Every day millions of us rely on tech to protect our cars from thieves. Immobilizers, for instance, ensure only the owner of the right key fob can start the vehicle.



But now that technology has become a security threat, after hackers told&nbsp;Forbes&nbsp;they could lock down up to 25,000 cars at once. It&#8217;s all thanks to a vulnerability (now fixed) that made it frighteningly simple to quickly take remote control of a car’s immobilizer and prevent drivers from starting their vehicle.



Your car’s immobilizer is  supposed to be used for good. If a crook steals your car, it&#8217;s possible for you to connect to the immobilizer, which tracks the vehicle and allows you to stop anyone from turning on the engine. 



READ MORE | <a rel="noreferrer noopener" aria-label="Hack Breaks Your Visa Card’s Contactless Limit For Big Frauds (opens in a new tab)" href="https://www.forbesafrica.com/technology/2019/07/30/hack-breaks-your-visa-cards-contactless-limit-for-big-frauds/" target="_blank">Hack Breaks Your Visa Card’s Contactless Limit For Big Frauds</a>



But with one particular immobilizer &#8211; the U.K.-made SmarTrack tool from Global Telemetrics &#8211; an easy-to-hack vulnerability meant it was simple for researchers at Pen Test Partners to turn on the immobilizer permanently, without the customer knowing a thing.



To prove it was possible, the researchers from British cybersecurity company Pen Test Partners hacked the vehicle of one of their own employees, disabling his car whilst they were in the U.K. and he was in Greece, not long before he was due to head to a wedding.



&#8216;We own your immobilizer&#8217;



Ken Munro, cybersecurity researcher and partner at Pen Test Partners, first described the hack to&nbsp;Forbes&nbsp;at the DEF CON convention in Las Vegas.



He found that it was possible to turn the immobilizer on and the car off by sending a simple request via a browser. Once he&#8217;d entered the command, it took less than a second for the immobilizer to be triggered. 



It was as if Munro was acting as one of the SmarTrack call center employees who were permitted to turn the immobilizer on. SmarTrack systems just weren&#8217;t correctly checking that the commands were being sent by an authorized user, Munro said.



READ MORE | <a rel="noreferrer noopener" aria-label="Google Is Making Android As Difficult To Hack As iPhone—And Cops Are Suffering (opens in a new tab)" href="https://www.forbesafrica.com/technology/2019/05/24/google-is-making-android-as-difficult-to-hack-as-iphone-and-cops-are-suffering/" target="_blank">Google Is Making Android As Difficult To Hack As iPhone—And Cops Are Suffering</a>



Munro warned that it would be impossible for anyone to start the car again with the immobilizer fitted. The only option would be to have the tech removed entirely, he added. &#8220;We now control the immobiliser, so only we can de-immobilize the car.&#8221;



And, if the hacker turned the immobilizer on when the car is moving, it would simply prevent the car from running as soon as the engine stopped. As Munro noted, that could be &#8220;quite nasty&#8221; if the car has an auto start and stop function (such a feature is found in many modern models to help cut emissions in traffic).



Munro was also critical of Thatcham Research, the industry body which had given accreditation to the SmarTrack devices, saying it was safe to use.&nbsp;&#8220;People buy these devices thinking that the accreditation means something. We’ve shown that in some cases, fitting a theft tracker makes your car less secure,&#8221; Munro said.



Thatcham said that it accredits security products against a minimum set of requirements, including alarm and driver identification functionality. &#8220;The process also includes an attack test where the system on the vehicle needs to resist physical deactivation for two minutes,&#8221; the spokesperson added. &#8220;We do not, however, test the security of the vehicle system or the surrounding ecosystem.&#8221;



READ MORE | <a rel="noreferrer noopener" aria-label="#30Under30: Technology Category 2019 (opens in a new tab)" href="https://www.forbesafrica.com/30-under-30/2019/07/01/30under30-technology-category-2019/" target="_blank">#30Under30: Technology Category 2019</a>



Fixes available



Fortunately for SmarTrack customers, the flaws have now been addressed. &#8220;All potential vulnerabilities have now been resolved,&#8221; a Global Telemetrics spokesperson said. &#8220;Our customers can be assured that no password or personal details were compromised by this process and there are no security or safety concerns with any of our products.



