Twitter | Search | |
This is the legacy version of twitter.com. We will be shutting it down on 15 December 2020. Please switch to a supported browser or device. You can see a list of supported browsers in our Help Center.
Charlie Miller
Cool new research out on car hacking: . Hang on or mute as I'll give my thoughts on it.
Reply Retweet Like More
Charlie Miller 30 Apr 18
Replying to @0xcharlie
They looked at 2015 vehicles. This is a big difference between car hacking and, say, browser hacking. 2015 is an old browser, but still a pretty new car.
Reply Retweet Like
Charlie Miller 30 Apr 18
Replying to @0xcharlie
These cars didn't have Over The Air (OTA) updates for their headhunts. If your device talks to the internet, it should be updatable over the internet.
Reply Retweet Like
Charlie Miller 30 Apr 18
Replying to @0xcharlie
They don't report the vulnerability details because it would be "irresponsible". We reported full details and nobody ever got hacked by them in the last 3 years but :shrug:
Reply Retweet Like
Charlie Miller 30 Apr 18
Replying to @0xcharlie
They found a remote vulnerability in Audi head units but "An attacker can only abuse this vulnerability if the owner has the Audi connect service, and the ISP in the country of the owner allows client-to-client communication, or hands out public IPv4 addresses."
Reply Retweet Like
Charlie Miller 30 Apr 18
Replying to @0xcharlie
Again, the architecture of the headunit was QNX talking to a v850 chip over serial. Again, it seems you could reflash the v850 chip. They did not do this but speculated it was possible.
Reply Retweet Like
Charlie Miller 30 Apr 18
BTW tesla (and jeep) have the same architecture. research was similar in they didn't bypass the v850, but later did exactly that like we did for Jeep.
Reply Retweet Like
Charlie Miller 30 Apr 18
Replying to @0xcharlie
Unlike Tesla and Jeep, the Audi's architecture separated the components from the High Speed bus where brakes/steering/etc live. This would have required ANOTHER exploit to bypass. The researchers did not bypass this either.
Reply Retweet Like
Charlie Miller 30 Apr 18
Replying to @0xcharlie
In summary: cool research, hat-tip from me. Remote vulnerability in some cases on the Internet. Remote vulnerability over Wifi if you can join the network. However, quite a ways from cyber physical control of vehicle. Keep up the research everyone!
Reply Retweet Like
Charlie Miller 30 Apr 18
Replying to @0xcharlie
Remember car hacking research helps keep cars safer! Rock on hackers!
Reply Retweet Like
Imo 1 May 18
Replying to @0xcharlie
Man thanks for sharing very interesting. Btw your research was nuts!
Reply Retweet Like