Incident: OnStar RemoteLink Vulnerability Allows Unauthorized Control of GM Vehicles

Published Date: 2015-07-30

Postmortem Analysis
Timeline 1. The software failure incident happened in July 2015. [37647, 37994, 38051]
System 1. OnStar RemoteLink app for iPhone [37647, 37994, 38051] 2. OnStar RemoteLink system [37994, 38051]
Responsible Organization 1. General Motors (GM) - GM's OnStar RemoteLink app for iPhone had a security vulnerability that allowed hackers like Samy Kamkar to track vehicles, unlock doors, start ignitions, and access personal information [37647, 37994, 38051].
Impacted Organization 1. General Motors (GM) [37647, 37994, 38051]
Software Causes 1. The software vulnerability in GM's OnStar RemoteLink app for iPhone allowed hackers to track vehicles, unlock doors, start ignitions, and access personal information [37647, 37994, 38051]. 2. An authentication flaw in GM's app allowed hackers to intercept user credentials and take control of the vehicle remotely [37647, 37994]. 3. The RemoteLink app did not properly check the certificate ensuring secure communication, enabling a man-in-the-middle attack [37994]. 4. GM's initial fix through a change in server software was incomplete, requiring further updates to the RemoteLink app on iOS [37647, 37994, 38051].
Non-software Causes 1. Lack of proper authentication in the OnStar RemoteLink app, allowing for interception of user credentials and unauthorized access to vehicle functions [37647, 37994, 38051] 2. Vulnerabilities in the OnStar system's communication protocols, enabling unauthorized control of vehicles [37647, 37994, 38051] 3. Insufficient security measures in internet-connected cars, making them susceptible to hacking [37647, 37994, 38051]
Impacts 1. The software failure incident allowed hackers to track GM vehicles, unlock their doors, start their ignitions, and access car owners' personal information, including email and address [37647, 37994]. 2. The vulnerability in the OnStar RemoteLink app could lead to potential theft, privacy breaches, and unauthorized access to the user's OnStar account information [37647, 37994]. 3. The incident raised concerns about the security of internet-connected cars and highlighted the lack of cybersecurity measures in the automotive industry [37647, 37994]. 4. The software failure incident demonstrated the risks associated with the increasing connectivity of vehicles and the potential for digital attacks on cars [37994]. 5. GM had to issue a software update for its RemoteLink app on iOS to fully mitigate the risk posed by the vulnerability [37647, 37994]. 6. The incident prompted GM to take immediate action to secure its back-office system and reduce the risk posed by the software vulnerability [38051]. 7. The software failure incident highlighted the need for enhanced security measures in in-vehicle and connected vehicle systems to prevent cybersecurity threats [38051].
Preventions 1. Regular security audits and testing of the software to identify vulnerabilities before they can be exploited by hackers could have prevented the software failure incident [37647, 37994, 38051]. 2. Implementing proper authentication mechanisms in the app to ensure secure communication between the user's device and the server could have prevented unauthorized access and data interception [37647, 37994, 38051]. 3. Ensuring that the software checks certificates properly to prevent man-in-the-middle attacks could have enhanced the security of the system and prevented the hack [37994]. 4. Timely and effective communication between security researchers like Samy Kamkar and the company, in this case, GM, to address and fix identified vulnerabilities promptly could have prevented the software failure incident [37647, 37994, 38051]. 5. Continuous monitoring and updating of the software to address new security threats and vulnerabilities could have helped prevent the exploit demonstrated by Kamkar [37647, 37994, 38051].
Fixes 1. An update to the OnStar RemoteLink iOS app [37647, 37994, 38051] 2. A change to GM's server software [37647, 37994] 3. Enhanced security measures implemented by GM [37994] 4. A patch for the vulnerability identified by Samy Kamkar [37994] 5. An app update for the iOS platform [38051]
References 1. Security researcher Samy Kamkar [37647, 37994, 38051] 2. GM OnStar [37647, 37994, 38051] 3. GM spokesperson Renee Rashid-Merem [37647, 37994] 4. GM's OnStar twitter account [37647] 5. WIRED [37647, 37994] 6. CNET [38051]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to GM OnStar's RemoteLink app vulnerability has happened again within the same organization. Security researcher Samy Kamkar discovered a vulnerability in GM's OnStar RemoteLink system, allowing hackers to track vehicles, unlock doors, start ignitions, and access personal information [37647, 37994, 38051]. Despite GM issuing fixes, Kamkar found the initial fix to be incomplete, prompting further updates to the RemoteLink app [37994, 38051]. This incident highlights the ongoing challenges faced by GM in securing its connected car systems. (b) The software failure incident involving car hacking and vulnerabilities in connected car systems has also been observed at other organizations. For example, security researchers Charlie Miller and Chris Valasek demonstrated wireless hacking of a 2014 Jeep Cherokee, leading to a recall of 1.4 million Chrysler vehicles [37647, 37994]. Kamkar's research indicates that vulnerabilities in connected car systems are not unique to GM OnStar and that other automakers may also have similar issues [37994]. This broader trend underscores the cybersecurity risks associated with internet-connected vehicles across the automotive industry.