Sat nav systems at risk from hackers

In-car route-planning equipment could be the next target for hackers after researchers expose wireless data vulnerability.

The satellite navigation systems in many cars are wide open to potentially dangerous abuse by hackers, warns a security expert.

Andrea Barisani, chief security engineer with Italian consultancy Inverse Path, says systems based on Radio Data System-Traffic Message Channel (RDS-TMC) technology are particularly vulnerable.

He says his own tests show how a hacker could get into such systems and send drivers wrong messages about where to go, and other misleading information.

RDS-TMC is used widely in vehicles across the UK, Europe and the US, typically to provide data on traffic conditions, accidents and detours. Because it does not authenticate the source of data sent to it, says Barisani, the system is open to senders of bogus information, or large amounts of data aimed at swamping it and causing a denial of service.

Advertisement - Article continues below
Advertisement - Article continues below

"I recently bought a new car with an RDS-TMC sat nav feature, which made me wonder how easy it would be for someone to detect it and then inject it with false data," Barisani said. "A colleague and I tested it and discovered it was relatively easy."

He believes there are a number of ways that navigation systems could be abused: "You could divert someone to a secondary road that you know of, and ambush them there. You could create a traffic jam by sending everyone down a narrow street. You could use it to send false terror alerts and spread alarm."

He says company car drivers could be especially at risk from competitors making them divert, or springing a denial of service attack. "A lot of professional people no doubt depend on this technology," he says.

"The trouble is that people trust sat nav," he points out. "It's not like your PC which everyone knows is vulnerable to hackers and viruses, so are wary of. Sat nav naturally inspires blind faith."

Barisani says he is amazed that there is no authentication on RDS-TMC systems: "I know some manufacturers are working on new and more secure standards, primarily for billing purposes though," he says. "These new standards will solve most of the issues but it's going to take quite some time before wide implementation and adoption."

He says he'd like to see more awareness of this, 'so at least the good guys know what the risks are before the bad guys get to work'.

Barisani and colleague Daniele Bianco plan to present their full research at next month's CanSecWest security conference in Vancouver.

Featured Resources

How inkjet can transform your business

Get more out of your business by investing in the right printing technology

Download now

Journey to a modern workplace with Office 365: which tools and when?

A guide to how Office 365 builds a modern workplace

Download now

Modernise and transform your sales organisation

Learn how a modernised sales process can drive your business

Download now

Your guide to managing cloud transformation risk

Realise the benefits. Mitigate the risks

Download now

Most Popular


How to use Chromecast without Wi-Fi

5 Feb 2020
Microsoft Windows

Microsoft pulls disastrous Windows 10 security update

17 Feb 2020
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020
cloud computing

Google Cloud snaps up multi-cloud analytics platform for $2.6bn

13 Feb 2020