This $100 device can locate, unlock and remote start GM cars

---

OwnStar is a device that can locate, unlock and remote start any vehicle with OnStar RemoteLink after intercepting communication between the RemoteLink mobile app and OnStar servers.

---

When director Sam Esmail was casting for his latest cyberpunk–thriller TV series Mr. Robot, we’re surprised serial hacker Samy Kamkar wasn’t in the running for the star role. That’s because, in just the last year alone, the 29-year-old has devised a plug-in box capable of tracking everything you type, a 3D-printed robot that can crack combination locks, and his own radio device for online anonymity. Added to that growing list is a tablet-sized unit can easily tap into and wirelessly take control of a GM car’s futuristic features.

Undoubtedly, car hacking will be a hot topic at this year’s Black Hat and DEFCON events. Cognizant of this, the Los Angeles-based entrepreneur has created what he’s calling OwnStar, a device that can locate, unlock and remotely start any vehicle with OnStar RemoteLink after intercepting communication between the RemoteLink mobile app and OnStar servers.

As you can see in the video below, the system is driven by a Raspberry Pi and uses an ATmega328 to interface with an Adafruit FONA for cellular connection. After opening the OnStar RemoteLink app on a smartphone within Wi-Fi range of the hacking gadget, OwnStar works by intercepting the communication. Essentially, it impersonates the wireless network to fool the smartphone into silently connecting. It then sends specially crafted packets to the mobile device to acquire additional credentials and notifies the attacker over 2G about the new vehicle it indefinitely has access to, namely its location, make and model.

First reported by WIRED, Kamkar has revealed that if a hacker can plant a cheap, homemade Wi-Fi hotspot somewhere on an automobile’s body — whether that’s under a bumper or its chassis — to capture commands sent from the user’s smartphone, the results for vulnerable car owners could range from pranks and privacy breaches to actual theft.

With the user’s login credentials, an attacker could do just about anything he or she wants, including tracking a car, unlocking its doors and stealing stuff inside (when carjacking meets car hacking), or starting the ignition from afar. Making matters worse, Kamkar tells WIRED that remote control like this can enable a malicious criminal to drain the car’s gas, fill a garage with carbon monoxide or use its horn to drum up some mayhem on the street. The hacker can also access the user’s name, email, home address, and last four digits of a credit card and expiration date, all of which are accessible through an OnStar account.

It’s evident that Kamkar’s objective here isn’t to help thieves and endanger the lives of drivers; instead, he is hoping to utilize OwnStar to raise awareness around the vulnerabilities of connected cars. Fortunately though, the actual issue lies on the mobile software and not the GM vehicles themselves. The carmaker has already been receptive of this discovery and plans to fix the matter at hand. Until then, the hacker advises owners to refrain from opening the app until an update has been provided by OnStar.

Intrigued? Kamkar says that he will provide more details around this and other hacks at DEFCON, which he will share on his website as well. Until then, you can watch the demonstration that was conducted on a friend’s 2013 Chevy Volt.

NOTE: Kamkar has confirmed that OnStar has indeed resolved the vulnerability and a RemoteLink app update has been released.

GM says driverless Cadillac to hit the road by 2017

Mary Barra, CEO of General Motors, has recently announced that the company plans to introduce 120-miles of technology-enabled highways in and around the Motor City.

By 2017, GM is planning on deploying vehicle-to-vehicle (V2V) communication systems as a standard in its Cadillac CTS sedan. Equipped with the company’s “Super Cruise” technology, future vehicles will be able to drive themselves, handling highway speeds of up to 70mph. GM’s semi-automated technology will keep a vehicle in a specific, properly equipped freeway lane, making necessary steering and speed adjustments in bumper-to-bumper traffic or long highway trips. However, unlike the driverless vehicle being tested by Google, GM’s system will still require drivers to remain attentive and ready to resume control of the vehicle.

Although Google’s driverless cars have been at the center of all the buzz, several automakers aren’t too far behind in the IoT fast lane. According to reports, Audi, Mercedes-Benz, Ford, Nissan, Toyota and Tesla are among the latest manufactures dipping their toes into the autonomous driving waters.

In line with our previous discussions around V2V, these new GM endorsed roadways will allow cars to “talk” with one another, thereby promoting safety, reducing traffic congestion and improving fuel economy. Jon Lauckner, GM’s CTO believes, “in the not so distant future, intelligent and connected vehicle technologies could help eliminate the crash altogether.”

The U.S. Department of Transportation has also recently said it is considering adopting a rule by 2016 requiring V2V systems. V2V communications use a variation of the 802.11 wireless network standard used by laptops and mobile phones, but instead link cars, which can share position and speed information with each other 10 times per second.

“I’m convinced customers will embrace V2V and automated driving technologies for one simple reason: they are the answer to everyday problems that people want solved,” Barra said.

According to GM’s CEO, the so-called Super Cruise technology will “kick in when there’s a congestion alert on roads like California’s Santa Monica Freeway, you can let the car take over and drive hands free and feet free through the worst stop-and-go traffic around.” She adds, “If the mood strikes you on the high-speed road from Barstow, California, to Las Vegas, you can take a break from the wheel and pedals and let the car do the work. Having it done for you — that’s true luxury.”

That being said, safety remains the paramount concern when assimilating driverless vehicles onto modern roadways. “The key to all these systems is big data — the mounds of information flowing in and out of your vehicle from intelligent transportation systems, otherwise known as vehicle-to-vehicle or vehicle-to-infrastructure technology,” Forbes‘ Joann Muller explains.

At this week’s Intelligent Transportation Systems World Congress in Detroit, Honda and GM unveiled systems where pedestrian smartphones would send alerts to drivers about an individual’s location. These alerts, scanned for every 10 seconds by the vehicle, could greatly improve pedestrian safety in heavily-trafficked areas.

While full vehicle autonomy may not be on the immediate horizon, there are still concrete steps being taken by major industry players to get ahead of the technology curve. With some driverless cars hitting the streets next year, this topic of discussion will only heat up.