[h=1]
Charlie Miller (left) and Chris Valasek hacking into a Jeep Cherokee from Millers basement as I drove the SUV on a highway ten miles away. Whitney Curtis for WIRED
Hackers Remotely Kill a Jeep on the HighwayWith Me in It[/h]Jisomee hapa: https://www.yahoo.com/autos/jeep-cherokee-owners-get-upgrade-after-hackers-124667401327.html
I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold. Though I hadnt touched the dashboard, the vents in the Jeep Cherokee started blasting cold air at the maximum setting, chilling the sweat on my back through the in-seat climate control system. Next the radio switched to the local hip hop station and began blaring Skee-lo at full volume. I spun the control knob left and hit the power button, to no avail. Then the windshield wipers turned on, and wiper fluid blurred the glass.
As I tried to cope with all this, a picture of the two hackers performing these stunts appeared on the cars digital display: Charlie Miller and Chris Valasek, wearing their trademark track suits. A nice touch, I thought.
The Jeeps strange behavior wasnt entirely unexpected. Id come to St. Louis to be Miller and Valaseks digital crash-test dummy, a willing subject on whom they could test the car-hacking research theyd been doing over the past year.
The result of their work was a hacking techniquewhat the security industry calls a zero-day exploitthat can target Jeep Cherokees and give the attacker wireless control, via the Internet, to any of thousands of vehicles. Their code is an automakers nightmare: software that lets hackers send commands through the Jeeps entertainment system to its dashboard functions, steering, brakes, and transmission, all from a laptop that may be across the country.
To better simulate the experience of driving a vehicle while its being hijacked by an invisible, virtual force, Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch from Millers laptop in his house 10 miles west. Instead, they merely assured me that they wouldnt do anything life-threatening. Then they told me to drive the Jeep onto the highway. Remember, Andy, Miller had said through my iPhones speaker just before I pulled onto the Interstate 64 on-ramp, no matter what happens, dont panic.[SUP]1
[/SUP]
As the two hackers remotely toyed with the air-conditioning, radio, and windshield wipers, I mentally congratulated myself on my courage under pressure. Thats when they cut the transmission.
Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed, then slowed to a crawl. This occurred just as I reached a long overpass, with no shoulder to offer an escape. The experiment had ceased to be fun.
At that point, the interstate began to slope upward, so the Jeep lost more momentum and barely crept forward. Cars lined up behind my bumper before passing me, honking. I could see an 18-wheeler approaching in my rearview mirror. I hoped its driver saw me, too, and could tell I was paralyzed on the highway.
Youre doomed! Valasek shouted, but I couldnt make out his heckling over the blast of the radio, now pumping Kanye West. The semi loomed in the mirror, bearing down on my immobilized Jeep.
I followed Millers advice: I didnt panic. I did, however, drop any semblance of bravery, grab my iPhone with a clammy fist, and beg the hackers to make it stop.
[h=3]Wireless Carjackers[/h] This wasnt the first time Miller and Valasek had put me behind the wheel of a compromised car. In the summer of 2013, I drove a Ford Escape and a Toyota Prius around a South Bend, Indiana, parking lot while they sat in the backseat with their laptops, cackling as they disabled my brakes, honked the horn, jerked the seat belt, and commandeered the steering wheel. When you lose faith that a car will do what you tell it to do,
Miller observed at the time, it really changes your whole view of how the thing works. Back then, however, their hacks had a comforting limitation: The attackers PC had been wired into the vehicles onboard diagnostic port, a feature that normally gives repair technicians access to information about the cars electronically controlled systems.
A mere two years later, that carjacking has gone wireless.
Miller and Valasek plan to publish a portion of their exploit on the Internet, timed to a talk theyre giving at the Black Hat security conference in Las Vegas next month. Its the latest in a series of revelations from the two hackers that have spooked the automotive industry and even helped to inspire legislation; WIRED has learned that senators Ed Markey and Richard Blumenthal plan to introduce an automotive security bill today to set new digital security standards for cars and trucks, first sparked when Markey took note of Miller and Valaseks work in 2013.As an auto-hacking antidote, the bill couldnt be timelier.
The attack tools Miller and Valasek developed can remotely trigger more than the dashboard and transmission tricks they used against me on the highway. They demonstrated as much on the same day as my traumatic experience on I-64; After narrowly averting death by semi-trailer, I managed to roll the lame Jeep down an exit ramp, re-engaged the transmission by turning the ignition off and on, and found an empty lot where I could safely continue the experiment.
Miller and Valaseks full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeeps brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch. The researchers say theyre working on perfecting their steering controlfor now they can only hijack the wheel when the Jeep is in reverse. Their hack enables surveillance too: They can track a targeted Jeeps GPS coordinates, measure its speed, and even drop pins on a map to trace its route.
