汽车智能化增加被黑风险

DAVID GREENE, HOST: Technology in cars has made a lot of things easier for drivers: parking, climate control, picking the music you want to listen to. But there is one downside: Cars can now be hacked. That reality is getting a lot of attention this week in Las Vegas, where hackers, hacktivists and security researchers have all gathered for two annual computer security conferences: Defcon and Black Hat. Here's NPR's Steve Henn.

STEVE HENN, BYLINE: Chris Valasek and Charlie Miller have been hacking into products for a long time. But they don't steal stuff or mess with people. Instead, their purpose is to pressure companies into making their products more secure. And this week, they scored big when their research on hacking cars made it onto the "Today" show.

(SOUNDBITE OF TV SHOW, "TODAY")

UNIDENTIFIED MAN #1: Well, good morning. We're back now with something to think about before you hop behind the wheel this morning of your car.

HENN: Miller and Valasek are not the first guys to hack a car, but they perhaps like no one who's come before it, they demonstrated just how dangerous these kinds of attacks could be.

CHRIS VALASEK: And that's really where Charlie and I came in.

HENN: Chris Valasek.

VALASEK: We really wanted to see, once someone was inside your car network, to what extent could you control the automobile?

HENN: They got a grant from DARPA, the Defense Advanced Projects Research Agency, and bought two modern, connected cars: a Toyota Prius and a Ford Escape. Then they physically plugged into the network of little computers built into these cars that run virtually everything.

VALASEK: Those are electronic control units.

HENN: The first of these little computers were used to replace carburetors, but soon, they were being used for lots of stuff: cruise control, antilock brakes.

VALASEK: And now we're to the point where cars parallel park themselves. And that's not just magic. There's computers in the car that have censors and actuators.

HENN: And all these little devices talk to each other on an open network. They listen in to every message that's sent. And they don't verify where a specific command is coming from. Charlie Miller says all of this makes cars easy to attack.

CHARLIE MILLER: If I'm an attacker and I break into, say, your radio, I can send messages and say, hey, I'm the brakes, and I'm telling the engine to do this.

HENN: Any processor on the network is vulnerable, and that let Miller and Valasek create all kinds of havoc.

VALASEK: We were able to turn the wheel at high torque, jerky motions at high speeds. We were able to administer the brakes.

HENN: They could yank on the seatbelt, set off the horn, press the accelerator, turn off the engine.

MILLER: And I could make your brakes not work anymore.

HENN: That's right: no brakes. And once, Charlie Miller forgot that that hack was running on his Ford Escape as he drove it into his garage.

VALASEK: Yeah, luckily, these weren't our cars.

MILLER: My lawn mower, it was destroyed, utterly. So the lawn mower was, like, perhaps the first cyber-attack-in-a-car victim.

HENN: Miller and Valasek tried to share their findings with Toyota and Ford before they went public. Now, both companies say while they're taking this research seriously, they're still convinced their cars are safe. They say if someone has to physically wire a computer into your car to get this attack to work, you're going to notice. But...

DON BAILEY: Well, I've actually been very disappointed with the reaction from these companies.

HENN: Don Bailey is a security researcher who's hacked into cars remotely, using the cell phone network.

BAILEY: Once you are through that initial security barrier, you can and will be able to do almost anything you want to.

HENN: Now, before a hacker could really create havoc, he or she has to learn the specific code that each car uses to talk on its internal network. That's tough. It takes time. But Chris Valasek says it's not impossible.

VALASEK: Charlie and I hope by releasing all this information that more and more people will get interested.

HENN: And give car companies the little push they need to make some security improvements. Steve Henn, NPR News, Silicon Valley.