Wireless apps at risk from carhackers

Just about any smartphone app can br cracked from a wi-fi enabled laptop.

Just about any smartphone app can br cracked from a wi-fi enabled laptop.

Published Aug 4, 2011

Share

A lot of cars now use wireless technology to lock and unlock doors, start engines and even switch on aircon systems from a smartphone so the car is cool and comfortable when you get in but - and this is a big but - any wireless communication between two devices can be intercepted and, with sufficient effort, controlled.

It isn't easy, say computer security researchers Don Bailey and Mathew Solnik, but it can be done. It took them about two hours to crack the network code of a test car, recreate the commands on a laptop, unlock the car and start it - and they caught the whole process on video.

Bailey says they've already cracked two remote-control products - although he won't say which ones - and the video will form part of a presentation at next week's Black Hat conference in Las Vegas in which he'll discuss his research - but without giving full technical details of how it's done.

Probably the best known in the US is OnStar RemoteLink, which can be downloaded to your smartphone, paired with one of a number of recent GM models and used to unlock and start the car. Similar software is available for Mercedes-Benz and BMW, among others.

To prove to the car that it's the owner's phone, it automatically connects to a server that sends a code (a numerical password, if you will) to the car - over the same network! - but Bailey and Solnick get round that by intercepting the messages between the server and the car.

"Once we have the codes," says Bailey, "we work backwards to write the protocols that use those codes."

The principle is similar to war driving, in which hackers drive around looking for wi-fi network signals and break into them looking for data. Since car-hacking involves reading, decoding and sending complex SMS messages, Bailey has coined the term "war texting" to describe it.

But it's not just cars that are at risk - any remote gizmo that can be remotely operated from a smartphone can be cracked, from the home theatre set-up in your TV room, to your garage door, to the Johannesburg traffic light system, which operates over a cellular network from a sim at each intersection.

Bailey warns that mobile networking is now built into an astonishing range of devices, many of which can be hacked and misused - although the cynical would say that hacking the Joburg CBD's traffic controls could only be an improvement.

He has even managed to hack into a positioning system that tells subscribers the locations of family members or employees (now that's a scary thought - imagine if the bad guys could use a laptop to find out where your kids are) and says the same technique could be used to get into a cellphone-based vehicle tracking system and draw up a "shopping list" of cars worth stealing - and where they are.

The current generation of open-source tools has given hackers an easy way to set up their own cellphone test networks, he says, using a common architectural flaw to give them access to hundreds of wireless products.

Related Topics: