Fiat Chrysler announced the recall of about 1.4m cars and trucks in the US on Friday after two hackers were able to take control of a Jeep over the internet.
The recall, which includes Dodges, Jeeps, Rams and Chryslers, comes after Wired magazine published an article on Tuesday in which two hackers were able to remotely manipulate a Jeep Cherokee’s transmission, radio, air conditioning and other systems.
The company also disclosed in government documents that the hackers got into the Jeep through an electronic opening in the radio and said it would update software to close it. On Thursday, Fiat Chrysler sealed off a loophole in its internal cellular telephone network with vehicles to prevent similar attacks, the automaker said in a statement.
The vulnerability exposed by the hack rippled through the auto industry and drew the attention of government safety regulators, who on Friday opened an investigation into the Jeep incident.
The National Highway Traffic Safety Administration said it would find out which other automakers use the same radios. It came as the industry is rapidly adding internet-connected features such as Wi-Fi and navigation that are convenient for drivers but make the car more vulnerable to outside attacks.
Shortly after the hack was disclosed, Fiat Chrysler said it would contact owners of 471,000 vehicles and offer software updates to fix the problem. But documents show that the wider recall came at the urging of government safety regulators.
Fiat Chrysler, which faces penalties from the NHTSA for recall delays over several years, said in documents that it agreed to the recall even though there were no problems in the field other than the Jeep attack, and it had no complaints or warranty claims. The company also implied in its statement that the hackers broke the law by manipulating a vehicle remotely without authorization.
The Wired magazine article was about two well-known hackers, Charlie Miller and Chris Valasek, who remotely took control of the Cherokee through its UConnect entertainment system. They were able to change the vehicle’s speed and control the brakes, radio, windshield wipers, transmission and other features.
Miller said on Friday that he didn’t think the company statement about criminal activity was directed at them because they hacked into a vehicle they own. “I don’t think they are saying anything bad against us in that statement, just reminding people that if someone were to hack their car, it’d be against the law,” he said.
He confirmed that the two got into the Cherokee’s operating systems through the radio.
The recall affects vehicles with 8.4-inch touchscreens including 2013 to 2015 Ram pickups and chassis cabs and Dodge Viper sports cars. Also covered are 2014 and 2015 Dodge Durango and Jeep Grand Cherokee and Cherokee SUVs, as well as the 2015 Chrysler 200 and 300, and the Dodge Charger and Challenger. Fiat Chrysler says it knows of no incidents involving hacking of its vehicles except for the one unveiled this week. Initially the company didn’t issue a recall, but said it would contact all affected customers about a software update.
NHTSA encouraged people to get the repairs done as soon as possible and said the recall is the right step to protect customers. “It sets an important precedent for how NHTSA and the industry will respond to cybersecurity vulnerabilities,” the agency said in a statement.
It’s not the first attack on a vehicle by hackers. Earlier this year, BMW had to offer a software patch after hackers remotely unlocked the doors of its cars.
Mark Reuss, General Motors’ product development chief, would not comment specifically on the Jeep incident, but said on Friday that GM is learning about security measures from the US military and aircraft manufacturers such as Boeing.
“Cyber security is one of the most important things we spend time on these days,” he told reporters at an event at the company’s testing ground in Milford, Michigan.
Miller said he and Valasek first told Fiat Chrysler about their research in October and have been in touch with the company several times since then.
Owners of the recalled vehicles will get a USB drive that they can use to update the software. Fiat Chrysler says it provides added security features beyond what has been done on the company’s vehicle network.
Comments (…)
Sign in or create your Guardian account to join the discussion