Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Transportation IT

Hacking a Car With Music 133

Posted by timothy from the lady-gaga's-secret-plan dept.
itwbennett writes "Researchers at the University of California, San Diego, and the University of Washington have identified a handful of ways a hacker could break into a car, including attacks over the car's Bluetooth and cellular network systems, or through malicious software in the diagnostic tools used in automotive repair shops. But their most interesting attack focused on the car stereo. By adding extra code to a digital music file, they were able to turn a song burned to CD into a Trojan horse. When played on the car's stereo, this song could alter the firmware of the car's stereo system, giving attackers an entry point to change other components on the car. This type of attack could be spread on file-sharing networks without arousing suspicion, they believe. 'It's hard to think of something more innocuous than a song,' said Stefan Savage, a professor at the University of California."
This discussion has been archived. No new comments can be posted.

Hacking a Car With Music More

Hacking a Car With Music

Comments Filter:
    • LOL, funniest part about that story:

      When the receiver downloads the attachment, the electrical current and molecular structure of the central processing unit is altered, causing it to blast apart like a large hand grenade

    • Re: (Score:1)

      by Tx-0 ( 572768 )
      Sometimes I'd wish it could be true: that would make people think twice before opening email attachments!
    • What a bizarre article. My first thought was "how old is this article?", because the computer have a 5.25" floppy drive and the screen is quite small, perhaps 13-14". So the computer is from the eighties, but then the article mentions amazon and ebay, so it cannot be that old.

  • Uh, what? (Score:5, Interesting)

    by gman003 ( 1693318 ) on Friday March 11, 2011 @11:02PM (#35460742)
    I can accept malicious data taking over the stereo system. That's believable. What I find impossible is going from there to the rest of the car. I installed my own stereo system - the only wires involved were power and output to the speakers. That's it. Unless they can find an exploit in a 12v battery, they literally cannot get to anything automotive.

    Maybe newer cars, where everything is "integrated", are different. In which case, I'm glad I bought a used '99 Talon rather than a brand-new anything.

    • Re:Uh, what? (Score:5, Informative)

      by Anonymous Coward on Friday March 11, 2011 @11:05PM (#35460776)

      Newer cars with integrated stereos hook them up to the car's CAN bus. From there all bets are off.

      • Re: (Score:1, Offtopic)

        by pitchpipe ( 708843 )
        I think that the attack would have to be very specific. Might work as a targeted attack, but as a general exploit it would probably run up against too many versions/variations in hardware/firmware/software.

        Offtopic: I love Republicans/Regressives! [regressives.com]

        • Re: (Score:3)

          by gomiam ( 587421 )
          Too many variations? Erm... Audi/Volkswagen/Seat use basically the same control software, for example, even if different revisions of it. And i'ts not like you can't put several attack vectors inside a 3-4MB file, right?

      • Re: (Score:3, Interesting)

        by MacGyver2210 ( 1053110 )

        Even from the CAN bus your largest attack would be messing with fuel economy. The communications on the CAN bus are usually quite secluded from any form of digital engine control.

        For example, the Oxygen and MAP sensors might broadcast on the CAN bus, and you may be able to spoof them so in the ECU it causes an engine light or bad fuel economy. Beyond that, the CAN bus is pretty much just information being sent about the status of things. There is usually no control taking place via those connections. All co

        • Re: (Score:1)

          by Anonymous Coward

          You are very wrong. You should read the posted paper.

          • Re: (Score:2)

            by kasperd ( 592156 )

            You should read the posted paper.

            It turns out that the links in the article don't actually take you to the paper. So, where is the paper? The article is too short on detail to find out what this is really about?

        • That's simply wrong. Lots of safety relevant systems, like ESP, communicate via CAN (or FlexRey in more modern cars). So, in theory, if you hijacked the whole bus you could pretty easily kill everyone inside the car. In praxis, however, it's not quite that simple. e.g. the bus driver of a FlexRay bus will electrically prevent sending any data outside of your designated timeslot, so you can't override data send by other ECUs. (Not to mention that the only place data from the entertainment system and from saf

      • Re:Uh, what? Nonsense! (Score:1)

        by Anonymous Coward

        My car - a toyota - has 2 can buses which are isolated. The stereo/satnav sits on one, vital systems sit on the other - never the twain shall meet. Sensationalist reporting as usual...

        • Your car will probably have a lot more then just two busses. It will probably even have ECUs that are conected to more then two busses. However, I'd guess that in theroy the network of ECUs and busses will be fully connected, e.g. most systems report data to the dashboard, so that will be a point where many busses will meet. (Not that this would help taking over the bus or safety relevant systems in any relevant way)

    • Re:Uh, what? (Score:4, Informative)

      by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Friday March 11, 2011 @11:06PM (#35460778) Homepage Journal

      Maybe newer cars, where everything is "integrated", are different. In which case, I'm glad I bought a used '99 Talon rather than a brand-new anything.

