Unless you have been living under a rock, chances are you have seen one of GEICO's many advertisements. Regardless of…
Can My Car Be Hacked?
🎙️ Enjoy our PODCAST on this topic
* podcast transcript
EVA
Ever get that feeling when you get in your car these days and it’s like less of a car and more like stepping into a giant smartphone on wheels, GPS, Bluetooth. I swear my like tries to remind me to stop for coffee in the morning. It’s cool. But then you kind of remember somebody could probably, like, hack all that stuff, right?
MAX
Yeah, you’re, you’re hitting on a nerve there that’s keeping a lot of security experts up at night.
EVA
Really.
MAX
It’s it’s not just about data anymore, it’s about control. You know the potential for somebody to take over your car remotely is possible.
EVA
So this isn’t just like a paranoia thing, this is like a real.
MAX
Oh yeah.
EVA
This is a real concern.
MAX
That kind of sparked this whole deep dive for us. Today we got this article that claims that breaking into a car system is alarmingly simple.
EVA
Yeah, I mean, this article, it really highlights how cybersecurity is always kind of playing catch up to technology. And you know, when it comes to our cars, that blag time can have some real serious consequences for sure. It it even says that hackers are getting in through those insurance tracker devices, you know, the ones that give you the discounts for driving safe, right? It’s like leaving a side door wide open.
MAX
Well, that’s a perfect example of how even like harmless technology can become a vulnerability. You see, most modern cars use a system called a CAN, stands for Controller Area Network. But think of it like your car’s central nervous system. It sends all the commands between all the different parts. Here’s the kicker. The CAN format hasn’t fundamentally changed since 2007.
EVA
Wait a minute, so my car with all this fancy technology could be running on tech that’s older than my cell phone?
MAX
It’s it’s more common, they might think, and that outdated tech is a lot easier to exploit. Yeah. Hackers have had, you know, nearly 20 years to find all the weak points. Oh, wow. Think of it like those old video games with cheat codes. You know hackers are finding the automotive equivalent of those cheat codes in the sling and system.
EVA
OK, that makes it scarily easy to visualize. So if they get into the CAN system, what can they actually do? Can they like turn on the radio and blast polka music or?
MAX
Something. Oh, they can do a lot more than that.
EVA
Oh no.
MAX
We’re talking about, you know, potentially controlling functions like you’re steering your brakes, even the ignition.
EVA
Really. Yeah. So that little harmless insurance tracker is not so harmless.
MAX
Not so harmless anymore.
EVA
Wow, OK, you officially made this real for me. This isn’t some sci-fi movie scenario, this is actually happening.
MAX
Exactly. And that brings up a really important point. Yeah, who are these hackers and what are they after?
EVA
So when I picture a hacker, I don’t know about you, but it’s always some guy, like in a dark room with the hoodie pulled up, typing furiously, you know? But this article mentioned something about white hat hackers. Is that like the good guys in this scenario?
MAX
Exactly. They’re like the ethical hackers of the cybersecurity world. Instead of using their knowledge for bad, they’re actually using it to find and expose these vulnerabilities before the bad guys can get to them.
EVA
So they’re like the superheroes of hacking and like car companies work with these guys.
MAX
Oh yeah, absolutely. The article mentioned Tesla specifically. They are really ahead of the curve on this and they actually have what they call a bug bounty program where they reward these white hat hackers for finding and reporting security flaws.
EVA
That’s so smart. Turn a potential threat into like an asset.
MAX
Exactly. It’s a very proactive approach to security and it’s been proving to be super effective. Yeah, but, and this is a big but, not every car manufacturer is as proactive as Tesla, unfortunately.
EVA
OK, so we got the good guys out there battling it out in the digital world. Who are the bad guys and what are they even trying to do?
MAX
Well, the motivation can vary. Some hackers are motivated by financial gain, maybe trying to steal data, personal data that’s stored on your car system, right? Credit card information, if you use your car to make any purchases. Yeah, you know, or even trying to hold the vehicle itself for ransom.
EVA
Wait, hold up ransom. Like they take control of your car and they’re like, give me money or you don’t get your car back. Is that even possible?
MAX
Yeah, it’s not as far fetched as it sounds really. Unfortunately, there have been real world cases where hackers have exploited these vulnerabilities and they’ll disable the car’s engine or lock the owner out completely and demand payment to give control back. Oh my.
EVA
Gosh.
MAX
Scary stuff.
EVA
OK, that just took a really dark turn. Yeah. And that’s not even getting into the potential of like causing accidents or I don’t even want to think about that’s. This is serious business. I got to say, this is a this is giving me like a whole new level of anxiety about my morning commute. But knowledge is power, right? So where do we go from here? What can our listeners do to like, protect themselves?
