IEEE Technology and Society Magazine - March 2018 - 18

Exploitation Case Studies
Wireless Carjacking
Wireless penetration using cellular connection, Bluetooth bugs, a
rogue Android App, and a malicious
audio file on a CD were reported
in 2010 [15]. White hat hackers
revealed nasty new car attacks
[16]. White hat hackers killed a
jeep on the highway in 2015 [17]-
[19]. Because of simple authentication of ECUs, hackers can control
ECUs. For example, the steering
wheel of the 2010 Ford Escape's
parking assist module can be controlled by CAN command 0x0081
[17]-[19]. The power steering of the
2010 Toyota Prius with lane keep
assist (LKA) can be controlled by
controller area network (CAN) command 0x02E4 [17]-[19]. By plugging an Internet-connected gadget
into a car's OBD2 port, researchers
could take control of a Corvette's
brakes in 2015 [20]. Because of
vulnerabilities, Fiat Chrysler recalling 1.4 million vehicles amid concerns over remote hack attacks
[21]. High-tech thieves could steal
Hyundai cars via its mobile APP in
2017 [22]. Cyber security expert
Kevin Mahaffey said: "Automakers that transform themselves into
software companies will win. Others will get left behind" [23].

Known and Unknown
Vulnerabilities
There are currently security problems of connected vehicles that we
must solve immediately. Jamming/
spoofing problems on vehicle sensor attacking should be resolved.
An immediate solution is needed for
vehicle access attacking, including
key fob cloning and telematics service attacks.
There are many known/unknown
vulnerabilities in the current connected vehicles. The connected
vehicles must be also protected

18

against wireless carjacking. Otherwise, the connected vehicles, and
self-driving cars, will become the
next crime frontier.

And-Connected-Cars-Fooling-Sensors-AndTracking-Drivers-wp1.pdf.
[12] F.D. Garcia et al., "Lock it and still
lose it -On the (in)security of automotive
remote keyless entry systems," in Proc.
USENIX, 2016; https://www.usenix.org/
system/files/conference/usenixsecurity16/
sec16_paper_garcia.pdf.
[13] Y. Burakova et al., "Truck hacking: An
experimental analysis of the SAE J1939
Standard," in Proc. USENIX, 2016; https://
www.usenix.org/system/files/conference/
woot16/woot16-paper-burakova.pdf.
[14] A. Greenberg, "Securing driverless cars
from hackers is hard. Ask the ex-uber guy
who protects them," Wired, 2017; https://
www.wired.com/2017/04/ubers-formertop-hacker-securing-autonomous-cars-really-hard-problem/.
[15] J. Markoff, "Researchers show how
a car's electronics can be taken over
remotely," New York Times, Mar. 10, 2011;
http://www.nytimes.com/2011/03/10/
business/10hack.html?_r=0.
[16] A. Greenberg, "Hackers reveal nasty
new car attacks - With me behind the
wheel" (Video), Forbes, Jul. 24, 2013; https://
www.forbes.com/sites/andygreenberg/
2013/07/24/hackers-reveal-nasty-newcar-attacks-with-me-behind-the-wheelvideo/#6677f02228c7.
[17] A. Greenberg, "Hackers remotely kill a
Jeep on the highway-With me in it," Wired,
Jul. 2015; https://www.wired.com/2015/07/
hackers-remotely-kill-jeep-highway/.
[18] C. Miller and C. Valasek, "Remote
exploitation of an unaltered passenger
vehicle," Aug. 10, 2015; http://illmatics.
com/Remote%20Car%20Hacking.pdf.
[19] C. Valasek and C. Miller, "Adventures
in automotive networks and control units,"
IOActive, 2014; https://www.ioactive.com/
pdfs/IOActive_Adventures_in_Automotive_
Networks_and_Control_Units.pdf.
[20] A. Greenberg, "Hackers cut a Corvette's brakes via a common car gadget," Wired, Aug. 2015; https://www.wired
.com/2015/08/hackers-cut-cor vettesbrakes-via-common-car-gadget/.
[21] M.B. Quir, "Fiat Chrysler recalling 1.4M
vehicles amid concerns over remote hack
attacks," Consumerist, Jul. 24, 2015; https://
consumerist.com/2015/07/24/fiat-chryslerrecalling-1-4m-vehicles-amid-concern-overremote-hack-attacks/.
[22] Reuters, "High-tech thieves could steal
Hyundai cars via its mobile app: Re searchers," Hindustan Times, May 17, 2017;
http://www.hindustantimes.com/autos/
high-tech-thieves-could-steal-hyundaicars-via-its-mobile-app-researchers/storyzQ6R1Vouy5bAH1I72shu6I.html.
[23] N. Perlroth, "Why car companies are
hiring computer security experts," New
York Times, May 7, 2017; https://www
.nytimes.com/2017/06/07/technology/
why-car-companies-are-hiring-computersecurity-experts.html?mcubz=1&_r=0.

