{"id":76731,"date":"2017-08-04T09:11:54","date_gmt":"2017-08-04T16:11:54","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=76731"},"modified":"2025-08-14T02:21:40","modified_gmt":"2025-08-14T09:21:40","slug":"connected-cars","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/connected-cars\/","title":{"rendered":"Connected Cars: How One Vulnerability Can Turn Cybercriminals into Backseat Drivers"},"content":{"rendered":"

Whether it\u2019s turning the music up a little, or turning down the AC \u2013 when you\u2019re in your own car, you\u2019re the driver in all senses of the word. Well, usually. Now, with the recent boom in connected cars, cybercriminals may soon be a backseat driver, only they\u2019re not executing commands from the back row. They have the capability to remotely track you as you drive, or even take control of the settings all due to this recent explosion of connected cars \u2014 and vulnerabilities within those cars that have yet to be addressed.<\/p>\n

Our Advanced Threat Research (ATR) team addressed these vulnerabilities<\/a> in preparation for this year\u2019s DEFCON, a cybersecurity conference held annually in Las Vegas, that brings together the best and the brightest to poke and prod new technologies and discover and document vulnerabilities. Vulnerabilities in connected cars are a particularly severe issue, especially as internet-connected and semi-autonomous vehicles begin to become commonplace.<\/p>\n

The first vulnerability explored, which our team disclosed before DEFCON, allowed a test ransomware attack. The simulated ransomware attack didn\u2019t disable the car, it made being around the car a chore by playing a popular 80\u2019s song at full volume until the target paid the ransom.<\/p>\n

Another newly-discovered (and fixed) vulnerability found by our research team allowed them to make their way within into the car\u2019s navigation system. There, they were able to find the web address the car used to check in with its manufacturer for navigation. As it so happens, the manufacturer no longer owned the domain \u2014 enabling our team to set up a honeypot site<\/a> for any car that wanted to check into the manufacturer\u2019s site. Our ATR team was surprised to see a number of cars check in. Not only that, but a number of vehicles gave their geographic location, their current navigation destinations, the GPS coordinates of waypoints and even the name of those waypoints.<\/p>\n

That\u2019s not all. Our team was also able to execute code through the S-Gold 2 (PMB 8876) cellular baseband chipset<\/a> \u2014 a device used in a car to communicate with either the internet or a manufacturer\u2019s intranet (an intranet being, essentially, a private internet). Obviously, our ATR team notified the relevant manufacturers of these issues, and a fix has been issued.<\/p>\n

Tips to Keep Your Vehicle Safe<\/h2>\n

All of these vulnerabilities may sound concerning, but their public disclosure is actually good. Since we\u2019ve notified Nissan and BMW of the S Gold 2 vulnerability, we have been told that a free fix has been issued to their dealers, which is available now to all affected customers in U.S. and Canada. It\u2019s important both manufacturers and their drivers become aware of these issues, and take the necessary steps to keep their vehicles secure. To help keep your vehicle safe as a driver, follow these security tips:<\/p>\n