Found On Road Dead

Airstreamer · 03-14-2010

Hack a firewall, kill an engine?

Ford preps anti-hacking tech for in-car WiFi

Barry · 03-15-2010

At least they're planning security at the start and not until something bad happens.

streaker69 · 03-15-2010

Quote:

Originally Posted by Barry

At least they're planning security at the start and not until something bad happens.

Something bad already happened. They put it in a Ford.

<hides from Thorn>

Barry · 03-15-2010

Quote:

Originally Posted by streaker69

Something bad already happened. They put it in a Ford.

<hides from Thorn>

Well you know why the F-150 comes with a heated tailgate. It's so your hands don't get cold pushing it.

Also, could be worse. It could be tied into OnStar....

streaker69 · 03-15-2010

Quote:

Originally Posted by Barry

Well you know why the F-150 comes with a heated tailgate. It's so your hands don't get cold pushing it.

Also, could be worse. It could be tied into OnStar....

That will be next, Gubment will mandate all new cars be tied into gubment owned OnStar, and all new cars sold in US will require blackboxen.

theprez98 · 03-15-2010

Quote:

Originally Posted by streaker69

That will be next, Gubment will mandate all new cars be tied into gubment owned OnStar, and all new cars sold in US will require blackboxen.

NHTSA is already talking about that.

streaker69 · 03-15-2010

Quote:

Originally Posted by theprez98

NHTSA is already talking about that.

I know, and GovStar will be next.

Thorn · 03-15-2010

My 2010 Explorer came in last week. It has SYNC on it, and I've started researching it.

In a nutshell, SYNC is basically a WinCE variant, which has Bluetooth, voice command, USB I/O, and is run through the entertainment center. Bluetooth security is good. To sync a Bluetooth device, the system generates a random 8-digit access number. Voice command is pretty good, and it can directly run USB devices (including my iPod; the screen changes to a Ford emblem.

) Plain old USB drives can also be accessed directly for music, via the voice command. Crash detection/airbag deployment will use any synced BT cellphone to dial 911 if SYNC sees the phone.

Firmware updates are available on the Ford SYNC website; download the update to a USB drive and plug into the USB port. Login to the Ford site is required including the car's VIN. That the firmware can be updated that way indicates there is an autoplay function of some type, which would also indicate there is a route for exploits.

Interestingly, some SYNC forum sites have a lot of anti-hacking FUD and rhetoric on them. Most of it is along the lines of "SYNC is hooked into your [engine/OBD-II/transmission/ABS brake] on-board computer and if you hack it, then [the engine won't start/your brakes will fail/the warranty will be voided] and you will [be stranded/die horribly/get nasty letters from Bill Gates, Bill Ford, and some brutish DCMA lawyers]!!!"

Frankly, I'm doubtful there is really much to do if an exploit can be found, although I still plan on poking around with it. I can't see Ford putting any direct path between the SYNC and any other on-board control systems, mainly for safety reasons.

BTW, cars have had black boxes for years. Most OBD-II computers out there record the last 30 minutes of things like braking and acceleration, and police routinely download the data for serious accidents.

streaker69 · 03-15-2010

Quote:

Originally Posted by Thorn

BTW, cars have had black boxes for years. Most OBD-II computers out there record the last 30 minutes of things like braking and acceleration, and police routinely download the data for serious accidents.

I realize that and have known that for years, my only real concern here is now that the feds pretty much own GM the abuses are going to start. It's only a short step between blackboxen and Onstar being linked together in a live manner.

I know TFB stuff, right? But before GM was bought out by the Feds, OnStar was very adamant about not using their system to end chases track vehicles and such. There were several articles about it. It was only a month after the buyout that the commercials started showing up about Onstar stopping a high speed chase.

This kind of access by the government is wide open to abuse of liberties. What'll be next? Them saying you can only put so many miles on your car a week, restricted travel between states, warrentless tracking of citizens via the Onstar system? After all, you have no idea when that system could be turned on.

To me, it all seems wide open to be abused.

theprez98 · 03-15-2010

Note to people selling your car with bluetooth-enabled everything: you might want to clear out your entire synced phonebook and saved GPS locations. Just sayin...

Thorn · 03-15-2010

Quote:

Originally Posted by streaker69

I realize that and have known that for years, my only real concern here is now that the feds pretty much own GM the abuses are going to start. It's only a short step between blackboxen and Onstar being linked together in a live manner.

I know TFB stuff, right? But before GM was bought out by the Feds, OnStar was very adamant about not using their system to end chases track vehicles and such. There were several articles about it. It was only a month after the buyout that the commercials started showing up about Onstar stopping a high speed chase.

This kind of access by the government is wide open to abuse of liberties. What'll be next? Them saying you can only put so many miles on your car a week, restricted travel between states, warrentless tracking of citizens via the Onstar system? After all, you have no idea when that system could be turned on.

To me, it all seems wide open to be abused.

It's already wide open to being abused. Actually, GM's denial of tracking and ending chases was pure bull, they were doing that before, but just didn't want to admit it to the public. If anything, at this point they're being more honest about what they do.

OnStar can also listen into any conversation in the vehicle at any time, and the occupants have no indication that it's occurring. Think about that the next time you want to by a GM vehicle.

streaker69 · 03-15-2010

Quote:

Originally Posted by Thorn

It's already wide open to being abused. Actually, GM's denial of tracking and ending chases was pure bull, they were doing that before, but just didn't want to admit it to the public. If anything, at this point they're being more honest about what they do.

