Ford "Quietly" Provides Sync 3 Security Vulnerability Warning

[Alaska Wolf]

Found this today entirely by accident. "Ford learned from a supplier that a security researcher discovered a vulnerability in the Wi-Fi software driver supplied for use in the SYNC 3 infotainment system available on some Ford and Lincoln vehicles. Immediately, and in collaboration with them, we began developing and validating measures to address the vulnerability."

No idea how far back this goes, but I'm guessing that ALL Sync 3 vehicles including vehicles still on 3.0 are vulnerable.  While they say it would not affect the safety of vehicle occupants, since the infotainment system is firewalled from controls like steering, throttling and braking, there obviously seems to be a reason for concern as they want us to turn off WiFi functionality.

https://media.ford.com/content/ford...uidance-in-response-to-supplier-disclosu.html

Sponsored

 

[Phantomfixer]

Found this today entirely by accident. "Ford learned from a supplier that a security researcher discovered a vulnerability in the Wi-Fi software driver supplied for use in the SYNC 3 infotainment system available on some Ford and Lincoln vehicles. Immediately, and in collaboration with them, we began developing and validating measures to address the vulnerability."

No idea how far back this goes, but I'm guessing that ALL Sync 3 vehicles including vehicles still on 3.0 are vulnerable.  While they say it would not affect the safety of vehicle occupants, since the infotainment system is firewalled from controls like steering, throttling and braking, there obviously seems to be a reason for concern as they want us to turn off WiFi functionality.

https://media.ford.com/content/ford...uidance-in-response-to-supplier-disclosu.html

I did a little time (thankfully) with SAC...416th FMS Griffiss AFB

 

[Alaska Wolf]

I did a little time (thankfully) with SAC...416th FMS Griffiss AFB

410th BW and 17th RW myself. Today's AF could take a lesson or 12.

 

[Phantomfixer]

410th BW and 17th RW myself. Today's AF could take a lesson or 12.

Thx for your service to our country…

 

[Junior Blue]

Found this today entirely by accident. "Ford learned from a supplier that a security researcher discovered a vulnerability in the Wi-Fi software driver supplied for use in the SYNC 3 infotainment system available on some Ford and Lincoln vehicles. Immediately, and in collaboration with them, we began developing and validating measures to address the vulnerability."

No idea how far back this goes, but I'm guessing that ALL Sync 3 vehicles including vehicles still on 3.0 are vulnerable.  While they say it would not affect the safety of vehicle occupants, since the infotainment system is firewalled from controls like steering, throttling and braking, there obviously seems to be a reason for concern as they want us to turn off WiFi functionality.

https://media.ford.com/content/ford...uidance-in-response-to-supplier-disclosu.html

50th Security Police Sq. Hahn Air Base, Germany 11-67 to 12-71

 

[TJC]

I did a little time (thankfully) with SAC...416th FMS Griffiss AFB

I spent 3 years at SAC HQ 8th Air Force in the War Room. Barksdale AFB.

The first 3 years spent at NORAD CMC in Colorado Springs.

A l o n g time ago!

The Buffs are still flying, but the number has sure been whittled down. I think only 72 are operational from the 744 built.

I remember the G's & H's being on SAC 24/7 nuclear standby at Barksdale, and I remember as a 5 year old living at Homestead AFB in the early 1960's seeing the Buffs stationed there landing and taking off. Dad was career AF, and spent most of his CONUS time at Homestead.

I vividly remember the October 1962 Cuban Missile Crisis while living there. The place was armed to the teeth. You name it and it was down there. The trains were running hard each night bringing in tanks, troops, and missile batteries. Machine gun placements and anti aircraft batteries were on the beaches.

Yep, ancient memories...

 

[Bob902]

Damn. I'm just a SAC pup. Whiteman AFB. 87-91. 351 Missile Security Squadron. Raider Flight.

 

[Friday yet?]

Found this today entirely by accident. "Ford learned from a supplier that a security researcher discovered a vulnerability in the Wi-Fi software driver supplied for use in the SYNC 3 infotainment system available on some Ford and Lincoln vehicles. Immediately, and in collaboration with them, we began developing and validating measures to address the vulnerability."

No idea how far back this goes, but I'm guessing that ALL Sync 3 vehicles including vehicles still on 3.0 are vulnerable.  While they say it would not affect the safety of vehicle occupants, since the infotainment system is firewalled from controls like steering, throttling and braking, there obviously seems to be a reason for concern as they want us to turn off WiFi functionality.

https://media.ford.com/content/ford...uidance-in-response-to-supplier-disclosu.html

Could be completely wrong, but I think the WiFi was a "no choice, we're deleting it" on the '23's. Think it was $20 build credit.

