everybody thumbdrives with updated firmware. That suggests that the hack doesn't require changing the firmware, but merely exploits what's already there.

mmozeiko• 11 years ago

Charlie and Chris modified V850 firmware that is connected to CAN bus to control devices on CAN bus. They flashed V850 firmware from main info/entertainment system that runs Linux on ARM board. Chrysler most likely is patching this main firmware. Linux on this ARM board was entry point for this attack - it is connected to WiFi, 3G and other stuff and it has/had dbus listening on 6667 port for all interfaces.

maxerickson• 11 years ago

They go into detail about how they flashed the controller in the paper, page 64.

pacquiao882• 11 years ago

They were able to remotely flash the firmware while the vehicle is being driven down the highway and there's not really anything the passengers can do while it's happening. They are able to control other components like the audio system without needing to flash anything.

dsuth4• 11 years ago

Regardless of the firmware question with the V850 module, I'm surprised that other modules on the CAN bus would accept commands from an entity that 'should' only have read access, without validation.

I'm not up to speed on CAN bus, but if it's not possible to secure it in this manner, then it cannot be considered an appropriate communications bus for safety-critical applications. Even the industrial guys are getting their heads around this with encrypted & validated signalling over ethernet.

mzs5• 11 years ago

CAN is a bus over a wire with no concept of source (or destination).

kevin_thibedeau• 11 years ago

CAN isn't really designed for security. The nodes don't even have addresses. They communicate using message IDs without regard to who the sender or responder is. The error detection requires a party line so that any node can flag a corrupt message and the data rate is too slow to make tunneling a secure stream practical.

jfim• 11 years ago

CAN bus isn't designed for security, it's designed to transmit bits in electrically noisy environments (such as a car) between embedded devices. It sends frames of up to 8 bytes, which is not even large enough to fit a TCP packet header.

sitkack2• 11 years ago

encryption is not the answer, physical read only circuits are the answer.

ChuckMcM3• 11 years ago

That is an answer, except consider the situation where a flaw is detected in the manufacturer's code. The cost to fix is to replace the entire chip. Which is fine, from a process standpoint, but these cars are going to be competing with other cars in the market and will have a higher "service cost" and that higher cost will dissuade people from buying (because historically less than 5% of the market is willing to pay a higher price for something that is "more secure").

So while I agree with you, unless it were federally mandated for all cars, the ones that didn't do it would have lower cost of ownership and get more buyers.

RealityVoid2• 11 years ago

I don't think that is easly done with CAN communication. You have a clock line and a data line. You don't have to drive the data line if you want to talk on it, you only have to pull down. So you can't simply not connect a wire (as in a Rx/Tx configuration) but you have to make the sillicon chip unable to Tx. This requires new sillicon chips, and even then I don't know how well they can pull it off. So this solution is far from trivial.

forgottenpass2• 11 years ago

If the firmware is SECURITY CRITICAL then the only way to change it can be through physical presence, loading encrypted and and signed firmware

Physical access? So, hypothetically another car gets hacked, but this time there is no middleman in position to implement a mitigation like Sprint was in this case. How do you suggest a firmware rollout happens? Recalls? Mailing thumbdrives to end users?

Over the last week I've seen the infosec community warmer to the idea of OTA updates and all that baggage that entails compared to the alternative ways to update car firmware. You're posting pretty authoritatively though, if you've got some analysis that the rest of us don't, I'd love to hear it.

hueving• 11 years ago

The basic idea is that this wouldn't have happened in the first place if it required physical access.

vessenes• 11 years ago

I have for some time felt that robot cars absolutely need a physical disconnect lever. Nice and big, break glass, and you're driving off the wire.

But, this hack reminds me that there's no such thing in a modern car; the whole thing is networked.

So, yeah, physical updates of firmware. Although, in the article, it's a subsystem's firmware, which physically protecting that is just not in the minds of engineers right now: think of all the ports you'd need.

Even if the physical kill switch left me with just (unpowered) steering and brakes, I would have a vastly different perspective on the safety inherent.

Qantourisc2• 11 years ago

In a lot of cars, this break-the-glass is still your ignition/car key. Big problems start when you have a "break-by-wire" model.

__david__• 11 years ago

"Of course its secure, you can only READ the CANbus, the software doesn't even HAVE a write capability!"

That can mean two things—either the software didn't implement writing but the hardware is capable of it, or the hardware isn't capable at all. Sounds like the former in this case. It should have been the latter.

retrogradeorbit2• 11 years ago

Vintage cars have never been more appealing!

Corrado• 11 years ago

This whole story reminds me of the Battlestar Galactica reboot a couple of years ago. The premise was that the shiny, new spaceships were all susceptible to hacking and virus injection while the old, "vintage" ones were unhackable.

jessaustin3• 11 years ago

From this point forward we should make very few assumptions about electronic systems.

I'll just leave these here: http://jalopnik.com/why-its-unlikely-someone-killed-michael-...

http://jalopnik.com/aols-story-about-terrorist-carhacking-is...

AgentME• 11 years ago

Those articles say that the idea of a remotely exploitable vulnerability in a car is ridiculous (therefore so is the murder idea), but is that not exactly what happened with Jeep here?

jessaustin3• 11 years ago

Yeah that was my point. There are always "experts" to be found who can't imagine a particular exploit working. Reality is not limited to some dude's imagination, so we should have read the initial articles for what they were: "nothing to see here, move along." If we knew then what we know now, such articles would have piqued our curiosity. Therefore, the fact that they were published does pique my curiosity.

wkcamp• 11 years ago

I'm sure many engineers overlook the "guy who knows a guy" situation. The whole car itself is one giant system that works in unison; practically everything in that car IS connected. Which obviously means everything is accessible one way or another. Isolation is not really isolation as isolation more than likely depends on something.

twrkit• 11 years ago

Has there been a consensus reached on whether or not this could have been a factor in the death of Michael Hastings? [0]

[0] https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)#...

retrogradeorbit2• 11 years ago

If you can hack a car like this, what about a Boeing?

ild• 11 years ago

God thanks bicycles, horses and hot air balloons don't have wireless yet.

exo762• 11 years ago

http://www.runwaygirlnetwork.com/2015/05/17/boeing-ife-exper...

joshu2• 11 years ago

They were able to control steering wheel

This seems unlikely.

akira2501• 11 years ago

Why?

https://en.wikipedia.org/wiki/Power_steering#Electric_system...

Plus, the vehicle can park for you. Clearly it has the raw hardware to allow for this.

joshu2• 11 years ago

Generally cars cannot control their steering. But obviously this one does have that ability. Interesting.

im3w1l• 11 years ago

Software can not be trusted. It is too complicated and people get things wrong.

If something really needs to be be read only, enforce it with physical diodes or similar.

satyajeet23• 11 years ago

Why would someone who knows how to use a computer want a Jeep?

rndmind• 11 years ago

I'm going to just ride my honda ruckus moped and forget buying a new car.

antoinealb• 11 years ago

A lot of automotive manufacturers are migrating to FlexRay (https://en.wikipedia.org/wiki/FlexRay) and Ethernet so hopefully they will use the extra bandwith to implement a bit more of message authentication to their protocol.

Black Hat USA 2015: The full story of how that Jeep was hacked

Related Stories