Hackers' text message unlocks, starts your car

You have one new message: Your high-tech car security system can be hacked, and your car stolen, with a simple text message.

And, say the researchers who proved it, the same methods can be used to take over a power plant or water-treatment facility.

At next week's (July 30-Aug. 4) Black Hat Security Conference in Las Vegas, researchers Don Bailey and Matthew Solnik from the San Francisco security consulting firm iSec Partners will give a demonstration titled, "War Texting: Identifying and Interacting with Devices on the Telephone Network."

They'll show how they remotely unlocked a car, started its engine and learned its GPS coordinates — all by sending a specially crafted text message to hack into the car's cellular-network-based security system.

("War texting" refers to the practice. of hacking into a cellular-network-connection device via text messages.)

Highly sophisticated vehicle security systems have been in use for more than a decade. General Motors' OnStar, perhaps the best-known, communicates with call centers and GPS satellites and can be used to unlock, track, start and turn off cars remotely.

Other car manufacturers have similar systems, especially in luxury models. OnStar and other brands are also available as aftermarket add-ons.

Bailey and Solnik have not identified the specific security system they cracked, but they that say that modern cars are sitting targets — at least for attackers with their level of skills.

For Subscribers

FOR SUBSCRIBERSAbdul El-Sayed tries to woo MAHA voters as Democrats seek inroads with RFK’s supporters

FOR SUBSCRIBERSKratom-like substances are popping up in a typically benign supplement

FOR SUBSCRIBERSGOP super PAC increases its spending for Sen. Jon Husted in tough Ohio race

FOR SUBSCRIBERSRecords reveal tumultuous marriage between slain New York Times executive and wife

FOR SUBSCRIBERSFrom clean energy warrior to ‘wall of shame,’ James Talarico reverses on a fossil fuel money pledge

FOR SUBSCRIBERSCongressional staff planned official trip with luxury stops in Italy and France weeks before election

FOR SUBSCRIBERSA harrowing ordeal aboard an Israel-bound plane

FOR SUBSCRIBERSOpenAI CEO Sam Altman to skip congressional hearing on rogue AI agents

FOR SUBSCRIBERSKey DOJ lawyers departed Trump ‘grand conspiracy’ probe amid pressure to produce, source says

FOR SUBSCRIBERSTrump’s new AI chatbot often links to a site launched under Clinton 26 years ago

FOR SUBSCRIBERSAt MAHA summit, industry CEOs the movement once vilified take the stage

FOR SUBSCRIBERSThis Paralympian has two goals: Win medals and give away $500,000 to her teammates

FOR SUBSCRIBERSCornell rape allegation spotlights stringent New York state laws that have long drawn criticism

FOR SUBSCRIBERSThe debate over AI’s future rages on both coasts

FOR SUBSCRIBERSDecades-old march dispute reignites in Northern Ireland, threatening political crisis

For Subscribers

FOR SUBSCRIBERSAbdul El-Sayed tries to woo MAHA voters as Democrats seek inroads with RFK’s supporters

FOR SUBSCRIBERSKratom-like substances are popping up in a typically benign supplement

FOR SUBSCRIBERSGOP super PAC increases its spending for Sen. Jon Husted in tough Ohio race

FOR SUBSCRIBERSRecords reveal tumultuous marriage between slain New York Times executive and wife

FOR SUBSCRIBERSFrom clean energy warrior to ‘wall of shame,’ James Talarico reverses on a fossil fuel money pledge

FOR SUBSCRIBERSCongressional staff planned official trip with luxury stops in Italy and France weeks before election

FOR SUBSCRIBERSA harrowing ordeal aboard an Israel-bound plane

FOR SUBSCRIBERSOpenAI CEO Sam Altman to skip congressional hearing on rogue AI agents

FOR SUBSCRIBERSKey DOJ lawyers departed Trump ‘grand conspiracy’ probe amid pressure to produce, source says

FOR SUBSCRIBERSTrump’s new AI chatbot often links to a site launched under Clinton 26 years ago

FOR SUBSCRIBERSAt MAHA summit, industry CEOs the movement once vilified take the stage

FOR SUBSCRIBERSThis Paralympian has two goals: Win medals and give away $500,000 to her teammates

FOR SUBSCRIBERSCornell rape allegation spotlights stringent New York state laws that have long drawn criticism

FOR SUBSCRIBERSThe debate over AI’s future rages on both coasts

FOR SUBSCRIBERSDecades-old march dispute reignites in Northern Ireland, threatening political crisis

"This is not technologically advanced," Bailey told Kaspersky Lab's ThreatPost blog. "The fact is you can own these kinds of systems in under a couple of hours. It's easy. There's no confidentiality or integrity built into the systems ... It shouldn't be possible for any fly-by-night 12-year-old to do this."

Researchers Use Trojan CD to Hack Car

Bailey and Solnik previously used war texting to get into personal GPS devices made by New York-based Zoombak.

What's particularly worrisome to the larger security community, Bailey said, is that the same system architecture used in the Zoombak and the car security system is also used in critical infrastructure security systems, such as those found at power plants or waste treatment facilities.

• Hey Stupid: Why Internet Hacking Is Your Fault
• Cop Car's Computer Hacked by Security Researcher
• Car Alarm Review