Don't be too sure your car is an island of privacy. Under certain circumstances, outsiders can eavesdrop on conversations among you and your passengers if your car has a built-in Bluetooth telephone link.
Bluetooth provides a low-power wireless connection between your cellphone and your car -- it permits hands-free conversations through a speaker and microphone built into the vehicle, or with a headset -- and it may be vulnerable to amateur eavesdroppers.
At a recent computer security convention in the Netherlands, a group of European wireless-security experts called the Trifinite Group demonstrated a system that lets a laptop user listen to conversations in passing cars with Bluetooth setups.
The system, which Trifinite calls the Car Whisperer, also lets the user talk to people in these cars.
While that could be used to deliver compliments to a fellow motorist, it would also be possible for the user to insult the driver or to make a lewd proposition.
Using a laptop computer with a Bluetooth transmitter and a software program that runs under the Linux operating system, the Car Whisperer has a range of 100m, some 10 times that of Bluetooth hands-free systems.
The range can be extended beyond that distance by 1km by adding a directional antenna.
HEADING OFF MISCHIEF
The system was developed not to create mischief but to head it off, said Martin Herfurt of Salzburg, Austria, a co-founder of Trifinite and inventor of the Car Whisperer, by showing manufacturers how vulnerable some of their products are.
"Unless you can demonstrate the problem," Herfurt said in an e-mail message, "they may not recognize that it exists."
The security loophole exists only in setups that do not follow the recommendation of the industry consortium that sets Bluetooth standards.
Bluetooth devices can talk to one another only if they share a secret passcode.
While this code can be up to 128 bits long, the equivalent of a 16-character string of letters and numbers, most are shorter.
The Bluetooth consortium recommends eight-character passwords, allowing nearly 3 trillion potential codes. A computer could try them all, but by that time a moving car would be far out of range.
Many manufacturers' codes are just four digits long and consist solely of numerals.
Such passcodes have only 10,000 potential values and can be cracked relatively quickly.
Worse, some manufacturers use a single passcode, like 1234 or 0000, over and over.
If you are shopping for a hands-free Bluetooth speakerphone system, or a car equipped with one, you should look for one with a confirmation button that must be pressed to initiate a phone connection, Herfurt said, adding, "A button press cannot be performed by an external attacker."
Herfurt added that you should change your car's passcode from the factory default, if the system permits, and that you should keep the phone turned on and linked to Bluetooth.
"The system can only communicate with one device at a time," he said.
A system that communicates with other cars could be used to pass useful traffic data to drivers traveling behind you.
When traffic slows, for instance, cars might automatically tell the vehicles behind them what has happened, giving drivers a chance to exit or slow down to avoid a crash.
PRIVACY ISSUES
This is not the first time privacy issues have arisen in cars with high-tech connections. It is possible to eavesdrop on people in a car that has a telematics service with a phone connection, like General Motors' OnStar (which is also offered on some non-GM models) or Mercedes-Benz' Tele Aid.
But listening in through such systems requires the cooperation of the companies providing the service, and they will not cooperate unless they receive a court order.
Such orders have been issued at least once, in a 2001 FBI investigation located in Las Vegas, but they were then overturned by the 9th US Circuit Court of Appeals.
What are Bluetooth's other vulnerabilities? Despite reports circulating a few months ago, it is not true that a Lexus picked up a virus through a wireless link. Though cellphones can catch viruses, they are rarely linked to a car's vital computers.
But the concern behind such rumors is logical: Any electronic device connected to the outside world is potentially vulnerable.
RETHINK? The defense ministry and Navy Command Headquarters could take over the indigenous submarine project and change its production timeline, a source said Admiral Huang Shu-kuang’s (黃曙光) resignation as head of the Indigenous Submarine Program and as a member of the National Security Council could affect the production of submarines, a source said yesterday. Huang in a statement last night said he had decided to resign due to national security concerns while expressing the hope that it would put a stop to political wrangling that only undermines the advancement of the nation’s defense capabilities. Taiwan People’s Party Legislator Vivian Huang (黃珊珊) yesterday said that the admiral, her older brother, felt it was time for him to step down and that he had completed what he
Taiwan has experienced its most significant improvement in the QS World University Rankings by Subject, data provided on Sunday by international higher education analyst Quacquarelli Symonds (QS) showed. Compared with last year’s edition of the rankings, which measure academic excellence and influence, Taiwanese universities made great improvements in the H Index metric, which evaluates research productivity and its impact, with a notable 30 percent increase overall, QS said. Taiwanese universities also made notable progress in the Citations per Paper metric, which measures the impact of research, achieving a 13 percent increase. Taiwanese universities gained 10 percent in Academic Reputation, but declined 18 percent
UNDER DISCUSSION: The combatant command would integrate fast attack boat and anti-ship missile groups to defend waters closest to the coastline, a source said The military could establish a new combatant command as early as 2026, which would be tasked with defending Taiwan’s territorial waters 24 nautical miles (44.4km) from the nation’s coastline, a source familiar with the matter said yesterday. The new command, which would fall under the Naval Command Headquarters, would be led by a vice admiral and integrate existing fast attack boat and anti-ship missile groups, along with the Naval Maritime Surveillance and Reconnaissance Command, said the source, who asked to remain anonymous. It could be launched by 2026, but details are being discussed and no final timetable has been announced, the source
CHINA REACTS: The patrol and reconnaissance plane ‘transited the Taiwan Strait in international airspace,’ the 7th Fleet said, while Taipei said it saw nothing unusual The US 7th Fleet yesterday said that a US Navy P-8A Poseidon flew through the Taiwan Strait, a day after US and Chinese defense heads held their first talks since November 2022 in an effort to reduce regional tensions. The patrol and reconnaissance plane “transited the Taiwan Strait in international airspace,” the 7th Fleet said in a news release. “By operating within the Taiwan Strait in accordance with international law, the United States upholds the navigational rights and freedoms of all nations.” In a separate statement, the Ministry of National Defense said that it monitored nearby waters and airspace as the aircraft