&#8220;Security has always been and remains of paramount importance to us and as a result of the contact from Pen Test Partners we now have reassessed our ongoing security improvement project to ensure we remain market leaders in security and safety.&#8221;



To deal with the issues, Global Telemetrics brought in cybersecurity consultancy Hedgehog Security. Peter Bassill, founder of  Hedgehog, confirmed that what Munro claimed to have found was accurate. 



READ MORE | <a rel="noreferrer noopener" aria-label="Navigating Bitcoin, Ethereum, XRP: How Google Is Quietly Making Blockchains Searchable (opens in a new tab)" href="https://www.forbesafrica.com/technology/2019/02/27/navigating-bitcoin-ethereum-xrp-how-google-is-quietly-making-blockchains-searchable/" target="_blank">Navigating Bitcoin, Ethereum, XRP: How Google Is Quietly Making Blockchains Searchable</a>



Of the ability to shut down 25,000 cars at once, Bassill said: “It&#8217;s one of those assertions security researchers make&#8230; but there&#8217;s certainly capability where that could&#8217;ve happened&#8230; it certainly would&#8217;ve taken longer than one line of code, but the art of the possible is certainly possible.&#8221;



He said the vulnerabilities were likely down to developers writing code without enough attention to security. But Bassill has been working with new developers on the SmarTrack team to patch the vulnerabilities and set up processes to make sure issues are fixed quickly in the future.



But, as Bassill and Munro are warning, there are many immobilizers being used in millions of cars across the world. With many similar devices potentially containing security weaknesses, something we use every day without thought could very quickly become the latest weapon in a hacker’s arsenal.



-Thomas Brewster; Forbes

gettyimages-760226865-170667a

Hacker Claims He Can ‘Turn Off 25,000 Cars’ At The Push Of A Button

Deloitte, known popularly in the United States as one of the &#8220;Big Four&#8221; accounting firms, has confirmed that it was the victim of a cyber attack. Not all of the details have been made public, but a Deloitte spokesperson noted that the attacker accessed data from an email platform.
According to the spokesperson, a review of the email platform is now complete. Their findings? While the company didn&#8217;t provide specific information, the spokesperson did say that, &#8220;Importantly, the review enabled us to understand precisely what information was at risk and what the hacker actually did and to determine that only very few clients were impacted and no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.&#8221;
<a href="http://www.forbesafrica.com/technology/2017/06/28/mayday-mayday-ive-hacked/" target="_blank" rel="noopener">Mayday! Mayday! I&#8217;ve Been Hacked</a>
Deloitte’s response to the attack has included &#8220;implementing its comprehensive security protocol and initiating an intensive and thorough review which included mobilizing a team of cyber-security and confidentiality experts inside and outside of Deloitte; contacting governmental authorities immediately after it became aware of the incident; and, contacting each of the very few clients impacted.&#8221;
The company did not release any hard numbers or indicate whether the attacks affected individual clients. Speculation within the cyber security world has theorized that the attacks were focused on corporate clients and not individual clients but that information has not been confirmed.
No one person or company has yet claimed responsibility for the hack. However, the fact that the attack appeared to target email systems to gain access to client information &#8211; possibly corporate client information &#8211; would suggest that the hackers were cyber criminals looking to steal data that could be sold.
<a href="http://www.forbesafrica.com/technology/2017/06/28/petya-notpetya-latest-ransomware-deadlier-wannacry/" target="_blank" rel="noopener">Petya Or NotPetya: Why The Latest Ransomware Is Deadlier Than WannaCry</a>
It&#8217;s the second announcement of a high-profile cyber hack this month. Earlier, Equifax <a href="https://www.forbes.com/sites/laurengensler/2017/09/07/equifax-says-143-million-americans-potentially-impacted-in-cyber-attack/?utm_source=TWITTER&amp;utm_medium=social&amp;utm_content=1064233649&amp;utm_campaign=sprinklrForbesMainTwitter#5d45a3a95097" target="_blank" rel="noopener">announced</a> that hackers had gained access to personal information for nearly 143 million Americans. The hack raised eyebrows about security at the company and eventually resulted in the <a href="https://www.forbes.com/sites/halahtouryalai/2017/09/26/equifax-ceo-out-after-massive-security-hack/#44596f3321ee" target="_blank" rel="noopener">resignation</a> of Richard Smith, the company&#8217;s Chief Executive Officer (CEO).
Deloitte offers audit &amp; assurance, consulting, risk and financial advisory, risk management, tax, and related services to clients around the world. Two weeks ago, Deloitte Global <a href="https://www2.deloitte.com/global/en/pages/about-deloitte/articles/global-revenue-announcement.html" target="_blank" rel="noopener">announced</a> revenues of $38.8 billion for the last fiscal year. Among the industries credited with driving that growth? Risk Advisory revenue.
A spokesperson for the company added that &#8220;Deloitte remains deeply committed to ensuring that its cyber-security defenses are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security.&#8221; &#8211; <a href="https://www.forbes.com/sites/kellyphillipserb/" target="_blank" rel="noopener" data-ga-track="contrib block byline">Kelly Phillips Erb</a>, FORBES STAFF