MAX
That’s the spirit. Don’t let this paralyze you, Let it empower you. The first thing he’s got to get informed about your own vehicle. Crack up in that owner’s manual. Do a little digging online. Find out what kind of cybersecurity features your car actually has, if any.
EVA
Because some cars are probably better equipped than others, right?
MAX
Exactly. And this is where I think the article made a really good point about how traditional automakers could learn a thing or two from tech companies. They mentioned Uber specifically. Now Uber, they don’t, you know, make cars, but they rely on technology for like, their entire operation. And guess what? They’ve been hiring hackers to proactively test and improve their systems like from the ground up.
EVA
So they’re like using the hacker’s knowledge to make a more secure system.
MAX
Exactly. Being proactive instead of reactive smart, which frankly is something that more car manufacturers should be doing because the reality is cars are only becoming more connected, right? And this problem is only going to get worse before it gets better.
EVA
It’s like the Wild West out there right now.
MAX
It really is you.
EVA
Got the good guys, the bad guys, and everyone is trying to, you know, figure out this whole car technology thing.
MAX
Yeah, it’s a brave new world.
EVA
Well, hey, at least at least our listeners have a better understanding now of like what to even ask, you know?
MAX
Exactly. Stay informed, be proactive, that’s the name of the game.
EVA
Knowledge is power.
MAX
There you go.
EVA
Awesome. Yeah, well, hey, another deep dive successfully navigated.
MAX
Another one for the books.
EVA
Don’t forget everybody, stay curious, stay informed, and maybe think twice before you connect to that free Wi-Fi at the coffee shop.
MAX
Yeah, seriously.
EVA
Until next time.
Breaking and entering has been redefined in last decade. That’s because anything with a computer—your webcam, garage opener, smartphone, and even your car—can be hacked.
The auto manufacturing industry unfortunately hasn’t taken the issue as serious as they should. In fact, not even so in the face of an increasing number of demonstrations revealing just how easy it is to hack a car—case in point, the video above.
Plug-and-Play
How easy is it to hack a car remotely? It’s just a matter of exploiting the plug-in trackers auto insurance companies use. Once they’re in, a hacker can send a command to the car to disable the brakes, for example, making any driver’s ultimate nightmare a reality.
The Nuts & Bolts
All modern cars have computer modules installed in them. They are typically located right under the steering wheel, which mechanics use to diagnose and read measurements of your car’s metrics.
This is also where insurance companies typically implement a tracker device that plugs in to the car’s computer to monitor a driver’s on-road behavior, with the promise of lower insurance rates if they drive safely. What makes it easy for a hacker to attack this configuration is the fact that the insurance company’s tracking device utilizes the same mobile cellular network as our phones do to receive text message inputs, requiring little technical background to exploit it.
The text messages are encrypted, but the fact that they are simply just that—text messages—gives hackers the access they need to achieve their goals.
No one man should have all that power.
One major problem with onboard computers is that they are extremely rudimentary and yet they control virtually everything in the modern automobile. If you get access to the CAN (controller area network) you then have control over everything from the steering to the brakes and ignition, not to mention all the tech devices that contain sensitive information like the drivers IP address or phone numbers. This CAN format has remained virtually unchanged since 2007, which gives you an idea of how high up on the priority list these onboard computers are for automakers.
So, what is the auto industry’s response to car hacking hitting the media?
Well, it depends on which company you ask. Tesla is leading the way in this aspect of automobiles as well. With their tech background, they were one the first to understand that aligning themselves with hackers is the only way to defend themselves against them.
Most hackers aren’t the shadowy, evil, and diabolical figure that has become their identity in all movies and TV shows. They are mostly driven by curiosity and the challenge of puzzles or solving riddles. Hackers who aren’t interested in a life of crime and being hated, which is the vast majority, are considered “white hat” hackers, who hack with harmless intentions.
Tesla Motors embraces these white hat hackers by awarding a $10,000 prize to those who find exploits in their cars and helps them patch it before anyone can attempt to do any harm to their vehicles or owners.
Although, not a manufacturer, Uber is another company who has taken a proactive approach to strengthening their company’s security. They have gone as far as hiring hackers to be their lead designers and engineers.
Corporation Resistance
However, surprisingly most major automakers have essentially dismissed these hacking threats and continue to drag their feet when it comes to consumer safety. What will most likely happen is, as with most cases like this, the government will start enacting legislation requiring manufacturers to protect the public. The FTC actually just won a case recently that went after hotels who were not securing their networks, which violates a customer’s right to reasonable privacy.
This provides a good opportunity for the FTC to force the auto industry’s hand in improving the security of their onboard computers, which would be a genuine improvement in the safety of all drivers on the road.
video source: WIRED (Jul 21, 2015) – “Hackers Remotely Kill a Jeep on the Highway—With Me in It”
