BMW ConnectedDrive
German car manufacturer BMW has taken ‘rapid’ steps to fix a flaw in its ConnectedDrive software, affecting 2.2m cars.
The patch comes on the back of the German automobile association’s (ADAC) investigation into the communications running through the service, which is in certain BMW, Mini and Rolls Royce models and operates through a SIM card installed directly into vehicles.
Reuters report that the security risk involved the ability to create a fake phone network, which BMW cars attempted to access, allowing hackers to manipulate functions activated by the SIM card.
In this case, it could lower the windows of cars or even unlock their doors. According to security blogger Graham Cluley, the flaw was actually discovered last summer, but BMW was given until now to work out a patch to fix the problem.
“The online capability of BMW Group ConnectedDrive allowed the gap to be closed quickly and safely in all vehicles,” said the car manufacturer in a statement. “Access to functions relevant to driving was excluded at all times.”
This fix will do little to quell the fear amongst security analysts who predicted situations like this long ago, some accusing car manufacturers of creating systems that were ripe for hacking.
“It appears the vulnerability revolved around the insecure transmission of data, as the patch rolled out by BMW appears to have enabled HTTPS. Something you would probably have hoped that BMW’s engineers would have thought about in the first place,” says Cluley.
BMW claims it has made a “rapid response”. Anything short of a year must fall into that category.
