The National Highway Traffic Safety Administration and the Federal Bureau of Investigation are warning motorists to watch for signs that their vehicles may have been hacked.
“While not all hacking incidents may result in a risk to safety—such as an attacker taking control of a vehicle—it is important that consumers take appropriate steps to minimize risk,” a bulletin from the agencies said.
The announcement said the agencies “are warning the general public and manufacturers—of vehicles, vehicle components, and aftermarket devices—to maintain awareness of potential issues and cybersecurity threats related to connected vehicle technologies in modern vehicles.”
The bulletin comes as the so-called “Internet of Things” is taking hold of the automotive sector. What’s more, researchers are exposing remote vehicle exploits, and there’s been high-profile vehicle recalls directly connected to hacking vulnerabilities.
A video of a jeep Cherokee exploit that could affect more than a million vehicles triggered a large-scale recall of Jeep and Dodge vehicles last year.
General Motors sent out an emergency update to its smartphone app that could allow hackers to unlock and start the engine of the Chevrolet Volt.
BMW fixed a vulnerability where hackers could unlock doors on some 2.2 million vehicles.
According to the bulletin, here’s what to watch out for:
Vulnerabilities may exist within a vehicle’s wireless communication functions, within a mobile device—such as a cellular phone or tablet connected to the vehicle via USB, Bluetooth, or Wi-Fi—or within a third-party device connected through a vehicle diagnostic port.
In these cases, it may be possible for an attacker to remotely exploit these vulnerabilities and gain access to the vehicle’s controller network or to data stored on the vehicle.
Although vulnerabilities may not always result in an attacker being able to access all parts of the system, the safety risk to consumers could increase significantly if the access involves the ability to manipulate critical vehicle control systems.
The bulletin urges motorists to keep their vehicle software up to date, but it suggests doing so with caution:
As a note of caution, if manufacturers regularly make software updates for vehicles available online, it is possible that criminals may exploit this delivery method.
A criminal could send socially engineered e-mail messages to vehicle owners who are looking to obtain legitimate software updates.
Instead, the recipients could be tricked into clicking links to malicious websites or opening attachments containing malicious software (malware).
The malware could be designed to install on the owner’s computer, or be contained in the vehicle software update file, so as to be introduced into the owner’s vehicle when the owner attempts to apply the update via USB.
Additionally, an attacker could attempt to mail vehicle owners USB drives containing a malicious version of a vehicle’s software.
For the security savvy motorist, the government’s advice may seem obvious.
But for the less digitally inclined, the government’s guidance makes good, precautionary sense.
And if you want to tinker with your vehicle’s software yourself, it became legal to do so in October. New rules on Digital Millennium Copyright Act exemptions authorized the public to fiddle with software in vehicles for “good faith security research” and for “lawful modification.”
Listing image by Jerk Alert Productions