Inside the Government Lab Hacking Into Cars

Picture this: You’re driving along a stretch of road, and an unseen force takes over. The car picks up speed, then swerves—without your touching the accelerator or turning the wheel. You’re no more than a helpless passenger. What just happened? Your car has been hacked.

It’s a frightening scenario. But how real is this threat? Real enough that car manufacturers and security experts from the federal government are taking it seriously.

“Any cyber expert will tell you that you can’t prevent it; it’s just a question of when,” says Mark Dowd, assistant general counsel for Global Automakers, a coalition of car manufacturers working to combat the looming threat of cyber attacks.

Part of the heightened concern about the risk of a car being hacked comes from the increased use of computerization and electronic features in new cars. Systems such as self-parking capability, steer-by-wire, and automatic cruise control give vehicles the ability to partly drive themselves—and that theoretically increases the risk of vital controls being hacked. (Read “Can Your Car Be Hacked?”)

As of now, a hack is difficult to pull off. But if carmakers standardize their software and firewalls, and become more uniform, it could attract the attention of hackers.

However, if software engineers with the automakers and the National Highway Traffic Safety Administration (NHTSA) have anything to say about it, these attacks will never happen. It’s their task to stay a step ahead of anyone who might seek to hack a car or groups of cars—whether it’s terrorists, tech-pranksters, or someone seeking personal revenge.

At a lab on the grounds of the sprawling Transportation Research Center in East Liberty, Ohio, a team of NHTSA engineers spends their days hacking into vehicles. Consumer Reports was recently invited for an exclusive, behind-the-scenes demonstration to find out what the agency is doing to keep cars safe from a cyber attack. (Watch our video, above.)

NHTSA Electronics Project Engineer Frank Barickman and his team showed us what kinds of hacks are possible—and which are not—using two test vehicles, a Ford Fusion and a Toyota Prius. The cars were chosen simply because they are commonplace, not because they have any particular vulnerability. The project team has uncovered ways to manipulate the ventilation fans, windows, lights, horns, door locks, seat-belt tension systems, instrument panels, brakes, steering, and engines—all while the cars are in motion.