cherokee

WIRED magazine published a story yesterday about the world’s first documented wireless attack of a vehicle. A pair of security researchers put a journalist behind the wheel of a Jeep Cherokee and took control of it while he was driving miles away.

Read my synopsis on Autonet, here’s the original WIRED story by Andy Greenberg, and below are the key things to know.

This security update does NOT affect Canadian vehicles

I contacted Chrysler, and got this quote for Autonet:

“An FCA representative in Canada tells Autonet, “Due to market access to cellular connectivity in the Canadian marketplace, FCA Canada vehicles are not affected by this condition and therefore do not require a system upgrade.”

It does however, affect American vehicles, specifically American mid-2013 to 2015 Fiat-Chrysler vehicles that are equipped with the Uconnect infotainment system.

WIRED estimates about 417,000 are affected. Download the security update from FCA here, or take it to a dealership mechanic.

What happened to the car?

Radio, A/C and wipers were all turned on high, and Andy spun the control dials with zero affect. They altered the dashboard screen image.

They cut the transmission, and an 18-wheeler came barrelling up behind him, then they disengaged the brakes and sent Andy into a ditch.

They turned the SUV into a surveillance tool, tracking its GPS coordinates and tracing it on a map.

How was the car attacked?

The pair gain wireless control of the Cherokee via the vehicle’s Uconnect infotainment system which is connected to the Sprint network.

They enter the car through its cellular connection, then move to an adjacent chip in the head unit and rewrite the chip’s firmware to include their malicious code. Now they’re able to send commands through the car’s computer network – CAN bus – and control physical components like the brakes and transmission.

What’s next?

The pair will present their findings at the upcoming Black Hat online security conference in Vegas, as well as share their code. A key vulnerability will be omitted, but the code to do the dashboard tricks will hit the internet.

Why? They say 2 reasons: for peer review, and it “sends a message: automakers need to be held accountable for their vehicles’ digital security.”

Overall Takeaway

What Charlie said:

“We shut down your engine—a big rig was honking up on you because of something we did on our couch,” Miller says, as if I needed the reminder. “This is what everyone who thinks about car security has worried about for years. This is a reality.”

They hacked a fun SUV.

In straight-from-factory 2015 Cherokee’s, Jeep sent us off-roading on Hell’s Revenge, one of North America’s most difficult off-roading trails.

As far as press trips go, this one was very laid back. Which was why it felt fine to commandeer the hotel golf cart, and drive it into the presentation.

Off into Utah, which is very red and alien-ish.

The trail is 10.5 km and okay woah, I totally get Jeep now, it just climbs up walls?! Throttle, little more now and whoooosh up I go.

I was literally hanging weightless from my seatbelt, my new favourite thing.

Got to drive with Lorraine Sommerfeld and there were lots of laughs, “it’s happening.”

A veteran auto journalist, like, my 2.7 column years to her 13, and 2 weekly columns at that. Plus she’s 2014’s ‘Canadian Journalist of the Year’. Read her stuff here, she’s snort-out-loud-clever.

(Above and below photos: Costa Mouzouris)

Jeep goes up, Jeep goes down.

The Cherokee’s Trailhawk trim is how it can do this (the base model won’t.)

Trailhawk means it’s been modified at the factory for this terrain – skid pads, tuned suspension, front tow hooks, and a more angled fascia for a 30º approach.

It’s also equipped with Selec-Terrain Mode (choose sand, snow, more) but the key is Active Drive Lock, available only on this trim. It locks the rear differential in 4WD so you can zoom straight up.