Vehicles Security Flaws Exposed in this year’s DEF CON

Security researchers presented their findings on the attacks that could happen for connected cars which could lead to improvements to protect the consumers in this year’s DEF CON. Chris Valasek and Charlie Miller, two of security researches who participated in the conference and known to discover security loophole in Jeep Cherokee, released their findings that is revolved around the car’s Uconnect infotainment system which is distributed by Harman.

Normally, the hackers will try to hack the display system which then if they are successful in hacking it, they will continue to access the more important and secure system. In this case, the hackers found an open port and as the process in the infotainment system is designed to execute code, they just need to inject a few lines of Python to give them root privileges.  After they have the root access, they are pretty much able to do anything to the firmware such as sending malicious instructions to the system which includes transmission and brakes. However, eventhough the hackers cannot access the firmware, they are still able to use the infotainment API to control the radio, wipers as well as track the car via GPS and even worse, they can do all this remotely.

As a result, 1.4 millions vehicles manufactured within three years of models in (FCA) line including 2014 Durango and 2013-2014 line of Ram pickups are recalled, the traffic on port 6667 was blocked as well as legislation was introduced by US Senator Edward Markey. Harman system announced that it is only affecting FCA vehicles as it is using older infotainment system. However, all these can only happen if they have physical access to the car ports first.

Another security researcher team, Marc Rogers and Kevin Mahaffey targeted on S, as they considered it as the most in the production currently. They tried to hack the infotainment system as a start. To their surprise, Tesla’s infotainment system is more secured than they thought it would be. While they were able to gain root access to it, they are able to perform actions as legitimately present in the API which includes altering speeds, unlocking and locking doors, opening windows as well as lowering and raising the suspension. They also discovered that the security token was a plain text.

Jeep Cherokee and Tesla handled the issue differently. Jeep Cherokee recalled the affected car models shortly before the conference eventhough the vulnerabilities were discovered months ago. Tesla on the other hand, sent representatives to the DEFCON and responded to the matter right after Rogers and Mahaffey done with their presentation. Tesla announced a bug bounty program through Bug Crowd for people to report bugs for the model and get awarded from it up to $10,000.


Samy Kamkar, another speaker in DEF CON, demonstrated vulnerabilities with some cars and garage RF’s system with a device named Rolljam. The device will jam the signal from reaching the car so that the owner is prompted to send another signal.  Rolljam will then save the second signal and playback the first signal to unlock the car. The second signal will be played back at a later date when the owner is not aware of it and it is can be done remotely.  However, this vulnerability has been solved years ago so there should not be any reason for the car owners to worry.

Josh Corman, a policy strategist who gives recommendation for the security of consumer goods observed that it took Microsoft 15 years to change its behavior from suing the hackers to working together with them to expose its product whereas the car industry does not have that much time. The automotive industry only has maximum 3 to 5 years time. On top of that, he also observed that security is always comes after the car design whereas security should be part of the initial design of the car.

Connected cars seems like not only an issue to America, but it is more to be an international issue. As the vehicle that we are going to have in the future is all connected therefore security is very important thing.  As connected cars also have their advantages, however, they do have vulnerabilities which are harder to solve as they are new. The best way is to allow the fix for the bug to be done by OTA (Over the Air) as it is simple, convenient and low cost and it should come as a free service to the car owners.

Print Friendly

Related posts: