I hear hackers could shut off a car's engine using flaws in the Bosch Drivelog Connect diagnostic dongle. How is...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
this possible? How can this be prevented?
A car can be equipped with third-party gadgets, such as the Bosch diagnostic dongle, which monitors the car's performance to make sure the engine is working properly. The Drivelog Connect app on smartphones pairs with the dongle and sends automatic diagnostic messages to the user when service is necessary to fix engine problems.
But what happens when, one day, the driver gets strange messages through the app? The car may suddenly stop moving, the airbag system won't work or the automotive braking system may fail. An attacker can use a mobile app to exploit a patched flaw in the diagnostic dongle and send unwanted messages over Bluetooth. It's then possible for the attacker to turn off the engine as he drives by his victim.
Researchers at Argus Cyber Security, a firm specializing in car security research, pinpointed the flaws to dongle firmware version 4.8.0 to 4.9.2 and Drivelog Connect app version 1.1 and below.
The diagnostic dongle enabled the researchers to connect to the onboard diagnostics (OBD) without a PIN number during the pairing process. The holes in the car dongle's message filter enabled them to send non-diagnostic messages to the Controller Area Network (CAN) bus on a car. If the PIN was needed, the researchers successfully guessed it offline using the information from the certificate, public key and MAC address.
To mitigate the vulnerabilities, Bosch updated dongle firmware to version 4.9.3. The update limits the commands that the car dongle can accept over the CAN bus. Users should use the mobile apps provided by the Bosch App Center.
In addition to Drivelog Connect, consider using Mobile Scan Bluetooth OBD II Connector as an additional security layer. The app pairs with the Mobile Scan adapter in the car; identifies the car; and checks the fuel system, airbag and automatic braking system.
Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)
Read about the driving forces accelerating and decelerating connected car security
Learn more about the DMCA controversy that followed the Chrysler car hack
Find out more about past car hacks
Dig Deeper on Emerging cyberattacks and threats
Related Q&A from Judith Myerson
The upcoming Windows update, Redstone 3, will patch the vulnerability that enables EternalBlue exploits. Expert Judith Myerson discusses protection ...continue reading
CrashOverride malware targets industrial control systems and can wreak havoc. Expert Judith Myerson explains the capabilities of the malware and what...continue reading
Using SNMP v3 is a good first step, but it's not enough to prevent attackers from accessing a network through an SNMP-enabled device. Expert Judith ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.