Earlier this year, researchers from the University of Washington and the University of California, San Diego showed that they could take over the control systems of a popular model of automobile, causing the brakes to lock or the engine to cut out.
“The security and privacy problems that the authors identify in TPMS systems are likely just one among many that will challenge the automotive industry in the years to come,” says Stefan Savage, a UC San Diego professor of computer science and engineering and an author of the earlier report.
ECUs entered production vehicles in the 1970s, following the California Clean Air Act and a surge in gas prices. At first, the systems were just used to adjust the fuel-oxygen mix using data from the vehicle’s exhaust. But the use of ECUs has expanded since then, and today they are used in every aspect of monitoring and controlling automobiles. ECUs are responsible for a feature known as roll stability control–they can apply the brakes, reduce the throttle, and modulate the steering to keep a car from rolling over.
The South Carolina-Rutgers team stresses that it would be difficult to attack a car through the wireless tire system. One hurdle is that the tire sensors communicate infrequently–about once every 60 to 90 seconds–making it difficult to manipulate the system, especially if a vehicle is moving. They were able to overcome these hurdles, however, by shadowing a target vehicle, and using directional antennas.
Even so, UCSD’s Savage stresses that car-hacking is a theoretical threat for the moment. “One shouldn’t overreact to this kind of news,” says Savage. “It’s not the case, for example, that the authors have identified a means by which the TPMS channel can remotely compromise safety-critical systems, nor is there any evidence that this channel is being targeted, or even that there is a clear threat of it being a likely target in the near-term.”
Savage says his group has entered discussions with the “appropriate stakeholders” regarding the exploits they discovered. The South Carolina-Rutgers team has had no luck so far in contacting carmakers.
The Alliance of Automobile Manufacturers will take the appropriate steps to secure its vehicles, says spokesman Wade Newton. “While this concern isn’t unique to autos, we continue looking at this issue–before it becomes a problem,” he says.