Digital plates, which are now legal to purchase in a growing number of states and to drive nationwide, offer some advantages over their sheet metal predecessors. You can change your display on the fly to frame your license plate number with novel messages, for example, or to indicate that your car has been stolen. Now, a security researcher has shown how they can also be hacked to enable a less benign feature: changing a car’s license plate number at will to avoid traffic fines and tolls, or even attributing them to someone else.
Josep Rodríguez, a researcher at the security firm IOActive, has revealed a technique to jailbreak digital license plates sold by Reviver, the main supplier of such license plates in the United States. By removing a sticker on the back of the board and connecting a cable to its internal connectors, you can rewrite the firmware of a Reviver board in a matter of minutes. Then, with that custom firmware installed, the unlocked license plate can receive commands via Bluetooth from a smartphone app to instantly change its screen to display any character or image.
That susceptibility to jailbreak, Rodríguez notes, could allow drivers with plates to evade any system that relies on license plate numbers for enforcement or surveillance, from tolls to speeding and parking tickets to automatic license plate readers that Police use it to track crime suspects. “You can put whatever you want on the screen, something that users shouldn’t be able to do,” says Rodríguez. “Imagine if you are going under radar or if you are a criminal and you don’t want to get caught.”
Worse yet, Rodríguez points out that a jailbroken license plate can be changed not only to an arbitrary number but also to the number of another vehicle, whose driver would receive fines and toll bills from the malicious user. “If you can change the license plate number whenever you want, you can cause some real problems,” Rodriguez says.
All traffic-related shenanigans aside, Rodriguez also points out that jailbreaking the plates could also allow drivers to use the plates’ features, including built-in GPS tracking, without paying the $1 monthly subscription fee. 29.99 from Reviver.
Because the vulnerability that allowed him to rewrite the boards’ firmware exists at the hardware level (in Reviver’s own chips), Rodriguez says Reviver has no way to fix the problem with a simple software update. Instead, you would have to replace those chips in each screen. That means it’s highly likely that the company’s plates will remain vulnerable despite Rodriguez’s warning, a fact, Rodriguez says, that transportation policy makers and authorities should keep in mind as digital plates They spread throughout the country. “It’s a big problem because there are now thousands of license plates with this problem and it would be necessary to change the hardware to solve it,” he says.