Remote exploit of UConnect possible.

[CHinton]

This may be old news but was the first I saw of it today.

Wired Article

It suggests it's across product lines too.

Fiat Chrysler Automobiles press release

Also when I enter my VIN in the download site I do have an update available that was published 7/15:

Update available
Your 2014 RAM 3500 LARAMIE REG CAB 4X4 equipped with the Uconnect 8.4AN AM/FM/BT/Access/NAV system qualifies for the following software update:
Update 1: UCONNECT® 8.4AN_RA4_15.26.1_MY13_&_M14 (download)
Service Bulletin ID: 08-072-15
Release Date: 2015-07-15

 

[seafish]

This is not just for Ram or even FCA…remote exploits of the entire wireless functions of the dcm are possible in almost any car. There is a video that some "blackhat" hackers who were hired by DARPA to exanne these vulnerabilities in a Prius that is as shocking or more--

http://jalopnik.com/watch-darpa-hackers-take-control-of-a-toyota-prius-896255481

 

[brods]

Look up "Boston Brakes"

 

[Tinman]

This is a big deal. I will never drive a vehicle can be "hacked". So in addition to crippling emissions that has to be removed, deactivating stability control so 4wd will actually work, and tire pressure systems changed so I don't have to run 80 psi all the time, we this now. The question is can the cellular antenna (and GPS for that matter) be unplugged, or removed without issues. I know on the JK the uconnect is a separate module that can be removed. Same for RAM? It really makes me angry I can't buy a vehicle without this. Don't want it, don't need it, won't use it.

 

[Brocky]

I read some of this on the Big Mack Trucks site:: http://www.bigmacktrucks.com/index....emonstrate-they-can-take-control-of-vehicles/

Question:: Is this only applicable to the 8.4 system or also my 5.0 system?????

 

[Newsa]

8.4 has 3G wireless connection. Which can be hacked as easy as any cell phone.

That's how the Nav knows where it is. Not sure about U connect 5.0. My U connect 3.0 can not be remotely hacked.

Funny how people think guns will save them from the government.

This is how they will assassinate people. Lol

 

[mfurrh55]

Went in to dealership today and they do not have a patch for it yet like they claimed, i just bought a Jeep Cherokee trailhawk and i don't like the idea of some nut being in control of my vehicle, They had better get it fixed, Monte

 

[lpennock]

Went in to dealership today and they do not have a patch for it yet like they claimed, i just bought a Jeep Cherokee trailhawk and i don't like the idea of some nut being in control of my vehicle, They had better get it fixed, Monte

Try this link.
http://www.driveuconnect.com/software-update/

 

[CHinton]

Looks like it's being turned into a recall program.

http://www.detroitnews.com/story/business/autos/2015/07/24/30613567/

Under government pressure, Fiat Chrysler Automobiles NV agreed Friday to recall 1.4 million vehicles that can be cyber-hacked remotely — as Congress, automakers and regulators are raising increasing concerns about vehicle communications.

The first-of-its-kind callback came just days after a magazine report showed hackers could wirelessly take control of some functions of a Jeep Cherokee.

The National Highway Traffic Safety Administration said it will open an investigation into the recall to ensure all vehicles that could be affected are covered. “Opening this investigation will allow NHTSA to better assess the effectiveness of the remedy proposed by Fiat Chrysler,” NHTSA Administrator Mark Rosekind said in a statement, acknowledging the agency had urged the move.

Owners will get a USB device that they may use to upgrade vehicle software, which provides additional security features independent of the network-level measures that largely addresses the problem.

and later in the article

Fiat Chrysler said it is unaware of any injuries related to software exploitation, nor is it aware of any related complaints or accidents outside of the media demonstration.

