Car computer security

July 7, 2014 10:48 AM

What sort of personal information would be stored on a newer model car's computer that was used for 2 or 3 years, totaled, and then sent to the junk yard? Has anyone researched or begun to address the security risks of more complicated car computers, if they exist at all?

I ask because a friend of mine is a hobbyist mechanic, and we were talking about how he'll scavenge at a junk yard for parts that he can flip online for other hobbyist mechanics. We got onto the topic of how he was making decent side cash pulling and selling car computers (ECU). This made me wonder what sort of security risks more modern car computers might hold.

Most of the ECUs that he was dealing with were simpler affairs (mostly ROM chips that handle stuff like fuel injection), but I know that more modern cars have increasingly advanced computers that handle at least GPS, and increasingly stuff like connections to cloud services such as email.

I brought this up, and he wasn't sure, but he said that junk yards tend to see stuff that's about 8 to 15 years out, so it wasn't something that's likely to be an issue since these more complex computers have just recently started hitting the market.

Also any general information that you can contribute about security and car computers would be of interest.

posted by codacorolla to Computers & Internet (5 answers total)

Your car might contain some phone numbers if it has a Bluetooth hand-free unit and you have programmed any numbers directly into that and/or sync your phone address book with your car. (I'd wager most people don't, since usually you can dial perfectly fine directly from the phone.) It might have a list of phone numbers you recently called or received calls from.

Similarly, it could include the unique identifiers (MAC addresses) of the Bluetooth devices it was paired with and maybe the names of the devices, which in some cases might disclose your name if you named your phone with your name.

I suppose some units might remember the names of songs you recently listened to, but there is no reason for them to store it so they probably don't.

This stuff will probably not be easily recoverable, but a determined hacker could probably dig it out.

The ECU might contain information on recent speeds, braking force, and other things that might be evidence in an accident investigation, but in that case the authorities will be the ones who'd be interested, not some random junk spelunker.
posted by kindall at 11:10 AM on July 7, 2014 [1 favorite]

Here is a YouTube presentation from DefCon titled Adventures in Automotive Networks and Control Units, all about hacking onboard computers (sponsored by a Darpa grant).

And here is more in-depth onboard computer security research by the joint University of Washington and the University of California San Diego's Center For Automotive Embedded System Security. Key quote:

We believe that car owners today should not be overly concerned. It requires significant sophistication to develop the capabilities described in our papers and we are unaware of any attackers who are even targeting automobiles at this time.

However, we do believe that our work should be read as a wake-up call. While today's car owners should not be alarmed, we believe that it is time to focus squarely on addressing potential automotive security issues to ensure that future cars — with ever more sophisticated computer control and broader wireless connectivity — will be able to offer commensurately strong security guarantees as well.

(Keep in mind this is from 2011).
posted by rada at 11:25 AM on July 7, 2014 [2 favorites]

There is also this fairly recent talk by Darpa's Kathleen Fisher where she says that the capability to remotely control modern cars exists today. For example, around the 2-minute mark, she describes how researchers created a music CD that plays fine in your home stereo but when played in your car stereo, takes over its computer systems.

More to your question, if you could get your hands on an older car computer, you could sniff out its communication protocols, making such a hack - at least for similar make cars - much, much easier. I am not a particularly brilliant programmer but I could probably get it working, given enough time.

(Oh, and read up on the conspiracy theories around Michael Hastings's car crash. Richard Clarke, U.S. National Coordinator for Security and Counter-terrorism said that the crash was consistent with a car cyber attack).
posted by rada at 11:43 AM on July 7, 2014

As above, plenty of research is being done. Interestingly Tesla (who have suffered public vulnerabilities being released about their cars) has a Vulnerability Reporting webpage and a "hall of fame" for security researchers...and judging by the number of folks on that page I'd say there have been a number of research findings.

The Tesla is an interesting vehicle (albeit somewhat a boutique rather than mass market car). Given it has a web browser built into its massive touch console I'd say it could have almost any data you'd find on a tablet or phone depending on how it caches data / session tokens etc. The same for a lot of other smart dashboards which are basically Android (or some other Linux based device) with apps on top...

As manufacturers start using commodity components for inboard dash displays (Android or IOS based, similar communications protocols, etc.) I'd expect a lot of general security research on these platforms will apply to the in-car systems as well.
posted by inflatablekiwi at 1:17 PM on July 7, 2014 [1 favorite]

If the car has a built-in garage door opener, then that could be a tremendous problem.
posted by Rad_Boy at 2:02 PM on July 7, 2014