Skip Links

Researchers reveal methods behind car hack at Defcon

They plan to release a research paper and all the custom tools they developed

By Lucian Constantin, IDG News Service
August 03, 2013 01:50 PM ET

IDG News Service - Two security researchers at Defcon on Friday revealed the methods they used to hack into car computers and take over the steering, acceleration, breaks and other important functions.

Charlie Miller, a security engineer at Twitter, and Chris Valasek, director of security intelligence at IOActive, spent 10 months researching how they could hack into the network of embedded computer systems called electronic control units (ECUs) used in modern cars and see what they could do once they gained access to it.

Their test cars were a 2010 Ford Escape and a 2010 Toyota Prius.

Some of the things they were able to achieve by hooking a laptop to the ECU communications network and injecting rogue signals into it included disabling the breaks while the car was in motion, jerking the steering wheel, accelerating, killing the engine, yanking the seat belt, displaying bogus speedometer and fuel gauge readings, turning on and off the car's lights, and blasting the horn.

The researchers also found a way to achieve persistent attacks by modifying the ECU firmware to send rogue signals even when they were no longer physically connected to the control units.

A research paper explaining how the hacking was done was shared with Ford and Toyota a few weeks before the Defcon presentation, the researchers said.

Toyota responded that it didn't consider this to be car hacking and that the company's security efforts are focused on preventing remote attacks from outside the car, not those that involve physically accessing the control system, Miller and Valasek said.

The goal of the research was to see what could be done when hackers gain access to the ECU network, known as the controller area network bus, the researchers said. It doesn't matter if it's done locally or remotely; access to a single ECU provides access to the whole network and gives the ability to inject commands, they said.

Miller is certain that other researchers will find ways to remotely attack the systems in the future. The software industry hasn't figured out how to write secure software yet, so there's no reason to believe car makers have figured it out either, he said.

The code in systems that can be accessed remotely -- telematics units, tire sensors, those using Bluetooth and Wi-Fi -- might have a lot of vulnerabilities, he said. "I'm sure that if people start looking, they would will start finding vulnerabilities."

That's part of the reason Miller and Valasek decided to make the details of their research public, including what kind of equipment, cables and software they used.

The full research paper and the custom software tools that were written to interact with the ECUs, as well as the code used to inject particular commands, will be released this weekend, Miller said.

"We want other researchers to keep working on this; on other cars or on the same cars," Miller said. "It took us ten months to do this project, but if we had the tools that we have now, we would have done it in two months. We want to make it easy for everyone else to get involved in this kind of research."

Our Commenting Policies
Latest News
rssRss Feed
View more Latest News