Is the 5th Gen Engine Software Hackable?

[Ron4RNevada]

Several times this week I've seen on the news where some 2013, all 2014 and some 2015 Jeep and Chrysler models can be remotely controlled by hackers. The articles didn't go into much detail but mentioned that the driver could lose control of braking, steering, throttle, etc.

Is the software on 5th gen 4Runners vulnerable to the same sort of thing? Is this sort of thing like the GM On-Star? Does the Blue Tooth stuff that is on my 13 SR5 make my truck hackable by the outside world? If so, how can I disable it?

Incidentally; I don't own a cell phone, I don't subscribe to Sirius or any other entertainment stuff, in fact the only time I even turn on the radio is to get updates on weather or road conditions (usually when crossing Donner Pass in the winter).

 

[wfo9]

It's all hype nothing to worry about.

 

[DesertCanyons]

Remote Driver Hack

Wait, I think I saw your totally stock 2013 SR5 driving down the road - with no driver. :laugh:

The story said they connected through the U-Connect. I'm not sure if Toyota has that on it's system.

 

[SilverRiver]

The answer is YES!!

Even if we don't know how right now or there is not a demonstration of a hack right now.

Let me ask; how many security holes are in your iPhone, Android device, Windows computer? Security exploits are being found and patched daily. How is the software in the 4Runner any different?

As the systems get more complex and they add wi-fi/Bluetooth connectivity, the attack surface grows. They are back at the stage computers were in 1995 when computer started getting connected to the Internet and they really weren't designed to be connected and secure in that way.

The auto companies are in denial about the problem just like computer companies were back in the day. It is the exact same scenario only with cars.

In fact, I am sure our government has hacked every armored BMW 7 series used to drive around foreign dignitaries. If we need/want to we can drive them off the road at 90 mph and make it look like suicide or a DUI.

Yes it is possible and yes, it is only a matter of time.

I don't even know if the software in the ECU is digitally signed and whether or not unsigned firmware can be uploaded. Maybe some techs can comment.

While I am no security expert I know the basics and I am looking a copies of "Writing Secure Code" and "Building Secure Software" on my bookshelf. I have worked on securely provisioning mobile broadband radios (the chip in your cell phone) with firmware and IMEI numbers in a secure factory environment.

 

[SilverRiver]

But don't worry because adding a $45 TRD oil filler cap will protect against such attacks. Just don't buy the cheap sticker off eBay though. It doesn't work.

 

[1engineer]

Everything is hackable.

 

[SilverRiver]

The articles didn't go into much detail but mentioned that the driver could lose control of braking, steering, throttle, etc.

Somehow they are getting access to the CAN bus and are sending 8 byte packets. The data packets tell the steering, brakes and throttle what to do. Obviously, there is no authentication on the packets e.g. where did they come from?

They are using one or more of the following basic attacks:

Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege

Since these systems are ancient and have no real security, once they get onto the CAN bus, it is just spoofing and tampering with bus traffic.

To get on the CAN bus through wi-fi/Bluetooth they have to go through more hardened systems, presumably. For this they probably exploited some holes in iOS (or Android, etc) using elevation of privilege & repudiation.

 

[Ron4RNevada]

Looks like its time for me to buy a TRD Oil Filler Cap and make an aluminum foil hat.

Second best solution = remove the shark fin antenna on the roof........unscrew the whip on the fender..........

 

[SilverRiver]

This forum makes me feel dumb sometimes because I can barely use a socket wrench and change my oil. There are so many talented folks here.

However, I feel 100% confident I could hack your car like these guys did. In fact a Tesla intern is releasing a $60 device to make this stuff fun and easy to do.

For $60, you can hack a connected car

I would love to get one to play around with. It would make it easy to set the odometer to anything you want. It is "secure" but the security on the odometer is kindergarten level security.

Here is Eric Evenchick explaining how his $60 device works. It is pretty simple stuff.

https://www.youtube.com/watch?v=qPIscmaIt8U

 

[msp]

I believe the hack only worked on internet-connected computers featured in their dashboard known as Uconnect, through the Sprint network. If anyone is worried about being hacked like this, please remain inside your house, remove all communications devices, and wait for the rapture.

