I hear hackers could shut off a car's engine using flaws in the Bosch Drivelog Connect diagnostic dongle. How is...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
this possible? How can this be prevented?
A car can be equipped with third-party gadgets, such as the Bosch diagnostic dongle, which monitors the car's performance to make sure the engine is working properly. The Drivelog Connect app on smartphones pairs with the dongle and sends automatic diagnostic messages to the user when service is necessary to fix engine problems.
But what happens when, one day, the driver gets strange messages through the app? The car may suddenly stop moving, the airbag system won't work or the automotive braking system may fail. An attacker can use a mobile app to exploit a patched flaw in the diagnostic dongle and send unwanted messages over Bluetooth. It's then possible for the attacker to turn off the engine as he drives by his victim.
Researchers at Argus Cyber Security, a firm specializing in car security research, pinpointed the flaws to dongle firmware version 4.8.0 to 4.9.2 and Drivelog Connect app version 1.1 and below.
The diagnostic dongle enabled the researchers to connect to the onboard diagnostics (OBD) without a PIN number during the pairing process. The holes in the car dongle's message filter enabled them to send non-diagnostic messages to the Controller Area Network (CAN) bus on a car. If the PIN was needed, the researchers successfully guessed it offline using the information from the certificate, public key and MAC address.
To mitigate the vulnerabilities, Bosch updated dongle firmware to version 4.9.3. The update limits the commands that the car dongle can accept over the CAN bus. Users should use the mobile apps provided by the Bosch App Center.
In addition to Drivelog Connect, consider using Mobile Scan Bluetooth OBD II Connector as an additional security layer. The app pairs with the Mobile Scan adapter in the car; identifies the car; and checks the fuel system, airbag and automatic braking system.
Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)
Read about the driving forces accelerating and decelerating connected car security
Learn more about the DMCA controversy that followed the Chrysler car hack
Find out more about past car hacks
Dig Deeper on Emerging cyberattacks and threats
Related Q&A from Judith Myerson
A patch was issued for the Dirty COW vulnerability, but researchers later discovered problems with the patch. Expert Judith Myerson explains what ...continue reading
Getting firewall settings right is one of the most basic ways to protect enterprise data from accidental exposures. Expert Judith Myerson discusses ...continue reading
Expert Judith Myerson explains how IP theft can happen despite the cryptographic protections in IEEE standard P1735, as well as what can be done to ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.