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase: - The software vulnerability in GM's OnStar RemoteLink app for iPhone was exploited by security researcher Samy Kamkar, allowing hackers to track vehicles, unlock doors, start ignitions, and access personal information [37647]. - GM initially attempted to fix the flaw through a change to its server software but later had to create a patch for its iOS app after Kamkar pointed out that the attack wasn't blocked in subsequent tests [37647]. - Kamkar developed a proof-of-concept device called "OwnStar" to exploit an authentication flaw in the app, intercept user credentials, and take full control of the vehicle [37647]. - GM released an update for the RemoteLink app to fully protect vehicles and communicated with impacted customers to ensure security [37647]. - GM acknowledged the need for an enhanced RemoteLink app to fully mitigate the risk and worked on securing the back-office system and reducing risk [38051]. (b) The software failure incident related to the operation phase: - Kamkar demonstrated that with his OwnStar device, a hacker could track a car, unlock doors, start the ignition, and access personal information through the OnStar account [37994]. - The OwnStar device exploited a vulnerability in GM's app to steal user credentials and send the data to the hacker, allowing full control of the vehicle [37994]. - GM confirmed that the initial fix to the OnStar system was not successful, and an app update was required to fully mitigate the risk [38051]. - GM emphasized the importance of customer safety and security, working with the researcher to secure the back-office system and reduce risk, and planning to release an enhanced RemoteLink app to address the vulnerability [38051].
Boundary (Internal/External) within_system, outside_system (a) The software failure incident related to the GM OnStar vulnerability can be categorized as within_system. The vulnerability was due to an authentication flaw in the OnStar RemoteLink app, which allowed a hacker to intercept user credentials and take full control of the vehicle [37647, 37994, 38051]. The issue originated from within the system's software design and implementation, leading to potential security risks for users of GM vehicles equipped with OnStar technology. The fix for the vulnerability required updates to the server software and the RemoteLink app itself to address the flaw [37647, 37994, 38051]. (b) Additionally, the software failure incident can also be considered as outside_system to some extent. The vulnerability exposed by security researcher Samy Kamkar highlighted the risks associated with internet-connected cars and the broader implications of cybersecurity in the automotive industry [37647, 37994, 38051]. The incident demonstrated how external factors, such as the increasing connectivity of vehicles and the evolving landscape of cyber threats, can impact the security of software systems within the automotive sector. The need for enhanced security measures and vigilance against external threats was emphasized in response to the incident [37647, 37994, 38051].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident in the articles was primarily due to a security vulnerability in GM's OnStar RemoteLink app that could be exploited by a device called OwnStar, created by security researcher Samy Kamkar. This device could intercept communications between the app and OnStar-equipped cars, allowing unauthorized access to various functions like tracking, unlocking doors, starting the ignition, and accessing personal information [37647, 37994, 38051]. (b) The software failure incident occurring due to human actions: - The failure was exacerbated by human actions as GM initially attempted to fix the flaw through a change to its server software but the fix was incomplete. Subsequently, GM had to issue an app update for the iOS platform to fully address the vulnerability. Additionally, security researcher Samy Kamkar played a crucial role in identifying and demonstrating the vulnerability, highlighting the need for better cybersecurity practices in the automotive industry [37647, 37994, 38051].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The software failure incident reported in the articles is related to a hardware device called OwnStar, developed by security researcher Samy Kamkar, which was used to intercept communications between GM's OnStar RemoteLink app and OnStar-equipped cars [Article 38051]. - OwnStar, a device created by Kamkar, was designed to be hidden under the chassis or bumper of a GM vehicle to intercept user credentials and send them wirelessly to a hacker, allowing unauthorized access to the vehicle's functions [Article 37647]. - The OwnStar device used a Raspberry Pi computer and wireless adapters packed into a small protective case to capture commands sent from the user's smartphone and exploit vulnerabilities in GM's app [Article 37994]. (b) The software failure incident occurring due to software: - The software failure incident was primarily caused by vulnerabilities in GM's OnStar RemoteLink app, which allowed the OwnStar device to exploit an authentication flaw in the app to steal user credentials and control the vehicle remotely [Article 37647]. - GM initially attempted to fix the issue through a change to its server software and an update to the RemoteLink app for iOS, but the fix was incomplete, leading to the need for further app updates to fully mitigate the risk [Article 38051]. - The vulnerability in the OnStar RemoteLink app, not specific to any vehicle, allowed Kamkar to demonstrate the attack on a friend's 2013 Chevy Volt and potentially affect any RemoteLink-enabled vehicle, highlighting software weaknesses in the app [Article 37994].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in the articles is malicious in nature. Security researcher Samy Kamkar developed a device called OwnStar that could intercept communications between GM's OnStar RemoteLink app and OnStar-equipped cars, allowing a hacker to track vehicles, unlock doors, trigger the horn, start the engine, and access personal information [37647, 37994, 38051]. Kamkar demonstrated how the OwnStar device could exploit vulnerabilities in GM's app to steal user credentials and take full control of the vehicle [37647, 37994]. The incident was part of a series of car hacks revealed by researchers leading up to hacker conferences, highlighting the vulnerabilities in internet-connected cars [37647, 37994]. (b) The software failure incident was non-malicious in the sense that the vulnerabilities exploited by Kamkar were not intentionally introduced by GM or the users. GM responded by issuing software updates to patch the security vulnerabilities in its RemoteLink app for different platforms [37647, 37994, 38051]. The company acknowledged the issue and worked to secure its systems and reduce risks, indicating a non-malicious intent to address the software flaws [38051].
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident related to poor_decisions: - The software failure incident related to the OnStar vulnerability in GM vehicles was not due to poor decisions but rather due to security vulnerabilities that were exploited by a security researcher, Samy Kamkar. GM responded to the vulnerability by issuing software updates to patch the security flaws [37647, 37994, 38051]. (b) The intent of the software failure incident related to accidental_decisions: - The software failure incident was not due to accidental decisions but rather due to the discovery of security vulnerabilities in GM's OnStar RemoteLink system by security researcher Samy Kamkar. The incident highlighted the vulnerabilities in internet-connected cars and the need for enhanced cybersecurity measures [37647, 37994, 38051].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development incompetence: - The software failure incident involving GM OnStar's RemoteLink app was due to a security vulnerability that allowed hackers to track vehicles, unlock doors, start ignitions, and access personal information [37647]. - GM initially attempted to fix the flaw through a change to its server software but later had to create a patch for its iOS app as well after the initial fix was found to be insufficient [37647]. - Despite GM's efforts to resolve the issue, the security researcher Samy Kamkar was still able to exploit the vulnerability and steal app credentials with his OwnStar device, highlighting the development incompetence in ensuring the software's security [37647]. - GM acknowledged the incomplete fix and had to release an app update for the iOS platform to fully address the vulnerability [38051]. (b) The software failure incident occurring accidentally: - The software failure incident involving GM OnStar's RemoteLink app was accidental in the sense that the vulnerability was not intentionally created but was a result of an authentication flaw in the app that allowed for interception of user credentials [37994]. - The hacker, Samy Kamkar, demonstrated how the OwnStar device could exploit this vulnerability to intercept communications between the app and OnStar-equipped cars, indicating an accidental oversight in the app's design [38051]. - GM responded promptly to the incident, indicating that they were not aware of the vulnerability beforehand, suggesting that the flaw was accidental rather than intentional [38051].
Duration temporary (a) The software failure incident in the articles appears to be temporary. The incident involved a security vulnerability in GM's OnStar RemoteLink app for iPhone that allowed hackers to track vehicles, unlock doors, start ignitions, and access personal information [37647, 37994, 38051]. GM initially attempted to fix the flaw through a change to its server software but later had to create a patch for its iOS app as well [37647]. The fix was incomplete initially, and GM had to issue an app update for the iOS platform to fully resolve the issue [38051]. Additionally, the hacker behind the exploit, Samy Kamkar, demonstrated the vulnerability with a proof-of-concept device and planned to present the details at the DefCon hacker conference [37647, 37994]. The incident was actively being addressed and updated by GM and the security researcher, indicating that it was not a permanent failure.
Behaviour omission, value, other (a) crash: The software failure incident in the articles does not involve a crash where the system loses state and does not perform any of its intended functions. (b) omission: The software failure incident involves omission where the system omits to perform its intended functions at an instance(s). The vulnerability allowed a hacker to intercept communications and issue commands through the OnStar RemoteLink app to control features of GM vehicles, such as unlocking doors and starting the engine [37994]. (c) timing: The software failure incident does not involve a timing issue where the system performs its intended functions correctly but too late or too early. (d) value: The software failure incident involves a value issue where the system performs its intended functions incorrectly. The vulnerability allowed unauthorized access to GM vehicles, enabling actions like tracking the vehicle, unlocking doors, starting the ignition, and accessing personal information [37647, 37994, 38051]. (e) byzantine: The software failure incident does not involve a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior observed in the software failure incident is a security vulnerability that allowed a hacker to exploit an authentication flaw in the OnStar RemoteLink app, leading to unauthorized access and control of GM vehicles [37647, 37994, 38051].