The recall includes 1.4 million vehicles equipped with 8.4-inch touchscreens including:

■2013-15 Dodge Vipers

■2013-15 Ram 1500, 2500 and 3500 pickups

■2013-15 Ram 3500, 4500, 5500 chassis cabs

■2014-15 Jeep Grand Cherokees and Cherokees

■2014-15 Dodge Durangos

■2015 Chrysler 200, Chrysler 300 and Dodge Charger sedans

■2015 Dodge Challengers

Owners can visit www.driveuconnect.com/software-update/ to input their vehicle identification numbers (VINs) and determine if their vehicles are included in the recall.

So we all get a new USB Stick.

 

[TCDiesel]

It took Me 35 minutes to update My 2013 & 14 3500s ,2014 Dodge Charger, and even My 2015 Ecodiesel. I did use 2 Flash drives, You will spend more time trying to talk to the SR PER Vehicle, The downloads are a little tricky but once you figure it out it take less then 5 Minutes to download and 5-8 Minutes to install.

 

[CHinton]

Yeah, I updated mine the other night and it was easy. Getting the download without installing the download assistant was the trickiest part.

 

[HPSimpson]

Download the software update converted to iso file and loaded into My 2014 3500, and 1500 Eco total time about 30 minutes.

 

[sag2]

This is a big deal. I will never drive a vehicle can be "hacked". So in addition to crippling emissions that has to be removed, deactivating stability control so 4wd will actually work, and tire pressure systems changed so I don't have to run 80 psi all the time, we this now. The question is can the cellular antenna (and GPS for that matter) be unplugged, or removed without issues. I know on the JK the uconnect is a separate module that can be removed. Same for RAM? It really makes me angry I can't buy a vehicle without this. Don't want it, don't need it, won't use it.

The patch is out there for download now, but I think you are worrying a little too much about this one. The hackers had access to a vehicle for a long time, and spent many hours writing code to hack it. They also had to be in close proximity to the vehicle (couple hundred feet) for it to work, and you also had to have the Apps enabled (paying a monthly fee) for it to work. So although it is good they are closing the hole, all it will really do is give the politicians something to blubber about and save us from yet another non issue that will end up costing us all more money.

 

[Ram4Sam]

The patch is out there for download now, but I think you are worrying a little too much about this one. The hackers had access to a vehicle for a long time, and spent many hours writing code to hack it. They also had to be in close proximity to the vehicle (couple hundred feet) for it to work, and you also had to have the Apps enabled (paying a monthly fee) for it to work. So although it is good they are closing the hole, all it will really do is give the politicians something to blubber about and save us from yet another non issue that will end up costing us all more money.

This^^^^^^^^^

Well said.....

Sam

 

[mwilson]

This^^^^^^^^^

Well said.....

Sam

x100............

 

[Newsa]

The patch only closes one door. The other doors are wide open in the 8.4.

 

[Dieselnerd]

Getting the updates to download to my computer was the hardest part. I've done it several times in the past but things seem to have changed at U-Connect.

The updates would not load using Internet Explorer or Firefox. Wouldn't do anything on IE, just sat there. Started to download on Firefox and then said Firefox unsupported above release 37 and I'm on 39. Next I tried Google Chrome and it worked great! Downloaded and installed on truck with no problems.

I thought I would pass this along in case others have the same problem getting the update to download to their computer.

 

[pjorlando]

I was able to download it and installed on zip drive. I could not get the system in my truck to recognize the drive. It keep giving the message, unreadable.

 

[Dieselnerd]

Pjorlando, did you download it directly into the memory stick or zip drive? If you did, that is your problem. It has to be downloaded into your computer first because it's a compressed file. When you open it you extract it into your USB device. Another thought, you have to format the USB drive first so it is completely empty. If there is any other data on there it won't work either.

I did my truck and my wife's Dodge SUV today and both worked fine. I had to erase the truck from the USB stick before I downloaded her fix since her download was different then mine.

 

[BaldwinScott]

I would like to know where you file your flight plan for this so next time I take a trip the Hackers can drive for me and I can sit back and enjoy the ride!! :-laf