Could Michael Hasting's car crash have been caused by a remote attack? Technically, yes

BY ANDREW LEONARD | TUESDAY, JUN 25, 2013 | Salon

Modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled bydozens of digital computers coordinated via internal vehicular networks. While this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks… We demonstrate that an attacker who is able to infiltrate virtually any Electronic Control Unit (ECU) can leverage this ability to completely circumvent a broad array of safety-critical systems. Over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input — including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on.

We have endeavored to comprehensively assess how much resilience a conventional automobile has against a digital attack mounted against its internal components. Our findings suggest that, unfortunately, the answer is “little.”

The researchers’ findings are not theoretical. They were able to attack a 2009 model sedan and render its brakes ineffective while a test driver was operating the car.

The computerization of the modern car has been aggressively evolving for decades. (Ironically, the researchers credit California’s clean air laws in the 1970s with providing the first incentive for moving car engines into the digital era.) But it might come as a surprise to the average person just how interconnected and accessible today’s high tech cars are. “Such [computer] systems have been integrated into virtually every aspect of a car’s functioning and diagnostics, including the throttle, transmission, brakes, passenger climate and lighting controls, external lights..”

There turn out to be multiple pathways for car hackers. Diagnostic tools used by mechanics can give hackers laptop access to critical systems. If an attacker is able to get a music file preloaded with malware onto your iPod, just plugging it into car’s USB port could give that attacker full access. Nearly all new cars now have two-way cellular capability necessary for such systems as GM’s On-Star that are purposely designed to faciliate access to all important systems.

Your car, ultimately, might be more vulnerable to attack than your computer or smartphone, because there’s little evidence that there has been any systematic thought devoted to vehicle cyber-security. Quite the opposite. Cars are increasingly designed to allow remote access via a variety of input systems.

Just one more reason why we should all be riding bikes.