Hackers Could Turn Off Your Car Engine – While You Are Driving
Bosch’s Drivelog Connect product, which enables you to monitor your car’s performance from your smartphone, can be exploited by hackers to shut off your engine while you are driving.
Researchers at security firm Argus found a vulnerability in the authentication process between the Drivelog Connector dongle, which connects to the car’s diagnostics interface, and the Drivelog Connect smartphone app.
The resulting information leakage enabled the researchers to “brute-force” the PIN and connect to the dongle through Bluetooth.
Once they connected to the dongle, the researchers were able to exploit security holes in the message filter to inject malware into the vehicle’s controller area network (CAN bus). They then shut off the engine of the moving car. The CAN bus enables microcontrollers and devices to communicate with each other without a host computer.
The researchers explained that attackers could also manipulate other vehicle systems connected to the network.
Argus informed Bosch of the vulnerabilities and the following day Bosch responded that it was working to fix the problem. In an advisory published recently, Bosh said it activated two-step authentication and updated the dongle’s firmware to address the vulnerabilities identified and exploited by the researchers.
What the Argus researchers found is disturbing, but the fact that the attackers have to be within Bluetooth range limits its impact since the attackers would have to be close to the target vehicle in order to shut off the engine.
You Might Also Read:
Older Cars Can Connect To Modern Smartphones:
No Need To Shoot Down Drones – Just Hijack Them:
Connected-Cars Could Cost Your Privacy:
