Chrysler Recalls 1.4 Million Vehicles After Jeep Hacking Demo

Today, Fiat Chrysler recalled 1.4 million vehicles possibly affected by a vulnerability in the UConnect infotainment system that could allow attackers to hijack the vehicle's steering and braking. Car hacking researchers Chris Valasek and Charlie Miller demonstrated proof of concept in striking fashion, when they wirelessly took control of a 2014 Jeep Cherokee driven by Wired reporter Andy Greenberg and brought it from 70 mph to a screeching halt.

The National Highway Traffic Safety Administration (NHTSA) is launching an investigation to determine the effectiveness of Fiat Chrysler's recall.

As Dark Reading's Kelly Jackson Higgins wrote yesterday in an interview with Valasek:

Miller and Valasek were able to control a 2014 Jeep Cherokee's steering, braking, high beams, turn signals, windshield wipers and fluid, and door locks, as well as reset the speedometer and tachometer, kill the engine, and disengage the transmission so the accelerator pedal failed.

Although Miller and Valasek said that only up to 400,000 vehicles were affected by the vulnerability, 1.4 million are listed in the voluntary recall, including 2013 to 2015 Dodge Vipers and Ram pickups; 2014 to 2015 Jeep Grand Cherokee, Cherokees and Dodge Durango SUVs; and 2015 Chrysler 200, Chrysler 300 and Dodge Chargers and Challengers.

"The interesting thing about this recall is not that it’s going to be expensive and inconvenient (it will)," says Jeff Williams, CTO of Contrast Security, "but that it shouldn’t have had to happen. We already know the importance of auto-update. Remember those painful years of downloading Windows updates only to have them fail, crash, and re-release? If cars are going to have software, then they absolutely need to have auto-update."

"You can develop that most advanced vehicle that has all of the latest safety features and high tech gadgets in it, but if it can be bricked by remote exploits, you are going to have wary consumers who may choose the next brand of vehicle because they put more emphasis on security," says Ken Westin, senior security analyst for Tripwire. "The automotive industry understands the importance of security and they are not only working with researchers, but also each other to help develop standards and best practices for more secure vehicles and the work that researchers are doing like Miller and Valasek is actually helping to make our vehicles more secure in the future.”