Author Information
Yoshiyasu Takefuji is with the Faculty of Environment and Information
Studies, Keio University, 5322 Endo,
Fujisawa 2520882 Japan. Email:
takefuji@sfc.keio.ac.jp.

References
[1] Y. Takefuji, "Black box is not safe at all,"
E-Letters of Science,2017; http://science
.sciencemag.org/content/352/6293/1573/
tab-e-letters.
[2] 1. Jean-François Bonnefon et al., "The
social dilemma of autonomous vehicles,"
Science, vol. 352, no. 6293, pp. 1573-1576,
Jun. 24, 2016.
[3] J. Lynch, "Why is open source software
more secure?," Infoworld, Sept. 22, 2015;
http://www.infoworld.com/article/2985242/
linux/why-is-open-source-software-more-secure
.html.
[4] V. Beal, "In-Vehicle Infotainment (IVI),"
Webopedia, 2018; http://www.webopedia.
com/TERM/I/in-vehicle-infotainment-ivi
.html.
[5] C. Smith, The Car Hacker's Handbook:
A Guide for the Penetration Tester. No
Starch Press, 2016.
[6] D. Blundell, "ECU hacking," The Car
Hacker's Handbook: A Guide for the Penetration Tester, 2016, ch. 6; http://publicism
.info/engineering/penetration/7.html.
[7] Software-Defined GPS Signal Simulator,
Github; https://github.com/osqzss/gps-sdrsim, accessed Dec. 15, 2017.
[8] S. Kiese, "Gotta Catch 'Em All! - WORLDWIDE! (or how to spoof GPS to cheat at
Pokémon GO), Insinuator, 2016; https://
insinuator.net/2016/07/gotta-catch-em-allworldwide-or-how-to-spoof-gps-to-cheat-atpokemon-go/.
[9] M.L. Psiaki and T.E. Humphreys, "GNSS
spoofing and detection," Proc. IEEE, vol.104,
no. 6, pp.1258-1270, Jun. 2016.
[10] C. Yan et al., "Can you trust autonomous vehicles: Contactless attacks against
sensors of self-driving vehicles," presented
at DEFCON24, 2016; https://assets.documentcloud.org/documents/3004659/
DEF-CON-whitepaper-on-Tesla-sensorjamming-and.pdf, https://media.defcon
.org/DEF%20CON%2024/DEF%20
CON%2024%20presentations/DEFCON24-Liu-Yan-Xu-Can-You-Trust-AutonomousVehicles.pdf.
[11] J. Petit et al., "Remote attacks on automated vehicles sensors: Experiments on
camera and LiDAR," in Proc. of BlackhatEU15, 2015; https://www.blackhat.com/
docs/eu-15/materials/eu-15-Petit-Self-Driving-

IEEE Technology and Society Magazine

∕

march 2018
Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - March 2018
