Feeds

Satnav hacking made simple

Create your own traffic jam, bull fight or air raid

Protecting users from Firesheep and other Sidejacking attacks with SSL

CanSecWest A pair of hackers have demonstrated a way to spoof travel information messages displayed on satellite navigation systems used by Italian drivers to bypass accidents, traffic jams and plot the most efficient routes from one point to another.

The hack is so simple it's hard to believe no one has shown it off before. It uses inexpensive, off-the-shelf gear to inject RDS-TMC (radio data system-traffic message channel) data that is digitally coded into FM signals that many satnav systems use to receive travel information in real time. While the technique could be used for ill intent, Andrea Barisani, one of two researchers from Inverse Path who presented the hack at the CanSecWest conference in Vancouver, swears his goals were much more benign.

"The whole point is you can actually get laid," Barisani declared. He was alluding to video he had just rolled depicting Daniele Bianco, Barisani's partner in the demo, ambling down an unpaved road with a ravishing young woman. Based on the input from their 2006 Honda's integrated natsav, the two become stranded in the middle of nowhere. Upon learning an evil hacker brandishing an FM antenna is responsible, the young woman, so impressed with his power, quickly takes up with him.

Beyond an RDS encoder (price tag: $40), an FM transmitter and a hand-held antenna, the hackers needed the codes used to denote a particular event (e.g. an accident, parade or bull fight), and the event's location - information that can be easily learned from online sources. The strength of the FM signal can be augmented for long-range hacks that target a large number of drivers or more narrowly for those that aim to single out someone in particular.

Depending on the event invoked, the driver may receive a pop up notification (e.g. airplane crash or bomb alert), or the notification may not be displayed. But even in the latter case, the spoofed alert has the potential to mislead a satnav user. For example, an injection reporting a road has been closed will cause the satnav to recalculate a route to avoid the closure.

The injection is trivial to carry out. While TMC specs employ encryption, it is used for discrimination and not authentication, and the key can be broken by sampling a small amount of data. Also facilitating injection: terminals that use encryption are still expected to accept unencrypted data.

In addition to the FM band, TMC is also supported over digital audio broadcast and satellite radio, but those mediums are likely harder to exploit for injections. Microsoft DirectBand, an FM subcarrier used for MSN Direct, is a closed system that employs more robust encryption, also making it look promising, Barisani said. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.