Is the 5th Gen Engine Software Hackable?

[Intruder]

And in case anyone missed it, some DARPA researchers already did more or less the same thing with OnStar back in February.

?DARPA Hacks GM's OnStar To Remote Control A Chevrolet Impala

 

[msp]

Dudes if a guy can hack a 737 from the in-flight entertainment and also from a computer on the ground of course our 5th gens can be hacked.

Looking for a good long term investment? Here's a free idea from a finance guy... cyber security.

Great market if you're looking for a job. Good security folks are hard to find and hard to keep. They're also expensive....right up until they prevent a problem.

 

[BlackWorksInc]

The most they can do is somehow get in through bluetooth, trojan on your phone when linked, and/or Toyota SOS Connect; then blast packets on the CAN Bus and crash the network. Keep in mind that GM and Chrysler are heavily playing with "self driving" technology while Toyota only currently has ABS that overtakes customer control (thus the only way they could control the vehicle besides crashing the network.)

Newer "smart" vehicles are vulnerable to this, current and older are limited in what they can do.

 

[marshal]

People get so confused here.

There are three different questions being answered.

Back to the original question:
The chances of your 4runner being remote controlled/hacked maliciously are about as likely as you winning the lottery every single day for the next year.

The main reason being that there is no way to remote connect to it. It is not addressable in any way shape or form (beyond physical connection or very short range Bluetooth - which is isolated). The jeeps being discussed in the headlines have a wireless radio and an IP address....

Like everything, no security is unbreakable (even physical security). But people don't spend time or money to break into something unless there is something to gain.

So, absolutely nothing to worry about.

If the 4Runner isn't connected to the internet, it can't be hacked unless you 1) have physical access or 2) are within Bluetooth range.

In the case of the Jeep, it has an internet connection and there was a security hole in that software. The 4Runner doesn't have an internet connection. So you can dink around all you want on the internet, but you're not going to remotely connect to a 4Runner.

This.

Not to mention, the Bluetooth and head unit are not connected to the ECU or CANBUS in any form outside of power and ground leads

 

[Intruder]

This.

Not to mention, the Bluetooth and head unit are not connected to the ECU or CANBUS in any form outside of power and ground leads

Might be on the Limited though since you've got climate control that adjusts the fans and temp. Connecting to a moving vehicle via Bluetooth would be quite difficult though. Actually, doesn't the 4Runner lock out any Bluetooth changes while the vehicle is in anything other than park? Not to mention that the Bluetooth range on my 4Runner seems to be fairly small - if I'm more than a few feet away with my phone in my pocket the audio starts to get choppy.

It probably is only a matter of time before more vehicles get these internet connected systems, including Toyota. Tesla is probably one of the more advanced ones in that regard, and even pushed out an update a couple years ago to disable the low ride setting at highway speeds.

Elons blog mentions air suspension update for further fire safety | Forums | Tesla Motors

The real problem here comes with connecting an old system designed purely for speed of communication with no security (CAN bus) to a new system that's connected to the internet without considering all the possible implications.

 

[marshal]

Might be on the Limited though since you've got climate control that adjusts the fans and temp. Connecting to a moving vehicle via Bluetooth would be quite difficult though. Actually, doesn't the 4Runner lock out any Bluetooth changes while the vehicle is in anything other than park? Not to mention that the Bluetooth range on my 4Runner seems to be fairly small - if I'm more than a few feet away with my phone in my pocket the audio starts to get choppy.

It probably is only a matter of time before more vehicles get these internet connected systems, including Toyota. Tesla is probably one of the more advanced ones in that regard, and even pushed out an update a couple years ago to disable the low ride setting at highway speeds.

Elons blog mentions air suspension update for further fire safety | Forums | Tesla Motors

The real problem here comes with connecting an old system designed purely for speed of communication with no security (CAN bus) to a new system that's connected to the internet without considering all the possible implications.

The benefit that tesla has is that if can do pushed OTA updates on a secure connection. As soon as an exploit is identified it's patched. Chrysler can't do that at this point. Their updates have to be manually installed via a thumb drive.

 

[4RunnerAU]

Incidentally; I don't own a cell phone.

Wat?

 

[kboxvegas]

While our infotainment system is nothing like the ones in a Prius, our Entune system COULD be connected to the ECU in some form unless the service reminders calculates mileage from GPS. Beyond that I cannot see any reason for it to be connected. If it is not connected, the worst they could do is annoy you by looping music or something. :shocked:

<iframe width="420" height="315" src="https://www.youtube.com/embed/2RsvrKg-cDA?rel=0" frameborder="0" allowfullscreen></iframe>

Also the bit about steering a car remotely could only work if you had electrically assisted power steering.

 

[BlackWorksInc]

The new Headunits ARE connected on the CAN Bus, though I think it's pretty much solely to output DTCs via the DLC. So the most that can be done is to have the vehicle stall out or run poorly because they forced a ton of useless data on the CAN Bus and blocked communication.

For a hacker to be able to do anything else they would need specific coding, software, and the strategy information for each model, trim, and emissions platform of every module in that vehicle. Then then could MAYBE get the car to lock up the ABS for you or increase the resistance in the steering if it's electric; other than that there are no other direct ways for the vehicle to overcome a human occupant's control at the moment with a Toyota in the US.

Though IF they did have all that requisite information and managed to crack it; they'd make far more money selling it to 3rd party companies who have been hungrily hunting for a "crack" into Toyota's computer systems for years than anything they'd get by maliciously hacking a vehicle.

Now if you're talking about something like Cadillac's new cars that will be basically self driving, Mercedes's self driving set-up, or Infiniti's Q50 that disengages the physical steering wheel from the steering rack, those are the vehicles that can be "taken over" by a hacker because the vehicles already take the driver out of the equation.

 

[Lester Lugnut]

I have no money in the glove box.

 

[SilverRiver]

Note: VW was kind enough to add CAN bus support to the mainline Linux kernel. This allows you to easily talk to the CAN bus on your car.

Your friendly Tesla intern explains:
https://www.youtube.com/watch?v=qPIscmaIt8U#t=867

He also outlines a simple denial of service attack where spamming the CAN bus with packets prevents the car from starting. Awesome.
https://www.youtube.com/watch?v=qPIscmaIt8U#t=999

Happy hacking!!
:typing:

 

[Ron4RNevada]

Thanks to all of you for your answers. It sounds as if my basic '13 SR5 is so far pretty safe from hacking. Guess I'll now have to keep it forever........

Incidentally, I'm glad I brought up the topic; learned a lot.


:grouphug: :couch2:

 

[Blitzkrieg]

Meh, I never liked Jeeps anyway...

 

[Mikey01]

My wife really wants a jeep, I keep bringing this and a few other concerns I have up to every sells men we talk to. It's always some reply like, it will never happen and jeeps have the highest resell value.

 

[NoLight]

Everything is hackable.

True Dat...