Chris Valasek

Chris Valasek (born June 2, 1982, in Ford City, Pennsylvania) is an American computer security researcher best known for partnering with fellow researcher Charlie Miller to remotely hack a moving Jeep Cherokee in 2015, a landmark demonstration that reshaped how the automotive industry treats software security. He holds a B.S. in computer science from the University of Pittsburgh and has been involved with the hacker conference SummerCon since the mid-2000s.

Before moving into automotive research, Valasek built a career in traditional Windows exploitation. While working on IBM's ISS X-Force research team, he co-authored, with John McDonald, the Black Hat USA 2009 presentation and paper "Practical Windows XP/2003 Heap Exploitation," which detailed novel techniques for defeating Windows heap-corruption mitigations. He went on to work as a security researcher at Coverity and Accuvant before joining IOActive, where he was named Director of Vehicle Security Research.

Automotive Security Research

Starting around 2013, Valasek and Charlie Miller turned their attention to the electronic systems inside modern cars. At DEF CON 21 in 2013 they presented "Adventures in Automotive Networks and Control Units," showing how a device connected to a car's OBD-II port could send spoofed CAN-bus messages to control braking, steering, and other functions in a Toyota Prius and Ford Escape. At DEF CON 22 in 2014 they followed up with "A Survey of Remote Automotive Attack Surfaces," broadening the analysis to remote (non-physical) attack vectors across many manufacturers.

The 2015 Jeep Cherokee Hack

In July 2015, Valasek and Miller, working with IOActive, demonstrated a fully remote exploit of a 2014 Jeep Cherokee's Uconnect infotainment system over the Sprint cellular network. With Wired journalist Andy Greenberg driving the vehicle on a highway, the pair remotely operated the radio, air conditioning, and windshield wipers before cutting the transmission and, in a follow-up test, disabling the brakes, sending the SUV into a ditch. The disclosure led Fiat Chrysler Automobiles to recall approximately 1.4 million vehicles in the United States on July 24, 2015 to patch the flaw. Valasek and Miller presented the full technical details, "Remote Exploitation of an Unaltered Passenger Vehicle," at Black Hat USA and DEF CON 23 in August 2015.

Later Career

Following the Jeep research, Uber hired Valasek and Miller to work on security for its self-driving car program at the Uber Advanced Technologies Center, with Valasek serving as security lead. In mid-2017 the pair reunited at General Motors' autonomous-vehicle subsidiary, Cruise Automation, where they became joint heads of the vehicle security team.

Legacy

The Jeep Cherokee hack is widely regarded as one of the most consequential public demonstrations in the history of vehicle cybersecurity: it moved automotive security from a niche academic concern to a boardroom and regulatory issue, and prompted a major manufacturer recall over a cybersecurity flaw for the first time.

Timeline

• 1982-06-02Born in Ford City, Pennsylvania.
• 2009Co-authored (with John McDonald, at IBM ISS X-Force) the Black Hat USA paper 'Practical Windows XP/2003 Heap Exploitation.'
• 2013-08-02Presented 'Adventures in Automotive Networks and Control Units' with Charlie Miller at DEF CON 21.
• 2014-08Presented 'A Survey of Remote Automotive Attack Surfaces' with Charlie Miller at DEF CON 22, as Director of Vehicle Security Research at IOActive.
• 2015-07-21Wired published Andy Greenberg's account of Valasek and Miller remotely hacking his Jeep Cherokee while he drove on a highway.
• 2015-07-24Fiat Chrysler Automobiles recalled approximately 1.4 million vehicles in the U.S. to patch the Uconnect vulnerability.
• 2015-08Valasek and Miller presented 'Remote Exploitation of an Unaltered Passenger Vehicle' at Black Hat USA and DEF CON 23.
• 2017-07Valasek and Miller joined General Motors' Cruise Automation as joint heads of its vehicle security team.