Know How... 153: Car Hack, Disable Flash, & Bacteria

Smart cars getting hacked, how to disable Flash and why you should. Learn how much bacteria is living on things you use everyday, and more.

Yet another car hack (and this one is a little scary) http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

• It's Blackhat time! Which means it's the season of exploits!
• Charlie Miller and Chris Valasek will be doing a presentation at Blackhat on another exploit of the "CAN" (Controller Area Network)
• This is the "communications bus" that allows devices in a car to communicate with each other. We've seen this before... in January with BMW's "Connected Drive"
• And a researcher showed off a device at Blackhat Asia that allowed attackers to gain complete control over a car with a gadget that plugged into the On board Diagnostic port.

Car Hackin' -- Made EASY!

http://www.wired.com/2015/03/60-gadget-thatll-make-car-hacking-easier-ever/

"Black Hat Asia" in Singapore, 24-year old "Eric Evenchick" introduced the "CANtact"

• It's a $60-$100 device that interfaces with your car's computer
• It has a USB port on one side, a OBD2 port on the other It allows a user to take control of anything that is connected to the car's "Controller Area Network" (CAN) - Engine, windows, entertainment, brakes, security
• Basically. EVERYTHING.
• He is releasing the software as open source. This isn't the first time that researchers have developed a device that can hack a car's computer -- but this is an extraordinarily inexpensive device.
• Most importantly, this device converts the OBD2 protocol into something that regular users can hack.

But back to THIS story:

• The researchers joined forces with journalist Andy Greenberg to do something that should be possible:
  • They took advantage of an "entertainment feature" within some Chrysler vehicles to affect driving-critical systems
  • They were able to turn on the radio and set it to full blast, with the driver not able to turn it off
  • They turned on the flashers, the windshield wipers and the air con
  • Then they did some REALLY scary stuff:
    • They disabled the transmission, the brakes, and could have sent signals to the power-steering system to turn the car. And they did all of this to a Jeep Cherokee being driven by Greenberg while the team was in Miller's basement.
• They did it by exploiting the "Uconnect", internet-connected computer, which gave them access to the entertainment system
• They hacked the entertainment system, then used it as a beachhead to access the engineer, wheels and electrical systems

Flash / Security

It's time to take back our security! (Ok... let's not get too dramatic... it's just time for us to take our security seriously)

There are two things that need to happen:

1. Stop using Flash
2. Start using a tool to prevent scripting exploits

Chrome:

• There are a lot of security folk who say Google Chrome is becoming a bloated mess with many integrated plugins that lend themselves to exploits.
• However, I know that many of us are attached to Chrome because of it's tight integration with our Google Services
• But... we CAN at least turn off the integrated Flash plugin!
• If you go into the extensions window, you won't find it:
  1. In the address bar, type: "chrome://plugins"
  2. Disable the Flash Plugin

Firefox:

1. Menu
2. Add Ons
3. Scroll to "Shockwave Flash"
4. Select "Never Activate"
   • We're not

VLC

These show notes have been truncated due to length. For the full show notes, visit https://twit.tv/shows/know-how/episodes/153

Hosts: Fr. Robert Ballecer, SJ and Bryan Burnett

Sponsor:

• lynda.com/knowhow