Proof of Concept: Car Wash Hack Can Strike Vehicle, Trap Passengers, Douse Them With Water

[captain_to_fire]

If hacking couldn't get creepier at all.

 

Sources: Motherboard, Kaspersky Lab, and The Register

Quote

"We believe this to be the first exploit of a connected device that causes the device to physically attack someone," researchers presenting the proof-of-concept say

A group of security researchers have found vulnerabilities in internet-connected drive-through car washes that would let hackers remotely hijack the systems to physically attack vehicles and their occupants. The vulnerabilities would let an attacker open and close the bay doors on a car wash to trap vehicles inside the chamber, or strike them with the doors, damaging them and possibly injuring occupants.

 

"We believe this to be the first exploit of a connected device that causes the device to physically attack someone," Billy Rios, the founder of Whitescope security, told Motherboard. Rios conducted the research with Jonathan Butts of QED Secure Solutions. They plan to discuss their findings this week at the Black Hat security conference in Las Vegas.

 

An attacker can send an instantaneous command to close one or both doors to trap the vehicle inside, or open and close one door repeatedly to strike the vehicle a number of times as a driver tries to flee.

 

This time his focus was on the PDQ LaserWash, a fully-automated, brushless, touchless car wash system that sprays water and wax through a mechanical arm that moves around a vehicle. PDQ car washes are popular throughout the US because they don't require attendants to operate. Many of the facilities have bay doors at the entrance and exit that can be programmed to automatically open and close at the start and end of a day, and a touchscreen menu that allows drivers to choose their cleaning package without interacting with any workers.

 

The systems run on Windows CE and have a built-in web server that lets technicians configure and monitor them over the internet. And herein lies the problem.

Obviously it's freaking Windows again but this time, it is Windows CE which by the way, is a kernel used by the dead smartphone OS "Windows Phone 7/7.5". But the mere fact that they can trap you inside a car wash either as a silly prank or as an assassination attempt is a bit concerning but keep in mind that at the moment, it's just a proof of concept hacking.

Quote

The pair found that Laserwash installations can be remotely monitored and controlled by their owners via a web-based user interface: the hefty gear has a builtin web server, and can be hooked up to the public internet allowing folks to keep an eye on their equipment from afar.

A photo of the web-based interface which, oddly, bundles in a social media feed ... 

The hardware's control system is an embedded WindowsCE computer powered by an ARM-compatible processor. Since Microsoft no longer supports WinCE, then no matter how secure the control software running on it is, the equipment is at the mercy of any unpatched security bugs lingering in the underlying operating system, Rios said. However, there was no need to find and exploit old WinCE holes to remotely break into one of these bad boys. Once the infosec duo had found a suitable car wash connected to the web, the researchers found that the default password – 12345 – just worked. Once logged in from their browser, they were given full control of the system. From there, they could prod the web app into doing things it really shouldn't. “Car washes are really just industrial control systems. The attitudes of ICS are still in there,” Rios said. “We’ve written an exploit to cause a car wash system to physically attack; it will strike anyone in the car wash. We think this is the first exploit that causes a connected device to attack someone.”

Kinda reminds me of the Stuxnet worm that was designed to shut down Iran's nuclear power plant. The vulnerability is not yet disclosed to the public but the manufacturer has been informed but no software patch is available at the moment. Even the video filmed with a phone is not allowed to be shown to the public as per the car wash owner's wishes. 

Quote

The researchers also noted that although they disclosed the vulnerability to the manufacturer, there is no patch as of Black Hat 2017.

 

The work done by Rios and Butts further highlights the need for everyone to change default passwords and think twice before connecting a device to the Internet. Although this was a test on a seemingly benign system, a car wash is a mini industrial control system that if used inappropriately could inflict some pain and suffering to innocent people.

Finally last words from the researchers:

"All systems—especially internet-connected ones—must be configured with security in mind... This includes ensuring that the systems are behind a network firewall, and ensuring that all default passwords have been changed. Our technical support team is standing ready to discuss these issues with any of our customers."

 

To be honest, I'm not really a fan of those automated car washes where you insert money and just shift gears to D (1st gear for manual transmission) for a couple of reasons. First, it doesn't clean well especially the mags after driving in the rain and secondly, I can wash my car by myself. If I want my car to be thoroughly clean and shiny inside and out, I'll just send it over for detailing.

