Feeds

Satnav hacking made simple

Create your own traffic jam, bull fight or air raid

High performance access to file storage

CanSecWest A pair of hackers have demonstrated a way to spoof travel information messages displayed on satellite navigation systems used by Italian drivers to bypass accidents, traffic jams and plot the most efficient routes from one point to another.

The hack is so simple it's hard to believe no one has shown it off before. It uses inexpensive, off-the-shelf gear to inject RDS-TMC (radio data system-traffic message channel) data that is digitally coded into FM signals that many satnav systems use to receive travel information in real time. While the technique could be used for ill intent, Andrea Barisani, one of two researchers from Inverse Path who presented the hack at the CanSecWest conference in Vancouver, swears his goals were much more benign.

"The whole point is you can actually get laid," Barisani declared. He was alluding to video he had just rolled depicting Daniele Bianco, Barisani's partner in the demo, ambling down an unpaved road with a ravishing young woman. Based on the input from their 2006 Honda's integrated natsav, the two become stranded in the middle of nowhere. Upon learning an evil hacker brandishing an FM antenna is responsible, the young woman, so impressed with his power, quickly takes up with him.

Beyond an RDS encoder (price tag: $40), an FM transmitter and a hand-held antenna, the hackers needed the codes used to denote a particular event (e.g. an accident, parade or bull fight), and the event's location - information that can be easily learned from online sources. The strength of the FM signal can be augmented for long-range hacks that target a large number of drivers or more narrowly for those that aim to single out someone in particular.

Depending on the event invoked, the driver may receive a pop up notification (e.g. airplane crash or bomb alert), or the notification may not be displayed. But even in the latter case, the spoofed alert has the potential to mislead a satnav user. For example, an injection reporting a road has been closed will cause the satnav to recalculate a route to avoid the closure.

The injection is trivial to carry out. While TMC specs employ encryption, it is used for discrimination and not authentication, and the key can be broken by sampling a small amount of data. Also facilitating injection: terminals that use encryption are still expected to accept unencrypted data.

In addition to the FM band, TMC is also supported over digital audio broadcast and satellite radio, but those mediums are likely harder to exploit for injections. Microsoft DirectBand, an FM subcarrier used for MSN Direct, is a closed system that employs more robust encryption, also making it look promising, Barisani said. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.