Remotely Controlling Automobiles Via Insecure Dongles

Automobiles are getting smarter and smarter. Nowadays many vehicles run on a mostly drive-by-wire system, meaning that a majority of the controls are electronically controlled. We’re not just talking about the window or seat adjustment controls, but also the instrument cluster, steering, brakes, and accelerator. These systems can make the driving experience better, but they also introduce an interesting avenue of attack. If the entire car is controlled by a computer, then what if an attacker were to gain control of that computer? You may think that’s nothing to worry about, because an attacker would have no way to remotely access your vehicle’s computer system. It turns out this isn’t so hard after all. Two recent research projects have shown that some ODBII dongles are very susceptible to attack.

The first was an attack on a device called Zubie. Zubie is a dongle that you can purchase to plug into your vehicle’s ODBII diagnostic port. The device can monitor sensor data from your vehicle and them perform logging and reporting back to your smart phone. It also includes a built-in GPRS modem to connect back to the Zubie cloud. One of the first things the Argus Security research team noticed when dissecting the Zubie was that it included what appeared to be a diagnostic port inside the ODBII connector.

Online documentation showed the researchers that this was a +2.8V UART serial port. They were able to communicate over this port with a computer with minimal effort. Once connected, they were presented with an AT command interface with no authentication. Next, the team decompiled all of the Python pyo files to get the original scripts. After reading through these, they were able to reverse engineer the communication protocols used for communication between the Zubie and the cloud. One particularly interesting finding was that the device was open for firmware updates every time it checked in with the cloud.

The team then setup a rogue cellular tower to perform a man in the middle attack against the Zubie. This allowed them to control the DNS address associated with the Zubie cloud. The Zubie then connected to the team’s own server and downloaded a fake update crafted by the research team. This acted as a trojan horse, which allowed the team to control various aspects of the vehicle remotely via the cellular connection. Functions included tracking the vehicle’s location, unlocking hte doors, and manipulating the instrument cluster. All of this can be done from anywhere in the world as long as the vehicle has a cellular signal.

A separate but similar project was also recently discussed by [Corey Thuen] at the S4x15 security conference. He didn’t attack the Zubie, but it was a similar device. If you are a Progressive insurance customer, you may know that the company offers a device that monitors your driving habits via the ODBII port called SnapShot. In exchange for you providing this data, the company may offer you lower rates. This device also has a cellular modem to upload data back to Progressive.

After some research, [Thuen] found that there were multiple security flaws in Progressive’s tracker. For one, the firmware is neither signed nor validated. On top of that, the system does not authenticate to the cellular network, or even encrypt its Internet traffic. This leaves the system wide open for a man in the middle attack. In fact, [Thuen] mentions that the system can be hacked by using a rogue cellular radio tower, just like the researchers did with the Zubie. [Thuen] didn’t take his research this far, but he likely doesn’t have too in order to prove his point.

The first research team provided their findings to Zubie who have supposedly fixed some of the issues. Progressive has made a statement that they hadn’t heard anything from [Thuen], but they would be happy to listen to his findings. There are far more devices on the market that perform these same functions. These are just two examples that have very similar security flaws. With that in mind, it’s very likely that others have similar issues as well. Hopefully with findings like this made public, these companies will start to take security more seriously before it turns into a big problem.

[Thanks Ellery]

Hybrid 50cc Ultracapacitor Scooter

We’re all familiar with hybrid gas-electric cars these days, but how about a hybrid scooter that uses supercapacitors instead of batteries? Our hats are off to [Alex] from Labs Bell for the almost entirely-DIY conversion.

The hybrid idea is to drive the vehicle’s wheels with electric motors, but generate the electricity with a normal gasoline engine. This allows the hybrid to control the engine speed almost independently of the wheel motors’ demand for power, allowing the gas engine to run at its most efficient speed and charge up batteries with the extra energy. As an extra bonus, many hybrids also use regenerative braking to recoup some of the energy normally wasted as heat in your brake pads.

[Alex]’s hybrid scooter does all of the above and more. Since the stock vehicle is a 50cc scooter, any increase in acceleration is doubtless welcome. We’d love to see the scooter starting from stop with a full charge. Using supercapacitors as storage instead of batteries is a win for charging efficiency. In urban stop-and-go traffic, the natural habitat of the 50cc scooter, the regenerative braking should help further with gas consumption.

What’s most impressive to us is the completely DIY hybrid control unit that takes some simple inputs (wheel speed and throttle position) and controls regenerative braking, the gas engine’s throttle, etc. Since the hybrid control system is currently under development, there’s even a button to switch between different trial algorithms on the fly. Very cool!

Oh yeah, and [Alex] points out the fire extinguisher on-board. He had occasion to use it for his hybrid motorcycle V1. Safety first!

Autonomous RC car navigates by waypoints

autonomous-rc-car

Check out this autonomous RC car which [Jason] built for the chipKIT design challenge. It’s been able to successfully navigate a planned route taking just a few waypoints as inputs.

Obviously this uses a chipKIT as the controller, the max32 to be specific. [Jason’s] write-up shows off all of the components of the design, but you’ll have to head over to his recently posted update to hear about the custom board he had spun to host them all. It starts with a GPS module, but that’s only accurate enough to give the rover the big picture. To handle getting from one waypoint to the next successfully he also included a gyroscope which provides very accurate orientation data, as well as optical encoders on the wheels for on-board distance traveled information.

We hope he’ll keep refining the design and make a trip to next year’s Autonomous Vehicle Competition.

Continue reading “Autonomous RC car navigates by waypoints”

Le-GoKART; a GoKart built entirely from Lego

[Eric Steenstra], from the Netherlands, decided to build a GoKart entirely from LEGO Mindstorm parts. Tested at being able to carry just over 100Kg in weight, a 16 stone man(224 lbs). This GoKart can easily carry a child and propel him along. Eric used 48 stock Mindstorm motors, geared down,  and 16 battery packs to provide a balance between torque and speed.

This vehicle doesn’t expect to win any races in the speed department. From the point of view of being something different this wins hands down. The Karts first test drive was only two weeks ago so drivability and durability are still under development at this stage.  See the video after the break on this monstrous Mindstorms creation.

via[Make]

Continue reading “Le-GoKART; a GoKart built entirely from Lego”

Thumper The T-Shirt Launcher

Thumper The T-Shirt Launcher

[joe] and [ryan] built Thumper for their high school FIRST robotics team. The cannon itself is a solenoid-fired compressed air launcher that gets its juice from three large PVC tanks stored in the box below the turret, and the cannon is able to be fired nine times between visits to the air compressor. It was intentionally designed to resemble an M2 Browning 50 Caliber heavy machine gun, with the two vertical handles and boxy body.  They finished construction in about a week with a budget of only $300. When they saw that a lot of their friends had also built cannons, they scrounged for parts from their garages to re-use to build the mobile platform simply for one-upmanship sake. The motor and drive-train propelling this behemoth came out of a 1980s-era mobile X-Ray machine that had been discarded by a local hospital. The rear wheels were specially modified to fit the drivetrain, and the front end is a chopped, hacked, and welded axle and steering mechanism from an old lawn tractor. Sections of unistrut form the rest of the frame.

[joe] and [ryan] were even asked to bring Thumper to their high school prom as a unique way to hand out T-Shirts for the evening. Unfortunately, there’s no website for this build.

See video of Thumper in action with a Nerf Football after the break. Hack A Day even got to take it for a spin around the Power Wheels Racing Series track at Maker Faire KC!

Continue reading “Thumper The T-Shirt Launcher”

Take me back to a simpler time, Radio Flyer

[Fred Keller] and [Judy Foster], both retired, are proving that age is just a number. What you see above is a nostalgia inducing full size driveable Radio Flyer red wagon. The base of which is a 1976 Mazda pickup truck, while the wagon portion is a mishmash of wood, fiberglass and bondo, detergent bottles, and more. Even the steering wheel has been retrofitted from an actual wheel from a wagon. We were surprised to find out the entire conversion only took the two 11 months to complete (finishing this past august), and even more confounded to learn the vehicle is completely street legal.

[Thanks Rob]

A different take on electric motor cars

[Craig Carmichael] has been hard at work on his electric hub motor for cars. Unlike typical electrical vehicles the plan is to bypass the transmission, differential, and everything else all together by connecting directly to the hub of the wheel. The goal of giving greater thrust and still allowing the use of a gas engine if need be.

There’s really too much detail for us to even begin to try to explain the entire project in a short recap, but [Craig] builds the entire motor (from magnets to coil windings) and wires his own controller (from schematic to finished PCB), all while documenting the process thoroughly for those wishing to make their own.