      If your car uses the CAN-bus for stereo controls, and has only a single CAN-bus, then yeah, you can probably hack the security, which is integrated into the PCM, from the stereo.

      • Re:Uh, what? (Score:4, Interesting)

        by MacGyver2210 ( 1053110 ) on Saturday March 12, 2011 @02:40AM (#35461800)

        I've never seen a keyless entry system connected to a CAN bus.

        I have in no way worked on all cars out there, but that would be what we with common sense call 'poor system design'.

        • In virtually all cases the factory security is integrated into or at least closely with the PCM so that it can control starting (or not) at the source. This is especially true when the car has a special key required for starting. The PCM is on the CAN bus. QED.

        • Newer VWs have the following things all on a single CAN bus (and there actually is a justification for it):

          Engine control unit
          Transmission control unit
          Anti-lock brakes/traction/stability control (and these can actually command the ECU to accelerate or decelerate)
          Instrument cluster (this one can command the ECU to shut down, if it thinks the car is stolen)
          Radio
          Climate control
          Central convenience module (handles remote locks, power windows, and things like that)
          Airbags
          Electric power steering

          So, the reason for

          • Re: (Score:2)

            by Enleth ( 947766 )

            And they actually share the address space without any network segmentation and routing? You know, CAN has something between a NAT and a network bridge - can't remember the term used by the spec right now - which was designed to allow controlled routing between parallel networks precisely for such things as this. I can't believe they wouldn't use that. For example, new Citroen C5s use such routing to separate vital and non-vital networking while allowing certain devices to communicate cross-network for reaso

            • Re: (Score:1)

              by Anonymous Coward

              And they actually share the address space without any network segmentation and routing? You know, CAN has something between a NAT and a network bridge - can't remember the term used by the spec right now.

              What is employes in most cars are CAN Gateways, which are able to route Messages between different Networks or even different Bus systems (think CAN/LIN gateway).
              On a single bus, the Messages (read: Packets) go to every device on the bus, where local acceptance filters decide whether to accept it or not. These filters are usually defined in Software so if I can take control of the Stereos CAN Stack, I am able to listen to every device on the Bus, as well as to mimic every other device. Since CAN Messages ha

            • And they actually share the address space without any network segmentation and routing?

              You mean like early computer networks? Network segmentation and routing isn't enough to keep you secure, so now we even have firewalling. A programmer who is CAN-savvy could probably make some money right now rolling a portable firewalling framework.

              • Re: (Score:2)

                by Enleth ( 947766 )

                The thing is, that those "gateways" can be smart and only allow certain packet types between certain senders and receivers. It is a kind of a very simple firewall, actually. In a C5, it most likely restricts communications only to those packets that were intended to be used by design, so it should let the airbag controller send a 112 request to the stereo, but not let the stereo deploy airbags spontaneously, even if the controller actualy does support triggering over CAN (I have no idea wether it does). I d

                • The thing is, that those "gateways" can be smart and only allow certain packet types between certain senders and receivers. It is a kind of a very simple firewall, actually.

                  Sure, that's the idea, but I don't think those gateways are very smart yet.

                  Thus, we have another good reason to use network separation, or at least signal-level repeaters immune to shorts and noise.

                  To my mind, it makes zero sense to use such an approach, and it makes more sense to simply have multiple CAN (or other) buses, and either actually route messages (with firewalling) inside the relevant module, or not use CAN in such a way. Cars are not yet so complicated that this will lead to a significant increase in cost. I DO anticipate that eventually every sensor will be a computer (really a microcontroller and as little else as

    • Re:Uh, what? (Score:4, Informative)

      by Osgeld ( 1900440 ) on Friday March 11, 2011 @11:08PM (#35460798)

      can bus

      http://en.wikipedia.org/wiki/Controller_area_network [wikipedia.org]

      course it all depends on what your car has in it, my 06 kia not a big deal as my stereo is not connected to it, much like you mention above, my mom's 2011 jeep on the other hand, you cant even unlock a door without talking on it

    • Re: (Score:1)

      by Anonymous Coward

      Yeah, it's for the more integrated systems I suppose. I had a few cars over the years that the factory deck held at least part of the "brains" too, so I couldn't just mash in any ol' after market unit.

