Researchers reveal methods behind car hack at Defcon

They plan to release a research paper and all the custom tools they developed

Two security researchers at Defcon on Friday revealed the methods they used to hack into car computers and take over the steering, acceleration, brakes and other important functions.

Security researchers Charlie Miller (left) and Chris Valasek (right) explaining how they hacked into car computers
Security researchers Charlie Miller (left) and Chris Valasek (right) explaining how they hacked into car computers

Charlie Miller, a security engineer at Twitter, and Chris Valasek, director of security intelligence at IOActive, spent 10 months researching how they could hack into the network of embedded computer systems called electronic control units (ECUs) used in modern cars and see what they could do once they gained access to it.

Their test cars were a 2010 Ford Escape and a 2010 Toyota Prius.

Some of the things they were able to achieve by hooking a laptop to the ECU communications network and injecting rogue signals into it included disabling the brakes while the car was in motion, jerking the steering wheel, accelerating, killing the engine, yanking the seat belt, displaying bogus speedometer and fuel gauge readings, turning on and off the car's lights, and blasting the horn.

The researchers also found a way to achieve persistent attacks by modifying the ECU firmware to send rogue signals even when they were no longer physically connected to the control units.

A research paper explaining how the hacking was done was shared with Ford and Toyota a few weeks before the Defcon presentation, the researchers said.

Toyota responded that it didn't consider this to be car hacking and that the company's security efforts are focused on preventing remote attacks from outside the car, not those that involve physically accessing the control system, Miller and Valasek said.

The goal of the research was to see what could be done when hackers gain access to the ECU network, known as the controller area network bus, the researchers said. It doesn't matter if it's done locally or remotely; access to a single ECU provides access to the whole network and gives the ability to inject commands, they said.

Miller is certain that other researchers will find ways to remotely attack the systems in the future. The software industry hasn't figured out how to write secure software yet, so there's no reason to believe car makers have figured it out either, he said.

The code in systems that can be accessed remotely -- telematics units, tire sensors, those using Bluetooth and Wi-Fi -- might have a lot of vulnerabilities, he said. "I'm sure that if people start looking, they would will start finding vulnerabilities."

That's part of the reason Miller and Valasek decided to make the details of their research public, including what kind of equipment, cables and software they used.

The full research paper and the custom software tools that were written to interact with the ECUs, as well as the code used to inject particular commands, will be released this weekend, Miller said.

"We want other researchers to keep working on this; on other cars or on the same cars," Miller said. "It took us ten months to do this project, but if we had the tools that we have now, we would have done it in two months. We want to make it easy for everyone else to get involved in this kind of research."

Concerns that the tools could enable people to hack car systems for malicious purposes are valid, the researcher said. However, if it's that easy to do, then they could do it anyway; it would just take them a bit more time, he said.

"If the only thing that keeps our cars safe is that no one bothers to do this kind of research, then they're not really secure," Miller said. "I think it's better to lay it all out, find the problems and start talking about them."

However, fixing the issues won't be easy because most of them are there by design, according to Miller.

Car manufacturers won't be able to just issue a patch, the researcher said. "They'll have to change the way these systems are made."

Right now, there's no authentication when car computers communicate with each other, because they need to react and send signals quickly in potentially dangerous situations, the researcher said. Adding authentication will introduce latency, so the systems will need faster processors to make up for that. Those processors would cost more, so car prices would rise, he said.

Toyota Motor Sales and Ford Motor Co. in the U.S. did not immediately respond to requests for comments.

Join the PC World newsletter!

Error: Please check your email address.

Tags Ford Motor Companysecurityphysical securityAccess control and authenticationencryptiontwitterToyota Motor SalesExploits / vulnerabilitiesIOActive

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?