BY MITCH DAVIS
Things change fast in the automotive world. The bad guys do a good job keeping up with changes. Manipulation, hacks, telematics, onboard safety gear, and general ADAS function knowledge should be integrated into your general awareness platform to increase operational proficiency. I wanted to provide a quick list of technologies, and considerations to keep in mind, while operating as a security driver, or fleet supervisor, if you will.
Quick definitions:
Dash Cameras: We have passive and active. Passive will provide the user with imaging while moving, stopped, sometimes while parked, and store this data on an SD card/ internal memory for retrieval post-incident. This can be an asset or liability depending on your intended use. A simple visual inspection will allow the driver to locate it with ease. They can be installed temporarily, or permanently attached ( hardwired) to the vehicle.
“Active” Dash Cameras perform the same as passive except….Time, date speed, location, events triggered by hard braking, excessive speed, heavy braking, speeding over posted limits, facial analytics, and more are uploaded to cloud storage, and can remain in place for as long as the account is in good standing with the provider. Some providers claim indefinite storage of events. Triggered events can be configured by administrators of the system to report or bypass event notifications. These triggered events can be retrieved, even if the vehicle sustains catastrophic damage. Companies also collect vehicle and driver data to be used for autonomous driving analytics. More so, when driver-facing cameras are in use.
GPS tracking
GPS tracking exists in just about everything that rolls of the line destined to middle and upper-tier purchasers. Let’s not forget to add On Star, Toyota service, MBZ customer care, BMW care, and more. Most of them do the same thing, with a handful of differences.
ADAS
ADAS is your lane departure and driver-assist systems. The market has experienced a high surge in these devices becoming a standard as an OEM supplied feature, and are being pushed by safety advocates to reduce “everything”. They were never meant to cater to security drivers or entities that don’t require their use for daily operations.
Remote diagnostics
Remote diagnostics can be integrated into almost all of the above, to gather fault codes, anomalies, and driver/vehicle performance, as long as they ( the devices) are tethered to the diagnostic port, via the aftermarket, or through OEM integration.
They can also be performed by plugging a Bluetooth device into the OBD2 diagnostic port, or by adding it using a “Y “cable, hidden in line with the OBD2 port diagnostic port connection. Data is now bi-directional between the vehicle and user. Basically, the Bluetooth device serves as a connection to access the vehicle’s computers. The device can send vehicle data back and forth to a diagnostic reader (aka scan tool) and provide real-time information and function tests. Function tests can include locking and unlocking doors, shutting off the fuel pump, pop trunk, and simulating component failure on demand. This can be done within 25 feet of the vehicle using Bluetooth technology, or remotely using cellular data-supported communication (almost like Onstar). Do you see where I’m going with this?
Right to Repair
OEM auto manufacturers have long fought with locksmiths and independent repair shops over making vehicle service and diagnostic tools available. Another reason why it can cost over $200.00, for extra or replacement keys, and fobs. As fast as OEM says no or waits for us to release it, folks capable of manipulating manufacturer software will stay hard at work until they produce a fix that will be sold in the grey market to shops that need that software. And the bad guys will gladly pay as well.
How does this affect the security driver?
Almost all of the information collected by these telematic/image collecting/ADAS devices can be accessed by anyone as long as they have: The name of the provider, username, and password. Vehicles can be remotely manipulated through hacks, man-in-the-middle attacks on remotes, rogue scan tool owners, and more. The attacks are not just technical, they can be done remotely. The attacks require vehicle information, human interaction, knowledge of policy, procedure, and usually physical access to the vehicle. Often less than 5 minutes.
What can the security driver do to help protect their conveyance from exploitation?
- Disable the OEM “customer assistance system”. ( You don’t need it if you have good comms)
- Have your shop disable the capability of your OBD2 plug. Remove it, hide it or even pull the fuse for it. (This may disable your 12 V Lighter socket)
- Have the dealer or reputable locksmith check vehicle history to see if extra keys have been generated and if so, remove the extras from the system and start doing some homework.
- If you can, in a high-risk environment, try to use your key to lock doors before leaving the vehicle by itself. You can also cycle the locks rapidly quickly 10 times in rapid succession to help deter a MIM attack. If it can’t grab the code from the FOB, it won’t work. This does not always work but it is a good countermeasure.
- Don’t allow a provider to power a dashcam/GPS from OBD2, or obtain diagnostics. Make them hardwire it to the vehicle. NO diagnostic integration.
- Have your trusted mechanic/shop inspect the vehicle for aftermarket wiring, and stay with the vehicle while it’s being done. Just tell them the battery has been acting up and you want them to physically look and see if anything was added to the vehicle. If they find something have them show it to you in person and determine if it’s a friend.
- Keep a cover on the vehicle when not in use. One that is tight that will not allow doors to open without removing it.
- If a dash camera or GPS is required, remove all labels containing numbers from the device. Of course, you should be present during the install.
- For ADAS concerns, consult with a technician at the dealership, or the vendor they use for calibrating ADAS. Sometimes a windshield or glass shop will have someone equipped to do ADAS work that may be able to disable it for you without affecting the vehicle’s normal unassisted operation.
- The information presented will not fit every scenario or concern, due to the many different vehicles in use. I wanted to provide a baseline for security drivers to use to help keep everyone at a better level of safety, with real-world knowledge.
About the Author
Mitch is the owner of TSCM Group located in Nashville, Tennessee. They provide world-class investigation services, technical investigation services, electronic surveillance equipment, and outside-of-the-box approaches for difficult situations. As well as crash data recovery from the US and foreign vehicles.
For more information please visit the company website – https://www.tscmusa.com/