      Especially at risk would be something like the Ford Sync systems. But, this CD with magic code method would require the ne'r do weller to be *in* the car, presumably with the ignition at least in ACC, to pull off. The bluetooth hacks are more ominous. If someone could send a malformed BT packet storm and pop t

      • Re: (Score:2)

        by jimicus ( 737525 )

        But, this CD with magic code method would require the ne'r do weller to be *in* the car, presumably with the ignition at least in ACC, to pull off.

        What TFA doesn't say is if the hacked music file was an MP3 (which many modern car stereos can play directly) or a plain audio CD. A hacked MP3 could be pushed out on a p2p network.

        Granted you'd need a bit of a perfect storm - someone who uses P2P to download the hacked MP3, to burn it direct to a CD for in-car listening and to have the exact model and revision of parts in their car necessary. I can't see it being terribly likely on its own.

      • Re: (Score:2)

        by kasperd ( 592156 )

        But, this CD with magic code

        Nice way to put it. I find it hard to believe that there could be a flaw in handling of uncompressed audio data that could be used to take control over the CD player in the first place. If we are talking about the standard stereo 16 bits per sample audio, then it is unlikely to have a flaw in the code to handle it for too reasons. It is ******* simple. There are no possibility of the code to handle it having forgotten to check for invalid inputs, as every possible combination of

    • Re: (Score:2)

      by jonwil ( 467024 )

      These days, car stereos are not car stereos, they are stereos + MP3 players + iPod docks + navigation systems + bluetooth car kits + emergency help systems and more.

      And a lot of this stuff needs to talk to the cars sensors and systems (e.g. these systems may require knowing how fast the car is going or the like)

    • It's not a big stretch to assume their electronics are designed by the lowest bidder.

      The fact that such a device would run arbitrary code from a music file, that tells me today's programmers really are as idiotic and useless as I assumed. It's music, decoded by some type of finite state machine. There is no dynamic execution, it should treat "trojan code" like any other bits in the input stream and play them as static noise, or skip them if the checksum fails. The decoder shouldn't even be capable of sma

      • The fact that such a device would run arbitrary code from a music file,

        It can't. There is *no possible way* that you can send a malicious audio track to mess about with the car's electronics. The article is totally on crack.

        What you can do on most cars with multiplexed (CANBus) electronics is put new firmware onto various systems from a CD. Rather than recall a batch of cars to do an update, you can just pop a CD in the post. It speeds things up at the workshop, too - when my van needed an update the guy from Mercedes was able to come out to me, but I dropped by the garage

    • Re: (Score:2)

      by camg188 ( 932324 )
      From the article:

      They found lots of ways to break in. In fact, attacks over Bluetooth, the cellular network, malicious music files and via the diagnostic tools used in dealerships were all possible, if difficult to pull off, Savage said. "The easiest way remains what we did in our first paper: Plug into the car and do it," he said.

      and

      Car hacking is "unlikely to happen in the future," said Tadayoshi Kohno, an assistant professor with the University of Washington who worked on the project. "But I think the a

    • My stereo is integrated with my navigation system. The nav system is (read only I hope, come on) able to get data from the EC, such as current speed. I suppose that is one path.

  • until you bump into the RIAA..

    Just make sure not to play the stereo loud enough for anybody to hear it.

    • OT / sig reply:

      Hey, what's the story about that craft? Was it ever reported? I can't find a report anywhere to satisfy my curiosity :P (assuming the tail number is N717T)

  • The x-files has come true... does anyone remember the episode where some cars got hacked/unlocked by a 'genius' with a special CD played in the stereo? I remember thinking man, these writers are stupid! ...

    • Re: (Score:1)

      by Anonymous Coward
      Actually it was a CD containing a "Kill Switch" (and the episode name) that was left the the laptop of a dead programmer. Of course Mulder loves 'stealing' evidence. The CD contained a virus designed to kill an AI; one that was built by said dead programmer. The song that was played was "Twilight Time". Though it basically just flashed the lights. Yes, I watched the 'X-Files' a FEW times.
    • silly, took these guys that long to watch the X-files episode? Lame!

  • This is a follow-up to http://www.autosec.org/pubs/cars-oakland2010.pdf [autosec.org] where they demonstrate various attacks of varying levels of danger from relatively innocuous (turn the horn on permanently) to kind of scary (disable brakes and power steering). In a talk, Stefan claimed to have the ability to remotely drive as well, i.e., steer/accelerate/brake.

