Recently, the media has been on discussion on making the country roads to be controlled by private company and Finnish cars envisaged the so-called mandatory. black box. On this discussion it has been several times mentioned that the Finnish Government has planned a mandatory monitoring devices for all cars to collect “road tax” based on how much cars are used. Some parties have seen that the black box can be a viable option for collecting motoring taxes in the future in a new way. For example, if applied for Employment and the Economy Ministry of the so-called. energy support electric cars , tracking device in the car was a mandatory period of three years. Several Finnish companies have been willing to sell such devices for this purpose. New ways of road-use preparations began for the Ministry of Transport already during the previous government. Mileage-based road user fee based on satellite positioning idea was proposed in statement Jorma Ollila Working Group.
The Finnish Transport Safety Agency Trafi has already tested the Semel sold devices on more than thousand cars as one implementation of the kilometer-based monitoring. Trafi has tested the cars installed “black box”, which tells the authorities where the car is driven, in 2900 cars. It can send data on position and speed. Trafi and telecom operator that have been doing the test have been satisfied with the results of tests. For example, if applied for Employment and the Economy Ministry of the so-called. energy support electric cars , tracking device in the car was a mandatory period of three years.
The GPS tracking device sold buy Semel is quick to set up: attaching it to your car’s dashboard with double-sided tape takes only takes a few minutes and then plug to OBD if needed. The device costs a few dozen euros to a couple of hundred euros, depending on the features.
What about security – whether the system is protected in such a way that it can not be tampered with?
- None of the device is not one hundred percent sure, but there are ways to protect that information. The device sends only one address information.
The question has been on protection of privacy and data protection of motorists. It turned out that due to a security issue garish cars containing these black boxes could be followed in real time via the Internet.
Tivi told last week that the follow-up of cars in Finland within the meaning of “black box” found an error, as a result of the location information was viewed by anyone on the internet. The security was practically none: It turned out that by knowing the 6 digit serial number, the cars could be followed in real-time on the company (Semel) web site. When on the website chose the black box and type the 6-digit identifier, the page began to head to the coordinates of a car display. These coordinates will be able to strike eg. Google Maps and see where the cars are going (Sunday 08/01/2017). This issue (was active on-line for week or two) that been fixed now, at least in the way that the same trick does not work anymore. The exact locations of Sonera Mobile test run was kind of service users has been the Internet visible to anyone for several days or even weeks. “It was specifically Finnish mistake”, says Semel CEO Börje Nummelin.
But the story does not end here, because the tracking system had also other problems. I was on weekend at Disobey hacker event where people hacked that GPS tracking device. I saw what was inside Semel GPS tracker “black box”:
This closeup shows the GPS antenna in the center, QUETEL GPS receiving module (has serial data output) on the left and Antennova cellular antenna on the right.
On the other side you see Cinterion cellular module (serial and USB inerfaces), main processor (there are some pins on the case that carry JTAG signals), USB connector and car interfacing connector (that has for example CAN bus implemented in it).
Here is component list.
“We found a serious vulnerability in the device,” said the main organizer of the event Benjamin Särkkä. The box was manufactured by WirelessLinks and sold by Finnish company Semel. If some person gets physical access to the device (USB interface for example), it is possible to change what the device does I was told. The vulnerability allows you to change device settings, so that an outsider can follow your movements in real time the data transmitted by the GPS device allows. So this was just another embedded IoT box with bad security built-in. Tracking and payment systems selling Semel Oy’s President and CEO Börje Nummelin is not a hacker with the absolutely agree with the company’s “black box” data protection observations have been made. Semel has openly cooperate with the hacker community and Semel announced the corrective measures after consulting the found vulnerability.
What happened after those findings came at the annoying moment for politicians? Just few days after the event, coalition transport infrastructure maintenance overhauls we are in favor, although there also criticized motorists digital GPS-monitoring. It would break the fundamental rights. Movement control is knocked out completely. Therefore, ministers Berner and Sipilä now assert that the GPS tracking does not come.
Sources:
Suomalaisten autoihin kaavailluista seurantalaitteista löytyi karmea aukko
Karmea tietoturvamoka mustissa laatikoissa: Suomalaisautot seurattavissa netissä
Autoihin musta laatikko – testataan tuhannella suomalaisella
Lentokoneista tuttua “mustaa laatikkoa” testattu jo 2 900 autossa – tuleeko pakolliseksi?
