+ Publier publicitaire GRATUIT !
Stats d'annonce: Dernier 24h - 79, actuel - 1400, total - 83071

Nissan Leaf App Contains Cyber Vulnerability, Researcher Says

25 Février 2016 - Autoblog

Nissan Leaf App Contains Cyber Vulnerability, Researcher Says

An app that helps Nissan Leaf owners connect to their cars contains cyber vulnerabilities that allow outsiders to manipulate certain controls and view information on the whereabouts of drivers.

Anyone with knowledge of a Nissan Leaf's vehicle identification number could use it to manipulate heating and air-conditioning functions and potentially drain the electric vehicle's battery. Outsiders could also view location data from a vehicle's recent trips and obtain private information on a driver's whereabouts.

Cyber-security research Troy Hunt disclosed the vulnerabilities Wednesday after discovering them during a workshop last month. He says the interface that controls communications between the outside world and car doesn't authenticate users, so anyone with cursory knowledge of a VIN can access the vehicle via the NissanConnect app and receive responses.

"Fortunately, the Nissan Leaf doesn't have features like remote unlock or remote start, like some vehicles from other manufacturers do, because that would be a disaster with what's been uncovered," Hunt writes on his website.

The vulnerability is an anomaly in automotive cyber-security circles. It contains none of the dire implications of the remote hack of a Jeep Cherokee that researchers demonstrated last year, in which they commandeered steering, acceleration and brake functions from halfway across the country. At worst, someone with mischievous intent could drain a battery and leave a car owner with a headache.

But that also misses the point. The Jeep hack was a difficult feat – it took researchers Chris Valasek and Charlie Miller months to target and exploit a single vehicle. By contrast, the NissanConnect vulnerability, Hunt says, was easy to find and exploit.

"In my view, this is the sort of flaw that needs to have the service pulled until it can be fixed properly and restored." – Troy Hunt

VINs can often be viewed through the windshield, and the "risks like the one above were discovered by doing nothing more than using the app as it was intended to be used and observing the traffic going backwards and forwards," Hunt writes. "This is the mobile equivalent of opening your browser's dev tools and watching the network tab."

On Wednesday afternoon, Nissan acknowledged a "data issue." A spokesperson for the company says, "our global technology and product teams are currently working on a permanent and robust solution. We are committed to resolving the issue as a matter of priority, ensuring that we deliver the best possible experience for our customers."

But as automakers rush to connect smartphone apps to vehicle functions, Hunt's research will surely be a topic discussed by the automakers' fledgling Information Sharing and Analysis Center, a group that became operational in December that's supposed to deal with the industry's car-hacking vulnerabilities.

In the meantime, Hunt is hoping Nissan fixes the problem by shuttering the app until it's more secure.

"In my view, this is the sort of flaw that needs to have the service pulled until it can be fixed properly and restored; it's not a critical feature of the vehicle yet it has the potential to impact its physical function and there's the privacy risk as well."