    • Re:Attacks (Score:5, Informative)

      by StefanSavage ( 454543 ) on Friday March 11, 2011 @11:44PM (#35461004)

      > In a talk, Stefan claimed to have the ability to remotely drive as well, i.e., steer/accelerate/brake.
      I'd be surprised if you're not misremembering... both because we hadn't spoken publicly about concrete remote vulnerabilities before our NAS briefing and because some of this is not true. In particular, steering is not electrically intermediated on most cars (new electric cars aside) and we've never demonstrated acceleration control (engine start/shutdown, yes... acceleration no... although I'd be surprised if it wasn't possible).

      • I just wanted to chime in and say that my friends and I always found your talks and papers to be awesome. =) I attended your DOS backscatter talk (in the old AP&M building) when I was getting my Masters at UCSD. (I worked with Scott Baden, and Fran Berman a bit.)

      • Re: (Score:1)

        by import ( 40570 )

        Thanks for clearing that up, it was indeed not claimed. I believe you said you would be surprised if it wasn't possible.

  • That's it! (Score:3, Insightful)

    by celle ( 906675 ) on Saturday March 12, 2011 @12:03AM (#35461100)

    Back to the horse and buggy everyone.
    Or at least to pre '80s cars with a dumb ignition/electrical system instead of this newer butt-kissing junk.

    "The more they try to overtake the plumbing, the easier it is to stuff up the drain. "
    Scotty -- Star Trek III:The Search for Spock. (or was it "search for more money"?)

    • Re: (Score:3, Insightful)

      by billcopc ( 196330 )

      If consumers had any say in automobile design, we wouldn't have all this bullshit in the first place. They charge us thousands for a factory stereo worth less than an hundred. They sell us all these proprietary navigation systems that get trounced by an iPhone or Android. They oh-so-cleverly forget to put in a drain plug so you have to pay the dealer $150 for an oil change.

      Yeah, the auto industry is taking its cues from Wall Street: more bullshit = more money.

      • If consumers had any say in automobile design, we wouldn't have all this bullshit in the first place. They charge us thousands for a factory stereo worth less than an hundred. They sell us all these proprietary navigation systems that get trounced by an iPhone or Android. They oh-so-cleverly forget to put in a drain plug so you have to pay the dealer $150 for an oil change.

        Pfft. You're stuck in the 80s.

        My Nissan and my wife's Honda dealership both charge ~$24 for an oil change. I actually bought a lifetime

        • My Nissan and my wife's Honda dealership both charge ~$24 for an oil change. I actually bought a lifetime (for the ownership of the car) all-you-can-eat oil change plan (with Synthetic) for $400, which includes oil filters, air filters, etc.

          I think they dropped oil change prices as a loss leader to more costly stuff.

          But I've got you beat...My Subaru dealer gives me free every other oil changes (paid for ones are $25), and they recently sent me two $25 certificates for an "inconvenient" factory recall I had done while getting an oil change. While using one of these certificates for a $25 oil change, they handed me a promotional $35 gift card. I am MAKING money on oil changes.

          • Heh, that's hilarious.

            You're right, of course, about them wanting to keep you coming into the dealership hoping to get more expensive repairs made / keep a good relationship for buying a new car in 5 years, but one very nice thing about getting oil changes at the dealership is that they have records of all your oil changes, which are required for car warranties these days. We got a pretty good price on a 7 year bumper to bumper on my wife's Honda, so it all works out pretty well.

        • When I bought my new car (ten years ago), the sales guy was trying to hype up the "premium" factory stereo, so I popped in my own CD, pointed out the distorted mess coming out of the speakers, and turned it off. A week later, I tore all that crap out of my doors and dashboard, and replaced it with about $700 worth of aftermarket equipment (no subwoofer yet). Even though it was "cheap" gear, the difference was night-and-day.

          Full disclosure: I am an audiophile, as you had probably guessed, but I am also a h

      • If consumers had any say in automobile design, we wouldn't have all this bullshit in the first place. They charge us thousands for a factory stereo worth less than an hundred. They sell us all these proprietary navigation systems that get trounced by an iPhone or Android. They oh-so-cleverly forget to put in a drain plug so you have to pay the dealer $150 for an oil change.

        Yeah, the auto industry is taking its cues from Wall Street: more bullshit = more money.

        Careful there, you're sounding a bit too anticapitalist. Perhaps rethink your values. Or perhaps various lawsuits, tax audits, rumors, and accidents might occur.

        • Instead of suggesting that 'billcopc' was being anticapitalist when I think all that was intended was an emotional outburst, perhaps we should suggest that he has discovered an unfilled market niche and he should build his own cars to fill said niche. That way, it would be quite hard to accuse him of anticapitalism.

  • Great, so now Sony doesn't have to stop with rooting your PC, they can also root your car. All in the name of copy protection, natch!

