Cars hacked through wireless TPMS access

Interesting... not sure if this is a repost, I searched key words and found nothing. I've seen several articles on wired hacking into vehicles which led to theorizing about gaining access via Bluetooth or other optional equipment. This is the first I've seen where mandated safety equipment provides the access.

Apparently for $1500 you can hack into an ECU via the TPMS system and wreak all kinds of mischievous havoc and track vehicles for as far as you have detectors setup.

My favorite of the comments so far:

Yo dawg, I heard you like buffer overruns in your ECU, so I installed this TPMS in your new rims dawg. Now you can be crashin' while you're crashin'!
​

http://arstechnica.com/security/new...less-tyre-sensors.ars?comments=1#comments-bar

The tire pressure monitors built into modern cars have been shown to be insecure by researchers from Rutgers University and the University of South Carolina. The wireless sensors, compulsory in new automobiles in the US since 2008, can be used to track vehicles or feed bad data to the electronic control units (ECU), causing them to malfunction.

Earlier in the year, researchers from the University of Washington and University of California San Diego showed that the ECUs could be hacked, giving attackers the ability to be both annoying, by enabling wipers or honking the horn, and dangerous, by disabling the brakes or jamming the accelerator.

The new research shows that other systems in the vehicle are similarly insecure. The tire pressure monitors are notable because they're wireless, allowing attacks to be made from adjacent vehicles. The researchers used equipment costing $1,500, including radio sensors and special software, to eavesdrop on, and interfere with, two different tire pressure monitoring systems.

The pressure sensors contain unique IDs, so merely eavesdropping enabled the researchers to identify and track vehicles remotely. Beyond this, they could alter and forge the readings to cause warning lights on the dashboard to turn on, or even crash the ECU completely.

Unlike the work earlier this year, these attacks are more of a nuisance than any real danger; the tire sensors only send a message every 60-90 seconds, giving attackers little opportunity to compromise systems or cause any real damage. Nonetheless, both pieces of research demonstrate that these in-car computers have been designed with ineffective security measures.

The Rutgers and South Carolina research will be presented at the USENIX Security conference later this week.
​

 

Jamming the accelerator.... Hmmm, I wonder if that what has happened with the "sticky" gas pedals.

Good find!

 

glad I dont have them, damn cyber car tmps hacker

 

Haha, I don't have TPMS. I can't believe this is even possible...

 

I've hesitated buying after-market wheels just because of the annoyance of getting TPMS to work again or ignoring the warnings. Now maybe I'll look at not having TPMS as an extra bonus.

 

yea, I think in either case the actual risk associated with this is overstated. In any case, I want to talk to these hackers about updating my TPMS ECU with my new sensors. Save me $90!

 

Even just knowing I can be tracked so easily is a bit unnerving... sure, there are other ways to track me but most of them I can control by not using a specific device or a specific function within a device. In this case my only option to avoid it is by removing factory-provided gear.

 

there's no need to worry about really anything with this...TPMS sensors are very simple devices. They send pressure and temperature readings to a receiver, and that's it.

Now if a baddie wanted to try and mess with you, he could send a single to the recevier that indicated your pressure was 23049823049823 psi. This *could* cause a buffer overflow and allow him to get at other parts of your ECU that control important things. If the toyota TPMS computer is seperate from the ECU, then there isn't much to worry about. If that were to happen, it would simply light up your TPMS indicator until you were out of range of wherever he was transmitting from.

they're just TPMS sensors, I wouldn't expect any automaker to design mission-critical security layers into them...it's not like they store your SSN, blood type, bank pin code, etc