From Car-Jacking to Car-Hacking: How Vehicles Became Targets For Cybercriminals

Featured article by Jeremy Sutter, Independent Technology Author

As cars are “smarter,” protecting them requires more than locking the doors and closing the windows. Electronic entry, Wi-Fi, computer sensors that enable self-driving or automatic stopping measures, and on-board global positioning systems can encourage safer driving. Cars are also equipped to record data that can reveal safety problems in the car or how a crash occurred. An estimated 95 percent of auto crashes involve human error.

What Can – and Has Happened?

These advances are also portals for hackers to steal and invade your car, impeding your safety and ability to access affordable insurance costs. The diversion of a car to a hidden place portends more severe consequences, such as hostage-taking, or worse.

A 2015 Wired Magazine report chronicled how test hackers, with a laptop, took over a Jeep Cherokee’s climate control, radio, windshield wiper fluid and the accelerator – causing the vehicle to stop. In the report’s wake, Fiat/Chrysler – with prompting from the National Highway Traffic Safety Administration – recalls 1.4 million Jeep Cherokees and installed a software patch.

In Austin, Texas, a disgruntled former employee of a dealership hacked into the vehicle immobilization systems of a 100 vehicles. The hacking caused horns to blow and shut down the ignition system.

Houston Police arrested two men in early August 2016 on charges of stealing 30 vehicles by using a laptop computer. In London, vehicles have been theft targets thanks to a scheme of stealing keyless entry codes and duplicating electronic fobs to open the cars.

The Entry Points

With the number of electronic and computer-run components, criminals do not need coat hangers or other physical tools. Many of the electronic controls appear in cars courtesy of federal mandates and are pathways to spyware and other forms of malware. Technology meant for the safety and convenience of drivers and passengers can place them at the mercy of hackers.

For example, a vehicle’s on-board diagnostics system – required for all vehicles manufactured since 1996 – detects exhaust emissions, ignition systems, fuel pump sensors and speed controls, among other functions. Dealerships connect their computers to the system. Malware can infect the dealership’s computers, thereby spreading the infection to the vehicle’s system.

Federal law also mandates that vehicles carry an event data recorder, functionally equivalent to a black box on a piece of aircraft. Recorders on newer models can transmit the information wirelessly to a cloud-based or other remote repository.

Other openings for malware include satellite radio, hands-free cellular phone devices, and navigation systems. Car makers are touting vehicles as WiFi hot spots to allow especially passengers to browse the Internet, use social media and email while on the road.

The turn to self-driven cars may also spur the prominence of wireless controls and features. By 2020, approximately 90 out of every 100 cars will be connected. The Insurance Information Institute reports estimates of 3.5 million self-driven vehicles on the road by 2025 and an additional 1 million by 2030. They promise the ability of cars to stop at intersections, safely follow other vehicles more closely, automatically change lanes, and detect blind spots. In particular, through vehicle-to-vehicle technology (V2V), cars transmit wireless signals that warn others of their approach.

Another attack source can come from carrying satellites on cars and recreational vehicles. These VSAT enabled cars afford Internet and phone service by connecting to a satellite.

Security Measures

To reduce the chances of becoming a victim of car-hacking:

– Avoid connecting thumb drives or other hardware into the USB ports or the On-Board Diagnostic II port until you have first scanned the content for viruses or malware. Run the scans on a computer with antivirus or other security applications.

– Use a mechanic trustworthy or familiar to you or to a service station that monitors its technicians. Inquire about any unfamiliar devices connected to the ports.

– Report any malfunctions of or difficulty in steering, braking or other vehicle functions.

– Periodically change passwords for WiFi accounts on your vehicle.