 

*Not my car.

 

But it only shows that software based security solutions alone like that ones built in to Windows CE is not very secure given that the last stable release was in June 2013. Internet of Things is very promising but the potential risks could deter people from buying them and send technology back to the dark ages. If an attacker can hack an iRobot Roomba or Sous Vide device or even an automated garage door, we might as well just pick up a broom to clean a big house or just learn that a medium rare for a 1" steak should just be around 3 to 4 minutes on both sides. But then again, this is just a proof of concept hacking at the moment and it's not available in the wild so to all the people fan of automatic car wash service can relax that the brushes won't scratch and they won't trap you inside. 

[Himommies]

Pepole still use these at all

[captain_to_fire]

I wonder if Windows 10 IoT is better? I hope it is better tbh. 

 

[vanished]

I just skimmed very briefly... so they were running horribly out-of-date software that was exposed to the internet, and it got hacked?  Wow, never would have seen that coming /s lol

[captain_to_fire]

Just now, Ryan_Vickers said:

I just skimmed very briefly... so they were running horribly out-of-date software that was exposed to the internet, and it got hacked?  Wow, never would have seen that coming /s lol

Aside from running a newer OS (Windows 10 IoT?), I'd like them to improve their cleaning capabilities especially after driving in the rain and my car especially at the mags is covered in dried up mud. My friend once told me those car washes can't get rid of dried up bird poop properly.

[Aytex]

wannacry  

[GoodBytes]

I wash my car by hand, and recommend to do it (assuming you can)

Why washing your car by hand is better?

• Ability to clean under the car.
• Doesn't scratch the car (assuming proper cleaning procedure is used). Automatic car washes scratches the paint, the roller aren't clean between cars. This is most visible with silver cars and black cars. Silver cars turn dull after a few years if no proper care is taken due to the high amount of scratches, and black cars you see scratches everywhere under the sun. Of course, 1 car wash through the automated system won't show anything as it will be minor, but doing many times will show.
• Give you a chance to go around the car ensure that all your lights are working, and inspect your car paint against any damages that be treated before it gets worse and you can't do anything, or it will be costly to repair.
• Gives you a chance to clean the inside
• Clean the tires and make them look line new, and not muddy brown.

[GoodBytes]

11 minutes ago, huilun02 said:

Bbbut if you have a Windows 10 device with you, the car wash will not attack. Also a chance of curing cancer. 

... right guys? 

Well, Cortana might go rogue...

[Drak3]

26 minutes ago, GoodBytes said:

I wash my car by hand, and recommend to do it (assuming you can)

I use a pressure washer. Doesn't get every last little bit of dirt, but betwren a 2500 for work, a Dakota for off roading, and parking is a dirt alley, it don't matter.

[DeScruff]

What Im getting from this: Things that shouldn't be connected to the internet, are and nobody should be surprised at the results.

Also that I played a game on the GBA back in 2001, that showed why having everything connected to the internet is a bad idea. - I also recall people laughing at that concept back then...

[vanished]

1 hour ago, GoodBytes said:

• Doesn't scratch the car (assuming proper cleaning procedure is used). Automatic car washes scratches the paint, the roller aren't clean between cars.

>roller

That's assuming you use those ones like this:

Spoiler

I didn't realize anyone actually did... so many ways that could go badly.  Stones in the brushes, snagging and ripping mirrors off, etc. no telling what might happen

 

Spoiler

 

At least these don't actually touch your car, just spray water, soap, and then more water.  Don't tend to get off tougher stuff tho.

 

[NumLock21]

 

[captain_to_fire]

2 hours ago, GoodBytes said:

Doesn't scratch the car (assuming proper cleaning procedure is used). Automatic car washes scratches the paint, the roller aren't clean between cars. This is most visible with silver cars and black cars. Silver cars turn dull after a few years if no proper care is taken due to the high amount of scratches, and black cars you see scratches everywhere under the sun. Of course, 1 car wash through the automated system won't show anything as it will be minor, but doing many times will show.

Here's me thinking if my car insurance would cover detailing costs if the paint gets scratched by the brushes of automated car wash services.

 

But then, they didn't cover my tint replacement when my windshield got cracked because of a flying rock. 

[Syntaxvgm]

Quote

1. Have you ever used an automated car wash service?

No, I have a hose. 

