Digital computers at the heart of modern cars can be infiltrated and controlled by hackers, says a report from the Center for Automative Embedded Systems Security (CAESS).
Researchers at the CAESS used two cars of the same make and model from 2009 that they elevated on jacks before running their tests. Other tests were done running the cars on closed courses.
The report says they set out to “assess how much resilience a conventional automobile has against a digital attack mounted against its internal components. Our findings suggest that, unfortunately, the answer is ‘little.’”
By hacking the cars, they were able to “systematically control” different parts, including the engine, brakes, heating, cooling, lights, instrument panel, radio, locks, and other areas.
“Combining these we have been able to mount attacks that represent potentially significant threats to personal safety,” says the report.
Researchers were able to “forcibly and completely disengage the brakes while driving,” and they were also able to make the car abruptly hit the brakes and cause it to stop suddenly, which could potentially slam the driver forward.
According to the report, there are more than 250 million registered passenger automobiles in the United States, of which the “vast majority” are computer controlled to some degree. It adds that “virtually all new cars are now pervasively computerized.”
The digital Engine Control Units (ECUs) began making their way into vehicles in the late 1970s and were used to adjust the fuel-oxygen mixture in the cars. Later, the systems were “integrated into virtually every aspect of a car’s functioning and diagnostics,” which led to the units being renamed as Electronic Control Units, says the report.
The CAESS is a collaboration of researchers at the University of California San Diego and the University of Washington, according to their website.
Although their findings raise new concerns about vulnerabilities in cars, their website states that “car owners today should not be overly concerned at this time,” on grounds that “it requires significant sophistication to develop the capabilities described in our paper and we are unaware of any attackers who are even targeting automobiles at this time.”
“However, we do believe that our work should be read as a wake-up call,” says the website.
