Chrysler 300 Limited Navigation Rear Camera Panorama Roof on 2040-cars

Auto blog

The problem with how automakers confront hacking threats

More than anyone, Chris Valasek and Charlie Miller are responsible for alerting Americans to the hacking perils awaiting them in their modern-day cars. In 2013, the pair of cyber-security researchers followed in the footsteps of academics at the University of Cal-San Diego and University of Washington, demonstrating it was possible to hack and control cars. Last summer, their research established which vehicles contained inherent security weaknesses. In recent weeks, their latest findings have underscored the far-reaching danger of automotive security breaches. From the comfort of his Pittsburgh home, Valasek exploited a flaw in the cellular connection of a Jeep Cherokee and commandeered control as Miller drove along a St. Louis highway. Remote access. No prior tampering with the vehicle. An industry's nightmare. As a result of their work, FCA US recalled 1.4 million cars, improving safety for millions of motorists. For now, Valasek and Miller are at the forefront of their profession. In a few months, they could be out of jobs. Rather than embrace the skills of software and security experts in confronting the unforeseen downside of connectivity in cars, automakers have been doing their best to stifle independent cyber-security research. Lost in the analysis of the Jeep Cherokee vulnerabilities is the possibility this could be the last study of its kind. In September or October, the U.S. Copyright Office will issue a key ruling that could prevent third-party researchers like Valasek and Miller from accessing the components they need to conduct experiments on vehicles. Researchers have asked for an exemption in the Digital Millennial Copyright Act that would preserve their right to analyze cars, but automakers have opposed that exemption, claiming the software that runs almost every conceivable vehicle function is proprietary. Further, their attorneys have argued the complexity of the software has evolved to a point where safety and security risks arise when third parties start monkeying with the code. Their message on cyber security is, as it has been for years, that they know their products better than anyone else and that it's dangerous for others to meddle with them. But in precise terms, the Jeep Cherokee problems show this is not the case. Valasek and Miller discovered the problem, a security hole in the Sprint cellular connection to the UConnect infotainment system, not industry insiders.

Chrysler Recalling 700k Vehicles For Ignition Switch Woes

General Motors isn't the only automaker with ignition switch problems. Chrysler is fighting it too and is now announcing a recall of 695,957 examples worldwide of the Chrysler Town & Country and Dodge Grand Caravan minivans from the 2008-2010 model years, plus the 2009-2010 Dodge Journey. According to a statement from Chrysler, the models have a bad wireless ignition node detent ring in the ignition switch, making it possible for drivers to appear to have the key in the "Run" position but for the spring not to fully engage. It can then slip back to the "Accessory" position and shut the car off. If this happens, the vehicle loses power steering, brake boost and the airbags. There is some disparity about the number of vehicles affected under this recall. In its statement, Chrysler claims that it covers 525,206 vehicles in the US, 102,892 in Canada, 25,591 in Mexico and 42,268 elsewhere. However, the recall announcement posted by The National Highway Traffic Safety Administration lists an estimated 438,109 vehicles in the US. Chrysler spokesperson Nick Cappa told Autoblog via email that the reasoning for the different figures "will become clear at a later date." To fix the problem, Chrysler will install a new detent ring in the vehicles. It will begin contacting owners soon, and obviously the repair will be free of charge. This isn't the first time this problem has cropped up in these models. Chrysler issued a recall for 248,437 vehicles in 2011 for certain 2010 model year examples. A few weeks ago, NHTSA also began investigating the 2008-2010 model years of the affected models for ignition switch problems. At this time, it's not clear whether that evaluation and this campaign are linked. Chrysler told Autoblog that it has no reports of injuries related to the problem. Scroll down to read the company's statement and the NHTSA recall report. Statement: Expansion of Wireless Ignition Node (WIN) safety recall July 1, 2014 , Auburn Hills, Mich. - Out of an abundance of caution, Chrysler Group is expanding a previous safety recall to install a more robust WIN module detent ring. A previous recall in 2010 included 196,000 Chrysler Town & Country, Dodge Grand Caravan and Dodge Journey vehicles built August 2, 2009 through June 17, 2010. The expansion includes an additional 695,957 vehicles manufactured January 29, 2007 through August 1, 2009.

FCA UConnect fiasco could set over-the-air updates back years

Since cars have become more software dependent, most major automakers have been inching toward enabling over-the-air updates to keep vehicle electronics, ranging from infotainment systems to safety features, current. But there are only two car companies — Fiat Chrysler and Ford —± currently doing OTA updates, and on a limited basis. GM CEO Mary Barra announced last summer that the automaker will launch a new EV architecture and infotainment system capable of over-the-air updates "before 2020." The one exception, per usual, is Tesla. Since the release of the Model S almost six years ago, the maverick EV automaker has made routine OTA software updates a core part of its vehicle platforms and value proposition, and has sent out updates for everything from adjusting ride height to enabling Autopilot, largely without incident. When I've asked automakers why they can't do the same thing, I've heard reasons ranging from running afoul of their dealers (and archiac regulation) to security concerns. Automakers like Ford and General Motors say they want to act like tech companies, which routinely send out OTA updates for a wide range of devices, but overall the car industry still moves at a very cautious snail's pace. And when automakers do try to move faster and take more risks — unlike with a smartphone update, which people bitch about but live with — the consequences can be significant when things go wrong. That's the case with Fiat Chrysler America and its recent public-relations nightmare when an OTA update went awry. The update went out at the end of last week for the Uconnect system in late-model vehicles, and it made head units go into a near continuous reboot, which caused owners to not only lose access to entertainment features, but also critical functions like emergency assistance. Almost immediately, owners took to Twitter to express outrage, and FCA was caught flatfooted. A tweet went out on Monday on the UconnectCares Twitter account that read, "Certain 2017 & 2018 Uconnect systems may experience a reboot every 45-60 seconds. Our Engineering teams are investigating the cause and working towards a resolution.