Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Communications Privacy Transportation Wireless Networking Technology

Volkswagen, Audi Cars Vulnerable To Remote Hacking (bleepingcomputer.com) 75

Posted by BeauHD from the remote-control dept.
An anonymous reader writes: "A Dutch cyber-security firm has discovered that in-vehicle infotainment (IVI) systems deployed with some car models from the Volkswagen Group are vulnerable to remote hacking," reports Bleeping Computer. The vulnerabilities have been successfully tested and verified on Volkswagen Golf GTE and Audi A3 Sportback e-tron models. Researchers say they were able to hack the cars via both WiFi (remote vector) and USB (local vector) connections. Researchers hinted they could have also went after the cars' braking and acceleration system, but stopped due to fear of breaking VW's intellectual property on those systems.

"Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history," Computest researchers said in their paper. "Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time," researchers added. VW deployed patches.
This discussion has been archived. No new comments can be posted.

Volkswagen, Audi Cars Vulnerable To Remote Hacking More

Volkswagen, Audi Cars Vulnerable To Remote Hacking

Comments Filter:

  • Is this still QNX/Blackberry? (Score:1)

    by Anonymous Coward

    Those infotainment systems were once made by QNX under Harman Becker, now owned by Blackberry. I bet they're still doing them. This is actually surprising to me, as QNX is known for better work than that. If these car companies switched to a different dashboard maker, QNX should jump in at the marketing opportunity.

    • Other than a feed of +12V, a signal line from the steering wheel controls, ground, and maybe a data signal from a rear-view camera, why does the "infotainment" system need to talk to the rest of the car at all?

      • Re: (Score:2)

        by ELCouz ( 1338259 )
        HVAC controls and stuff... never been in a recent car lately eh?

        • VW products generally have separate (knob) HVAC controls, not the integrated junk that many other manufactures have stuck their customers with.

          I've been in new cars -- driving them has mostly made me want to beat the hell out of some of the people that engineered them.

          • Re: (Score:3)

            by mjwx ( 966435 )

            VW products generally have separate (knob) HVAC controls, not the integrated junk that many other manufactures have stuck their customers with.

            As do BMWs, Toyotas, Mercedes, Hondas Jaguars (that is pronounced Jag-U-ar, if we called it Jagwar, we'd spell it that way), in fact most new cars retain physical knobs, switches and buttons for the HVAC, Radio and other things you use on the move. Most British, Asian and German manufacturers do, its only the Americans who think different (OK, I haven't driven a new French car and frankly, never plan to). Journalists call this a "dated interior" though.

            Only crappy manufacturers have swallowed the touchsc

            • Re: Is this still QNX/Blackberry? (Score:1)

              by Anonymous Coward

              Thanks to your snobbery in regards to pronunciation Americans now pronounce Jaguar like "jaggy wire."

              I can't even begin to tell you how much I hate you now.

              • Re: (Score:2)

                by mjwx ( 966435 )

                Thanks to your snobbery in regards to pronunciation Americans now pronounce Jaguar like "jaggy wire."

                I can't even begin to tell you how much I hate you now.

                Good, let your hate teach you how to pronounce Jaguar properly.

                I on the other hand with smirk with mild amusement and drink tea. Toodle pipsky.

      • The access of the infotainment system to other parts of the car is very restricted. It is absolutely not unexpected that someone breaks into the infotainment system, but they should not get further from there. These researchers have not even tried, so this article is just sensational.

      • Why do you think it's called an "info" tainment instead of "entertainment" system? Because is displays a random wikipedia page on startup?

      • Re:Is this still QNX/Blackberry? (Score:5, Insightful)

        by clodney ( 778910 ) on Tuesday May 01, 2018 @08:45AM (#56535537)

        Other than a feed of +12V, a signal line from the steering wheel controls, ground, and maybe a data signal from a rear-view camera, why does the "infotainment" system need to talk to the rest of the car at all?

        The most pragmatic reason is that wiring harnesses in cars are complex and expensive, and replacing a bunch of point to point wires with a data bus makes the car cheaper and easier to build. And once you have everything connected to a data bus, why not put the UI for many of those items on the thing with the biggest display and most available controls, like the infotainment system.

        And my car has lots of settings that you may not think are worthwhile, but that I appreciate. Like to unlock all 4 doors when I touch the door handle, and to fold in the mirrors when I park. Things that may not be everyone's preference, but I like my bells and whistles.

        My car has multiple cameras, and when the car is in reverse it shows me the rear view camera - so it needs to know transmission indicators. And it automatically turns off the cameras when I reach a certain forward speed, so it needs to know the speedometer reading. And since it has no physical gauges on the dash, the whole driver display is nothing but an LCD screen, so it needs to know speed, RPM, gas gauge, temperature, cruise control settings, etc.

        Maybe not to your taste, but definitely to mine.

        • Between your description of these bells and whistles and my time working at the car wash, I gather you drive a Chevy. I can confirm for you each bell and each whistle will be broken about the time of next year's model. Although I consider the temperature controls broken to begin with, even the physical ones they still use in some models. They simply don't measure up to old fashioned knobs in tactile feedback, speed, or precision of operation.

    • Re: (Score:3)

      by jrumney ( 197329 )
      QNX is an operating system. It may provide the fundamentals required to secure the system, but it doesn't magically make the software running on top of it secure.

      But nothing that they accomplished supports the outlandish claim that they could have messed with the brakes, "but stopped due to fear of breaking VWs intellectual property on those systems." If they reverse engineered the the Wifi and USB protocols for controlling the unit, they have likely "broken VWs intellectual property" already, but acces

      • the outlandish claim that they could have messed with the brakes, "but stopped due to fear of breaking VWs intellectual property on those systems."

