Hackers remotely kill a Jeep at 70mph from the internet... is the C-Max vulnerable?

[Jaspah]

Hi all, been a long time lurker on the forums since I bought my 2013 C-Max Energi. Read this article today and found it incredibly unnerving.

 

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

 

Makes me wonder if Ford's systems are also vulnerable...

[raadsel]

I don't believe, at least overall, that Ford's have the same vulnerability. This system appears to depend on services where you can perform functions over the Internet, such as turning your car on and other commands across the Internet. From what I can tell, Ford does not have that type of functionality built into current Sync/MyFordTouch systems (not sure about MyFordTouch 3).

 

I wish the article had better explained which car makers are most vulnerable -- instead they merely mention all Chrysler products with UConnect and Cadillac. Of course, GM Onstar, Lexus Enform, Toyota Safety Connect, Hyundai Bluelink, and Infiniti Connection are all telematics system (again, Ford does not have this type of system) that potentially could be hacked -- it just depends on what vulnerabilities exist in their software. The comment that Cadillac is among the most vulnerable makes me believe that all GM vehicles with OnStar would be high risk. Worse, these types of systems typically cannot be updated by the owner, so a simple software patch (such as the ones Microsoft does monthly) would likely require a trip to the dealer in the form of a recall for all effected vehicles.

[Jaspah]

From what I understand from reading the article and the summary from the DEF CON presentation, it sounds like while these features may not exist in the interface we see, all of the systems are still connected in the background through the CAN bus. The fact that we can remote start, lock, and unlock our vehicles (might be an Energi only thing? Not sure) does indicate this connection may exist...

Edited July 21, 2015 by Jaspah

[jdbob]

The Hybrid doesn't have a cell phone connection. However the C-Max Energi, Fusion Energi, and Ford Focus Electric do have a cell phone connection built-in for the MyFord Mobile service. Maybe it's a good thing AT&T is shutting down that connection at the end of next year ;)

[hybridbear]

This would definitely be a concern in the Energi since it has an AT&T cellular modem.

[fbov]

...Cadillac is among the most vulnerable...

Funny you should mention...

 

The C-Max has me watching product placement on TV and movies more than before, because they're getting creative. Long shot of a shiny black Cadillac. Someone gets in so they can Skype in privacy using the car's onboard Wi-Fi. Nothing like advertising a hidden vulnerability, as if criminals needed any help...

 

Frank, who, without park assist, never expects his steering wheel to move on its own.

[JAZ]

Potentially far worse than most would like to believe: 

 

http://market-ticker.org/akcs-www?singlepost=3383472

 

(Courtesy Karl Denninger)

 

 

[scottwood2]

This will be a growing concern.  Our cars are a computer (or many computers) on wheels.  They are becoming more advanced and reaching out to other vehicles and the internet is going to happen.   Our computers, phones and other electronics have to be updated on a regular basis partly because of security concerns.   Our cars will be joining the list of needing to be updated devices as well.  

 

The comment I heard from Chrysler was that they thought that this information should not be shared for security reasons.  That is true but I think they should be thanking the team that hacked their system.  Better a good guy trying to show what can happen then a bad guy planing who knows what.  

 

Google now pays people who hack their systems.  I think they have it right.  

[SPL Tech]

Who cares. Two out of three Americans are overweight. You have about a 50,000x higher chance of dying because you eat too many cheeseburgers and dont exercise than you do from someone hacking your car. On the list of things to be worried about, someone hacking your car doesn’t even make the top 10,000. Worry about the stuff that actually harms people.

[Marc Smith]

Makes me wonder if Ford's systems are also vulnerable...

Its not a matter IF hackers will find a way in.  just a matter of when. 

 

No system connected to the airwaves/internet is hacker proof.

 

All the IT guys do is try to stay a step a head of the hackers,  and there are probably more hackers trying to get into a system than there are IT guys trying to protect it...

 

SLP  you are correct, in that there are much more pressing matters that affect our daily lives. and for a hacker to hack an individual vehicle at random would be a low priority.  The high priority for a hacker would to hack the ford system and cause all the cars connected to the system to go wonky.  But taking control of one car is just the first step.

 

so not cause for us to run around like chickens with our heads cut off,  but  it warrants us keeping abreast of the situation