- [Chris] Security isn't a winnable game.
You basically want to make the return on investment
for an attacker increasingly low.
We're adding technology and communications
onto things that traditionally didn't have them.
- [Charlie] It's one thing for your computer
to get hacked and lose some photos or emails,
but if your car gets hacked
and you end up in a ditch and people are hurt,
it's a whole different story.
So we tear apart cars, see how they work,
see what attackers could do
and try to raise awareness on this issue.
- You could have massive traffic pile up,
bodily injury, death, who knows?
You want technology to progress,
but at the same time you want it to be secure.
- And so we're working hard on trying to make sure
that does, ah, that doesn't happen.
- You were good and then - Eh
- You just like you stumbled - That's alright.
- over yourself in the end.
- They'll get that out in post - That's alright.
- Don't worry.
- [Chris] You may think I love computers
but I hate computers, all kinds.
- I'm Chris Valasek and I'm a car hacker.
- I'm Charlie Miller, I'm a hacker.
I've hacked cars, phones, computers.
You name it, I've hacked it.
Cars are the most expensive, biggest, dangerous
computer you own.
In your cars. - [Chris] It's one of the few
computers that can go 120 miles per hour.
Right, like it's a big machine,
run by software that can get hacked
and is, you know, dangerous.
We're not really getting paid to hack this stuff.
We're actually just doing it out of curiosity
and trying to make things better.
It's the love of the game, right?
A lot of the automotive companies
are slowly realizing that they are software companies.
And up until recently they just assumed
software helped their cars work.
But now, software is really driving
what modern-day automobiles are.
- [Charlie] Here comes the jeep, a Grand Cherokee.
- [Chris] Mmm-hmm, Hacked.
- Pew. - Boo.
- You can't build security into cars
if you don't understand how attacks against cars work,
and so we do the attacks in order
to understand how to defend against those attacks.
Cars today, some cars have 50 computers,
some cars have up to 200 computers in their car.
- Now while most of these features make cars safer,
you have to remember, too,
that we think about things differently.
So we figure those are attack points,
ways to manipulate the vehicles
in ways that was never intended.
So, this piece here is a portion of the telematics module.
- So this is the piece that we care most about.
- This is the way that the car gets on the internet.
- You know, let's talk about the jeep.
- Yeah.
We really wanted to show what's actually possible.
So what we did was compromise a head unit,
and this actually had the telematics module in it,
this cellular modem.
Doing it remotely was the best way to do that.
- [Charlie] So we took a reporter
and we put him in the jeep and sent him out on the highway.
- So we're killing the engine right now.
- [News Anchor] Computer security experts have proved
it is possible to hack a 2014 Jeep Cherokee
and take control of the car remotely over the internet.
- [Charlie] No one was harmed, but we could have
engaged his breaks or turned him off the road.
- Hold on.
- [Chris] Our message was received.
- [News Anchor] The car maker is issuing a recall
of 1.4 million vehicles in the United States
in order to patch the software.
- There's two autonomous cars right there.
- [Charlie] Oh yeah, - [Chris] See the spinning
things on top? - [Charlie] Oh yeah
they're back-to-back.
- Yeah, you know they have the ability
to drive themselves under the correct circumstances.
I think autonomous cars will allow humans to travel
wherever they're going
in a much more safe and reliable fashion,
because you don't have human error involved any longer.
It's a machine.
- [News Anchor] Tesla has announced
that they're building all of their vehicles
with self-driving technology.
- Every manufacturer is working on some sort of
autonomous technology because they know
that that's the future.
- There's some simple risks in just that
software's not perfect
and so autonomous cars are just sometimes
going to make mistakes.
- You don't want any company
with autonomous vehicles getting hacked.
It's bad for the entire ecosystem.
But luckily, a lot of the people that are working
on those problems are more than happy
to hire gentlemen like ourselves to secure such things.
You know, everyone says that they don't like autonomous cars
maybe because they don't trust the computers,
but people are just scared of the unknown,
they don't know anything about it,
so it will just take time til people get used to it.
- I think for sure like our grandchildren
are going to be like,
"Wow you used to drive a car." - Yeah like everyone
drove around?
That's crazy. - That's so dangerous, right.
- "Well, what happened if you want to check your phone?"
You'd be like, "oh you just did it dangerously."
Like you, - You just did it
and sometimes you ran
into someone - Yeah sometimes you smashed
into, you know, a school bus.
It happens
- [Charlie] We can't build more secure cars,
like we're just two guys.
What we can do is just raise awareness.
- Whether it be cars or medical equipment
or heavy machinery, we want these things to improve
and we want them to be easier to use,
but at the same time you need to be especially careful
to ensure that you have proper levels of security.
There was a time where cars
didn't have airbags or seat belts,
but now everything out there really is
just becoming more connected and more run by software.
Security is getting to that point
where it needs to be part of the process
of making these things.
- Yeah, and even in the safety world it took someone
to take them to task before they really did that.
And so, maybe that's us.
- [Chris] We really want more transparency
into how they are actually securing these cars
instead of just blindly trusting them.