Researchers reveal methods behind car hack at Defcon

They plan to release a research paper and all the custom tools they developed

Two security researchers at Defcon on Friday revealed the methods they used to hack into car computers and take over the steering, acceleration, brakes and other important functions.

Security researchers Charlie Miller (left) and Chris Valasek (right) explaining how they hacked into car computers
Security researchers Charlie Miller (left) and Chris Valasek (right) explaining how they hacked into car computers

Charlie Miller, a security engineer at Twitter, and Chris Valasek, director of security intelligence at IOActive, spent 10 months researching how they could hack into the network of embedded computer systems called electronic control units (ECUs) used in modern cars and see what they could do once they gained access to it.

Their test cars were a 2010 Ford Escape and a 2010 Toyota Prius.

Some of the things they were able to achieve by hooking a laptop to the ECU communications network and injecting rogue signals into it included disabling the brakes while the car was in motion, jerking the steering wheel, accelerating, killing the engine, yanking the seat belt, displaying bogus speedometer and fuel gauge readings, turning on and off the car's lights, and blasting the horn.

The researchers also found a way to achieve persistent attacks by modifying the ECU firmware to send rogue signals even when they were no longer physically connected to the control units.

A research paper explaining how the hacking was done was shared with Ford and Toyota a few weeks before the Defcon presentation, the researchers said.

Toyota responded that it didn't consider this to be car hacking and that the company's security efforts are focused on preventing remote attacks from outside the car, not those that involve physically accessing the control system, Miller and Valasek said.

The goal of the research was to see what could be done when hackers gain access to the ECU network, known as the controller area network bus, the researchers said. It doesn't matter if it's done locally or remotely; access to a single ECU provides access to the whole network and gives the ability to inject commands, they said.

Miller is certain that other researchers will find ways to remotely attack the systems in the future. The software industry hasn't figured out how to write secure software yet, so there's no reason to believe car makers have figured it out either, he said.

The code in systems that can be accessed remotely -- telematics units, tire sensors, those using Bluetooth and Wi-Fi -- might have a lot of vulnerabilities, he said. "I'm sure that if people start looking, they would will start finding vulnerabilities."

That's part of the reason Miller and Valasek decided to make the details of their research public, including what kind of equipment, cables and software they used.

The full research paper and the custom software tools that were written to interact with the ECUs, as well as the code used to inject particular commands, will be released this weekend, Miller said.

"We want other researchers to keep working on this; on other cars or on the same cars," Miller said. "It took us ten months to do this project, but if we had the tools that we have now, we would have done it in two months. We want to make it easy for everyone else to get involved in this kind of research."

Concerns that the tools could enable people to hack car systems for malicious purposes are valid, the researcher said. However, if it's that easy to do, then they could do it anyway; it would just take them a bit more time, he said.

"If the only thing that keeps our cars safe is that no one bothers to do this kind of research, then they're not really secure," Miller said. "I think it's better to lay it all out, find the problems and start talking about them."

However, fixing the issues won't be easy because most of them are there by design, according to Miller.

Car manufacturers won't be able to just issue a patch, the researcher said. "They'll have to change the way these systems are made."

Right now, there's no authentication when car computers communicate with each other, because they need to react and send signals quickly in potentially dangerous situations, the researcher said. Adding authentication will introduce latency, so the systems will need faster processors to make up for that. Those processors would cost more, so car prices would rise, he said.

Toyota Motor Sales and Ford Motor Co. in the U.S. did not immediately respond to requests for comments.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Ford Motor Companysecurityphysical securityAccess control and authenticationencryptiontwitterToyota Motor SalesExploits / vulnerabilitiesIOActive

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?