With Smarter Cars, The Doors Are Open To Hacking Dangers
Chris Valasek and Charlie Miller have been hacking into products for a long time. But they don't steal stuff or mess with people; instead, their purpose is to pressure companies into making their products more secure.
Miller and Valasek are not the first guys to hack a car, but they demonstrated like few have before just how dangerous these kinds of attacks could be.
"That's really where Charlie and I came in," says Valasek, a security researcher at IOActive. "We really wanted to see, once someone was inside your car network, to what extent could you control the automobile?"
The pair got a grant from the Defense Advanced Research Projects Agency (DARPA) and bought two modern, connected cars: a Toyota Prius and a Ford Escape. Then they tapped into the network of little built-in computers that run on virtually every car sold today.
Car makers began embedding electronic control units, or ECUs, in cars more than 30 years ago. These simple little computers were developed during the first gas crisis. Initially, they were used as tiny computerized carburetors.
"Engineers figured out that computers were much better at figuring out how to mix gas and air than a mechanical device," Valasek says. "They were much more efficient and you could get better gas mileage."
But soon these little computers were being used for a lot of things, like cruise control or anti-lock brakes.
"Now we're to the point where cars parallel park themselves," Valasek says. "And that's not just magic. There's computers in the car that have sensors and actuators."
Remote Control Havoc
All these little devices talk to each other on an open network. They listen in to every message that's sent, and they don't verify where a specific command is coming from. Miller says all of this makes cars easy to attack.
Any sensor attached to the processor on the network is vulnerable. So after Miller and Valasek learned the code that controlled the ECUs on the two cars they were testing, they were able to cause all kind of havoc.
They were able to jerk the wheel at high speeds in the Prius. They could cause the car to accelerate or brake. They could beep the horn or set off the crash preparation system and jerk the seatbelts back.
In the Ford Escape, if the driver was moving slowly, they could turn the wheel or even kill the brake. In fact, once Miller forgot that the hack was running on his Ford Escape and he drove it into his garage.
"Luckily, these weren't our cars," Valasek says.
But Miller did crush his lawnmower.
"My lawnmower — it was destroyed, utterly," Miller says. "The lawnmower was perhaps the first cyber-attack-in-a-car victim."
Car Companies Not Worried
Miller and Valasek tried to share their findings with Toyota and Ford before they went public. Both companies say while they are taking the research seriously, they're still convinced their cars are safe. They say if someone has to wire a computer into your car to get an attack to work, you are going to notice.
"I've actually been very disappointed with the reaction from these companies," says Don Bailey, a security researcher who has hacked into cars remotely via the cell phone network.
Bailey says Miller and Valasek have proven that "once you are through that initial barrier, you can and will be able to do almost anything you want to."
It's unlikely, however, that malicious hackers will take advantage of these attacks any time soon. All cars don't all use one operating system and they don't all speak one single language. So before a hacker can take control, he or she has to learn the specific code that runs the systems for that specific car.
That's tough, and it takes time. But Valasek says it's not impossible.
By going public with their research, Valesek hopes car companies will be forced to fix these problem before anyone — aside from a lawnmower — gets hurt.
Copyright 2020 NPR. To see more, visit https://www.npr.org.
"Kutoka kwa ""Smarter Cars: The Doors Are Open to Hacking Dangers,"" Chris Velasquez na Charlie Miller wamekuwa wakivunja bidhaa kwa muda mrefu." Lakini hawaibi vitu au kuingilia watu; badala yake, kusudi lao ni kushinikiza makampuni kufanya bidhaa zao ziwe salama zaidi. Miller na Velasek si wa kwanza kuharibu gari, lakini walionyesha kama wachache wamefanya kabla ya jinsi hatari aina hii ya mashambulizi inaweza kuwa. "Hiyo ni kweli ambapo Charlie na mimi alikuja katika", anasema Valasek, mtafiti wa usalama katika IOActive. """Tulitaka kuona, mara tu mtu anapokuwa ndani ya mtandao wako wa gari, ni kwa kiwango gani unaweza kudhibiti gari?" Kampuni hiyo ilipata ruzuku kutoka kwa Shirika la Utafiti wa Maendeleo ya Ulinzi (DARPA) na kununua magari mawili ya kisasa: Toyota Prius na Ford Escape. Kisha wakaingia kwenye mtandao wa kompyuta ndogo-ndogo zilizounganishwa ambazo zinaendeshwa na karibu kila gari linalouzwa leo. Kampuni za kutengeneza magari zilianza kuingiza vifaa vya elektroniki katika magari zaidi ya miaka 30 iliyopita. Kompyuta hizi ndogo rahisi zilitengenezwa wakati wa mgogoro wa kwanza wa gesi. Mwanzoni, zilitumiwa kama carburetors ndogo za kompyuta. "Wanahandisi waligundua kwamba kompyuta zilikuwa bora zaidi katika kujua jinsi ya kuchanganya gesi na hewa kuliko kifaa cha mitambo", asema Valasek. "Zilikuwa zenye ufanisi zaidi na ungeweza kutumia mafuta kwa kiasi kikubwa zaidi". Lakini hivi karibuni kompyuta hizi ndogo zilikuwa zikitumiwa kwa mambo mengi, kama vile kudhibiti mwendo au breki za kuzuia kufungwa. "Sasa tumefika hatua ambapo magari hujiacha yenyewe", anasema Valasek. "Na hilo si uchawi tu. Kuna kompyuta ndani ya gari ambazo zina sensorer na vifaa vya kuendesha gari". Remote Control Havoc Vifaa hivi vyote vidogo huzungumza na kila mmoja kwenye mtandao ulio wazi. Wao kusikiliza katika kila ujumbe kwamba ni kutumwa, na wao si kuthibitisha ambapo amri maalum ni kuja kutoka. Miller anasema yote haya hufanya magari kuwa rahisi kushambuliwa. Sensorer yoyote iliyounganishwa na processor kwenye mtandao ni dhaifu. Miller na Velasek walipojifunza kanuni za kuendesha magari mawili waliyokuwa wakijaribu, waliweza kusababisha uharibifu mkubwa. Waliweza kutikisa gurudumu kwa mwendo wa kasi sana katika Prius. Zingeweza kusababisha gari lifanye mwendo au lizuie. Wanaweza kupiga pembe au kuzima mfumo wa kujitayarisha kwa ajali na kugeuza mikanda ya usalama nyuma. Katika gari la Ford Escape, ikiwa dereva alikuwa akisonga polepole, angeweza kugeuza gurudumu au hata kuua breki. Miller alisahau kwamba gari lake la Ford Escape lilikuwa na kifaa hicho na akaendesha gari hilo hadi kwenye karakana yake. "Kwa bahati nzuri, hizo hazikuwa magari yetu", Valasek asema. Lakini Miller alivunja mashine yake ya kukata nyasi. "Mashine yangu ya kukata nyasi <unk> iliharibiwa kabisa", Miller asema. "Labda mashine ya kukata nyasi ndiyo iliyokuwa shabaha ya kwanza ya shambulio la kompyuta ndani ya gari". Kampuni za magari hazijali Miller na Valasek walijaribu kushiriki matokeo yao na Toyota na Ford kabla ya kwenda hadharani. Kampuni zote mbili zinasema wakati zinapochukua utafiti kwa uzito, bado zinaamini magari yao ni salama. "Wanasema kwamba ikiwa mtu ataweka kompyuta ndani ya gari lako ili kushambulia, utaona.""" "Nimekuwa na wasiwasi sana na mwitikio wa kampuni hizi, ""anasema Don Bailey, mtafiti wa usalama ambaye amevunja magari kwa mbali kupitia mtandao wa simu za mkononi." "Bailey anasema Miller na Velasek wamethibitisha kwamba ""mara tu unapopita kizuizi hicho cha awali, unaweza na utaweza kufanya karibu chochote unachotaka.""" Hata hivyo, haiwezekani kwamba wahasibu wenye nia mbaya watatumia vibaya mashambulizi hayo hivi karibuni. Magari yote hayana mfumo mmoja wa uendeshaji na hayasemi lugha moja. Kabla ya hacker kuchukua udhibiti, yeye lazima kujifunza kanuni maalum ambayo inaendesha mifumo kwa ajili ya gari maalum. Hilo ni jambo gumu, na huchukua wakati. Lakini Valasek anasema si jambo lisilowezekana. Kwa kwenda hadharani na utafiti wao, Valesek anatumaini makampuni ya magari yatalazimika kurekebisha tatizo hili kabla ya mtu yeyote - mbali na lawnmower - kuumia. Copyright 2020 NPR. Kwa maelezo zaidi, tembelea www.nl.org.