[SUP]
[/SUP]
Charlie Miller (left) and Chris Valasek hacking into a Jeep Cherokee from Millers basement as I drove the SUV on a highway ten miles away. Whitney Curtis for WIREDHackers Remotely Kill a Jeep on the HighwayWith Me in It[/h]Jisomee hapa: https://www.yahoo.com/autos/jeep-cherokee-owners-get-upgrade-after-hackers-124667401327.html
I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold. Though I hadnt touched the dashboard, the vents in the Jeep Cherokee started blasting cold air at the maximum setting, chilling the sweat on my back through the in-seat climate control system. Next the radio switched to the local hip hop station and began blaring Skee-lo at full volume. I spun the control knob left and hit the power button, to no avail. Then the windshield wipers turned on, and wiper fluid blurred the glass.
As I tried to cope with all this, a picture of the two hackers performing these stunts appeared on the cars digital display: Charlie Miller and Chris Valasek, wearing their trademark track suits. A nice touch, I thought.
The Jeeps strange behavior wasnt entirely unexpected. Id come to St. Louis to be Miller and Valaseks digital crash-test dummy, a willing subject on whom they could test the car-hacking research theyd been doing over the past year.
The result of their work was a hacking techniquewhat the security industry calls a zero-day exploitthat can target Jeep Cherokees and give the attacker wireless control, via the Internet, to any of thousands of vehicles. Their code is an automakers nightmare: software that lets hackers send commands through the Jeeps entertainment system to its dashboard functions, steering, brakes, and transmission, all from a laptop that may be across the country.
To better simulate the experience of driving a vehicle while its being hijacked by an invisible, virtual force, Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch from Millers laptop in his house 10 miles west. Instead, they merely assured me that they wouldnt do anything life-threatening. Then they told me to drive the Jeep onto the highway. Remember, Andy, Miller had said through my iPhones speaker just before I pulled onto the Interstate 64 on-ramp, no matter what happens, dont panic.[SUP]1
[/SUP]
As the two hackers remotely toyed with the air-conditioning, radio, and windshield wipers, I mentally congratulated myself on my courage under pressure. Thats when they cut the transmission.
Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed, then slowed to a crawl. This occurred just as I reached a long overpass, with no shoulder to offer an escape. The experiment had ceased to be fun.
At that point, the interstate began to slope upward, so the Jeep lost more momentum and barely crept forward. Cars lined up behind my bumper before passing me, honking. I could see an 18-wheeler approaching in my rearview mirror. I hoped its driver saw me, too, and could tell I was paralyzed on the highway.
Youre doomed! Valasek shouted, but I couldnt make out his heckling over the blast of the radio, now pumping Kanye West. The semi loomed in the mirror, bearing down on my immobilized Jeep.
I followed Millers advice: I didnt panic. I did, however, drop any semblance of bravery, grab my iPhone with a clammy fist, and beg the hackers to make it stop.
[h=3]Wireless Carjackers[/h] This wasnt the first time Miller and Valasek had put me behind the wheel of a compromised car. In the summer of 2013, I drove a Ford Escape and a Toyota Prius around a South Bend, Indiana, parking lot while they sat in the backseat with their laptops, cackling as they disabled my brakes, honked the horn, jerked the seat belt, and commandeered the steering wheel. When you lose faith that a car will do what you tell it to do,
Miller observed at the time, it really changes your whole view of how the thing works. Back then, however, their hacks had a comforting limitation: The attackers PC had been wired into the vehicles onboard diagnostic port, a feature that normally gives repair technicians access to information about the cars electronically controlled systems.
A mere two years later, that carjacking has gone wireless.
Miller and Valasek plan to publish a portion of their exploit on the Internet, timed to a talk theyre giving at the Black Hat security conference in Las Vegas next month. Its the latest in a series of revelations from the two hackers that have spooked the automotive industry and even helped to inspire legislation; WIRED has learned that senators Ed Markey and Richard Blumenthal plan to introduce an automotive security bill today to set new digital security standards for cars and trucks, first sparked when Markey took note of Miller and Valaseks work in 2013.As an auto-hacking antidote, the bill couldnt be timelier.
The attack tools Miller and Valasek developed can remotely trigger more than the dashboard and transmission tricks they used against me on the highway. They demonstrated as much on the same day as my traumatic experience on I-64; After narrowly averting death by semi-trailer, I managed to roll the lame Jeep down an exit ramp, re-engaged the transmission by turning the ignition off and on, and found an empty lot where I could safely continue the experiment.
Miller and Valaseks full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeeps brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch. The researchers say theyre working on perfecting their steering controlfor now they can only hijack the wheel when the Jeep is in reverse. Their hack enables surveillance too: They can track a targeted Jeeps GPS coordinates, measure its speed, and even drop pins on a map to trace its route.
[SUP]
[/SUP]
