BMW patches flaw could let hackers unlock car doors

BMW released a patch for a flaw affecting 2.2 million vehicles, which could allow hackers to remotely unlock doors. German automaker BMW has just fixed a flaw in its ConnectedDrive software that could have allowed hackers to unlock a car using a mobile phone.
A few years ago BMW brushed aside reports of thefts that made use of its keyless entry systems, saying the problem - that thieves steal cars - was one that faced all car owners, regardless of whether they use keys or not. In that case, hackers were thought to have used devices that plug into the car's On-Board Diagnostic (ODB) port to program a new fob, ZDnet reported.
BMW appears to have taken a new flaw with a similar impact a little more seriously: last week it released a patch that's now rolling out to 2.2 million BMWs, Mini, and Rolls-Royce vehicles that use BMW's ConnectedDrive software.
The platform includes a SIM card to support connectivity for navigation and apps, as well as BMW's emergency call feature, roadside assistance, and wi-fi hotspot set-up. However, the feature can also be used to control the vehicle's locking system.
German automobile association ADAC, which reported the bug to BMW, said it had demonstrated on several models that hackers could use their mobile phone to open a car "within minutes" without leaving a trace.
BMW hasn't said exactly what the flaw is, but confirmed in a statement that ADAC had found a "a potential security gap when data is transmitted" and added that it had "increased the security" of ConnectedDrive by ensuring it uses the HTTPS protocol for encrypting web traffic in transit.
HTTPS has been traditionally used by banks to ensure users can connect to their websites over an encrypted channel. In recent years, however, it's become more widely deployed to prevent interception from hackers and government spies.
BMW said of the new update: "The online services of BMW Group ConnectedDrive communicate with this configuration via the HTTPS protocol (HyperText Transfer Protocol Secure) which had previously been used for the service BMW Internet and other functions.
"The BMW Group ConnectedDrive packages in the vehicle are thereby using encryption which in most cases is also being used by banks for online banking. On the one hand, data are encrypted with the HTTPS protocol, and on the other hand, the identity of the BMW Group server is checked by the vehicle before data are transmitted over the mobile phone network.
"In this way, the BMW Group has responded promptly and increased the security of BMW Group ConnectedDrive, because no cases have come to light yet in which data has been called up actively by unauthorized persons from outside or an attempt of this kind is made in the first place."
BMW's patch comes as hackers pay closer attention to the security of networked vehicles, in particular how well manufacturers are walling off core components that control steering and breaks from others used for communications. As noted by researchers Charlie Miller and Chris Valasek at BlackHat 2014, Bluetooth is a prime target because it's relatively easy to hack, while built-in cellular systems in vehicles are the 'holy grail' for hackers because they lend themselves to long-range attacks.