Feeds

Satnav hacking made simple

Create your own traffic jam, bull fight or air raid

SANS - Survey on application security programs

CanSecWest A pair of hackers have demonstrated a way to spoof travel information messages displayed on satellite navigation systems used by Italian drivers to bypass accidents, traffic jams and plot the most efficient routes from one point to another.

The hack is so simple it's hard to believe no one has shown it off before. It uses inexpensive, off-the-shelf gear to inject RDS-TMC (radio data system-traffic message channel) data that is digitally coded into FM signals that many satnav systems use to receive travel information in real time. While the technique could be used for ill intent, Andrea Barisani, one of two researchers from Inverse Path who presented the hack at the CanSecWest conference in Vancouver, swears his goals were much more benign.

"The whole point is you can actually get laid," Barisani declared. He was alluding to video he had just rolled depicting Daniele Bianco, Barisani's partner in the demo, ambling down an unpaved road with a ravishing young woman. Based on the input from their 2006 Honda's integrated natsav, the two become stranded in the middle of nowhere. Upon learning an evil hacker brandishing an FM antenna is responsible, the young woman, so impressed with his power, quickly takes up with him.

Beyond an RDS encoder (price tag: $40), an FM transmitter and a hand-held antenna, the hackers needed the codes used to denote a particular event (e.g. an accident, parade or bull fight), and the event's location - information that can be easily learned from online sources. The strength of the FM signal can be augmented for long-range hacks that target a large number of drivers or more narrowly for those that aim to single out someone in particular.

Depending on the event invoked, the driver may receive a pop up notification (e.g. airplane crash or bomb alert), or the notification may not be displayed. But even in the latter case, the spoofed alert has the potential to mislead a satnav user. For example, an injection reporting a road has been closed will cause the satnav to recalculate a route to avoid the closure.

The injection is trivial to carry out. While TMC specs employ encryption, it is used for discrimination and not authentication, and the key can be broken by sampling a small amount of data. Also facilitating injection: terminals that use encryption are still expected to accept unencrypted data.

In addition to the FM band, TMC is also supported over digital audio broadcast and satellite radio, but those mediums are likely harder to exploit for injections. Microsoft DirectBand, an FM subcarrier used for MSN Direct, is a closed system that employs more robust encryption, also making it look promising, Barisani said. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.