Insurance monitoring dashboard devices used by Uber let hackers "cut your brakes" over wireless

UCSD computer scientist Stefan Savage and colleagues will present their work at Usenix Security: they were able to disable the brakes on a 2013 Corvette by breaking into a Mobile Devices/Metromile Pulse dongle, used by insurance companies to monitor driving in exchange for discounts on coverage.

Uber offers insurance to its drivers through Metromile; those drivers use Metromile devices. Metromile claims it has patched all the devices, but by scanning the Internet, the researchers were able to locate thousands of vulnerable vehicles on the road today that used the Mobile Devices dongle distributed in the US by Metro Mile.

Other insurance company/automotive telematics devices, including the Snapshot (mandated by Progressive Insurance), are also vulnerable. Federal regulations require federal agencies with more than 20 vehciles in their fleets to use the devices as well.

In the Mobile Devices dongles specifically, the UCSD team found a slew of serious security bugs. The gadgets had their “developer” mode enabled, allowing anyone who scanned for the devices to access them via SSH, a common protocol for remotely communicating with a computer. They stored the same private key on every device, which a hacker could immediately extract to gain complete “root” access on any of the dongles. And the Mobile Devices dongles were also configured to accept commands via SMS, a protocol with virtually no authentication. By sending texts to the devices from a certain phone number, anyone could rewrite their firmware or simply begin issuing commands to a connected car.

Hackers Cut a Corvette’s Brakes Via a Common Car Gadget [Andy Greenberg/Wired]

Notable Replies

  1. When are they going to realize, corporate America doesn't want their do-gooding? If you spot a zero-day flaw in some system, just pass it along to Anonymous, who can use it to... I dunno... maybe have a couple of "accidents" that change the tilt of the Supreme Court?

  2. How would one go about buying a car with no wireless connections of any kind? No WiFi, no Bluetooth, no SIM card, no remote starter, no nothing? Is that even a thing?

  3. 'CD'?

    Wouldn't that get in the way of the the 8 track slot?

  4. Last weekend we got rid of the car with the tape deck. Now I literally don't know what to do with my Salt and Pepa cassette as I can't play it on anything else. LOL!

  5. If these guys wanted to be useful they'd figure a hack to overwrite the collected data with another data set. I'd like to get my discount and still drive like a maniac.

Continue the discussion bbs.boingboing.net

13 more replies

Participants