Preventing Car Hacking

AUBURN HILLS, Mich. (PR) - FCA US LLC is conducting a voluntary safety recall to update software in approximately 1,400,000 U.S. vehicles equipped with certain radios. The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action.

Further, FCA US has applied network-level security measures to prevent the type of remote manipulation demonstrated in a recent media report. These measures – which required no customer or dealer actions – block remote access to certain vehicle systems and were fully tested and implemented within the cellular network on July 23, 2015.

The Company is unaware of any injuries related to software exploitation, nor is it aware of any related complaints, warranty claims or accidents – independent of the media demonstration.

Affected are certain vehicles equipped with 8.4-inch touchscreens among the following populations:

2013-2015 MY Dodge Viper specialty vehicles

2013-2015 Ram 1500, 2500 and 3500 pickups

2013-2015 Ram 3500, 4500, 5500 Chassis Cabs

2014-2015 Jeep Grand Cherokee and Cherokee SUVs

2014-2015 Dodge Durango SUVs

2015 MY Chrysler 200, Chrysler 300 and Dodge Charger sedans

2015 Dodge Challenger sports coupes

Customers affected by the recall will receive a USB device that they may use to upgrade vehicle software, which provides additional security features independent of the network-level measures. 

Alternately, customers may visit www.driveuconnect.com/software-update to input their Vehicle Identification Numbers (VINs) and determine if their vehicles are included in the recall.

The security of FCA US customers is a top priority, as is retaining their confidence in the Company’s products. Accordingly, FCA US has established a dedicated System Quality Engineering team focused on identifying and implementing best practices for software development and integration.

The software manipulation addressed by this recall required unique and extensive technical knowledge, prolonged physical access to a subject vehicle and extended periods of time to write code.

No defect has been found. FCA US is conducting this campaign out of an abundance of caution.

Customers are urged to acquire the software update. Those with questions or concerns may call the Vehicle Care at 1-877-855-8400.

Vulnerabilities

We read about “hacks” every day. All industries are potential targets of a hacker and the automotive industry has been no exception.

Well-known hackers Charlie Miller and Chris Valasek recently teamed-up with a WIRED reporter to publish a story that you may have read about or seen on the news. The story highlights how Miller and Valasek hacked into Miller’s 2014 Jeep® Cherokee and remotely controlled some functions. Miller and Valasek have been working on intentionally hacking into Miller’s vehicle over the past year as part of their on-going research in the area of automotive cybersecurity and have communicated with FCA about some aspects of their work.

To FCA’s knowledge, there has not been a single real world incident of an unlawful or unauthorized remote hack into any FCA vehicle.

After becoming aware of the vulnerabilities in some 2013 and 2014 vehicles equipped with the 8.4 inch touchscreen systems, FCA US and several suppliers worked to fix the vulnerabilities in model year 2015 vehicles. FCA also created a software update that eliminates the vulnerabilities uncovered by Miller and Valasek in their laboratory tests. This software update is available to customers right now and can be downloaded to a USB drive from http://www.driveuconnect.com/software-update/ and installed in a vehicle.

FCA will be contacting potentially affected customers with these details and has provided the software update to the FCA US dealer network for immediate customer installation.

Customers can enter a vehicle identification number (VIN) and find out if their vehicle needs the software update. If your vehicle needs the update, you can download the software update to a USB drive and install it yourself. Another option is to make an appointment with your FCA US dealership and have them install it for you at no charge. The update, if installed DIY, will take 30-45 minutes, and your vehicle needs to be parked throughout the software update/installation process.

In addition, FCA US has been working with its suppliers to implement additional protocols to block remote access. These changes will not require any action by our customers.