We recently reported on the hack of a Jeep Cherokee. The car had an internet connection, which hackers exploited to gain access to the driving system. So, logically, cars that aren't connected to the internet aren't at risk, right?
Wrong! Brakes and other critical systems can be compromised by sending data over radio waves through an attack on digital audio broadcasting (DAB).
The attack is similar to the hack that allowed security researchers Chris Valasek and Charlie Miller to take control of a Jeep Cherokee, after sending data to the infotainment and navigation systems via a mobile phone.
But NCC's attack method shows that even cars whose systems are not connected to mobile networks can be vulnerable.
Andy Davis, NCC's director of research, explained that the attack can be carried out from a laptop. The infotainment system of a targeted car can be used as a stepping stone to allow the hacker access to all critical systems, such as the steering and braking systems.
Depending on the power, a DAB broadcast could be used to carry out attacks on multiple cars at once.
“[The attacker] would probably choose a popular radio station to make sure the attack would reach a large number of vehicles.”
This approach has only been tested in the lab. Davis said he was able to achieve the automatic braking system of a real vehicle by manipulating the car's infotainment system.
The NCC does not say which infotainment system is vulnerable. We will learn more when the attack is officially presented at the Black Hat in Las Vegas next month.
