Comprehensive coverage

Jeep Cherokee and Tesla-S Hackers Reveal How They Did It and Teach How to Protect the Internet of Things

At the Savit exhibition that took place recently in Hanover, two "white" hackers presented how they hacked into a car that is a data center on wheels and what hacking into it means for the Internet of Things

Tesla S car at an exhibition in Berlin on March 5, 2016. Photo: Ugis Riba /
Tesla S car at an exhibition in Berlin on March 5, 2016. Data center on wheels. Photo: Ugis Riba /

In July 2015, two cyber security researchers demonstrated to a WIRED magazine reporter how they could remotely control a Jeep Cherokee after the infotainment systems were hacked in a "zero-day exploit" attack. This led Chrysler to call on 1.4 million vehicles to update their security systems, at a considerable cost to Chrysler's bottom line and also stoked a collective fear of its customers.

Kevin Mahaffey goes on a warning mission so that the case does not happen again. As founder and CTO of cybersecurity software vendor Lookout, Mahaffy and his research partner Mark Rogers of CloudFlare decided to see if not just the Jeep Cherokee could be hacked. In August 2015, they did this on a Tesla Model S in order to explain a key issue in the security of Internet of Things (IOT) devices at the CeBIT conference in Hanover, Germany. Last week, Mahaffy said, “Of all the connected cars, we chose the Model S for one reason: its architecture is completely new; She has no legacy. And besides, cheaper than a car, it's a data center on wheels. "

Kevin Mahaffey, CTO of online security company Lookout, explains how he hacked a Tesla Model S car. "Our hypothesis was that Tesla uses a lot of standards in the car," Mahaffey said. "That's why we thought it was said that even though we tried as hard as we could to hack it, we didn't succeed because they did a good job.'"

As it turned out, Tesla was doing many things right from an IT security perspective, but not enough. The duo gained access to a variety of computerized information systems in the car, and eventually the two caused Tesla to update the embedded software on the Model S.

After Mahaffey and Rogers notified Tesla of their vulnerabilities, the company quickly created software updates, which were sent via the cloud to all Model S vehicles as if it were a routine operation. Customers were not required to bring their cars to garages, Tesla did not have to spend time and money on service, and there was no serious PR fallout from the event.

Three separate servers are embedded in the Tesla Model S car. The Instrument Cluster (IC) and Center Information Display (CID) run Linux;, the computers are powered by the FreeRTOS real-time operating system. That means they all work using open source. Photo courtesy of Tesla Motors.

Mahaffy said there are three essential lessons to be learned from this Tesla Model S hack. These lessons apply to IT systems in general, but especially to the IOT systems that are becoming more common around the world. These lessons are vitally important because the industries developing the IoT "things" have no history in IT or online security. "It is easier to engineer [security] at the beginning of development and then there will be no need to add patches.

Lesson 1: Create a robust update process

Computing devices require updates on a regular basis. The IT providers and their customers understand this; They have established mechanisms in place for software upgrades. IoT devices are not immune to the need for software updates, but the ecosystem for software upgrades is not generally centralized, secure, or structured.

Mahafi insisted in his presentation on the need to engineer the fixes and not add them on top of the system. "Software updates should be distributed frequently, they should be free to the end user ... and require at most one or two clicks to activate," he said. Consumers generally ignore software updates if they are complicated and time-consuming.

Lesson 2: Create a security-proof system

Security was a central issue in the Sevit conference sessions.. a politician participated in one of the meetings. Jan Philipp Albrecht, a member of the European Parliament from Northern Germany from the Green Party, and a harsh critic of digital privacy issues. He advocates a strong role for the government in establishing security standards for the IOT.

"Before developing IOT systems we need to ensure an infrastructure of security and privacy in the design of these products," he said. "To achieve this we need the regulators to do the work first."

