(Kamkar declined to reveal any more about that aborted research.) Before focusing on GM OnStar, he adds that he had found yet another vulnerable automobile system that he had planned to speak about, but the company responsible for the flaws fixed them without his help. He's holding the details of those techniques until his DefCon talk. In fact, Kamkar, a serial hacker who has recently revealed hacks for garage doors, combination locks and drones, also plans to reveal a second set of security vulnerabilities in cars' digital key systems. 'We need to start paying attention to this, or cars will continue to get owned,' he says. Kamkar's hack shows that the same connected features in other vehicles likely have their own vulnerabilities. That hacker exploit, which led to a 1.4 million vehicle recall, took advantage of a flaw in the Uconnect feature in Chrysler vehicles' dashboards. Already, researchers Charlie Miller and Chris Valasek have demonstrated to WIRED that they could wirelessly hack a Jeep or any of hundreds of thousands of Chrysler vehicles over the Internet to control steering, brakes and transmission.

'I want to point out the lack of security here and the fact we need to pay more attention as we make more devices connected and quote ‘smart.’ The proof of concept is to show that it’s reasonably trivial for someone in my industry to do this.'Ĭar hacking in particular seems likely to dominate this year's Black Hat and DefCon hacker conferences, where much of the most interesting security research of the year is unveiled. 'I do play Grand Theft Auto a lot, but my motivation isn't to steal cars,' says Kamkar.

Instead, he says his research is intended to draw attention to the larger problem of cars being vulnerable to digital attackers-along with other devices in the so-called 'internet of things'-as they're increasingly computerized and networked. Kamkar's goal isn’t to use his attack to help thieves steal the contents of cars or unleash a remote honking-hack epidemic on GM vehicles. We need to start paying attention to this, or cars will continue to get owned.

Kamkar's shown that if a hacker can plant a cheap, homemade Wi-Fi hotspot device somewhere on the car’s body-such as under a bumper or its chassis-to capture commands sent from the user’s smartphone, the results for vulnerable vehicle owners could range from nasty pranks to privacy breaches to actual theft. But if a hacker like Samy Kamkar has hidden a small, $100 box anywhere on your Onstar-equipped car or truck, those same conveniences could fall into unintended hands.Īt the DefCon hacker conference next week, Kamkar plans to present the details of a new attack on GM’s OnStar RemoteLink system he’s developed that can allow a hacker to track a target vehicle, effortlessly unlock it, trigger the horn and alarm or even start its engine-everything but put the car in gear and drive it away, one function that thankfully still requires the presence of the driver’s key. GM’s Onstar service offers some of the most futuristic features on any connected car, including the ability to locate the vehicle, unlock it, and even start its ignition-all from a smartphone app.

Update 3:30pm EST: After an initial, incomplete fix Thursday, GM says it's now resolved the problem with a change to its server software and update to its OnStar RemoteLink iOS app.

Gmc acadia software update