        Yeah that's the nonsense quote of the week.

        • I assure you that the black hats are mighty worried about the GDPR at the moment, and are far to distracted to mess with VW's intellectual property.

          Meanwhile, I will continue to use my mechanically injected diesel - plenty of black smoke and no NOx.

  • The address book? TF? (Score:1)

    by Anonymous Coward

    "Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history,"

    Why in the fuck does the car have an "address book" or a microphone?

    My 1999 Ford gets me around just fine without a microphone or an address book.

    What's next? A video camera pointed at the driver so people can take selfies and live stream themselves while they drive around? An in-dash scrolling facebook update for the addicts?

    Has the world gone totally crazy now?

    • Re: (Score:2)

      by jonwil ( 467024 )

      Many people happen to like the fact that you can link your phone to your car via Bluetooth and then make completly hands-free phone calls.

      • Re: (Score:1)

        by Anonymous Coward

        Many people like meth. Doesn't make it a good idea.

        Hang up and drive.

      • Doesn't need an address book if the interface is properly designed. It should just pass a command: "call John Smith" or "call 202-555-1212" to the phone itself. No need to save any data in the car itself.
      • I do just that - but I do NOT need to share my address book and other stuff with my car. Just pair versus Bluetooth so I can use the car's microphone and speakers during calls. Nothing else needs to be exchanged to make it work.

    • Re: (Score:2)

      by haruchai ( 17472 )

      "A video camera pointed at the driver so people can take selfies and live stream themselves while they drive around?"

      The car's AI may also use such a camera to detect if the driver is conscious, alert or impaired

  • They could? They could have tried (Score:3)

    by Zorpheus ( 857617 ) on Monday April 30, 2018 @07:12PM (#56533719)
    The brake system is pretty well secured from the infotainment system, exactly because infotaintment systems are often not 100% secure.
    They could have tried to go after the brake system, but I doubt they would have been successful.
    • So the headline is sensational rubbish btw.

    • Re:They could? They could have tried (Score:4, Interesting)

      by Gravis Zero ( 934156 ) on Monday April 30, 2018 @08:09PM (#56533965)

      The brake system is pretty well secured from the infotainment system, exactly because infotaintment systems are often not 100% secure.

      Actually, critical systems like brakes are on a separate CAN bus than the normal crap to prevent a DoS attack from making you crash. However, both CAN busses are connected to the ECU. Hacking an ECU via CAN bus [illmatics.com] isn't a new trick.

      They could have tried to go after the brake system, but I doubt they would have been successful.

      They aren't blackhats, so attacking the ECU was never their objective. Instead, they successfully demonstrated significant vulnerabilities in the wireless systems which could enable remote attacks.

      • Of course there have been holes in the CAM bus separation of cars before, but they can't just assume that there is one. The entertainment system is not assumed to be safe, the CAN bus separation is. These guys have not achieved anything that is not planned for.

        • The point wasn't to impress you by wrecking the car, it was the compromise the security of the car's computer network which is exactly what was done. Stop moving the goal posts.

          • Who placed that goal post?
          • It's just that I had extensive discussions in Germany years ago, where everyone agreed that Wifi on cars is a security risk,especially since these systems are rarely patched. And the conclusion was that it is not an issue because of the CAN bus separation, although there were some issues with that found and fixed. This was before this topic even came up here.

  • Shielded from harm (Score:5, Funny)

    by Waffle Iron ( 339739 ) on Monday April 30, 2018 @08:29PM (#56534043)

    Researchers hinted they could have also went after the cars' braking and acceleration system, but stopped due to fear of breaking VW's intellectual property on those systems.

    This is yet another example of how strong IP laws can help to protect a nations' citizens from evildoers.

    • Re: (Score:2)

      by mjwx ( 966435 )

      Researchers hinted they could have also went after the cars' braking and acceleration system, but stopped due to fear of breaking VW's intellectual property on those systems.

      This is yet another example of how strong IP laws can help to protect a nations' citizens from evildoers.

      Yes, hardened criminals intent on stealing your car will be stopped dead in their tracks by our onerous IP laws. Score one for the good guys.

  • If you are plugging in a USB you probably know exactly where the car is already, also you would have a general idea if it's in WiFi range.

    • Re: (Score:2)

      by sinij ( 911942 )
      WiFi range is a big deal. This could be anyone in an unmarked van 30 meters (or more if they use directional antenna) in front of you on a busy highway that could potentially force your car to slam on the brakes just as you entering a corner, forcing a skid and a general life-threatening wreck.
      • Yes, I agree. All those bad things are very bad. (If true, they didn't try the brakes). But 'being able to tell where the car is' was specifically highlighted in the summary, that's clearly not in the same league.

        • Re: (Score:2)

          by sinij ( 911942 )
          Expecting journalists to accurately report on technology-intensive topics was empirically shown to be unreasonable.

          As Charlie Miller and Chris Valasek showed with their work culminating in sensational remote hacking of a Jeep Cherokee driven by a volunteering journalist, the key issue is that hackable infotainment units are capable of impacting other systems on the car's CAN bus. See Remote Exploitation of an Unaltered Passenger Vehicle [ioactive.com] for details.

          That was a known issue in 2015. There is simply no excuse
          • That's all well and good. But it's not what happened here. And has nothing to do with what I mentioned. Specifically sensationalizing things in the summary that are not that a big of a deal.
            Is it possibly because they didn't have an actual big deal, but still desperately needed people to read their report?
  • .. to make them emissions compliant?

  • "they could have also went after" (Score:2, Insightful)

    by Anonymous Coward

    "they could have also GONE after", I think you'll find...

Slashdot Top Deals

You know you've landed gear-up when it takes full power to taxi.

Close