I hear hackers could shut off a car's engine using flaws in the Bosch Drivelog Connect diagnostic dongle. How is...
this possible? How can this be prevented?
A car can be equipped with third-party gadgets, such as the Bosch diagnostic dongle, which monitors the car's performance to make sure the engine is working properly. The Drivelog Connect app on smartphones pairs with the dongle and sends automatic diagnostic messages to the user when service is necessary to fix engine problems.
But what happens when, one day, the driver gets strange messages through the app? The car may suddenly stop moving, the airbag system won't work or the automotive braking system may fail. An attacker can use a mobile app to exploit a patched flaw in the diagnostic dongle and send unwanted messages over Bluetooth. It's then possible for the attacker to turn off the engine as he drives by his victim.
Researchers at Argus Cyber Security, a firm specializing in car security research, pinpointed the flaws to dongle firmware version 4.8.0 to 4.9.2 and Drivelog Connect app version 1.1 and below.
The diagnostic dongle enabled the researchers to connect to the onboard diagnostics (OBD) without a PIN number during the pairing process. The holes in the car dongle's message filter enabled them to send non-diagnostic messages to the Controller Area Network (CAN) bus on a car. If the PIN was needed, the researchers successfully guessed it offline using the information from the certificate, public key and MAC address.
To mitigate the vulnerabilities, Bosch updated dongle firmware to version 4.9.3. The update limits the commands that the car dongle can accept over the CAN bus. Users should use the mobile apps provided by the Bosch App Center.
In addition to Drivelog Connect, consider using Mobile Scan Bluetooth OBD II Connector as an additional security layer. The app pairs with the Mobile Scan adapter in the car; identifies the car; and checks the fuel system, airbag and automatic braking system.
Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)
Read about the driving forces accelerating and decelerating connected car security
Learn more about the DMCA controversy that followed the Chrysler car hack
Find out more about past car hacks
Dig Deeper on Emerging cyberattacks and threats
Related Q&A from Judith Myerson
VPN vulnerabilities in products from popular vendors were recently found to enable serious threats. Discover how detrimental these threats are and ... Continue Reading
The Department of Homeland Security warned of a vulnerability affecting WAGO PFC200 logic devices. Discover how this flaw enables threat actors with ... Continue Reading
Zyklon malware targets three previously patched Microsoft Office vulnerabilities. Learn how attackers can access passwords and cryptocurrency wallet ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.