It’s been a busy summer for automotive hackers, and the latest development is bad news for luxury-car owners: Good-guy digital security researcher Samy Kamkar just revealed that BMW, Mercedes-Benz, Chrysler, and aftermarket Viper connected-car systems are all theoretically vulnerable to the same hack that allowed him to remotely control functions in OnStar-equipped vehicles.
-Wired reports that Kamkar has found a security flaw in four automotive iOS apps that allow car owners to remotely unlock their cars using their smartphones: BMW Remote, Mercedes-Benz mbrace, Chrysler Uconnect, and the aftermarket alarm system Viper Smartstart. “If you’re using any of these four apps, I can automatically get all of your login information and then indefinitely authenticate as you,” Kamkar told Wired. “Those apps give me different levels of control of your car. But they all give me some amount of control.”
-Taking advantage of the vulnerability is admittedly complicated. As we reported when Kamkar first exploited the security flaw on an OnStar-equipped vehicle, the exploit involves planting a small, home-built device on the target vehicle. The black box, shown above, intercepts the signal from a vulnerable connected-car iOS app, sending the car owner’s login info to the hacker through a built-in cellular connection. From that point on, the hacker can do everything the car’s owner can do through OnStar or the affected iOS app—including locating and GPS-tracking the affected vehicle, locking or unlocking the car, or remotely starting the affected BMW, Mercedes-Benz, or OnStar vehicle (although it’s unlikely that the car cannot be driven away without sensing the driver’s key inside the vehicle).
--
- -
- Hacker’s Small Device Enables Remote OnStar Access, GM Releases Fix
- -
- Security Researcher Builds $30 Device to Unlock Nearly Any Keyless-Entry Car
- -
- Fiat-Chrysler Recalls 1.4 Million Vehicles Over Remote Hacking Concerns
- -
-
While Kamkar was able to demonstrate the original OnStar hack on a 2013 Chevy Volt, the security researcher tells Wired that he hasn’t physically tested the expanded vulnerability on BMW, Mercedes, or Viper-equipped vehicles. Kamkar says that fixing the vulnerability is simple, requiring the affected automakers to simply update their iOS apps as GM did in response to the initial OnStar hack. The researcher has been in communication with the affected automakers, and says he will not release the code that allows the hack until the vulnerabilities have been addressed.
-from Car and Driver Blog http://ift.tt/1EpgJPe
via Agya
