Car Jacking Or Car Hacking?

The more I read about new cars, the more I want wheels that were manufactured pre-1973; full bore Luddite, EMP resistant, hack-proof, analog vehicles.

Like everyone else, Chrysler uses software in its on-board entertainment package. But this one can be accessed over the internet. Two hackers put it to the test...

[...]The result of their work was a hacking technique—what the security industry calls a zero-day exploit—that can target Jeep Cherokees and give the attacker wireless control, via the Internet, to any of thousands of vehicles. Their code is an automaker’s nightmare: software that lets hackers send commands through the Jeep’s entertainment system to its dashboard functions, steering, brakes, and transmission, all from a laptop that may be across the country.

The hackers were only ten miles away when they took control of the vehicle, but distance is not a factor.

Chrysler's UConnect system uses Sprint's cellular network for connectivity, so researchers were able to remotely locate cars by scanning for devices using that particular spectrum band. Chrysler has been including UConnect in cars since late 2013, and any cars that use the system are likely to be vulnerable to the attack. There's no apparent firewall, so once attackers have located the device's IP, they can deploy previously developed exploits to rewrite Uconnect's firmware and control the car as if they had physical access.

Story here and here.