  • I drive a car that's over 20 years old. It has no computers in it that could be hacked to do anything more harmful than cause me to have poor gas mileage.
    I could leave the keys laying on the hood in the parking lot of Walmart and no one would bother with it.

    I don't care about luxury, I care about a simple old car that will get me 5 miles a month to the grocery store twice a month.
    I care that it's old and simple enough that I can find someone besides a NASA scientist to work on it if it breaks.

    You want to d

    • So, how hard is it to access Slashdot on your Commodore 64?

      • Re: (Score:1)

        by Anonymous Coward

        http://jinx.etv.cx/media/contiki-eyecandy-slashdot-contiki.png

  • What kind of CD player is designed to do anything with what's on the cd other than run it through the D/A converters?

    Even if it's supposed to read CD-ROMs to get map/navigating info, wouldn't it treat it all as data rather than instructions?

    • MP3 decoders are common in CD players.
      Buffer overflow attacks are just one way to get a system to treat data as executable code.

  • used to work in Windows (Score:3, Interesting)

    by dltaylor ( 7510 ) on Saturday March 12, 2011 @01:08AM (#35461386)

    Microsoft Windows products have been known to scan media streams for executables, either deliberately (for installing gov't keyloggers, for example) or accidentally:

    http://www.iss.net/security_center/reference/vuln/RIFF_Codec_Overflow.htm [iss.net]

  • Please Do (Score:4, Funny)

    by dmomo ( 256005 ) on Saturday March 12, 2011 @01:15AM (#35461410)

    If it will disable bass boomers in my neighborhood.

  • Sounds like my AV receiver (Score:4, Interesting)

    by tlhIngan ( 30335 ) <slashdot@worf.ERDOSnet minus math_god> on Saturday March 12, 2011 @02:03AM (#35461602)

    After obtaining a service manual for my AV Receiver, firmware updates are done by using a CD player with digital out, and hooking it to the TOSlink input on the front.

    Put it in a special service mode, put a specially burned CD in the CD player, and hit play. The AV receiver grabs the firmware update information off the digital input.

    Presumably there's safeguards to ensure that the firmware is transferred correctly, as well as various sync signals to ensure that if you accidentally seeked at the beginning or the player skipped it would be detected.

    Probably not a simple modulated audio stream since that'll be quite slow.

    • 1. Terrible update design. Someone needs to be fired.

      2. Audio streams transmit (via normal CD) at 44.1kbps, with dual channel, for a total of about 88.2kbps. A healthy virus can take less than one kB to get started (about 1/5th of a second of audio)..

      • Looks like you missed the part about "service mode". Provided you have to physically flip a swich or press a series of buttons, it's perfectly safe - Unless the user decides to update with a virus cd that just -happens- to be signed and encrypted correctly, nothing will happen.
        And, if it's not in service mode, it should just play as bad data.

      • CD quality audio is 44.1 KHz, not kbps. As each audio sample is 16 bit wide, the total bit rate in a CD audio stream is 1411.2kbps (44.1 * 2 channels * 16).

  • Well, it appears closed source and copyrights have yet gotten me one step closer to being able to do just that.

  • Explain (Score:3)

    by Fizzl ( 209397 ) <`ten.lzzif' `ta' `lzzif'> on Saturday March 12, 2011 @04:26AM (#35462250) Homepage Journal

    ... car's stereo system, giving attackers an entry point to change other components on the car...

    Explain?
    Wtf? This is just silly.

  • http://en.wikipedia.org/wiki/Namcub [wikipedia.org]
    How long does it take before there is a hotkey combination for Emacs? And until it is applicable to humans?

  • hack a bicycle

    silly cagers

  • Yeah I love rocking out to the sounds of, what sounds to me like white noise and bursts of random screeching. Just because you COULD run this hack doesn't mean it is in any way plausible.

  • Why is everyone so easily convinced that Toyota's problems are "user error"?

    Well, it makes me wonder that, anyway.

    Slightly offtopic, I guess. Oh well.

  • a few weeks back there was this story of a kid who was told by ford that he had infected his parent's car stereo with a virus by playing a pirated mp3 through his ipod.

    http://www.reddit.com/r/technology/comments/fj04r/reddit_the_dealership_told_me_that_pirated_music/ [reddit.com]

    apparently there was a kernel of truth in that mechanic's bullsht.

  • And I won't be trusting a word of it.

    "In fact, attacks over Bluetooth, the cellular network [...]"

    Shit, I can barely get my headphones to work properly with my phone in my pocket when I'm out jogging. How the hell do I get it to go 25km to the base station?

Slashdot Top Deals

"I got everybody to pay up front...then I blew up their planet." "Now why didn't I think of that?" -- Post Bros. Comics

Close