Around 100 million Volkswagen cars could easily be hacked at any time, according to researchers at the University of Birmingham and the German security firm Kasper & Oswald.
Hackers discover new vulnerabilities in electronics almost every day. If it’s not a company falling into the hands of some ransomware, it’s some database getting hacked. Cars are no exempted, as described by the researchers of the new study. Owners of more modern vehicles don’t need to worry; the vulnerability doesn’t affect them.
The Research
Almost all Volkswagen cars sold since 1995 are at risk of being remotely unlocked with a £30 homemade radio, as published in a paper included in the Proceedings of the 25th USENIX Security Symposium.
Hackers can use two methods to spy on key fob signals. They can clone digital keys and use them to unlock Volkswagen, Audi, Seat, Skoda, Ford, Fiat, Citroen and Peugeot vehicles.
The process yielded cryptographic master keys, used and shared by millions of Volkswagen cars. It is important to note that this vulnerability only allows unlocking a vehicle’s doors. The engine cannot be started using this method.
Timo Kasper, of Kasper & Oswald, claimed that the team was “kind of shocked. Millions of keys using the same secrets — from a cryptography point of view, that’s a catastrophe.”
Two ways of hacking
The researchers used the radio to intercept the various signals emitted by the fob keys; these are then used to clone keys, granting access to the car.
They needed to be in a range of 298.556 feet from the car. They also needed the right cryptographic key that applied to the particular car model and year that they were trying to access. This is the first form of attack.
The second method involves using the radio to interpret rapidly a string of the coded signals given off by the fob key, allowing cryptography to be cracked and the key cloned.
Security experts all over note how incredibly dangerous are this news and argue that car manufacturers should think of cyber security when developing new software and cars.
More vulnerabilities
The paper omits several critical information regarding the exploits, such as the value of the master keys that they have found, as requested by Volkswagen.
The team alerted Volkswagen of the vulnerability back in November 2015 and has spoken with the company to make sure the vulnerability and its risks are understood.
Something that might help to mitigate the bitter news is that, as commented by security expert Ken Munro, “you’d need some academic-level knowledge to be able to do this.”
Fellow security expert Graham Cluley is more critical of the situation claiming it is time to make car manufacturers fix all the vulnerable vehicles that have been sold.
What if I have a newer model?
Current generation vehicles immune to the exploit are the Tiguan, Touran, Golf, and Passat, as they use a newer, different system, called MQB Modular Transverse Matrix, said a company’s spokesmen.
It’s important to note that the research team had also discovered yet another vulnerability before this one, back in 2013. The vulnerability allowed hackers to start the car’s ignition. It was withheld for two years because of Volkswagen’s threats to sue.
The finding of this fob key vulnerability is the latest of many recent conclusions demonstrating that onboard systems in modern cars might be vulnerable to hacking attacks.
Source: The Telegraph