OnStar can also listen into any conversation in the vehicle at any time, and the occupants have no indication that it's occurring. Think about that the next time you want to by a GM vehicle.

Every vehicle I've owned except for 1 has been a GM. That is going to change. I will not buy another GM. I'm glad that Ford didn't go the same route as GM, I guess if I want to buy American now I'll have to get a Ford, even though I don't like them that much.

theprez98 · 03-15-2010

Quote:

Originally Posted by streaker69

Every vehicle I've owned except for 1 has been a GM. That is going to change. I will not buy another GM. I'm glad that Ford didn't go the same route as GM, I guess if I want to buy American now I'll have to get a Ford, even though I don't like them that much.

IMO the whole "Buy American" deal is nonsense. For example, many of the vehicles Toyota sells in the US are made in the US (they just built a plant in San Antonio to make the Tundra). On the other hand, Ford makes a lot of its vehicles in Mexico. I owned an Isuzu Rodeo that was made in Indiana on the same manufacturing line as Hondas.

streaker69 · 03-15-2010

Quote:

Originally Posted by theprez98

IMO the whole "Buy American" deal is nonsense. For example, many of the vehicles Toyota sells in the US are made in the US (they just built a plant in San Antonio to make the Tundra). On the other hand, Ford makes a lot of its vehicles in Mexico. I owned an Isuzu Rodeo that was made in Indiana on the same manufacturing line as Hondas.

My Jimmy was made in NJ, and I understand what you're saying, but I just don't really like the feel of Toyota's or Isuzu's. There's just something about them in the way that they feel when driving that I don't like.

renderman · 03-15-2010

I think you'll find that no matter where things are built, everything will generally suck. If you've got any company wanting to improve their bottom line, the first thing to go is quality.

Made in America, Mexico, Canada, India, doesn't matter. Parts are generally sourced from the lowest bidder and from a dozen other countries, so whoever assembles it, the parts are all from the same crap.

03-14-2010	#1 (permalink)
Airstreamer Sniffin' the aether Join Date: Nov 2004 Location: A little North of Reason Posts: 2,838	Found On Road Dead Hack a firewall, kill an engine? Ford preps anti-hacking tech for in-car WiFi __________________ "America is at that awkward stage. It's too late to work within the system, but too early to shoot the bastards.." - Claire Wolfe, 101 Things to Do 'Til the Revolution

03-15-2010	#2 (permalink)
Barry Managing the iTards. Join Date: Dec 2002 Location: Ohio Posts: 6,049	At least they're planning security at the start and not until something bad happens. __________________ Never do anything you don't want to explain to the paramedics.

03-15-2010	#8 (permalink)
Thorn Did you do the math? Join Date: Apr 2002 Location: Villa Straylight Posts: 10,494	My 2010 Explorer came in last week. It has SYNC on it, and I've started researching it. In a nutshell, SYNC is basically a WinCE variant, which has Bluetooth, voice command, USB I/O, and is run through the entertainment center. Bluetooth security is good. To sync a Bluetooth device, the system generates a random 8-digit access number. Voice command is pretty good, and it can directly run USB devices (including my iPod; the screen changes to a Ford emblem. ) Plain old USB drives can also be accessed directly for music, via the voice command. Crash detection/airbag deployment will use any synced BT cellphone to dial 911 if SYNC sees the phone. Firmware updates are available on the Ford SYNC website; download the update to a USB drive and plug into the USB port. Login to the Ford site is required including the car's VIN. That the firmware can be updated that way indicates there is an autoplay function of some type, which would also indicate there is a route for exploits. Interestingly, some SYNC forum sites have a lot of anti-hacking FUD and rhetoric on them. Most of it is along the lines of "SYNC is hooked into your [engine/OBD-II/transmission/ABS brake] on-board computer and if you hack it, then [the engine won't start/your brakes will fail/the warranty will be voided] and you will [be stranded/die horribly/get nasty letters from Bill Gates, Bill Ford, and some brutish DCMA lawyers]!!!" Frankly, I'm doubtful there is really much to do if an exploit can be found, although I still plan on poking around with it. I can't see Ford putting any direct path between the SYNC and any other on-board control systems, mainly for safety reasons. BTW, cars have had black boxes for years. Most OBD-II computers out there record the last 30 minutes of things like braking and acceleration, and police routinely download the data for serious accidents. __________________ Thorn "Read Altas Shrugged. Compare it to today. Repeat as necessary"

03-15-2010	#10 (permalink)
theprez98 SpoonfeederExtraordinaire Join Date: Jan 2005 Location: Maryland Posts: 3,762	Note to people selling your car with bluetooth-enabled everything: you might want to clear out your entire synced phonebook and saved GPS locations. Just sayin... __________________ "\x74\x68\x65\x70\x72\x65\x7a\x39\x38";

03-15-2010	#15 (permalink)
renderman Drunken Stumbler Join Date: Jun 2002 Location: Anywhere but Utah Posts: 1,907	I think you'll find that no matter where things are built, everything will generally suck. If you've got any company wanting to improve their bottom line, the first thing to go is quality. Made in America, Mexico, Canada, India, doesn't matter. Parts are generally sourced from the lowest bidder and from a dozen other countries, so whoever assembles it, the parts are all from the same crap. __________________ Never drink anything larger than your head! Scaramental Wine Taster for the Church Of WiFi Buy our books! "I reject your reality, and substitute my own!" – Adam Savage CoWF WPA Hash Tables

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode