Modern Car Data Systems Lack Security

May 18, 2010 by Mike Szczys 65 Comments

Tomorrow a team of researchers will present their paper on Experimental Security Analysis of a Modern Automobile (PDF) at the IEEE Symposium on Security & Privacy. Much like the racing simulators we’ve seen they’re exploiting the ODB-II port to get at the vehicle’s Controller-area network, or CAN-bus. We’re not surprised at all that they can display custom text on the dashboard display or read sensor data from the car. What does surprise us is their exposé on how truly unsecured the system is. It seems that access to any device on the CAN-bus gives them unobstructed control of the car’s systems. Any device can send commands to any other device. They’ve even found a way to write malicious code to the car’s computer which can be programmed to erase itself in the event of a crash.

Much like RFID the security risks here are basically nill for the vast majority of consumers. We just find it a bit surprising that there’s apparently been little thought put into fortifying the communications between the safety systems such as the brakes on the vehicle. For instance, team experimented with sending random packets over the CAN-bus and stumbled across a way to lock the brake on just one wheel. To us it’s conceivable that a malfunctioning device on the network could start sending out damaged packets and cause a dangerous malfunction like this one.

The 14-page PDF linked above is a page-turner, check it out on your hacked ereader during lunch.

Beer Can Pinhole Camera

April 16, 2010 by Jakob Griffith 23 Comments

When [Justin Quinnell] sent in his beer can pinhole camera, we were just floored. The parts are easy to obtain, and the process for building and ‘shooting’ with the camera are near effortless.

The really impressive part of this hack is letting your camera sit for 6 months facing the sun. Yes, you read that correct, a 6 month exposure. Check out after the break for one of his astonishing shots, and trust us, its well worth the click. Continue reading “Beer Can Pinhole Camera” →

Now You Can Record Mermaids Singing

February 17, 2010 by Mike Szczys 34 Comments

Buy stock in hot glue, this project corners the market on the stuff. [Leafcutter John] uses the hot goop as his water-proofer of choice when building an underwater microphone (also known as a hydrophone). By installing a couple of piezo elements on one lid of a tin can he is able to record some amazingly clear audio. This is aided by a pre-amp inside the metal enclosure. By cleaning off the clear coating from the inside of these steel can parts, he was able to solder the seams to keep the water out. In the end, coins are added for ballast and any remaining space is completely filled with hot glue.

He’s got a handful of example recordings on his project page. Here’s an what a running faucet sounds like from under water:

Hacking The OnStar GPS V2

December 26, 2009 by James Munns 20 Comments

[Andy] has provided us with his new guide to hacking the OnStar GPS. Previously, we have covered a way to grab the GPS data from an unused OnStar system, however in recent years GM has added much more complex systems, which make it harder than swapping out a serial line. For the new version, [Andy] has figured out GM’s Controller Area Network (CAN), which they call GMLAN. He has also done most of the software snooping and sleuthing, and has mostly solved GMLAN’s method of announcing GPS data. There is sample code available to convert this information into generic latitude and longitude.

Unfortunately for the project, (and very fortunately for [Andy]), he has a child on the way and new job responsibilities, so he is offering up his results to the HaD community to finish up, double check, and provide a good how-to for everyone else. To anyone who decides to pick up this project and run with it, let us know!