The dealership tools trust that a car is a car. They’re a soft target.- Craig Smith
With that ODB-GW plugged into a laptop, Smith’s software can perform a technique known as “fuzzing,” throwing random data at a target diagnostic tool until it produces a crash or glitch that might signal a hackable vulnerability. Smith says he’s already found what appear to be multiple flaws in the dealership tools he’s tested so far: One of the handheld diagnostic tools he analyzed didn’t check for the length of a vehicle identification number. So rather than 14 digits, his car-spoofing device shows that an infected vehicle could send in a much longer number that breaks the diagnostic tool’s software and allows a malware payload to be delivered. Or, Smith suggests, an infected car could overload the dealership’s gadget with thousands of error codes until it triggers the same sort of bug. (Smith says his own tests are still preliminary, and he declined to name any of the diagnostic tools he’s tested so far.) “The dealership tools trust that a car is a car,” says Smith. “They’re a soft target.” If a hackable bug were found in those dealership tools, Smith says it could be exploited in an actual dealership garage by building an attack into a car itself. He suggests a hacker could plant an Arduino board behind a car’s OBD2 port that carries the malware, ready to infect any diagnostic device plugged into it. That “auto brothel” attack is hypothetical, but it’s not as farfetched as it might seem. In 2010 and 2011, researchers at the University of California at San Diego and the University of Washington revealed a slew of hackable vulnerabilities in a 2009 Chevy Impala that allowed them to perform tricks like disabling its brakes, although they didn’t name the make or model of the vehicle at the time. One of those attacks was designed to take advantage of an auto dealership: The researchers found that they could break into the dealership’s Wi-Fi network and gain access to the same diagnostic tools Smith has tested via gadgets’ Wi-Fi connections. From there, they could hack any vehicle an infected tool plugged into. “Any car ever connected to it, it would compromise,” says Stefan Savage, the computer science professor who led the UCSD team. “You just get through the Wi-Fi in the dealership’s waiting room and the attack spreads to the mechanics shop.” Savage admits that the dealership attack isn’t a particularly targeted one. But that’s precisely what makes it so powerful: he estimates that thousands of vehicles likely pass through a large dealership every month, all of which could be infected en masse. “If the goal is to create mayhem or plant some kind of car ransomware, then going after the dealership is a fine way to get a lot of cars,” Savage says. In his talk, Smith pointed out that an attack on a dealership’s diagnostic tools wouldn’t necessarily have to be malicious. It could also be aimed at extracting cryptographic keys or code that would let car hacker hobbyists alter their own vehicles for better or worse, changing everything from fuel ratios to emissions controls, as Volkswagen did with its own scandalous nitrogen oxide emissions hack. But Smith also argues that the diagnostic tool bugs his device susses out represent significant security threats—ones that the auto industry needs to consider as it tries to head off the potential for real-world car hacks. “As more and more security researchers look into automotive security, I want to make sure this isn’t overlooked, as it has been so far,” Smith says. “Ideally, I want people doing security audits in the automotive industry to be checking dealership tools, too. This is the way to do it.”
Author – ANDY GREENBERG Courtesy of WIRED
Open in new tab