State Trooper Vehicles Hacked

A state trooper responding to a call starts his vehicle, but is unable to shift the gear from park to drive. The engine RPMs suddenly spike and the engine accelerates, no foot on the pedal. Then the engine cuts off on its own.

The unmarked 2012 Chevrolet Impala from the Virginia State Police's (VSP) fleet has been hacked -- but luckily, by good hackers.

This is what police officers could someday face in the age of car hacking. It's just one in a series of cyberattacks waged on the VSP's Impala and on one of its 2013 Ford Taurus marked patrol cars as part of an experiment by a public-private partnership to test how state trooper vehicles could be sabotaged via cyberattacks. Virginia Governor Terry McAuliffe in May first announced the initiative, which was aimed at protecting the state's public safety agencies and citizens from vehicle-hacking.

Among the organizations that worked on the project were the Virginia State Police, the University of Virginia, Mitre Corp., Mission Secure Inc. (MSi), Kaprica Security, Spectrum, Johns Hopkins Applied Physics Lab, Digital Bond Labs, the Aerospace Corporation, and the Virginia Department of Motor Vehicles. The research was conducted in coordination with the US Department of Homeland Security's Science and Technology division and the US Department of Transportation's Volpe Transportation Systems Center.

Car-hacking has shifted into overdrive this past year, mainly thanks to research by famed car hackers Charlie Miller and Chris Valasek, who this summer demonstrated how they were able to remotely control a 2014 Jeep Cherokee's steering, braking, high beams, turn signals, windshield wipers and fluid, and door locks, as well as reset the speedometer and tachometer, kill the engine, and disengage the transmission so the accelerator pedal failed.

There were no state troopers driving into ditches or rolling into highway exit ramps after losing control of the gas pedal: unlike Miller and Valasek's video demonstration of those hacks with a journalist behind the wheel, the VSP research didn't hack moving vehicles. But the Virginia project demonstrated how even non-networked, older-model vehicles are also susceptible to cyberattacks.

The hacks of the VSP cruisers require initial physical tampering of the vehicle as well. The researchers inserted rogue devices in the two police vehicles to basically reprogram some of the car's electronic operations, or to wage the attacks via mobile devices, which they demonstrated.

The project evolved out of concerns by security experts as well as police officials of the dangers of criminal or terror groups tampering with state police vehicles to sabotage investigations or assist in criminal acts. And unlike most car-hacking research to date, it includes the creation of prototype solutions for blocking cyberattacks as well as data-gathering for forensics purposes.

Perhaps a bigger surprise than the car hacks themselves was that a police department would agree to participate in potentially sensitive cyberattack research. But Capt. Jerry L. Davis of the Virginia State Police's Bureau of Criminal Investigation, says there was no hesitation by law enforcement officials in the state when the project was first proposed. "Our executive staff was aware of the issue in the arena and some of the cascading effects that could occur if we didn't start to take a proactive" approach, Davis says.

The VSP even tested out some of the attacks on its students. "We wanted to be able to convey that message to them: you need to consider [cyberattacks] as you respond to incidents," he says. While he says there's been no confirmed cyberattacks on VSP vehicles thus far, "then again, we don't know what we don't know."

The VSP has around 155 2012 Chevrolet Impalas in its fleet, and 427 2013 Ford Tauruses, as well as a mix of other vehicle makes and models. Neither Ford nor GM worked directly on the project, but both carmakers were apprised of it. They also provided rare public statements about vehicle cybersecurity when contacted by Dark Reading.

"The University of Virginia study is helpful to remind industry, regulators, law enforcement and consumers that cybersecurity is an issue that requires focused attention. The staged cyber-attack on a Ford vehicle required unrestricted physical access to the interior to install a device that provided remote access to the electronic control module. This study does not simulate any immediate real-world risk," Ford said in its statement. "It highlights the need to be vigilant about vehicle security and to avoid plugging in devices or technologies that do not have proper security safeguards. And, it serves as a reminder that all connected computing systems should have appropriate safeguards in place to mitigate the threat of cyber-attacks."

