The article says that Kamkar intercepts the connection from a user's phone. Wouldn't that either imply this only works for phones on weak 2/3g connections or that the hack is much more impressive in that 4g/lte connections can be intercepted?
- Raspberry Pi
- RTL8187L USB 2.0 WiFi module
- Adafruit FONA mini GSM/GPRS module[0]. Not LTE capable.
It does imply this was in some part a TLS fail. Either none or failing to verify trust..
To clarify, the OnStar system in your vehicle talks to a data center at GM or wherever. When you use the app, it talks to that data center, and if you have an authenticated, actived session, the data center intermediates commands from the app to the vehicle.
This looks and smells like an entirely standard MITM type attack. He runs a rogue WAP, or listens in on low encryption APs, and when someone uses the app it exploits some weakness in the SSL/TLS process of the app (maybe DNS poisoning coupled with an app that doesn't demand a root signed cert from the peer). That can be fixed immediately and really is remarkably limited in utility and threat.