Gotta check on this.

Thanks for posting it.

Edit: Yep. Just checked my window sticker. WiFi Hotspot was a $20 credit due to delete.

 

[RedlandRanger]

Could be completely wrong, but I think the WiFi was a "no choice, we're deleting it" on the '23's. Think it was $20 build credit.

Gotta check on this.

Thanks for posting it.

Edit: Yep. Just checked my window sticker. WiFi Hotspot was a $20 credit due to delete.

Although it isn't completely clear in the link, I believe this is not for the wifi hotspot, but for wifi connectivity to the vehicle. You can connect your truck to your home wifi to do things like download updates, etc. I think it is referring to this setting (but I could be completely wrong too):

 

[Friday yet?]

Although it isn't completely clear in the link, I believe this is not for the wifi hotspot, but for wifi connectivity to the vehicle. You can connect your truck to your home wifi to do things like download updates, etc. I think it is referring to this setting (but I could be completely wrong too):

Good point. Thx. I'll have to check that out.

 

[Alaska Wolf]

The Buffs are still flying, but the number has sure been whittled down. I think only 72 are operational from the 744 built.

76 are still flying, all the remaining H models. And the youngest one shares the exact same birthday as me. And they're planning on flying them until they're 100, pretty amazing aircraft.

 

[Alaska Wolf]

Although it isn't completely clear in the link, I believe this is not for the wifi hotspot, but for wifi connectivity to the vehicle. You can connect your truck to your home wifi to do things like download updates, etc. I think it is referring to this setting (but I could be completely wrong too):

You are correct, its the actual connection to your home router wireless; the hotspot was for connecting to AT&T cell towers and required a separate subscription. Also, Ford mentions in the vulnerability announcement "customers who are concerned about the vulnerability can simply turn off the Wi-Fi functionality through the SYNC 3 infotainment system’s Settings menu."

Ford says "Soon, Ford will issue a software patch online for download and installation via USB." Only question I have, is when is Soon. When Ford pulled the flawed Sync 3 3.4.2251 update, they were going to fix that "soon" as well.

 

[Dgc333]

Well 3.4.23088 has been out for awhile and 3.4.23188 was released in the past couple or three weeks.

I was running 3.4.22251 for a few months without issue then I got a new phone. The new phone would connect with no issues but randomly would not make a call and I would get an error message from Sync. Restarting Sync would fix it until the next time. I updated to 3.4.23088 over a month ago and have not had that issue since.

Haven't seen enough written on Cyan Labs about 3.4.23188 to consider it yet.

 

[Alaska Wolf]

Well 3.4.23088 has been out for awhile and 3.4.23188 was released in the past couple or three weeks.

Actually, Sync 3.4.21194 is the ONLY current official Ford stable version; believe me I've been going through this with Ford for months now. They did release 3.4.22251 in January, but then figured out that it was not ready for Prime Time and was causing serious problems for some vehicles so they yanked it back off line. A new "official" Ford sanctioned stable version has not been released yet, although Ford's IVT (In Vehicle Technology) team keeps telling me "soon". The Cyan Labs 3.4.23088 and 3.4.23188 versions are NOT official Ford releases, are not supported by Ford, and are only Engineering versions attempting to fix the problems introduced in the aborted 3.4.22251. Ford does not consider either to be a stable release or bug free.

 

[Dgc333]

Actually, Sync 3.4.21194 is the ONLY current official Ford stable version; believe me I've been going through this with Ford for months now. They did release 3.4.22251 in January, but then figured out that it was not ready for Prime Time and was causing serious problems for some vehicles so they yanked it back off line. A new "official" Ford sanctioned stable version has not been released yet, although Ford's IVT (In Vehicle Technology) team keeps telling me "soon". The Cyan Labs 3.4.23088 and 3.4.23188 versions are NOT official Ford releases, are not supported by Ford, and are only Engineering versions attempting to fix the problems introduced in the aborted 3.4.22251. Ford does not consider either to be a stable release or bug free.

Regardless, 3.4.23088 fixed an issue I had been having with my new phone randomly not being able to make calls. AND, when I go to the Sync Update site it states I am up to date and lists my version as 3.4.23088.

Sponsored