4

Engineers and tech people like Craig Smith (who made a great book about hacking cars) never stop warning about car security. Saying that modern cars ain't secure and can be hacked from the outside (cellular) and eventually be controlled.

If a hacker is able to connect to the car via cellular, he will be connected to the infotainment system right ?

So this means that the infotainment console of those cars are directly connected to every single node/ECU of the car (comfort, body and engine) ?

It seems weird to me because on the car I own (without cellular), the infotainment system isn't connected to every ECU. If I want to control the body, I have to find wires that are connected to it, same for the comfort and engine. But none of them are linked together.

Can someone clarify this please ?

Many thanks in advance.

  • What car do you own that you are referring to? – Milison May 12 '18 at 22:45
  • 2
    Cars use what is called a CAN bus, which has no security whatsoever, so once you are in the system you can do anything you want. – Moab May 12 '18 at 23:05
  • Welcome to Motor Vehicle Maintenance & Repair! – Pᴀᴜʟsᴛᴇʀ2 May 12 '18 at 23:54
  • Thanks for your comments, I'm testing car hacking on a Toyota Hilux (2016) and a Lexus RX300. I actually know that CAN has no security itself but what I mean is : are there cars that have an infotainment system which has the main CAN buses linked together to it (engine+body+comfort) ? It seems to be the case when they hack the new Jeep from the outside (youtube.com/watch?v=MK0SrxBC1xs) because he apparently does not need anything else ? – Lawris May 13 '18 at 5:50
  • We have a few questions on this on Security Stack Exchange, and I have had Ken Munro keynote two years running at B-Sides Scotland: youtube.com/channel/UCFDj38U1zEPeIPvtZpA--Hg – Rory Alsop May 13 '18 at 21:06
4

In an ideal world, you are right, the entertainment system should be entirely separate from engine management, navigation, locks, immobiliser etc.

But the world isn't ideal, and many decisions are made not by security teams, but by management, marketing or technology teams who may be tasked with cost reduction, implementation timing etc.

So some cars have unsecured or poorly secured entertainment systems that can then be used to propagate an attack to other systems, and in some cases this could be used to disable security systems, compromise navigation data, shut down the engine, or potentially to steer more modern cars.

This is obviously being looked at by many car manufacturers, as people like Ken Munro at Pen Test Partners and others are having significant success in demonstrating weaknesses.

  • Thanks for the clarification, it seems that cars are at the same point where computers were so unsecure back in time. We will maybe have to wait some car accidents caused by hacking before car manufacturers start to consider upgrading their systems... – Lawris May 16 '18 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.