Jeep hackers return to take over your steering wheel
Last year, security researchers Charlie Miller and Chris Valasek made headlines by remotely hacking a Jeep, killing the transmission and applying the brakes while Wired reporter Andy Greenberg was behind the wheel and driving in traffic. The hack led to a 1.4 million-vehicle recall for Fiat Chrysler and new jobs at Uber’s Advanced Technology Center for Miller and Valasek. Despite the cushy new gigs, the two of them apparently aren’t done hacking Jeep Cherokees for sport. In their latest exploit, the pair can gain even more control over a vehicle, but it would also be extremely difficult to pull off in a real-world setting.
Here’s the harrowing part first: Miller and Valasek can do more than just apply the brakes at low speed or cut the transmission this time around. Now they can turn on the parking brake, mess with the cruise control and hijack the auto-parking system to jerk the steering wheel a dangerous 180-degrees while the car is in motion. It looks about as frightening as it sounds:
Although it’s not hard to see how that would make for a very terrifying drive, there’s a big grain of salt that comes along with it: Miller and Valasek actually used the same model 2014 Jeep Cherokee as the original demonstration, but without the software patch applied. Or, as Wired put it, “imagine an alternate reality,” where a fix had never been made. Unlike before, the latest hack requires a physical connection plugging their laptop into the Jeep’s OBD-II diagnostic port under the dash. The team also had to update the Jeep with their own firmware to disable some of the car’s built-in safety checks before they could get much control. In other words: In order to get hacked, Jeep owners would first need to roll back their car’s firmware to an older version, invite someone to remove security features and then also let them ride shotgun with a computer. Or, as Engadget‘s resident security expert Violet Blue wrote on Twitter, it’s sort of a non-threat.
Colleagues: If a hack requires ACTIVE, PERSISTENT, INFORMED CONSENT of the target, you don’t have a public danger story! You’ve been duped!
— Violet Blue ® (@violetblue) August 2, 2016
That said, The Verge points out that it may still be possible to exploit OBD-connected wireless dongles like the Metromile Tag, Automatic Link or other similar devices currently marketed by insurance companies. For Chrysler’s part, however, the company fired back in a statement to Wired: “While we admire their creativity, it appears that the researchers have not identified any new remote way to compromise a 2014 Jeep Cherokee or other FCA US vehicles.”
“It is highly unlikely that this exploit could be possible,” the statement continued, “if the vehicle software were still at the latest level.” Which is to say: don’t forget to keep your car’s firmware up to date.
Last year, security researchers Charlie Miller and Chris Valasek made headlines by remotely hacking a Jeep, killing the transmission and applying the brakes while Wired reporter Andy Greenberg was behind the wheel and driving in traffic. The hack led… Engadget RSS Feed
(47)
