Securing the Connected Car
summary
2015 Jeep Cherokee researchers chain a remote compromise from Wi‑Fi to cellular by exploiting a predictable Wi‑Fi key (unit boots to Jan 1 2013 time window), find DBus over TCP on port 6667 and use four lines of Python to escalate to root, then flash an unsigned V5850 firmware to gain CAN bus control; result is a 1.4 million vehicle recall and proof that lack of OTA + no signature checks enables full-vehicle takeover.
AI-written summary · about
chapters (22)
- 0:00Intro
- 2:31About me
- 3:53Session overview
- 4:50Software defined car: New revenue streams
- 6:20Cost savings by using open source platforms
- 8:42The software defined car requires OTA updates
- 10:01Jeep Cherokee hacked in July 2015
- 11:17Jeep Cherokee architecture
- 15:22Jeep Cherokee Head Unit with WiFi
- 16:21Wifi-based breach: Short-range
- 20:37Cellular-based breach: Country-wide
- 22:23The Controller Area Network (CAN) bus
- 23:09CAN bus
- 24:03Putting it together
- 26:02More complexity leads to larger attack surface
- 31:12Security patching is done too late
- 32:00Why security patching happens too late
- 33:33Patching connected devices is harder
- 34:57Generic embedded updater workflow
- 40:08Why automated rollback is important
- 40:59Prepare for securing the software defined car
- 41:43The best way to respond to hacking?
related talks
41mKeynote Presentation: Ten Years After the Jeep Hack: A Retrospective on...
40mSecuring the Connected Car
43mSecuring the Connected Car
20mSecurity and Safety in the Modern Vehicles
40mD2T1 - Backdooring & Remotely Controlling Cars
50mAdvanced CAN Injection Techniques for Vehicle Networks
58mA Survey of Remote Automotive Attack Surfaces
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking