Incident: Wireless Hacking of Vehicles via Insecure OBD2 Dongles.

Published Date: 2015-08-11

Postmortem Analysis
Timeline 1. The software failure incident happened in August 2015. [38900, 38980]
System 1. OBD2 dongles built by the France-based firm Mobile Devices and distributed by corporate customers like Metromile [38900, 38980] 2. Telematics dongles used for driver monitoring and connected to vehicles' electronic systems [38900, 38980] 3. Metromile Pulse dongles used for tracking cars and charging drivers on a per-mile basis [38900] 4. Progressive Snapshot device for telematics-based insurance [38900] 5. Zubie OBD2 device for personal tracking of driving efficiency [38900]
Responsible Organization 1. Mobile Devices - The software failure incident was caused by vulnerabilities in the OBD2 dongles built by Mobile Devices, which allowed hackers to wirelessly access critical driving functions in vehicles [38900, 38980]. 2. Metromile - The dongles distributed by Metromile, a corporate customer of Mobile Devices, were found to be vulnerable to hacking, leading to the software failure incident [38900, 38980].
Impacted Organization 1. Metromile - The software failure incident impacted Metromile, an insurance company that distributed the vulnerable dongles to its customers as part of a pay-per-mile car insurance program [38900, 38980]. 2. Mobile Devices - The French manufacturer of the dongles, Mobile Devices, was also impacted by the software failure incident as their devices were found to have serious security vulnerabilities [38900, 38980].
Software Causes 1. Insecure software design and implementation in the OBD2 dongles, allowing for remote access and control of critical driving functions [38900, 38980] 2. Lack of authentication in the SMS commands sent to the dongles, enabling unauthorized access to the vehicle's electronic systems [38900, 38980] 3. Vulnerabilities in the firmware of the dongles, potentially allowing for rewriting of the firmware or issuing commands to the connected car [38900, 38980]
Non-software Causes 1. Lack of proper security measures in the design and implementation of the OBD2 dongles, making them vulnerable to hacking [38900, 38980]. 2. Insecure configuration of the telematics dongles, such as storing the same private key on every device, leaving them open to intrusion [38900, 38980]. 3. Vulnerabilities in the cellular-connected gadgets plugged into cars' sensitive components, allowing for unauthorized access and control of critical driving functions [38900, 38980]. 4. Use of insecure protocols like SMS for sending commands to the dongles without proper authentication [38900, 38980].
Impacts 1. The software failure incident allowed hackers to wirelessly access critical driving functions of vehicles, such as steering, brakes, windshield wipers, locks, steering, or transmission, through insecure internet-enabled gadgets plugged into cars' dashboards [38900, 38980]. 2. The vulnerability in the OBD2 dongles distributed by companies like Metromile and Mobile Devices exposed thousands of vehicles to potential remote attacks, posing a significant security risk to drivers [38900, 38980]. 3. The incident highlighted the broader issue of wirelessly hackable dongles plugged into cars' networks, indicating a systemic problem in the automotive industry with potentially insecure telematics devices [38900, 38980]. 4. The software failure incident raised concerns about the security of devices connected to vehicles, emphasizing the need for consumers and third-party OBD2 device firms to consider the security implications of the gadgets they use [38900, 38980]. 5. The incident demonstrated the potential for malicious actors to exploit vulnerabilities in telematics systems, raising alarms about the growing use of internet-connected dongles in vehicles, including those used by government fleets [38900].
Preventions 1. Implementing strong authentication mechanisms for sending commands to the OBD2 dongles, such as requiring secure tokens or encryption keys for authorization [38900, 38980]. 2. Conducting thorough security assessments and penetration testing on the devices before deploying them in vehicles to identify and address vulnerabilities [38900, 38980]. 3. Enforcing stricter regulations and standards for the security of internet-enabled gadgets plugged into cars' critical systems to prevent unauthorized access [38900, 38980].
Fixes 1. Implementing security patches to address vulnerabilities in the OBD2 dongles used in vehicles [38900]. 2. Ensuring that the devices connected to vehicles' networks have robust security measures in place to prevent unauthorized access and control [38900, 38980]. 3. Conducting thorough security assessments and testing on all internet-enabled gadgets and devices plugged into cars to identify and address security deficiencies [38900, 38980]. 4. Encouraging consumers and third-party OBD2 device firms to prioritize the security of the devices they connect to vehicles [38900, 38980]. 5. Regularly updating and monitoring the security of connected devices to mitigate the risk of potential hacks and unauthorized access [38900, 38980].
References 1. University of California at San Diego researchers 2. Metromile 3. Mobile Devices 4. Coordina 5. TomTom Telematics 6. Progressive 7. Argus 8. White House

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) In the articles, it is mentioned that the vulnerability related to the OBD2 dongles used for monitoring vehicles' location, speed, and efficiency was exploited by researchers at the University of California at San Diego in collaboration with the insurance startup Metromile [38900, 38980]. The dongles were found to have serious security deficiencies, allowing attackers to wirelessly access critical driving functions of vehicles. Metromile, the distributor of the dongles, responded to the vulnerability by issuing a security patch to all devices. However, the researchers found that thousands of still-hackable Mobile Devices dongles were visible, mostly in Spain, indicating that the issue may not have been completely resolved [38900, 38980]. (b) The articles also highlight that the problem of wirelessly hackable dongles plugged into cars' networks is not limited to Metromile or Mobile Devices. Other organizations, such as the insurance company Progressive offering similar telematics-based insurance using OBD2 plug-ins called the Snapshot, and the cybersecurity firm Argus with the Zubie OBD2 device, have also faced vulnerabilities in their products [38900, 38980]. This suggests that similar incidents of software vulnerabilities in OBD2 dongles have occurred across multiple organizations offering similar services.
Phase (Design/Operation) design, operation (a) The articles discuss a software failure incident related to the design phase. The incident involved vulnerabilities in internet-enabled gadgets plugged into cars' sensitive systems, such as the CAN bus, which controls the physical driving components. Researchers from the University of California at San Diego discovered security deficiencies in these gadgets, particularly in OBD2 dongles used by companies like Metromile and Mobile Devices. These dongles had multiple security flaws, including developer mode enabled, storing the same private key on every device, and accepting commands via SMS with virtually no authentication. This design flaw allowed hackers to wirelessly access and control critical driving functions of vehicles [38900, 38980]. (b) The articles also mention a software failure incident related to the operation phase. The vulnerability in the telematics dongles, particularly those distributed by Metromile and Mobile Devices, allowed hackers to exploit the devices by sending SMS instructions to a specific phone number. This operation-related failure enabled the researchers to take control of a Chevrolet Corvette, activating wipers, engaging brakes, and even disabling brakes at low speeds. The insecure configuration of the dongles, distributed to end-users in a "developer mode" with the same private keys stored insecurely on every device, made the operation of these devices susceptible to intrusion and manipulation [38900, 38980].
Boundary (Internal/External) within_system, outside_system From the provided articles, the software failure incident related to the vulnerability of OBD2 dongles used in cars can be categorized as both within_system and outside_system. 1. **Within_system**: The vulnerability and security flaws in the OBD2 dongles themselves, such as having developer mode enabled, storing the same private key on every device, and accepting commands via SMS with virtually no authentication, are factors originating from within the system [38900, 38980]. 2. **Outside_system**: The external factor contributing to the software failure incident is the potential insecurity of internet-enabled gadgets plugged into cars' sensitive systems. These gadgets, like the OBD2 dongles, are external devices that connect to the car's internal network and can be exploited by hackers to wirelessly access critical driving functions [38900, 38980].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident in the articles was primarily due to vulnerabilities in internet-enabled gadgets plugged into cars' sensitive systems, such as OBD2 dongles [38900, 38980]. - Researchers were able to wirelessly hack into vehicles through a tiny commercial device by sending carefully crafted SMS messages, enabling them to control critical driving functions like brakes and windshield wipers [38900]. - The vulnerabilities in the devices allowed for remote control of various vehicle components without human intervention, showcasing a non-human action leading to the software failure incident [38900, 38980]. (b) The software failure incident occurring due to human actions: - The software failure incident was exacerbated by human actions such as the distribution of insecure telematics dongles by companies like Mobile Devices and Metromile [38900, 38980]. - The devices were distributed in a "developer mode" with the same private keys stored insecurely on every device, leaving them open to intrusion once reverse engineered, indicating a human action contributing to the vulnerability [38980]. - While patches were implemented after the vulnerability was discovered, the incident highlights the importance of considering the security of devices connected to vehicles, emphasizing the role of human decision-making in ensuring software security [38900, 38980].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The incident involved a vulnerability in OBD2 dongles, which are hardware devices plugged into cars' dashboards to monitor vehicles' location, speed, and efficiency [38900]. - The vulnerability in the dongles allowed hackers to wirelessly access critical driving functions like brakes and steering through the dongles connected to the car's CAN bus, which controls its physical driving components [38900]. - The dongles had security deficiencies such as having the "developer" mode enabled, storing the same private key on every device, and accepting commands via SMS with virtually no authentication, making them vulnerable to attacks [38900]. - The vulnerability was not limited to a specific car model, as the researchers demonstrated the attack on a Chevrolet Corvette but mentioned that the issue could apply to practically any modern vehicle with the vulnerable dongles plugged into their dashboards [38900]. - The dongles were distributed by companies like Metromile and Mobile Devices, and while patches were issued for some devices, thousands of potentially vulnerable dongles from other distributors were still visible online [38900]. (b) The software failure incident occurring due to software: - The incident involved software vulnerabilities in the OBD2 dongles, allowing hackers to exploit security flaws in the software of the dongles to remotely control various functions of the connected vehicles [38900]. - The dongles were configured to accept commands via SMS with almost no authentication, indicating a software flaw in the design of the devices [38900]. - The researchers reverse-engineered the dongles and found multiple security bugs in the software, including the ability to rewrite firmware or issue commands to the connected car by sending texts to the devices from a specific phone number [38900]. - The vulnerability in the software of the dongles allowed for remote exploits and potential control over critical vehicle components like steering and brakes [38900]. - While patches were issued for some devices, concerns remained about the overall security of wirelessly hackable dongles plugged into cars' networks, indicating ongoing software-related vulnerabilities [38900].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident described in the articles is malicious in nature. Researchers from the University of California at San Diego demonstrated how they could wirelessly hack into vehicles through insecure internet-enabled gadgets plugged into cars' dashboards, allowing them to remotely control critical driving functions such as brakes, steering, and transmission [38900, 38980]. The vulnerabilities in the devices allowed for malicious commands to be sent via SMS messages, enabling attackers to take control of the vehicles' physical components [38900, 38980]. The incident involved exploiting security deficiencies in the devices to gain unauthorized access and manipulate the vehicles, indicating a malicious intent to harm the system. (b) The software failure incident is non-malicious as well. The vulnerabilities in the devices used for monitoring vehicles' location, speed, and efficiency were not intentionally introduced to harm the system but rather stemmed from security deficiencies in the design and implementation of the gadgets [38900, 38980]. The incident highlighted the risks associated with using insecure telematics dongles that could leave vehicles vulnerable to hacking, emphasizing the importance of considering the security of devices connected to vehicles [38900, 38980]. The vulnerabilities were not created with the intent to harm the system but rather resulted from inadequate security measures in the devices.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident described in the articles can be attributed to poor_decisions. The incident involved the exploitation of vulnerabilities in internet-enabled gadgets plugged into cars' sensitive systems, such as the OBD2 dongles used by insurance firms and trucking fleets to monitor vehicles [38900, 38980]. These gadgets had security deficiencies, including developer mode being enabled, storing the same private key on every device, and accepting commands via SMS with virtually no authentication. The vulnerabilities allowed hackers to wirelessly access critical driving functions, such as controlling the brakes, steering, and transmission of vehicles. Despite being notified of the vulnerabilities, the companies involved did not address the security issues adequately, leaving thousands of vehicles at risk of being hacked [38900, 38980].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development incompetence: - The incident described in the articles is related to a software failure caused by development incompetence. The vulnerability in the OBD2 dongles, particularly those distributed by Mobile Devices and used by companies like Metromile, was due to multiple security deficiencies introduced during the development process [38900, 38980]. - The dongles were found to have serious security bugs such as having "developer" mode enabled, storing the same private key on every device, and accepting commands via SMS with virtually no authentication, indicating a lack of professional competence in ensuring secure development practices [38900, 38980]. - The researchers highlighted that the vulnerabilities in the dongles could have allowed hackers to remotely control various critical driving components of vehicles, demonstrating a lack of proper security measures during the development of the software and hardware components [38900, 38980]. (b) The software failure incident occurring accidentally: - The incident described in the articles is not related to a software failure occurring accidentally. Instead, it is attributed to intentional actions by hackers who exploited the vulnerabilities in the OBD2 dongles to wirelessly hack into vehicles [38900, 38980]. - The researchers conducted deliberate attacks to demonstrate the potential risks associated with the insecure dongles, indicating that the software failure incident was a result of intentional exploitation rather than accidental factors [38900, 38980].
Duration temporary The software failure incident described in the articles can be categorized as a temporary failure. The vulnerability in the OBD-II dongles used for monitoring drivers' behavior allowed hackers to wirelessly access critical driving functions in vehicles, such as activating wipers, engaging brakes, and even disabling brakes at low speeds [38900, 38980]. The incident was temporary in nature as it was caused by specific vulnerabilities in the dongles and the way they received and executed commands, rather than being a permanent failure affecting all circumstances. The vulnerability was addressed through security patches delivered wirelessly to the affected devices by the companies involved [38900].
Behaviour omission, other (a) crash: The articles describe a software failure incident where researchers were able to wirelessly hack into vehicles through insecure dongles plugged into the cars' dashboards. They were able to transmit commands to the car's CAN bus, turning on windshield wipers and even enabling or disabling brakes. The researchers demonstrated these proof-of-concept attacks on a 2013 Corvette, affecting its windshield wipers and brakes [38900]. (b) omission: The software failure incident involved the vulnerability of OBD-II dongles that were distributed to monitor vehicles' location, speed, and efficiency. These dongles were found to have security deficiencies, allowing hackers to remotely control various components of the connected vehicles. The incident highlighted the omission of proper security measures in these devices, leaving them open to intrusion and manipulation [38900, 38980]. (c) timing: The incident did not involve a timing failure where the system performed its intended functions either too late or too early. (d) value: The software failure incident did not involve a failure where the system performed its intended functions incorrectly. (e) byzantine: The software failure incident did not involve a byzantine failure where the system behaved erroneously with inconsistent responses and interactions. (f) other: The software failure incident can be categorized as a security vulnerability leading to unauthorized access and control of critical driving functions in vehicles through insecure dongles. This behavior falls under the category of a security breach or vulnerability exploit [38900, 38980].

IoT System Layer

Layer Option Rationale
Perception sensor, actuator, processing_unit, network_communication, embedded_software (a) sensor: The software failure incident mentioned in the articles is related to the sensor layer of the cyber physical system. The vulnerability was exploited through a dongle plugged into the car's dashboard, which was used by insurance firms and trucking fleets to monitor vehicles' location, speed, and efficiency. By sending carefully crafted SMS messages to the dongle, the researchers were able to transmit commands to the car's CAN bus, turning on the Corvette's windshield wipers and enabling or disabling its brakes [38900]. (b) actuator: The failure was also related to the actuator layer of the cyber physical system. Through the vulnerability in the dongle, the researchers were able to control critical driving components of the vehicle, such as turning on the windshield wipers and activating or cutting the brakes. This demonstrates a direct impact on the actuator functions of the vehicle [38900]. (c) processing_unit: The incident involved the processing unit layer of the cyber physical system. The researchers were able to wirelessly hack into vehicles by exploiting vulnerabilities in the dongles connected to the dashboard, which allowed them to transmit commands to the car's CAN bus, controlling its physical driving components. This indicates a failure introduced by errors in the processing unit of the system [38900]. (d) network_communication: The software failure incident also pertains to the network communication layer of the cyber physical system. The vulnerability allowed the researchers to send SMS messages to the dongles, which were connected to the car's network, enabling them to control various functions remotely. This highlights a failure introduced by errors in network communication protocols [38900]. (e) embedded_software: The failure was related to the embedded software layer of the cyber physical system. The dongles used in the incident had serious security bugs, including having developer mode enabled, storing the same private key on every device, and accepting commands via SMS with virtually no authentication. These vulnerabilities in the embedded software of the dongles allowed for remote exploitation and control of connected vehicles [38900].
Communication link_level [a: Article 38900, Article 38980] In both articles, the software failure incident discussed is related to the communication layer of the cyber-physical system that failed. The vulnerability and subsequent attacks were due to contributing factors introduced by the communication layer, specifically through wireless communication protocols. The failure allowed hackers to wirelessly access critical driving functions by exploiting insecure internet-enabled gadgets plugged into cars' sensitive systems. The attacks involved sending SMS messages to specific phone numbers associated with the dongles, which then transmitted commands to the car's internal network, enabling the hackers to control various components like windshield wipers, brakes, and potentially other critical systems. The vulnerabilities in the devices allowed for unauthorized access and control over the vehicles, highlighting a failure at the communication layer of the cyber-physical system.
Application TRUE The software failure incident described in the articles was related to the application layer of the cyber physical system. The failure was due to contributing factors introduced by bugs, operating system errors, unhandled exceptions, and incorrect usage. This was evident in the vulnerability of the OBD2 dongles used in cars, which allowed hackers to wirelessly access critical driving functions by exploiting security deficiencies in the devices' software and configuration. The vulnerabilities included having the "developer" mode enabled, storing the same private key on every device, and accepting commands via SMS with virtually no authentication [38900, 38980].

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) There is no mention of any deaths resulting from the software failure incident in the articles [38900, 38980]. (b) There is no mention of any physical harm to individuals resulting from the software failure incident in the articles [38900, 38980]. (c) There is no mention of people's access to food or shelter being impacted due to the software failure incident in the articles [38900, 38980]. (d) The software failure incident impacted people's property as it allowed hackers to wirelessly access critical driving functions of vehicles, such as turning on windshield wipers and enabling or disabling brakes, through vulnerable dongles connected to the vehicles' dashboards [38900, 38980]. (e) There is no mention of any delays caused by the software failure incident in the articles [38900, 38980]. (f) Non-human entities, specifically vehicles, were impacted by the software failure incident as hackers were able to remotely control various components of the vehicles, such as brakes and windshield wipers, through the vulnerable dongles [38900, 38980]. (g) The software failure incident had real observed consequences on property and potentially on the safety of individuals due to the ability of hackers to remotely control vehicles [38900, 38980]. (h) The articles discuss potential consequences of the software failure incident, such as the vulnerability of thousands of vehicles connected to other distributors of the vulnerable dongles, even after patches were applied [38900, 38980]. (i) There are no other consequences mentioned in the articles beyond those related to property, safety, and potential vulnerabilities [38900, 38980].
Domain transportation (a) The failed system was related to the transportation industry. The incident involved vulnerabilities in internet-enabled gadgets plugged into cars' dashboards, which were used by insurance firms and trucking fleets to monitor vehicles' location, speed, and efficiency [38900]. These devices were exploited by hackers to wirelessly access critical driving functions, such as controlling the car's physical driving components like brakes and steering [38900]. The specific industry mentioned in the articles is the automotive industry, which falls under the broader category of transportation.

Sources

Back to List