OBD II a Security Threat Vector?

[spp]

I’m not talking about an attack against Ford. For example, one potential attack I was proposing was malevolent to a “botnet” attack. A malicious actor loads malicious software (say, via a really cool “free” OBD II scanner on the Google Android store) through the OBD II port to autos where it sits quietly. It then just sits quietly in different EVs, including the Mustang Mach E, until it’s triggered. We’ve already seen these attacks happen on platforms in other industries so this is NOT “hypothetical”. Do you want to hop in your Mustang Mach E one morning to be greeted by a screen demanding X BitCoin to be sent to some silly URL before your $60,000 brick moves?

I would be very surprised if Ford didn't require signed firmware for the ECUs and a few levels of authentication between the device and ECU before allowing a firmware upload. At best, I can see the OBD port being disabled for spewing garbage on the network, at worst, I can see the vehicle shutting down because of said garbage.

Sponsored

 

[GoGoGadgetMachE]

don't worry. nobody can hack cars. we're all too good to have that problem.
[voice in ear]
free-fall-hacking-tesla-from-wireless-to-can-bus (blackhat.com)
oh never mind

 

[spp]

Does the presence of an accessible OBD II port pose a greater security threat on a heavily software driven car, like the Mustang Mach E, than a conventional car? What steps are taken to prevent a malevolent actor from using the OBD II port to inject malicious software? Or use the OBD II port to extract private information (such as driving history)?
I seem to recall I video not long ago, where some people demonstrated a proof of concept where they were able to take over control of steering acceleration and braking of a conventional car remotely. I’m hoping that Ford has tightly locked everything down so only authorized users can get into the car systems.

This was us and a Jeep Cherokee. This was way back when connected vehicles were in their infancy and group that didn't deal with computer security on a regular basis designed and built the connected vehicle system and forgot to lock the system down. I can go into details as the hack has been pretty thoroughly documented on the internet and at industry conferences.

That day was a wakeup call and the way we (and the industry) does business completely changed.

 

[Jimrpa]

This was us and a Jeep Cherokee. This was way back when connected vehicles were in their infancy and group that didn't deal with computer security on a regular basis designed and built the connected vehicle system and forgot to lock the system down. I can go into details as the hack has been pretty thoroughly documented on the internet and at industry conferences.

That day was a wakeup call and the way we (and the industry) does business completely changed.

Thanks for sharing the real-world insight! I know people must think I run around with a tinfoil hat - I don’t, but I work in a very security conscious organization ?

Sponsored