sch911 wrote:
AndyW wrote:
whjco wrote:
The "hack" was performed under a set of circumstances where the hackers had direct physical access to the vehicle and would be virtually impossible to duplicate over the internet. A security update to the UConnect software is available via download or dealer installation to plug any discovered security vulnerability.
That is false - the most recent demonstration was entirely via the internet, and they even demonstrated that they could scan for and find other vehicles susceptible to the same bug via the cellular network.
It's an interesting read about something that is likely to get worse before it gets better:
http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
Yes they did in fact spend several days with the vehicle physically enabling the exploit, before connecting to it remotely
They talked about redoing and then uploading new uConnect firmware. While remote firmware updates are old news, I was surprised that an auto manufacturer would turn down the chance to get you back into the shop for maintenance. :)
Physical access makes more sense.
Do we have confirmation from them that that's how the got thru the first zero-day?