DARPA Takes Control Of Vehicle Through Hacking Its OnStar System

In a report which aired on the February 6 edition of 60 Minutes, the Defense Departments demonstrated that it has the ability to hack into a vehicle through its OnStar system and take total control of the entire vehicle including its windshield wipers and brakes. Working with a videogame inventor, DARPA (Defense Advanced Research Projects Agency) was able to activate and dial into the OnStar system of a Chevrolet Impala, transmit data, which contained instructions, which allowed it to reprogram the vehicle’s electronic control unit and take complete control of the vehicle away from the driver.

The report released by Senator Ed Markey from Massachusetts contains some rather startling findings including:

1. “Nearly 100 percent of cars on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions.”
2. “Most automobile manufacturers were unaware or unable to report on past hacking incidents.”
3. “Security measure to prevent remote access to vehicle electronics are inconsistent and haphazard across all automobile manufacturers, and many manufacturers did not seem to understand the questions posed by Senator Markey.”
4. “Only two automobile manufacturers were able to describe any capabilities to diagnose or meaningfully respond to an infiltration in real-time, and most say they rely on technologies that cannot be used for this purpose at all.”
5. “Automobile manufacturers collect large amounts of data on driving history and vehicle performance.”
6. “A majority of automakers offer technologies that collect and wirelessly transmit driving data history to data centers, including third-party data centers, and most do not describe effective means to secure the data.”
7. “Manufacturers use personal vehicle data in various ways, often vaguely to ‘improve customer experience’ and usually involve third parties, and retention policies – how long they store information about drivers – vary considerably among manufacturers.”
8. “Customers are often not explicitly made aware of data collection and, when they are, they often cannot opt out without disabling valuable features, such as navigation.”

The white paper with their complete finding was released today and can be downloaded here.