OVERKILL
$100 Site Donor 2021
A new feature (to me) with the '14 SRT-8 was the ability to update the firmware on the UConnect system (the software that runs the infotainment, navigation...etc) via a USB key. This became relevant when the OTA Jeep hack was discovered, which we've discussed in the past. A quick recap: The embedded systems which should be isolated/protected were not and subsequently the system was able to be accessed remotely via the 3G interface and a modified firmware image written to the UConnect system that allowed it to send commands to other components/systems on the network, having a potentially catastrophic impact on the function (or malfunction) of the vehicle.
The original article from Wired here:
http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
Originally Posted By: wired
All of this is possible only because Chrysler, like practically all carmakers, is doing its best to turn the modern automobile into a smartphone. Uconnect, an Internet-connected computer feature in hundreds of thousands of Fiat Chrysler cars, SUVs, and trucks, controls the vehicle’s entertainment and navigation, enables phone calls, and even offers a Wi-Fi hot spot. And thanks to one vulnerable element, which Miller and Valasek won’t identify until their Black Hat talk, Uconnect’s cellular connection also lets anyone who knows the car’s IP address gain access from anywhere in the country. “From an attacker’s perspective, it’s a super nice vulnerability,” Miller says.
From that entry point, Miller and Valasek’s attack pivots to an adjacent chip in the car’s head unit—the hardware for its entertainment system—silently rewriting the chip’s firmware to plant their code. That rewritten firmware is capable of sending commands through the car’s internal computer network, known as a CAN bus, to its physical components like the engine and wheels. Miller and Valasek say the attack on the entertainment system seems to work on any Chrysler vehicle with Uconnect from late 2013, all of 2014, and early 2015. They’ve only tested their full set of physical hacks, including ones targeting transmission and braking systems, on a Jeep Cherokee, though they believe that most of their attacks could be tweaked to work on any Chrysler vehicle with the vulnerable Uconnect head unit.
Since I have access to WiTech through my dealer, I did the full suite of updates for the various embedded systems on my wife's '06 shortly after we bought it. This included updated firmware for things as simple as the amplifier controller to reduce distortion on bass-heavy music and updated PCM software that dealt with a bug relative to the EGR. All of the fixes/tweaks are present in the release notes for the respective updates for each system. There was also a firmware update for the sunroof controller, which had a bug that would cause it to hang open.
Some of the fixes are for issues most people will never experience and subsequently they are part of a TSB for a specific complaint. Others are of course more important and deal with issues like the one mentioned at the beginning. This could also be updated via WiTech, but the new feature, of being able to update it yourself, as an end-user, is what I found interesting. I would posit that it may not be in the too distant future that manufacturers will push out OTA updates like we have for smartphones.
Anybody in the IT field is pretty familiar with doing these updates anyways. Firmware updates for routers, switches, hard drives, optical drives, tape backups, BIOS; software that ranges in function from dealing with low-level commands/interfaces to operating as a full-blown embedded OS. However, historically this has not overlapped into the automotive side of things with updates only being available for specific systems (PCM/TCM primarily) and the manufacturers not being very open about what is fixed/modified nor forthcoming in implementing the updated software unless requested to do so.
With the advent of these "connected" systems and the various systems themselves being more autonomous the firmware that these components operate on becomes more of interest. With each little embedded device governing its own little section of the car and reporting back to the others, the possibility for bugs becomes higher (more pieces of software, a higher potential for bugs) and the implementation of the various methods of connectivity like WiFi, 3G, USB....etc opens a door for easier access to adding features with new firmware releases or patches for bug fixes.
So, all that being said, I'm pretty familiar with the process for Chrysler products at this point. Does anybody do this kind of stuff for other marques and what is your experience? What's the quality of the errata? Ease of updates?
The original article from Wired here:
http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
Originally Posted By: wired
All of this is possible only because Chrysler, like practically all carmakers, is doing its best to turn the modern automobile into a smartphone. Uconnect, an Internet-connected computer feature in hundreds of thousands of Fiat Chrysler cars, SUVs, and trucks, controls the vehicle’s entertainment and navigation, enables phone calls, and even offers a Wi-Fi hot spot. And thanks to one vulnerable element, which Miller and Valasek won’t identify until their Black Hat talk, Uconnect’s cellular connection also lets anyone who knows the car’s IP address gain access from anywhere in the country. “From an attacker’s perspective, it’s a super nice vulnerability,” Miller says.
From that entry point, Miller and Valasek’s attack pivots to an adjacent chip in the car’s head unit—the hardware for its entertainment system—silently rewriting the chip’s firmware to plant their code. That rewritten firmware is capable of sending commands through the car’s internal computer network, known as a CAN bus, to its physical components like the engine and wheels. Miller and Valasek say the attack on the entertainment system seems to work on any Chrysler vehicle with Uconnect from late 2013, all of 2014, and early 2015. They’ve only tested their full set of physical hacks, including ones targeting transmission and braking systems, on a Jeep Cherokee, though they believe that most of their attacks could be tweaked to work on any Chrysler vehicle with the vulnerable Uconnect head unit.
Since I have access to WiTech through my dealer, I did the full suite of updates for the various embedded systems on my wife's '06 shortly after we bought it. This included updated firmware for things as simple as the amplifier controller to reduce distortion on bass-heavy music and updated PCM software that dealt with a bug relative to the EGR. All of the fixes/tweaks are present in the release notes for the respective updates for each system. There was also a firmware update for the sunroof controller, which had a bug that would cause it to hang open.
Some of the fixes are for issues most people will never experience and subsequently they are part of a TSB for a specific complaint. Others are of course more important and deal with issues like the one mentioned at the beginning. This could also be updated via WiTech, but the new feature, of being able to update it yourself, as an end-user, is what I found interesting. I would posit that it may not be in the too distant future that manufacturers will push out OTA updates like we have for smartphones.
Anybody in the IT field is pretty familiar with doing these updates anyways. Firmware updates for routers, switches, hard drives, optical drives, tape backups, BIOS; software that ranges in function from dealing with low-level commands/interfaces to operating as a full-blown embedded OS. However, historically this has not overlapped into the automotive side of things with updates only being available for specific systems (PCM/TCM primarily) and the manufacturers not being very open about what is fixed/modified nor forthcoming in implementing the updated software unless requested to do so.
With the advent of these "connected" systems and the various systems themselves being more autonomous the firmware that these components operate on becomes more of interest. With each little embedded device governing its own little section of the car and reporting back to the others, the possibility for bugs becomes higher (more pieces of software, a higher potential for bugs) and the implementation of the various methods of connectivity like WiFi, 3G, USB....etc opens a door for easier access to adding features with new firmware releases or patches for bug fixes.
So, all that being said, I'm pretty familiar with the process for Chrysler products at this point. Does anybody do this kind of stuff for other marques and what is your experience? What's the quality of the errata? Ease of updates?