Big Four Accounting Firm Deloitte Confirms Cyber Attack

Google&#8217;s <a href="https://www.forbes.com/sites/thomasbrewster/2017/03/22/google-android-government-surveillance-fight/" target="_blank" rel="noopener noreferrer">proud of its track record</a> in protecting more than one billion Android phones and tablets from malevolent hackers. But in the last 12 months, it&#8217;s been dealt a few blows, including the <a href="https://www.forbes.com/sites/thomasbrewster/2017/05/26/google-shuts-down-massive-ad-fraud-on-play-store/" target="_blank" rel="noopener noreferrer">biggest ad fraud to ever hit its mobile operating system</a> and the <a href="https://www.forbes.com/sites/thomasbrewster/2016/11/30/gooligan-android-malware-1m-google-account-breaches-check-point-finds/" target="_blank" rel="noopener noreferrer">most significant single theft of Google accounts</a> thanks to an Android malware called Gooligan.
Those alarming events were set off via networks of cybercriminals focused on the platform, where coders combine their technical skills with the will and financial backing of organized gangs. Sometimes, the latter group don&#8217;t even have to pay for the former&#8217;s digital tools. Sometimes, the technically-savvy types open their minds for free.
That&#8217;s just what a character calling himself Maza-In did just before last Christmas, when he or she posted an in-depth guide on the Exploit.in hacker forum for creating Android &#8220;bankers&#8221; &#8211; malware designed to steal bank login details from users of Google&#8217;s platform. The post not only included directions, but source code for a banker too. There was also a description of the required backend infrastructure, all of which combined could deliver realistic-looking bank pages designed to trick victims into handing over their usernames and passwords.
And now, Android security experts have <a href="http://blog.checkpoint.com/2017/05/16/the-mobile-banker-threat-from-end-to-end/" target="_blank" rel="noopener noreferrer">pinned</a> a spike in banking malware on Maza-In and that post. They claim that Maza-In, in one fell swoop, caused a sudden leap in Android banking fraud, as cybercriminals took that open sourced code and adapted it to spread both in and outside Google’s official Play store. According to an independent researcher going by the moniker <a href="http://b0n1.blogspot.co.uk/2017/05/tracking-android-bankbot.html" target="_blank" rel="noopener noreferrer">b0n1</a>, as many as 60 variants of malware containing the Maza-In banker have been pushed out into the wider world by hackers hoping to make some easy money.
<a href="http://www.forbesafrica.com/focus/2016/03/01/making-millions-paranoia/" target="_blank" rel="noopener noreferrer">Making Millions From Paranoia</a>
Check Point, which has been tracking the mini-explosion in Android bank fraud with ElevenPaths, a Telefónica security unit, told Forbes it had records of several dozen servers operating Maza-In&#8217;s malware, the largest of which controlled close to 3,000 bots. ElevenPaths said that, from Google Play alone, downloads of apps based on Maza-In&#8217;s code stood at above 10,000 and expected to rise, not to mention the number of downloads outside the store.
Those aren&#8217;t massive numbers. But what Maza-In and those who adapted his work for their own machinations have proven repeatedly are flaws in Google Play&#8217;s security, namely the Bouncer technology that&#8217;s supposed to keep bad apples out. Just two weeks ago, a sample of BankBot, based on Maza-In&#8217;s creation, was seen inside Google Play initially disguised as a video downloader tool. On June 13th, a very similar looking video downloader was up on the market; underneath was, again, a banker using Maza-In&#8217;s work. Going further back to April, a malware called Charger, which also borrowed heavily from Maza-In, was doing much the same, but masquerading as a flashlight app inside the official store, <a href="https://www.welivesecurity.com/2017/04/19/turn-light-give-passwords/" target="_blank" rel="noopener noreferrer">ESET reported</a>. All were removed from Google Play as soon as the tech giant was alerted, but not before thousands were infected.
