Experts have warned that criminals have been exploiting a vulnerability to use the CAN injection method for stealing connected cars.
Automotive cybersecurity experts have uncovered a security vulnerability that allows criminals to steal vehicles using the CAN injection method.
The investigation was initiated by Ian Tabor, an automotive cybersecurity expert from EDAG Group, and Ken Tindell, CTO of Canis Automotive Labs after Tabor’s own Toyota RAV4 was stolen in 2021 and suffered suspicious damage to its headlight housing and front wing.
The security experts assigned a CVE identifier (CVE-2023-29389) to the Toyota RAV4 hack. Tabor observed that the arch rim and front bumper of his stolen car were pulled off, and the headlight wiring plug was removed. There were screwdriver marks and damage on the car’s paint, malfunctioning headlamps, and missing moulding cups. A few days later, the car was stolen.
Tabor analyzed the data logs from Toyota’s MyT app and discovered that the electronic control units (ECUs) in his RAV4 had detected malfunctioning and were logged as diagnostic trouble codes (DTCs) before the theft occurred. Tindell noted that Tabor’s car had “dropped a lot of DTCs.”
Further investigation revealed that the thieves gained access to the car’s system bus through the smart headlamp’s wiring. Tindell discovered the theft was carried out using a Controller Area Network (CAN) injection hack. The CAN bus is present in almost all modern vehicles and is used by microcontrollers to communicate between different systems and perform their functions.
In this type of attack, cybercriminals gain network access and send bogus messages on behalf of the smart key receiver in the car. These messages trick the car’s security system into unlocking the vehicle and disengaging the engine immobilizer, allowing the thieves to steal the car. This vulnerability exists because internal messages in most car models are not protected by any security mechanism, and the receivers trust them blindly.
The hackers gain network access through various methods, such as breaking open a headlamp and sending messages using its connection to the CAN bus, and then manipulating other systems to steal the car.
Watch as crooks steal a Toyota RAV4 in two minutes:
The attackers cannot directly connect to the smart key ECU but must reach it via the wires connected to the headlight only when both are on the same CAN bus. The hacking device is connected to the wires and validates the key by sending a bogus CAN message to the ECU and another message to the door ECU to unlock it and steal the car.
This discovery highlights the need for enhanced security measures to protect against CAN injection attacks and prevent vehicle theft through this method. Automotive manufacturers and cybersecurity experts are urged to address this vulnerability and implement necessary safeguards to secure communication networks and systems in modern vehicles.
![The leaked database was discovered on Shodan on May 14th.[wp_ad_camp_1][hlink][/hlink]A huge online database containing private contact information including phone numbers and email IDs of roughly 50 million Instagram profiles including those of influencers and brands has reportedly been discovered by security researcher Anurag Sen. The affected individuals include famous food bloggers and celebrities too apart from social media influencers. This database, which belongs to Chtrbox reportedly contains 49 million records was hosted on AWS (Amazon Web Services) and got exposed because it wasn’t protected with a password. Chtrbox is a Mumbai-based marketing firm that connects social media influencers to brands looking to market their products.See: Facebook: Storing Instagram passwords in plain text & harvesting your emailsEvery single record in the exposed database contains data belonging to social media influencers’ accounts and in some cases, even the account location is also mentioned. Each account has different worth depending on the number of followers, reachability, and engagement on the platform.[wp_ad_camp_1][hlink][/hlink]Zack Whittaker of TechCrunch contacted Chtrbox to inform about the exposed database, and it was eventually removed. It must be noted that Anurag claimed to discover the exposed database on Shodan on May 14th but in a statement issued by Chtrbox stated that the database was only exposed for 72 hours and contained no personal data.Whittaker also tweeted on Chtrbox's statement and called it "inaccurate."On the other hand, the Instagram spokesperson stated that they are figuring out the issue in order to understand whether the data actually is of Instagram accounts or of other sources."We're also inquiring with Chtrbox to understand where this data came from and how it became publicly available," the spokesperson told TechCrunch.[wp_ad_camp_1][hlink][/hlink]Whittaker claims that the information in the database must have been scraped from various publicly available social media accounts as it also included data such as the cost of a particular post and number of likes, etc. Moreover, some of the influencers claim that they aren’t associated with Chtrbox.See: Russian Hackers Control Malware via Britney Spears Instagram PostsFacebook, which owns Instagram, told TechCrunch that it is reviewing the matter. It is worth noting that Instagram doesn’t allow account scraping while Chtrbox claims that its client base boasts of over 184,000 Instagram influencers. This number is much less than the number of records found in the exposed database.Previously, hackers were found compromising and holding several Instagram influencers accounts for ransom - In the other case, personal data of top celebrities on Instagram was stolen and traded online while several dark web marketplaces were also seen selling Instagram data of 6 million celebrities.Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.](https://hackread.com/wp-content/uploads/2019/05/database-with-millions-of-instagram-influencers-leaked-online-1.jpg)