GM declined to comment directly on the project, but noted that it's working on securing its vehicles from cyberattacks: "GM takes matters such as potential cyber threats, which affect our customers’ safety and security very seriously. We are taking a layered approach to in-vehicle cybersecurity and are designing many vehicle systems so that they can be updated with enhanced security measures as potential threats evolve," GM said in its statement. "We recently created an integrated organization, Vehicle and Vehicle Services Cybersecurity, which consists of internal experts who work with outside specialists, and is actively working to minimize risks of unauthorized access to vehicles and customer data."

The Hacks

In addition to the gearshift, instrument panel, and engine hacks, researchers from Mitre Corp. also wrote attack code that opened the trunk, unlocked the passenger doors and locked the driver's door, and ran the windshield wipers and wiper fluid.

"We think this is really not about car hacking as it is about coming up with strategies" to protect vehicles from attack, says Brian Barrios, portfolio director of Mitre's National Cybersecurity FFRDC.

The first set of attacks by Mitre occurs via a smartphone app connected via Bluetooth to a hacking device planted  in the vehicle, he says. "This car [the Impala] doesn't have Bluetooth or cellular" connectivity  built in, he says, so connectivity was provided via the Mitre device.

"This is custom software we" wrote for the attacks, Barrios says. The attacks would require some knowledge of the car model's electronics, he notes, so it's not an attack "the average person" could pull off.

"But it's not so advanced that it's outside the realm of possibility," he says.

Kaprica Security built a real-time device to thwart such attacks and to gather forensic data from an attack.  Sagar Momin, engineer and co-founder of Kaprica, says his proof-of-concept tool could be plugged into the car's so-called On Board Diagnostic s (OBD) II in the form of a dongle. "It will record any forensics or other issues," he says. "It knows when there are abnormal messages [to the car]" and blocks them, he says.

The processor is faster than the car's own network, aka the CAN (Controller Area Network) bus, so it's able to determine whether to block or allow a message to pass to the car's controls. Data is written to an SD card, where it's stored for forensics investigation purposes. A state trooper could plug in the device when he got into the vehicle, Momin says.

MSi performed its own set of attacks on the VSP's marked Ford Taurus cruiser. One attack basically performs a denial-of-service hack that blocks the car from starting. The researchers also were able to remotely start up the car from a smartphone-borne attack, and lock and unlock the car such that the driver would be trapped in the vehicle unless he or she rolled down the window to manually open the door.

"A policeman would get out of the car to see what's wrong, he looks under the hood and the car starts itself and the dashboard is going crazy. Horns blow, lights blink, and he decides this car is no good," says Barry Horowitz, chair of the systems and information engineering department at the University of Virginia and one of the leaders of the VSP project. "That could take a half hour or 45 minutes and delay his mission."

The researchers also used a device placed in the vehicle that monitors the ODB II port and detects any hacking tools plugged into the car's port, as well as any attacks over the CAN bus. Like the Kaprica tool, it stops any attacks and collects attack information for forensic analysis afterward.

---Video credit: Justin Naumann, Red Titan Films. Video edit by Dave Harding

The Endgame

VSP's Davis says the new age of car hacking means law enforcement will be faced with considering the cybersecurity of its fleet. "We understand with vehicles that not being connected [to the Internet] is a good thing. Taking a look at systems and components embedded in there and how they communicate together: is this something I need to consider in my purchase?"

He says VSP already has in place technicians who investigate computer fraud, so forensics analysis out of a potential car hack would be another aspect of their duties.

"Police cars are less equipped with electronics, and police communicate through private networks so they are not as vulnerable as a consumer. But the [cruisers] have many of the same features as a consumer car has," and are potentially hackable, UVA's Horowitz says.

"The next question is what do you do about it? What kind of data can be extracted from a car and at the scene of an accident? These attacks [demonstrated] are based on putting devices on the car. You could have an inspection procedure when you get into the car, and at an incident, [the police] would check the consumer's car" for such devices, he says. If the cars have built-in forensics gathering capabilities, that data could be analyzed to confirm whether a traffic incident was due to a cyberattack, he notes.

"There are crashes every day" and it's impossible to tell if a cyberattack was the cause, says Frank Byrum, chief scientist for Defense contractor Spectrum. "Someday someone will claim responsibility for something. Then what do the automakers do? This is an engineering problem."