"Companies that do business in Europe must adhere to the rules. Europe has the gold standard for data protection. All manufacturers must assume that their devices will be attacked sooner or later. Most newcomers have to engineer to the point of making the device fortified to prevent the attack in advance. Today there are big walls on the outside and nothing protects the inside," Mahafi stated.

To help manufacturers understand the importance of what he calls resilient design, Mahaffy offers the metaphor of the human body. Skin is only the first line of resistance against disease; There is a large system in the body, each part of which has its own method of dealing with infections. IOT security should be achieved on a systemic basis and not by trusting that the external interface is impenetrable. "Total trust will result in the device being completely jailbroken," Mahaffy said. We must create sensors that monitor data transfers between the systems in order to track what happens in the event of a breach.

Lesson 3: Isolate critical components

Returning to the body as a metaphor for IOT. Mahaffy pointed out that the most critical system, the brain, has its own special layer of security - the blood-brain barrier. Car manufacturers and manufacturers of other Internet-connected devices need to create their own blood-brain barrier around the gateway to the system. An example of one industry that applies this is the airline industry.

V-Wi-Fi can't talk to the autopilot," Mahaffy said. “Your brake should not be able to talk to the web browser; More importantly, your web browser should not be able to talk to your brakes. "

The device gate is the most important part of the system, and it will have the strongest protection. You can't just rely on a big wall, Mahaffy pointed out, but a big wall is a good start.

9 תגובות

  1. דני
    This is true - but not enough. I have a Jeep Cherokee, and they sent me a software update in the mail. It was a small disk-on-key that contained a version update for the airbags. I checked by phone with the company that it was indeed something they sent.
    And don't forget - you'll go into the garage and there you'll know.... In this car you can't even replace a street lamp by yourself.

  2. Tesla was very lucky that the hackers weren't sophisticated enough and didn't really want to do any harm. Because those who did want to do harm would break into Tesla's servers (and not a single car) and issue an update to all the cars that also connects all the cars to them and disconnects them from Tesla's servers so that Tesla cannot even send an update even after they find and fix the breach.
    Software update for the car and any other critical device should be through a physical device only!!

    Everything connected to the network is a hackable point.
    If they don't learn it from this case, they will later learn it the hard way...

  3. Miracles
    It won't be long before you get into a car that doesn't have a steering wheel. You tell the computer where you want to go or type a work plan for that. Moreover, when the vehicle reaches 10,000 km, it will drive itself to the garage.

  4. Ronen
    Let me tell you the other side. I have a Jeep Cherokee like this. Beyond the fact that driving this car is pleasant and easy, the car is surprisingly safe. It keeps a distance by itself and brakes independently when a car in front of you brakes or someone cuts you off. It keeps a lane and turns the steering wheel when you leave the lane. And it warns you when there is a vehicle in the dead zone. And if you press the right button - it also parks itself...

    Convenience and safety come at a price in complexity. All in all - I think the advantages outweigh the disadvantages.

  5. Although I like progress, sometimes I think that simplicity wins.
    I heard a story from a jeep guide about a half a million shekel jeep that got stuck during a trip to Jordan on one of the dunes. We spilled some oil on some electrical circuit and had to tow the vehicle to Israel to the central garage because only there can it be started.
    In an old car this would not have happened...

  6. I was in a lecture on "The Internet of Things" at a large information security conference in Israel.
    My conclusion is unequivocal: no one will properly secure the devices and it is almost impossible.
    Especially when it comes to devices in the home that talk to other devices, the number of hacking scenarios is huge.
    Beyond that, which manufacturer will invest in updating security problems in a 5 or 10 year old product?
    Or rather a car: the refrigerator, the microwave, the kettle, the oven and the other household appliances.
    The manufacturers will stop updating at some point and will offer to purchase a new and more secure product also as a sales promotion.
    I doubt anyone would throw away a properly working kettle or washing machine because of security issues.
    It is a fact that many people still work with Windows XP.

Leave a Reply

Email will not be published. Required fields are marked *

This site uses Akismat to prevent spam messages. Click here to learn how your response data is processed.