Car satellite navigation systems can be hacked--experts

Agence France-Presse

LAS VEGAS -- Satellite navigation systems in cars can be hijacked remotely with relative ease, allowing hackers to feed drivers bogus directions, two experts told a major security conference here.

Andrea Barisani and Daniele Bianco from the website Inverse Path demonstrated Thursday how antennas and a patchwork of commonly available electronics can be employed to replace the legitimate traffic information radioed to the systems with false instructions.

The hacker tool works on in-car Radio Data System "SatNav" devices standard in Europe, which are becoming increasingly common in North America and are due to debut this year in Australia, Barisani told security professionals meeting in Las Vegas for the Black Hat digital self-defense conference.

"If we can make it, anyone can make it," Barisani said as he and Bianco assembled their hacking masterpiece for their seminar. "We type on keyboards all day and aren't very mechanical."

While navigation systems plot routes using stored maps and satellites, the systems receive perpetual updates about traffic accidents, road closures or other conditions that sometimes call for setting new courses.

The updated information is sent in packets of computer code on FM radio frequencies, sometimes sharing wavelengths with radio programs.

The hacking device can "sniff out" and replace legitimate traffic data on existing channels or create fake broadcasts on unused frequencies, according to Barisani.

Its signal can easily be boosted to a 16 kilometer (10 miles) radius, he said.

In-car navigation systems continually scan for data channels, downloading information about traffic, weather, and road problems.

"We can see what is going on and change the destination," Barisani said.

"We can create bad weather, fresh snow, full car parks, accidents...close bridges, roads or tunnels, and the SatNav will pop-up a detour."

Barisani referred to re-routing GPS-dependent drivers as the "keep your parents from getting home attack."

The two Italian experts said they discovered mischief-inspiring pre-programmed alerts they could trigger, among them the messages "air raid," "bomb," "bull fight," and "boxing match."

"You can mine all the highway, sending alerts for bombs, air crashes and terrorist incidents without end -- World War III on your highway," Barisani said. "The boxing match makes sense, because after an accident in Italy you get boxing on the highway."

The results of hacks were sent to the Traffic Message Channel in Europe that handles the sending of updates and alerts to in-car devices.

TMC wrote back that "pirate radio" stations are illegal and it is confident protections are built into devices, according to letters posted at the website of Inverse Path, where Barisani is chief security officer.

"The problem is people implicitly trust these things," Barisani said of in-car navigation systems. "You worry about viruses in your computer at home but not in your car. This is an open door to software running your car."