SMS messages unlocking a car

Black Hat Briefings have been going on all this week, with the expected announcements of vulnerabilities, tools, and other fun. I refuse to go to Vegas for health reasons, so I often miss out on Black Hat and Defcon. But this week, the one announcement that has me interested is that SMS messages are being used to unlock cars and start them – specifically the Subaru Outback. They also demonstrated that car unlocking isn’t the only capability that SMS messages have. Pretty much anything that uses the GSM network for communication may be vulnerable – electric meters, traffic lights, GPS-tracking, etc.

With more and more devices being “always connected”, I suspect we’ll see more problems. And these are the kinds of problems that may literally be life and death – turn someone’s heat off on a cold day, start a car in a closed garage, etc. Today, we assume that all Internet sites have a modicum of security knowledge, or someone has at least thought about security. Is the same true for these new technologies? In general, the Internet doesn’t control life and death – yes, it’s annoying when someone steals your credit card number, but you’re not (likely) going to die from it. These new systems are – and I suspect that security hasn’t been at the top of the designers’ minds.