&#8220;Before this Maza-In code, there were a lot of Android banking Trojans, for sure,&#8221; said ElevenPaths security researcher Sergio de los Santos. “But accessing the source code was not easy and this helps all kinds of people create variants and even get into Google Play. Giving a very simple and effective framework to create and manage your own banking Trojan opens the door to hundreds of profiles of attackers that want to get into business the easy way.
&#8220;Maza-in made it very simple to add different banks to attack, so you may see people from Latin America with their own samples focused on banks in there, UK people, Russians.&#8221;
A hacker responds
Maza-In says he is no cybercriminal, though. (As Maza-In uses a profile picture of Bob Marley, Forbes has chosen to refer to the hacker in the masculine). In an interview over encrypted chat, he said he only wanted to highlight weaknesses in Google’s operating system, not spawn a spike in Android cybercrime. He claimed, for instance, that despite security firms&#8217; claims he was behind the BankBot banker, another individual was responsible.
Yet he was aware of the criminal use of his code, revealing others, whether they&#8217;d given the malware additional features or not, were selling it for between $2,000 and $3,000 a pop on the web&#8217;s underground markets. &#8220;I did not expect it to work out that way, that it would spread so much,” he told me in Russian (translated by Google Translate).
&#8220;I did not write an article to harm people… I&#8217;m interested in studying the holey Android, since Google is not able to make a good operating system… by this I wanted to show the vulnerability of the Android and thought that Google would take care of security.&#8221; Unlike security pros who disclose bugs in return for credit or monetary reward, Maza-In said he didn&#8217;t contact Google.
<a href="http://www.forbesafrica.com/focus/2013/09/01/industrial-thief-line-can-rob/" target="_blank" rel="noopener noreferrer">Industrial Thief On The Line, How Can I Rob You?</a>
In describing just what he thought was wrong with Android security, he added: &#8220;The biggest problem is that the device can install any application, get full access to the device and can be substituted for fake banking applications [that can] intercept SMS [and] manage the device. In general, everything is possible.&#8221;
As for Check Point and ElevenPaths&#8217; assessment he was a malware creator supporting criminal operations, Maza-In said they&#8217;d exaggerated. He even claimed to be working on an Android anti-virus application.
But whilst analysts from both firms agree there&#8217;s no evidence he&#8217;s actively exploiting Android devices, they say it&#8217;s clear he is a malware creator who&#8217;s not followed best practise in highlighting security issues. &#8220;The blog contains explicit evidence that Maza-in is indeed behind the malware. He also boasted about his malware not being caught until January on one forum,&#8221; said Daniel Padon, mobile security researcher at Check Point. According to Lookout Mobile Security researcher Michael Flossman, Maza-In is just one handle used by a crew of Android fraudsters running all the aforementioned fraud malware.
&#8220;If you really want to show how unsecure Android is, you write an article about it, you code a proof of concept, you contact the right people to spread the word,&#8221; said de los Santos, explaining his disbelief at Maza-In&#8217;s claims to innocence.&#8221;But creating a Trojan? Oh, come on.&#8221;
Whatever the hacker&#8217;s involvement in the murkier parts of the internet, he and those who took advantage of his guide have given Google a headache. The company didn&#8217;t respond to requests for comment. But with the frequent appearances of these bankers on Google Play, it&#8217;s apparent the company has some work to do to keep ne&#8217;er-do-wells out of the market and users&#8217; Android devices. &#8211; Written by Thomas Fox-Brewster, FORBES STAFF

Tag: Hacker

FORBES AFRICA SOCIAL MEDIA

Hacker Claims He Can ‘Turn Off 25,000 Cars’ At The Push Of A Button

Big Four Accounting Firm Deloitte Confirms Cyber Attack

‘I Want To Expose Google’s Mistakes’: The Russian Hacker Blamed For A Big Android Fraud Problem