IoT System Layer

Layer Option Rationale
Perception sensor, processing_unit, network_communication, embedded_software (a) sensor: The software failure incident was related to a vulnerability in GM's OnStar RemoteLink app that allowed a hacker to intercept communications between the app and the OnStar-equipped car, enabling unauthorized access and control over the vehicle [37994, 38051]. (b) actuator: The incident did not specifically mention any failure related to actuator errors. (c) processing_unit: The vulnerability exploited by the hacker was related to an authentication flaw in GM's RemoteLink app, allowing the hacker to steal user credentials and take full control of the vehicle's functionalities [37994, 38051]. (d) network_communication: The failure involved intercepting communications between the user's smartphone and the OnStar server, exploiting a vulnerability in the app's communication protocol [37994, 38051]. (e) embedded_software: The vulnerability in the OnStar RemoteLink app, which allowed the hacker to take control of the vehicle, was a result of a flaw in the app's embedded software that did not properly check the certificate ensuring secure communication [37994].
Communication connectivity_level The software failure incident reported in the articles was related to the communication layer of the cyber-physical system that failed at the connectivity level. The failure was due to contributing factors introduced by the network or transport layer. The incident involved a vulnerability in GM's OnStar RemoteLink app that allowed a security researcher, Samy Kamkar, to intercept communications between the app and OnStar-equipped vehicles. Kamkar developed a device called OwnStar, which exploited a vulnerability in GM's app to steal user credentials and take full control of the vehicle remotely. This exploit was achieved by impersonating a Wi-Fi network and intercepting commands sent from the user's smartphone to the app, allowing unauthorized access to various vehicle functions [37994, 38051]. The failure was not related to the physical layer but rather to the network layer where the vulnerability in the app's communication protocol allowed for unauthorized access and control of the vehicles.
Application TRUE The software failure incident described in the articles was related to the application layer of the cyber physical system. The failure was due to contributing factors introduced by bugs, operating system errors, unhandled exceptions, and incorrect usage. Samy Kamkar discovered a vulnerability in GM's OnStar RemoteLink app that allowed him to intercept communications and issue commands to GM vehicles [37994]. GM initially attempted to fix the issue with a change to its server software but later had to release an app update for the iOS platform to fully resolve the problem [37994]. The OwnStar device developed by Kamkar exploited a vulnerability in GM's app to steal user credentials and take control of the vehicles [37994]. This incident highlights the presence of bugs and vulnerabilities in the application layer of the system, leading to unauthorized access and control over the vehicles.

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence, other (a) death: People lost their lives due to the software failure - There is no mention of any deaths resulting from the software failure incident in the provided articles. (b) harm: People were physically harmed due to the software failure - There is no mention of any physical harm to individuals due to the software failure incident in the provided articles. (c) basic: People's access to food or shelter was impacted because of the software failure - There is no mention of people's access to food or shelter being impacted by the software failure incident in the provided articles. (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incident allowed a security researcher to intercept communications and potentially access personal information, such as email, address, and credit card details, stored in the user's OnStar account [37647, 37994]. (e) delay: People had to postpone an activity due to the software failure - There is no mention of people having to postpone activities due to the software failure incident in the provided articles. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incident affected GM vehicles equipped with OnStar RemoteLink, allowing potential unauthorized access to the vehicles' systems [37647, 37994, 38051]. (g) no_consequence: There were no real observed consequences of the software failure - The software failure incident had real observed consequences, such as the potential unauthorized access to GM vehicles and personal information stored in the OnStar account [37647, 37994, 38051]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The potential consequences discussed included the ability for a hacker to track vehicles, unlock doors, start ignitions, and access personal information stored in the OnStar account [37647, 37994, 38051]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - The software failure incident highlighted the vulnerability of internet-connected cars and the need for increased cybersecurity measures in the automotive industry [37647, 37994, 38051].
Domain transportation, health (a) The failed system was related to the transportation industry, specifically affecting General Motors' OnStar RemoteLink app for iPhone, which allowed users to track GM vehicles, unlock doors, start ignitions, and access personal information [37647, 37994, 38051]. (j) The incident also had implications for the health industry as it involved potential security vulnerabilities in the OnStar system, which provides security services and hands-free calling in vehicles, impacting the safety and security of car owners [38051]. (m) Additionally, the software failure incident was relevant to the technology industry, highlighting the cybersecurity challenges faced by automakers as vehicles become more connected to the internet and part of the Internet of Things [37994, 38051].

Sources

Back to List