Sat nav systems at risk from hackers

In-car route-planning equipment could be the next target for hackers after researchers expose wireless data vulnerability.

The satellite navigation systems in many cars are wide open to potentially dangerous abuse by hackers, warns a security expert.

Andrea Barisani, chief security engineer with Italian consultancy Inverse Path, says systems based on Radio Data System-Traffic Message Channel (RDS-TMC) technology are particularly vulnerable.

He says his own tests show how a hacker could get into such systems and send drivers wrong messages about where to go, and other misleading information.

RDS-TMC is used widely in vehicles across the UK, Europe and the US, typically to provide data on traffic conditions, accidents and detours. Because it does not authenticate the source of data sent to it, says Barisani, the system is open to senders of bogus information, or large amounts of data aimed at swamping it and causing a denial of service.

"I recently bought a new car with an RDS-TMC sat nav feature, which made me wonder how easy it would be for someone to detect it and then inject it with false data," Barisani said. "A colleague and I tested it and discovered it was relatively easy."

He believes there are a number of ways that navigation systems could be abused: "You could divert someone to a secondary road that you know of, and ambush them there. You could create a traffic jam by sending everyone down a narrow street. You could use it to send false terror alerts and spread alarm."

He says company car drivers could be especially at risk from competitors making them divert, or springing a denial of service attack. "A lot of professional people no doubt depend on this technology," he says.

"The trouble is that people trust sat nav," he points out. "It's not like your PC which everyone knows is vulnerable to hackers and viruses, so are wary of. Sat nav naturally inspires blind faith."

Barisani says he is amazed that there is no authentication on RDS-TMC systems: "I know some manufacturers are working on new and more secure standards, primarily for billing purposes though," he says. "These new standards will solve most of the issues but it's going to take quite some time before wide implementation and adoption."

He says he'd like to see more awareness of this, 'so at least the good guys know what the risks are before the bad guys get to work'.

Barisani and colleague Daniele Bianco plan to present their full research at next month's CanSecWest security conference in Vancouver.

Featured Resources

BCDR buyer's guide for MSPs

How to choose a business continuity and disaster recovery solution

Download now

The definitive guide to IT security

Protecting your MSP and your customers

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Most Popular

16 ways to speed up your laptop

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021
Dell patches vulnerability affecting hundreds of computer models worldwide
cyber security

Dell patches vulnerability affecting hundreds of computer models worldwide

5 May 2021