 

[Foques]

One of my friends is working for a company that develops ECU maps.
They've been trying to break Toyota ECU codes for a good 7 years now.

I wouldn't worry about it.

 

[wfo9]

People get so confused here.

There are three different questions being answered.

Back to the original question:
The chances of your 4runner being remote controlled/hacked maliciously are about as likely as you winning the lottery every single day for the next year.

The main reason being that there is no way to remote connect to it. It is not addressable in any way shape or form (beyond physical connection or very short range Bluetooth - which is isolated). The jeeps being discussed in the headlines have a wireless radio and an IP address....

Like everything, no security is unbreakable (even physical security). But people don't spend time or money to break into something unless there is something to gain.

So, absolutely nothing to worry about.

 

[RaisedByWolves]

Dudes if a guy can hack a 737 from the in-flight entertainment and also from a computer on the ground of course our 5th gens can be hacked.

Looking for a good long term investment? Here's a free idea from a finance guy... cyber security.

 

[M1911]

The hackers were able to address the Jeep remotely through UConnect. Your 4Runner does not have anything similar to Chrysler's UConnect. So you don't have anywhere near the same kind of vulnerability.

 

[M1911]

Dudes if a guy can hack a 737 from the in-flight entertainment and also from a computer on the ground of course our 5th gens can be hacked.

If the 4Runner isn't connected to the internet, it can't be hacked unless you 1) have physical access or 2) are within Bluetooth range.

In the case of the Jeep, it has an internet connection and there was a security hole in that software. The 4Runner doesn't have an internet connection. So you can dink around all you want on the internet, but you're not going to remotely connect to a 4Runner.

 

[Mmikey]

The main reason being that there is no way to remote connect to it. It is not addressable in any way shape or form (beyond physical connection or very short range Bluetooth - which is isolated). The jeeps being discussed in the headlines have a wireless radio and an IP address....

The Entune connects to the internet through my phone via the Entune app, but that system is separate from the ECU, right? It's just the stereo/navi deck.

 

[perkdog258]

Everything is hackable.

The hack that has made the news was demonstrated on a Jeep via the Uconnect but the proof of concept was shown on a VW, Honda, and Toyota. If you have a Bluetooth connection or LTE service in your vehicle they can be hacked. Obviously using the Bluetooth to break in limits the range to roughly 15ft where as the Wireless LTE extends the range.

The reality of this is that it takes a person with a special skill set to pull this off. The Proof was like all other hacks....it is designed to raise awareness to the public and force engineers to make better security in the software.

 

[borfoo3]

You can definitely make the ECU un-hackable by cutting any and all wiring around it..

 

[Intruder]

Looking for a good long term investment? Here's a free idea from a finance guy... cyber security.

I agree with this 100%. And I'm not just saying that because I work in InfoSec. (We really hate the term "cyber security". Actually, we really hate "cyber" anything.)

As for the hack itself, Chrysler just recalled 1.4 million vehicles to patch the vulnerability that was exploited. My guess is that UConnect is sandboxed and they were simply able to break out of the sandbox and send commands over the CAN bus. Because speed is essential in CAN bus comms, no authentication or verification is performed. Either way we'll find out for sure when they release the exploit code at BlackHat the first week of August.

 

[Sunriser]

Here's the link to the wired.com article if anyone is interested.

Hackers Remotely Kill a Jeep on the Highway?With Me in It | WIRED

Pertinent Description:

From that entry point (the car's cellular connection and IP Address) , Miller and Valasek’s attack pivots to an adjacent chip in the car’s head unit—the hardware for its entertainment system—silently rewriting the chip’s firmware to plant their code. That rewritten firmware is capable of sending commands through the car’s internal computer network, known as a CAN bus, to its physical components like the engine and wheels.

There's also a good discussion going on today over on slashdot: Remote Control of a Car, With No Phone Or Network Connection Required - Slashdot