Yleisöltä: Bernerin hanke teiden yhtiöittämisestä näyttää liian isolta palalta purtavaksi
Ollilan työryhmä: Kokeiluin kohti kilometriverotusta
Jorma Ollilan työryhmä ehdottaa: Ajaminen kilometriverolle
Lehti: Berner autojen seurannasta vuosi sitten – ”Ei tule minkäänlaista seurantaa tai paikannusta”
Bernerin mallissa autot paikantaisi digiboksi, ei satelliitti
Aarnio: Autojen gps-valvonta vaatinee perustuslain muuttamista
Lännen Media: Bernerin ajama gps-seuranta harvinaista maailmalla
Hakkerit mursivat autojen mustan laatikon – ”Asentaminen on tyhmä idea” – Tietoturva – Ilta-Sanomat
Laitevalmistaja selittää mustien laatikkojen ongelmaa: ”Se oli suomeksi sanottuna moka” | Uusi Suomi
“Se oli suomeksi sanottuna moka” – laitetoimittaja selittää autojen sijaintitietojen paljastumista
Mustien laatikoiden myyjä ei vakuuttunut hakkereiden murrosta
Suomalaishakkerit tutkivat mustan laatikon: ”Vakava haavoittuvuus – suojaus on alkeellinen”
Hakkerit mursivat autojen ”mustan laatikon” – ”Siellä oli bootloader vastassa”
15 Comments
Tomi Engdahl says:
TRANSLATION:
ISTV LIVE RIGHT NOW: Berner reveal the most sensational plans – “huge change”
http://www.iltasanomat.fi/autot/art-2000005050238.html
The Ministry of Transport and Communications (MTC), the draft report in the development of the transport network to be released today at 10:30. ISTV send a chance to live.
LVM: Citizens forced to follow-up is not planned
- The report there have been a lot of discussion on payments related to the follow-up of vehicles. The purpose is not to monitor the citizens. payment based on time does not require any run-tracking device. Alongside it can later offer also based on mileage-based pricing packages that road users can choose to get. Mileage-based payment model ensuring information security and privacy laws, says Minister Berner.
ORIGINAL:
ISTV LIVE JUURI NYT: Berner paljastaa kohutut suunnitelmansa – ”Valtava muutos”
http://www.iltasanomat.fi/autot/art-2000005050238.html
Liikenne- ja viestintäministeriön (LVM) ehdotus selvitykseksi liikenneverkon kehittämisestä julkaistaan tänään kello 10.30. ISTV lähettää tilaisuuden suorana lähetyksenä.
LVM: Kansalaisten pakkoseurantaa ei suunnitella
– Selvitykseen liittyen on ollut paljon keskustelua maksuihin liittyvästä ajoneuvojen seurannasta. Tarkoitus ei ole seurata kansalaisia. Aikaan perustuva maksu ei vaadi mitään ajon seurantalaitetta. Sen rinnalla voidaan myöhemmin tarjota myös kilometripohjaiseen hinnoitteluun perustuvia paketteja, joita tienkäyttäjät voivat halutessaan hankkia. Kilometripohjaisen maksumallin tietoturvallisuus ja yksityisyydensuoja varmistetaan lailla, ministeri Berner sanoo.
Tomi Engdahl says:
http://yle.fi/uutiset/osasto/news/transport_minister_claims_road_privatisation_will_be_a_bigger_change_than_invention_of_car/9412652
Tomi Engdahl says:
http://yle.fi/uutiset/osasto/news/fridays_papers_bumpy_ride_for_ministers_road_reform_proposal__and_its_trump_time/9413769
Tomi Engdahl says:
Berner painoi äkisti jarrua: liikenneverkkoyhtiön selvitys keskeytetään
http://yle.fi/uutiset/3-9419760
GPS tracking device says:
I am in fact thankful to the holder of this web
site who has shared this great post at here.
Tomi Engdahl says:
Radio amateurs have their own GPS tracking system APRS
https://aprs.fi/#!lat=60.17080&lng=24.93750
Tomi Engdahl says:
http://www.etn.fi/index.php/13-news/8739-disobey-hakkeritapahtuma-tammikuussa-neljatta-kertaa-helsingissa
Tomi Engdahl says:
11 Myths About GPS for Autonomous Vehicles
https://www.electronicdesign.com/automotive/11-myths-about-gps-autonomous-vehicles?sfvc4enews=42&cl=article_1_b&utm_rid=CPG05000002750211&utm_campaign=25454&utm_medium=email&elq2=8d0add7f150f400493601b428dc18888
Though it has a relatively long track record, misconceptions still surround the Global Positioning System, especially in terms of autonomous vehicles. ACEINNA’s Dan Dempsey attempts to dispel those myths.
Tomi Engdahl says:
There are advertisement on gadgets that can “reverse” your GPS signal and prevent anyone from tracking you. It’s funny how illegal this is and they get around being taken down by not using keywords like “jammer” or “scrambler” in the title.
“These tiny little self-contained boxes spew RF at around 1575.42 MHz, the same frequency used by GPS satellites in high Earth orbit.”
“There are a few 555s in there creating low-frequency noise. This feeds a VCO with a range of between 1466-1590 MHz.”
https://hackaday.com/2017/12/01/a-teardown-of-something-you-should-not-own/
Tomi Engdahl says:
https://www.gpsworld.com/how-do-we-ensure-gnss-security-against-spoofing/
Tomi Engdahl says:
https://www.rtl-sdr.com/tag/gps-spoofing/
Tomi Engdahl says:
https://hackaday.com/2017/12/01/a-teardown-of-something-you-should-not-own/
Tomi Engdahl says:
https://hackaday.com/2020/08/14/how-to-choose-the-right-gps-module-for-your-project/
Tomi Engdahl says:
https://hackaday.com/2020/09/08/teardown-mini-gps-jammer/
Pearlsmith says:
Thanks for sharing nice information, it is a very informative post.