Omar Ramos-Lopez was none too pleased when fired from his job at an Austin, Tex., car dealership in 2010. So he decided to get even. Getting revenge on former employers may not be a particularly novel reaction, but his choice of payback was cutting-edge.
Texas Auto Center, where Ramos-Lopez worked, installs GPS units in leased cars that can remotely prevent the car from starting, or sound the horn on demand. Such functions come in handy if anyone happens to fall behind on their lease payments.
The disgruntled Ramos-Lopez, however, used the devices to disable cars regardless of payment status. He also set off their horns at random times. He disrupted about a hundred cars over several weeks, wreaking havoc with the lives of many drivers.
Police eventually traced the mayhem back to Ramos-Lopez, who was using another employee’s password to gain access to the firm’s GPS system from his home computer. He was charged with felony breach of computer security, but was subsequently placed in a first-time, non-violent offenders program that allowed him to avoid a criminal record.
Ramos-Lopez may not be your typical thriller-novel criminal mastermind. He does, however, offer a glimpse into the future of cybercrime. Your computer can be hacked. Your phone can be hacked. And now your car can be hacked too.
The modern car is no longer simply a mechanical propulsion device. It has also become a complex network of computers managing almost every aspect of the vehicle, from emission control to airbags, anti-lock brakes and entertainment systems. Some cars have up to 70 separate electronic systems, running on 200 million lines of code. The computers are in control.
Following Toyota’s unintentional acceleration crisis in 2010, the U.S. Transportation Research Board (TRB) commissioned a report on the implications of the widespread use of on-board electronics. While the Toyota issue turned out to be more human error than computer malevolence, the TRB report, released last month, did find much to be concerned about. Perhaps the biggest issue is what it called “automotive vulnerabilities to cyberattack,” or car hacking.
“We found that basically anything under computer control in a car is vulnerable to malicious attack,” says computer scientist Stephen Checkoway. “This includes the brakes, engine, lights, radio, wipers and electronic display. If a computer controls it, it can be controlled by an attacker.”
Checkoway, a PhD candidate at University of California, San Diego, was an investigator on two major research projects cited by the TRB. First, his team was able to hijack almost every component of an unnamed, but popular, 2009 model family sedan. Doing so required brief physical access to the car – downloading a virus via a music CD, or plugging into the engine’s diagnostic port.