Nouvelles par Tags

2011 models2012 models3D printing458 italia6-series coupeA1A2abc motorsabu dhabiaccidentaccidentsaccordACIMacuraadvertisingafricaAIairbagairbagsairbusairportalcotestalfaalfa romeoalgeriaalpineamazonamphibiousandroidAnil Bachooappappleappointmentsappsapriliaarabiaargentinaarielarnold schwarzeneggerArtashok leylandasiaastonaston martinauctionaudiaustraliaaustriaautoauto shanghaiauto showautonomous carautonomus carAutopilotaventadorawardsAxessBagatellebahrain grand prixBAIBaie-du-TombeaubajajBambousBangkok International Motor ShowBangkok Motor ShowBangladeshbatmobilebatterybattlebeachesBeau-BassinBeaux-SongesbeetleBeijing Motor ShowBelgiumBell-Villagebentleybernie ecclestonebetamaxbetamax casebicyclebicyclesbikebikesbiodieselbmwboatboatsBogota Auto ShowBois-Marchand accidentBologna Motor ShowbondboschBPObrabusbrakesbrazilbribebribesbridgestonebriobudgetbugattiBugatti ChironbuggybuickburnoutbusbusesbuyingbydcadillaccalebassescamaroCanadacarcar buying tipscar dealerscar importcar marketcar rentcar rentalcar salescar servicecar sharingcar theftcar washcarbon fiberCarPlaycarscartingCaudanCCIDCCTVCEBcelebretiescelebritiesCESChamp de MarsChamp-de-MarsChengdu Motor ShowcherychevroletChicago Auto ShowchinaCHINESE GRAND PRIXChris Evanschryslercitroencivicclassicclassic carsclassicscommercialcomparisonconceptconceptsconsumer reportsconvertiblecoromandelcorruptioncorvetteCourtCourtsCPBcr-vcrashcrash testcrash testscrossovercrowdfundingCubaCurepipecustom carCUVCWAdaciadaihatsudaimlerdakardartzdash camdashcamdatsunDelhi Auto ExpodesignDetroitDetroit Auto Showdieseldiesel scandalDIYDLCdodgeDPPdragdrag battledrag racedrag racingdriftdriftingdriver licensedriverless cardrivingdriving licensedriving schooldriving schoolsdriving testdriving tipsdronedronesdrugsdrunk drivingdsDubaiDubai Motor ShowducatiearthquakeEbayebeneecoecologyeconomyelectricelon muskengen motor showengineenginesEOCethanoletios livaEUEuropeeveventsexpofacebookfakeFast And FuriousFernando AlonsoferrariferryfiatfiestafilmsfinancesfinefinesfinlandFirefiskerfitness centerFlacqFlic-en-FlacFloodsflying carFootballForbach accidentforce indiafordFord mustangformula1forza motorsportFrancefrankfurtfrankfurt motor showfraudFSCfuelfuel economy scandalfuel pricefuel stationfuel stationsfunnyfutureGaikindo Indonesia International Auto ShowGaikindo Indonesia International Motor ShowgamesgeargeelygenesisGeneva Auto Showgeneva motor showGermanygirlsgmgodzillagolfGoodlandsgoodwoodgooglegoogle glassGoProgovernmentgpsgran turismogrand tourgrand-baiegreat wallgreecegreengreen energygrnoGRSE accidentGTAGymkhanahackershakershamannharley-davidsonHatchbackhellcatherohistoryhitachiholdenHollandHollywoodhondahonda cr-vHong Konghorsepower falsifyinghospitalshot wheelshotelhotelshoverbikehoverboardhow toHuayrahummerhumorhurricanehybridhydrogenhyundaii3i40ICACiframacIIHSillegal racingillegal taxiillegal transportIMCimportindiaIndian MotorcycleIndian OilindicaIndonesiaIndonesia International Motor Showindonesia motor showinfinitiInfinityinfrastructureinsuranceintelinteriorinteriorsiPadiphoneiranirelandIRPisraelisuzuitaliaItalyjaguarjamesjames bondJames Mayjapanjapaneese carsjapanese carjapanese carsJapanese Grand PrixjazzJDMjeepJeremy ClarksonjettaJin Feikartkawasakikei carken blockKenyakhankiaKoenigseggkoreaKoshik ReesaulKTMLALA Auto ShowLa MarieLa Vigielamborghinilancialandland cruiserland roverlawsleallegolewis hamiltonlexuslicenselight metroLionel Messilotuslow cost carLRTluxuryluxury carluxury carsm3mad maxMadagascarmahindramaintenancemalaysiamanmapsmarketmarketingmartinmarutimaruti suzukimaseratiMatt LeBlancMauritiansmauritiusmaybachmazdamazda3McLarenmecedesmercedesmetroMetro Expressmexicomichael schumacherMicrosoftMidlandsminimitsubishiMMMMokamonacomonaco grand prixMont-ChoisyMontebello accidentmontereymoparMoroccomotomotormotor showMotor vehicle test centremotorcyclemotorcyclesmotorsportmotorsportsmotosportmoviesmpvMRAmugenmuscle carMusicmustangmv agustaMVDANADA Auto ShowNandanee Soornacknanonascarnavigation systemnavigation systemsNavin RamgoolamNCGNDUNepalnetherlandsnew carnew york auto shownew zealandnfsNHTSANigerianissanissannorwayNouvelle-FranceNTANTCNurburgringoff-roadoffroadOlympic Gamesopelpaganipagani huayraPaillesPakistanPamplemoussespanasonicParisparis motor showparkingPebble Beachpenaltiespenalty pointsPetite-RivièrepeugeotPhilippinesPhoenixpickuppickupspininfarinapirelliPitonPlaine-LauzunplayboyPNQPointe-aux-SablespolandpolarispolicepoliticspollutionPomponettepontiacporscheporsheportPort LouisPort-LouisPPCPPPprankpricepricespriusproguardprotestsprotonPSApublic transportpublict transportQ3qorosquatre-bornesr8Raceracingrallyramrangerange roverratingsRDArecallrecallsrecordrecordsred bullreduitrenaultrenderingrent a carreplicaReunionRezvaniRHTRiambelRichard DuvalRichard HammondRiche-TerrerickshawrimacRing RoadrioRiviere-du-Rempartroadroad accidentroad rules & regulationsroad safetyRoad Traffic ActRoad Traffic Amendment Actroadsroads safetyrobberyrobotrobotsroche-boisRodriguesrolls-royceromeoRose-HillroverRoyal EnfieldRRSRSUrumoursRussiasaabsafetysafety ratingssafety testsafety testssalesamsungsamusao paulo auto showSao Paulo Motor Showsaudisaudi arabiascamscandalscaniaschool busscooterscootersseatsecond hand carsecond hand carssecond hand cars importself driving carself-drivingself-driving carself-driving carsSEMASEMA showSeoul Motor Showservice stationsShanghaishanghai motor showshelbyShellshowsingaporeSingapore Grand PrixskodaSlovakiasmartSobrinho caseSohail Sesungkursolar energysoreze accidentsoulsound systemssouthsouth africasouth koreaspainspare partsspeed camerasspeed limitspeedingsportSportscarspy shotsssang yongSsangYongstar warsstartupstatisticsSTCstreet racingstrikestudysubaruSudhir SesungkursudySunshine AutosupecarssupercarssurveySUVsuzukiSuzuki JimnySuzuki SwiftSwedenswiftSwitzerlandTATaiwantakatatankTarisa Resorttatataxtax fraudtaxestaxiTBStechnlogytechnolgytechnologyTerre-RougeTerre-Rouge–Verdunteslatesla model stest driveteststhailandThailand International Motor ExpoThe Grand Tourtheftticket pricetipstiresTMRSUtokyoTokyo Auto Salontokyo motor showtoptop geartoyotaToyota Hiluxtoyota supratoystraffictrailertransformerstransporttrendstricksTriolettriumphTrou d’Eau DoucetrucktruckstsunamituningTurkeytvstyresUAEuberUBSukukraineunionsuomuralUSused carused carsVacoasVacoas-Phoenixvanvarma casevehicle inspectionVehiclesvelostervenezuelaVictoria stationvideoVienna Auto ShowvietnamVintagevintage carsVipervivo energyvolkswagenvolvovwwheelsWorldyachtyamahayariszagato
Vendez Votre Auto