Too Much Tech: Crooks Are Taking Control of Cars by Hacking Their Headlights

Joined
Aug 31, 2007
Messages
117,682
This is not that difficult to do.

Since everything is now wired into the CAN buss on all new cars, any place you can literally "hot wire" into the network, any exposed wiring harness, will allow you access to the PCM, ECM and immobilzer modules.




Too Much Tech: Crooks Are Taking Control of Cars by Hacking Their Headlights

https://www.breitbart.com/tech/2023...-control-of-cars-by-hacking-their-headlights/

LUCAS NOLAN 12 Apr 2023

Manufacturers are reportedly scrambling to secure communication systems in their vehicles after thieves discovered new methods to bypass advanced security systems. In some cases, crooks are taking control of vehicles by hacking their headlights.

Hot Hardware reports that a new threat has emerged as car companies work to improve security measures in response to hackers exploiting remote keyless systems and hotwiring methods shared on social media. Modern vehicles’ central nervous system, the Controller Area Network (CAN) bus, is now the target of sophisticated thieves looking to easily bypass sophisticated security measures and steal cars.

In a blog post, Dr. Ken Tindell, CTO of Canis Automotive Labs, explained how most cars have “sophisticated car security systems, including an engine immobilizer,” which must be bypassed to steal the vehicle. Through the CAN bus, thieves have discovered a way to hack into the car’s communications and send false messages that unlock the doors and engine immobilizer.

The case of Ian Tabor, whose car was repeatedly tampered with before being stolen, brought attention to the CAN bus system’s weakness. Thieves apparently used the headlight wiring to access the car’s CAN bus, which they then used to send a series of false messages to the Electronic Control Units (ECUs) in order to take over the vehicle.

Although the CAN bus is not a new technology, these incidents have revealed the flaws in the system, according to Dr. Tindell. “Communications over the CAN bus are not very secure,” he states, raising concerns about the widespread use of CAN bus technology in cars, planes, boats, tractors, and more.

Automakers are currently securing CAN bus communications, but it is still unclear how criminals will modify their strategies in response to these security upgrades. The ongoing conflict between automakers and thieves will undoubtedly continue as technology develops, leaving car owners to speculate about the security of their vehicles.
 
How to hotwire a new car. Step one: Connect computer to headlight socket connector.

Didn't have that on my bingo card either.
 
My day-job is related to this. It is mathematically provable that no sufficiently-complex design[1] can be proven bug-free. This is one of the most important facts in the modern world, but it is little known. I have spent most of my adult life trumpeting this fact to anyone who will listen, because non-specialists have a tendency to believe that "we tested it, and there were no bugs" means "there are no bugs". That's not how it works.

You can think of the "state space" of a computing system as something like a chess game-tree (the tree of all legal moves). Exploring that space is prohibitively expensive (impossible, even for hypothetical quantum computers). For all but the tiniest logic circuits (a few dozen logic-gates), the only way to actually prove things about the state-space of a design is with formal proofs (mathematical proof techniques). Building such proofs is itself extremely difficult (expensive) and very few engineers have the required skills to do it.

As hard as all of this stuff is (proving functional correctness), digital security is even worse. To prove that a system is secure, proving that it has no functional bugs is not sufficient. Proving that the system has no functional bugs is a minimum condition to prove that it is secure. In general, there is no such thing as a "provably secure" system. Rather, you can only prove what are called "security properties" about a system. A "security property" is something like, "On startup, the system will not activate the display unless the motherboard completed boot without flagging an error." The specification author (security architect) should list all the security properties that he wants the system to satisfy and then it is up to design to work out how to achieve theses properties. Even for secure systems that have a security architecture (many don't even bother!), many of these security properties are much less rigorous than you might think. It often boils down to "our pen-testers tried to break in and couldn't." Which, as explained above, proves nothing.

The tl;dr is this: there is no such thing as a secure digital system. It's not absolutely true, but it's good enough for almost all purposes.

[1] - The technical term here is "Turing-complete"
 
Last edited:
How to hotwire a new car. Step one: Connect computer to headlight socket connector.

Didn't have that on my bingo card either.

Can't steal my truck by hacking this:

XzAuanBn
 
My hatchback is standard transmission. Apparently no one under the age of 40 can drive (steal) it.
 
Back
Top