[Bad Santa]

I'm the manager of a car wash so I can give a bit of insight into this.

 

So your car wash is going to be controlled by a tunnel controller, which is typically a standard computer.  All of the equipment is turned on and off by electrical relays that the controller is connected to.  The controller is what you're going to set all of the timing for you equipment with (which isn't actually based on time, but rather by "pulse").  Your controller is typically then connected to a push button panel in your tunnel that allows you to enter washes, send up rollers, etc.

 

Many newer systems also have a POS system, kind of like in a restaurant.  You enter washes, etc on this instead of on your tunnel panel because it keeps track of your washes and money better.  Many new ones also allow you to use prepaid plans where a car typically has a sticker on the windshield that you scan when it comes in and the entire transaction is done automatically.  This POS is also going to usually going to process your credit cards aswell, hence why you need an internet connection.  On certain systems, you may be able to gain access to turn equipment on and off remotely because of this, but certainly not on all.

 

Now, for the amount of damage that can be done.  Garage doors will obviously be the main issue, but most washes aren't going to have those connected to their controller.  Typically those will operate via a magnetic wire that is run on the ground and detects when a vehicle is above it, and opens or closes accordingly.  The "arms" that were referred to in the WAN show are what are called wrap arounds.  They're going to extend and contract via air cylinders.  The amount of air pressure these run at is set by a pressure regulator.  No way a hacker can change this.  The amount of air pressure that this runs at should NEVER be enough to smash into and critically damage a car.  

 

Having access to this and swinging it about at the wrong time could certainly break mirrors, damage plastic body trim, etc, but should NOT be able to break windows or damage the body of the vehicle.  The amount of soap/water being used is also set by a physical component just like the air pressure to the wrap arounds, etc. All a hacker would be able to do is keep a particular water/product sprayer on.  You MIGHT be able to change the pressure/dilution in washes equipped with something like a Hydroflex, but I don't know enough about them to be sure.  I doubt it though.

 

Overall, the car wash hacking really isn't something you should need to be worried about.  It's a very, very rare issue and I'm not surprised that this is one of the only instances of it I've heard of.  If you have any questions, feel free to ask.

[BuckGup]

I don't think people realize just how unsecure everything is. Hospitals, power plants, traffic lights, and much more get hacked frequently but are covered up so it doesn't make them look bad. If you don't believe me go to the search engine of unsecured devices 

https://www.shodan.io

[Liltrekkie]

On 7/27/2017 at 7:52 PM, GoodBytes said:

I wash my car by hand, and recommend to do it (assuming you can)

Why washing your car by hand is better?

• Ability to clean under the car.
• Doesn't scratch the car (assuming proper cleaning procedure is used). Automatic car washes scratches the paint, the roller aren't clean between cars. This is most visible with silver cars and black cars. Silver cars turn dull after a few years if no proper care is taken due to the high amount of scratches, and black cars you see scratches everywhere under the sun. Of course, 1 car wash through the automated system won't show anything as it will be minor, but doing many times will show.
• Give you a chance to go around the car ensure that all your lights are working, and inspect your car paint against any damages that be treated before it gets worse and you can't do anything, or it will be costly to repair.
• Gives you a chance to clean the inside
• Clean the tires and make them look line new, and not muddy brown.

 

While your points are valid, I don't want someone to just go with a bucket and a shitty rag and expect pro level results. 

 

If you do the proper job, two bucket, grit guards, proper wash pads, etc, youll do a much better job, and youll save your clear coat for a rainy day. 

 

You have to invest in the products and tools for the job. Which while it has a much higher up front cost, saves in the long run because youll use the product over a number of washes and months, if not years.

 

On topic, the amount of passwords that are 12345 is really really dumb, and they should be ashamed they are doing that as a business. 

[captain_to_fire]

1 hour ago, Liltrekkie said:

While your points are valid, I don't want someone to just go with a bucket and a shitty rag and expect pro level results. 

 

If you do the proper job, two bucket, grit guards, proper wash pads, etc, youll do a much better job, and youll save your clear coat for a rainy day. 

 

You have to invest in the products and tools for the job. Which while it has a much higher up front cost, saves in the long run because youll use the product over a number of washes and months, if not years.

If I want my car squeaky clean and shiny inside and out, I'd have detailing services to do that for me.  But for the most part, my hose and my hands holding a sponge can clean better than an automated car wash.