A report to be presented this week at the Black Hat USA conference in Las Vegas will detail which vehicles are most vulnerable to hacker attacks via a car's Bluetooth, telematics or on-board phone applications.
Researchers Charlie Miller and Chris Valasek, who in the past have issued reports on the most vulnerable vehicles, intend to release an update showing the most and least hackable cars.
Ford's Sync Infotainment System. At last year's Def Con conference, researchers pointed to the Toyota Prius and Ford Escape as vehicles whose internal networks they could gain access to in order to control critical functions.
"A malicious attacker leveraging a remote vulnerability could do anything from enabling a microphone for eavesdropping to turning the steering wheel to disabling the brakes," the researchers said in a brief outlining their upcoming report. "Unfortunately, research has only been presented on three or four particular vehicles. Each manufacturer designs their fleets differently; therefore analysis of remote threats must avoid generalities."
The most hackable vehicles include the 2014 Jeep Cherokee, the 2015 Cadillac Escalade and the 2014 Toyota Prius. The most secure cars include the Dodge Viper, the Audi A8, and the Honda Accord, according to an interview the researchers had with Dark Reading.
The report is expected to also address how automotive network security has changed over the last five years and how to better protect vehicles from cyberattacks in the future.
At the 2013 Def Con conference, Miller, a security engineer at Twitter, and Valasek, director of security intelligence at security service IOActive, described ways to launch cyberattacks to control brakes and steering on a Prius and Ford Escape.
The two researchers also revealed a prototype device that could thwart vehicle hacking. Their intrusion prevention device plugs into a vehicle's OBD-II port, watches data traffic on a car's internal network and then blocks any anomalies.
Miller and Valasek didn't physically test the vehicles cited in this year's report for vulnerabilities, relying instead on information about the vehicles' automated capabilities and internal network.
"We can't say for sure we can hack the Jeep and not the Audi," Valasek told Dark Reading. "But... the radio can always talk to the brakes" because both are on the same network.
All modern vehicles have a controller area network (CAN), which is an internal bus that allows microcontrollers and devices to communicate with each other. Gaining access through a wireless connection could potentially offer access to critical systems such as brakes and steering.
Nick Colella, Infotainment Manager for Ford, said his and other companies are researching the use of Ethernet as a separate, more secure and faster network for vehicles.
Sign up for CIO Asia eNewsletters.