Security Flaw in Uconnect Lets Hackers Remotely Kill Jeep's Engine
If you’re like me, you may have found yourself asking “Why would Fiat Chrysler Automobiles release a patch for Uconnect if nothing is wrong?” last week.
The answer, provided by Wired today, is “They wouldn’t,” and that hackers could remotely kill a Jeep through a zero-day exploit in the system’s software. Additionally, hackers could take control of many other functions including steering, climate controls, brakes, throttle — the whole nine yards.
The Internet-based attack can remotely control just about any part of the car, according to the story. The two St. Louis men featured, Charlie Miller and Chris Valasek, can reportedly control any part of the car: stereo, windshield wipers, steering (only in reverse), braking, transmission and air conditioning.
The duo say they plan to release a portion of their exploit when they speak at a security conference in Las Vegas next month.
Chrysler isn’t happy.
“Under no circumstances does FCA condone or believe it’s appropriate to disclose ‘how-to information’ that would potentially encourage, or help enable hackers to gain unauthorized and unlawful access to vehicle systems.
FCA has a dedicated team from System Quality Engineering focused on identifying and implementing software best practices across FCA globally. The team’s responsibilities include development and implementation of cybersecurity standards for all vehicle content, including on-board and remote services.
As such, FCA released a software update that offers customers improved vehicle electronic security and communications system enhancements. The Company monitors and tests the information systems of all of its products to identify and eliminate vulnerabilities in the ordinary course of business.
Similar to a smartphone or tablet, vehicle software can require updates for improved security protection to reduce the potential risk of unauthorized and unlawful access to vehicle systems. The software security update, provided at no cost to customers, also includes Uconnect improvements introduced in the 2015 model year designed to enhance customer convenience and enjoyment of their vehicle. Customers can either download and install this particular update themselves or, if preferred, their dealer can complete this one-time update at no cost to customers.
Customers with questions may call Vehicle Care at 1-877-855-8400.”
Miller and Valasek say they’ll leave out important parts of their code that potentially malicious hackers would require to duplicate their feats.
Last week, FCA released an update for Uconnect addressing the vulnerability. That update must be installed at dealerships, or by owners with a USB stick, which could be an encumbrance for many owners, leaving many vulnerable Jeeps left out on the road.
According to the Detroit News, two U.S. Senators are proposing a bill that would specify federal standards for automotive computer systems to combat hacking.
(I asked Chrysler last week when the patch was released and heard that “nothing in particular” prompted the update and I bought it. I have failed you, TTAC readers, and I’m sorry.)
More by Aaron Cole
Latest Car Reviews
Read moreLatest Product Reviews
Read moreRecent Comments
- Urlik You missed the point. The Feds haven’t changed child labor laws so it is still illegal under Federal law. No state has changed their law so that it goes against a Federal child labor hazardous order like working in a slaughter house either.
- Plaincraig 1975 Mercury Cougar with the 460 four barrel. My dad bought it new and removed all the pollution control stuff and did a lot of upgrades to the engine (450hp). I got to use it from 1986 to 1991 when I got my Eclipse GSX. The payments and insurance for a 3000GT were going to be too much. No tickets no accidents so far in my many years and miles.My sister learned on a 76 LTD with the 350 two barrel then a Ford Escort but she has tickets (speeding but she has contacts so they get dismissed or fine and no points) and accidents (none her fault)
- Namesakeone If I were the parent of a teenage daughter, I would want her in an H1 Hummer. It would be big enough to protect her in a crash, too big for her to afford the fuel (and thus keep her home), big enough to intimidate her in a parallel-parking situation (and thus keep her home), and the transmission tunnel would prevent backseat sex.If I were the parent of a teenage son, I would want him to have, for his first wheeled transportation...a ride-on lawnmower. For obvious reasons.
- ToolGuy If I were a teen under the tutelage of one of the B&B, I think it would make perfect sense to jump straight into one of those "forever cars"... see then I could drive it forever and not have to worry about ever replacing it. This plan seems flawless, doesn't it?
- Rover Sig A short cab pickup truck, F150 or C/K-1500 or Ram, preferably a 6 cyl. These have no room for more than one or two passengers (USAA stats show biggest factor in teenage accidents is a vehicle full of kids) and no back seat (common sense tells you what back seats are used for). In a full-size pickup truck, the inevitable teenage accident is more survivable. Second choice would be an old full-size car, but these have all but disappeared from the used car lots. The "cute small car" is a death trap.
Comments
Join the conversation
Glad to see this finally being made public. It's a big deal. It's one thing to require physical access to the ODB port or mechanical functions on the car if you intend to sabotage it. It's another thing entirely when it can be done with some malicious code and a few clicks from anywhere on the planet. While I have no doubt that this will prompt significantly better safeguards, this yet again highlights some of the dangers of living in a world where we place a higher value on convenience and entertainment than we do on security and simplicity. Not to sound alarmist, but we can extrapolate this example out to a scenario where someone with malicious intent takes control of thousands of cars simultaneously to create mass chaos and fear. No joke, one such event would have staggering repercussions on peoples' psyche and on the auto industry writ large. To quote Tommy Lee Jones: "A person is smart. *People* are dumb, panicky, dangerous animals, and you know it! "
So, a few years ago a journalist type investigating shady stuff just happened to off himself by driving his late-model C-Class,IIRC, blazing fast late night on the streets of the LA suburbs. At that time, there was chatter among my friends in the local chapter of the ATHC (American Tinfoil-Hat Club)that this wasn't necessarily an accident and there was more than meets the eye in the event. I believe the story even was discussed by Jack Baruth here on TTAC. So, a.) just idly wondering if there's any chance these two stories are linked? Government black-hat hackers are probably at least as advanced as these two....gentlemen....were, undoubtedly. Also, the vehicle hacked here was a Jeep, which until a few years ago was a closely related party to Mercedes. Possibly sharing electrical /software systems still, and thus sharing vulnerabilities? And, b.) Does a hack like this leave any electronic fingerprints? Will it be possible to forensically determine after an....er...accident that the vehicle was hacked which caused the accident? Or can potential hackers hack, cause an accident and unplug and be off without detection? Serious questions. Potential auto industry and insurance and law enforcement nightmare. If anyone knows the answers, I'd love to hear discussion.