Skip to content

The Jeep Cherokee Hack

Abstract

On 21 July 2015 Wired published Andy Greenberg’s account of driving a Jeep Cherokee on Interstate 64 near St. Louis while two security researchers, Charlie Miller and Chris Valasek, about ten miles away, took over the car through the cellular connection of its Uconnect entertainment system. They played with the air conditioning and the radio, and then cut the transmission on a stretch of highway with no shoulder. Two days later Fiat Chrysler recalled about 1.4 million vehicles, the first recall in the United States for a software security flaw, and its network provider Sprint closed the opening across its network. The demonstration had been arranged with the reporter, but it took place among other traffic. It moved car security from conference talks into law: within a few years the United Nations vehicle regulations required manufacturers to manage cyber risk before a car could be sold in Europe.

Jeep Cherokee KL 2014
A Jeep Cherokee of the 2014 model generation, the type used in the 2015 demonstration. Image: Charles01, CC BY-SA 4.0, via Wikimedia Commons.

Cars as Networks

By the 2010s a car was a network of dozens of electronic control units, joined by the CAN bus that Bosch had introduced in the 1980s (see From Carburetor to Code: The Computer in the Car). The bus had been designed for a closed system: any unit on it could send messages, and the others trusted them. That was reasonable while the only way onto the bus was a mechanic’s diagnostic port. It became a problem when manufacturers began to connect the entertainment and telematics units, which also sat on the car’s internal network, to Bluetooth and the mobile phone network.

Academic researchers showed what followed. In 2010 a team from the University of Washington and the University of California, San Diego presented “Experimental Security Analysis of a Modern Automobile” at the IEEE Symposium on Security and Privacy, showing that whoever reached a car’s internal network could interfere with its safety-critical systems. Miller and Valasek took up the subject in public; in 2013 they took control of a Toyota Prius.

The Highway

Their target in 2015 was the Uconnect head unit that Fiat Chrysler fitted to vehicles from model year 2013 onward. It had a cellular connection, provided by Sprint, for features such as navigation and wireless hotspots. They found that they could reach a vulnerable car through that connection from a distance, and from there the systems that controlled it. They estimated that about 471,000 vulnerable vehicles were on the road.

For the article, Greenberg drove the Jeep onto I-64 in St. Louis, knowing that something would happen but not what. First the speakers and the air conditioning misbehaved. Then the accelerator stopped working. The Jeep slowed to a crawl just before a long overpass with no shoulder, and by his account the experiment “had ceased to be fun.” He restarted the engine, which restored control, and drove to a deserted parking lot. There, at low speed, they demonstrated further control, cutting the brakes while he pumped the pedal, and the Jeep slid into a ditch.

On the day the article appeared, Senators Edward Markey and Richard Blumenthal introduced the Security and Privacy in Your Car (SPY Car) Act, which would have directed regulators to set security standards for cars and a “cyber dashboard” rating for buyers.

The Recall

On 23 July 2015 Fiat Chrysler announced Safety Recall 15V-461, covering about 1.4 million model-year 2013 to 2015 vehicles with two versions of the Uconnect head unit made by Harman International: Jeep Cherokee and Grand Cherokee, Dodge Durango, Charger, Challenger and Viper, Ram pickups and Chrysler 200 and 300. Owners received a USB stick with a software update, or could have it installed by a dealer. Sprint blocked the port that had been left open on its network, and the short-range wireless weaknesses were closed on 27 July. On 24 July the National Highway Traffic Safety Administration opened an investigation into whether the remedy worked; in August Fiat Chrysler added 7,810 Jeep Renegades.

NHTSA closed the investigation on 5 January 2016. It had reviewed 30 complaints of theft or strange behaviour that owners attributed to hacking, 26 of them filed after the Wired article, and found no confirmed case of hacking. Most concerned the radio, navigation or air conditioning; none involved the steering and braking effects the researchers had shown. The remedies, NHTSA concluded, “appear to have eliminated vulnerabilities that might allow a remote actor to impact vehicle control systems.”

Fiat Chrysler said it appreciated the research but urged researchers not to “compromise public safety” in its pursuit. In August 2015 Miller and Valasek left their jobs, at Twitter and IOActive, for Uber’s Advanced Technologies Center in Pittsburgh, which was building self-driving cars. At the Black Hat conference in August 2016 they returned with attacks on the steering of the Jeep at highway speed; their 2015 work had been limited to low speeds for such functions.

From Demonstration to Regulation

The recall showed that a car’s software could be a safety defect, handled by the same machinery as faulty airbags. What followed was mostly regulation. The UN Economic Commission for Europe’s World Forum for Harmonization of Vehicle Regulations (WP.29) adopted UN Regulation No. 155 on cyber security and No. 156 on software updates in 2020; R155 entered into force in January 2021. It requires each manufacturer to operate a certified cyber security management system. In the European Union it applied to new vehicle types from July 2022 and to all newly registered vehicles from July 2024, so that a car without it can no longer be sold there. The standard that manufacturers use to meet it, ISO/SAE 21434, Road vehicles: Cybersecurity engineering, was published in August 2021.

📚 Sources