Hacking industrial vehicles from the internet

http://jcarlosnorte.com/security/2016/03/06/hacking-tachographs-from-the-internets.html

by akavel • 10 years ago

152 46 10 years ago

tt442• 10 years ago

Is it really even considered hacking if there is no security at all?

lowglow• 10 years ago

I'd say hacking is a lot about discovery, manipulation, and exploitation, but not necessarily fundamentally about security alone.

tt442• 10 years ago

Seems to just be using the device in its intended manner, but perhaps it wasn't "intended" for random people on the internet to be accessing an open telnet service on the default port on a system connected directly to the public internet.

malka• 10 years ago

Given the Aaron Swartz case, I would say yes.

brokenWindows• 10 years ago

The knee-jerk, canned response from most parties erring on the side of Law & Order claims:

  Even if the door is wide left open, crossing the threshold 
  is still trespassing, if you don't belong on the property.

This is why burglars are typically charged with breaking AND entering.

Unlawful entry is still a crime one can commit, without breaking open, or otherwise circumventing pro-active security measures.

When it comes to the idea of "hacking" we often find our words fail to describe activities with precision.

The nuanced distinction some tend to draw between "hacking" and "cracking" is mostly relegated to specialized jargon, community slang, and pedantry. Laymen often do not distinguish between the two.

erikpukinskis• 10 years ago

I can't find any reference to "unlawful entry" in the law books. There is a Kurt Russell film by that name though.

Trespassing is an actual crime, but it does not fit your description, at least in California. Here, you must have an intent to interfere with the owner's property for it to be considered trespassing. If I enter your open door because I want to invite you to a party, or use your restroom, or hang out with your cats and play video games until you come home I have not committed any crime. Well maybe you could get me for stealing water and electricity, but the entry is not a crime.

"Breaking and entering" is also not a crime in California. However, if you actually steal something that is burglary, which is a crime, and does not require forced entry.

kriro• 10 years ago

A lot of this insecure IoT/vehicle etc. like stuff reminds me a bit of the early days of phreaking. Discovering "secret numbers", using open conference lines and the like. I think mere discovery is in the spirit of hacking since I'd define it as "curious exploration".

jacquesm6• 10 years ago

Is this supposed to be a poster example of irresponsible disclosure?

chatmasta3• 10 years ago

Yeah, you really have to wonder if this guy even exists or is just an alias. Because how could anyone be this openly reckless?

tcdent• 10 years ago

The people that produce blatantly poor products like this are the only ones to blame.

wepple• 10 years ago

I'd hazard a guess that unless the vendor can provide over-the-air updates and every system which plugs into these telematics units can also be easily upgradeable to incorporate the new added auth functionality, it might be better just to make everyone aware of the issue?

Ultimately this blog post doesn't describe any rocket science at all: anyone wanting to cause trouble on the internet is well aware of Shodanning for exposed ICS systems that fail to even implement authentication.

jacquesm6• 10 years ago

I'd be pretty wary of pushing information like this out in the open without first making sure the vendor had time to alert their customers that his is about to hit the streets. Who knows what kind of vehicles we're talking about and under what conditions they operate. Of course it isn't rocket science, but that doesn't mean you need to advance your stature in the security community by blindsiding some manufacturer on Sunday evening.

Anyway, call me old-fashioned, I don't think this is the way it should be done.

FWIW I'm aware of a SCADA system that is widely deployed that is just about as secure as this system here and I'd be the last person on the planet to publish the details of it because I know for a fact that it is used to control HVAC equipment and other building infrastructure in hospitals and prisons. These things are not toys and being aware of them does not actually allow you to play god. (In that particular case as far as I know the systems are so old that fixing them with an update is not even an option).

draven• 10 years ago

unless the vendor can provide over-the-air updates

http://www.neweagle.net/ProductDocumentation/Telematics/Tele... mentions "Remote Flashing" so I guess they fix that.

adamson• 10 years ago

Yeah, this is kind of ridiculous. You can go from skimming the article to tracking vehicles in 30 seconds...

dfc• 10 years ago

What was "disclosed"? The page simply demonstrates some of the remote administrative features of these units.

qjighap• 10 years ago

I am hoping this an advisory for those implementing these devices. The device does what it should by publishing everything that it is setup to do. It is leaking information everywhere as designed. There are a lot of things such as public transit that you want this information being broadcast everywhere. You could write the same story for an FTP server with an open connection to the internet.

pbhjpbhj3• 10 years ago

What should be interesting is to see that now the company(s?) producing them must now about this new interest in the details of their devices whether they have contacted all their clients today to warn them of potential issues.

I'm going to go with "no". Companies that admit their failings to their customers are probably pretty rare, particularly "companies that will fail to attempt to secure their computer systems but will actively engage their customers when an issue becomes the focus of unwanted attention" must be close to zero in number.

jacquesm6• 10 years ago

Agreed, but I would not actually be surprised if they did not learn anything yet. The embedded hardware world is not quite as well connected in that sense as the web start-up scene. It could take a few days before the circle of the people that know about this and the circle of the people involved in that company intersect.

andrewchambers2• 10 years ago

I think the companies that make this junk need to be held accountable or else it will keep happening.

mirimir3• 10 years ago

Right, this is what class tort actions are for.

majcherek128• 10 years ago

No! It's the companies who buys and USE this crap, even when they are configuring the devices and see that they cannot protect them, that needs to be held accountable.

It's like buying a bus with broken brakes, and still use it as public transportation. Nothing wrong with buying the bus.

andrewchambers2• 10 years ago

Its like a company selling a bus with broken brakes, not telling the customer it is broken and then the customer either knowingly or unknowingly use it after working that out for themselves.

Vintila• 10 years ago

At least their product page doesn't have some marketing wank about their security. In fact it has no mention of security whatsoever, which is apt because it doesn't seem to have any!

mirimir3• 10 years ago

There's nothing "new" at http://www.mobile-devices.com/news-and-prs/, either.

nekinie• 10 years ago

This is reckless for the manufactures and operators involved, the manor this information was released was also reckless. Poor show all round.

31reasons• 10 years ago

Just like FDA we need public or private organization that certify all IoT devices for their internet security level.

wereHamster2• 10 years ago

I.P. address

That's a novel way to abbreviate Internet Protocol address.

niij• 10 years ago

I'll bite. What's the problem with his abbreviation?

wereHamster2• 10 years ago

Did I say there was a problem? I just said novel. As in: From Old French novel ‎(“new, fresh, recent, recently made or done, strange, rare”) (modern nouvel), from Latin novellus ‎(“new, fresh, young, modern”), diminutive of novus ‎(“new”).

More towards the meaning of strange, rare rather than young, modern. Google automatically corrects "I.P. address" to "IP address", so I can't easily say how much more widespread the second spelling is. But I bet is a lot more.

miahi• 10 years ago

There is a way to secure this kind of devices. The mobile data providers can offer VPN services for customer devices, so they could be "hidden" from the Internet an the network level, without changing their configuration.

Hacking industrial vehicles from the internet

Related Stories