Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Risk of unsafe software in automobiles?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 133 posts

Re: Ask HN: Risk of unsafe software in automobiles?

#11

Post by jdminhbg »

weakfortress wrote: post #6

A long time ago I attended a DEFCON where this was discussed. Long before it became a big deal in the industry to have all this tech in cars. CANBUS was broken reliably, and if my memory serves me they even had a car you could take a shot at hacking yourself. After playing with it the entire conference I came to the conclusion I would never own a modern car if I can avoid it. Any car running CANBUS is vulnerable to a…

When it comes to potentially fatal attacks on my car, I'm a lot more worried about drunk drivers than CANBUS.

Re: Ask HN: Risk of unsafe software in automobiles?

#12

Post by kube-system »

weakfortress wrote: post #6

A long time ago I attended a DEFCON where this was discussed. Long before it became a big deal in the industry to have all this tech in cars. CANBUS was broken reliably, and if my memory serves me they even had a car you could take a shot at hacking yourself. After playing with it the entire conference I came to the conclusion I would never own a modern car if I can avoid it. Any car running CANBUS is vulnerable to a…

Pre-CANBUS cars were even easier to exploit. Much of everything on those systems were in plaintext, and could be easily tinkered with. A 25 year old car may have many of the same safety systems (although it is definitely missing a few), but the passive safety systems that do exist are most certainly not to the same standard as today's vehicles. To put it plainly, you are way more likely to die because the safety cage collapses on your late 90's vehicle, than you are to die because someone attacked the CANBUS of your vehicle.

DEFCON has a lot of great security demos, but don't mistake any of those demos as representative of the real-world landscape of issues.

Re: Ask HN: Risk of unsafe software in automobiles?

#13

Post by luciusdomitius »

I don't think it is bugs which worries you, but rather the completely wrong concept of modern day car production. Almost all cars built in the past 20-years have 0 compliance with the laws of physics, being extremely front-heavy and with transversely-mounted engines - disbalanced even on the Y-axis. What keeps them from spinning is the so-called DSC/ESC/ESP which is basically a neural network. We all know how reliable those are. It is in fact a very similar situation to the 737 Max, just on wheels.

Due to regulations you will not be able to find a non-veteran vehicle without those systems, nor you'd want to, but BMW, Mercedes, Subaru and Lexus still have models which are well balanced and don't rely on those to such a heavy degree. This would be my advise as well.

Disclaimer: I am not against (almost) perfectly deterministic safety systems such as ABS. On the contrary - I consider them to be a massive advantage or almost mandatory.

Re: Ask HN: Risk of unsafe software in automobiles?

#14

Post by AlotOfReading »

mcqueenjordan wrote: post #4

ISO 26262 is the functional safety standard that automobile manufacturers adhere to. Furthermore, companies with a strong safety culture may also have other safety controls, including MISRA, AUTOSAR, and others. I think reputable car companies take this stuff very seriously, but your concern is also well placed.

26262 covers system failures that produce unsafety, like broken accelerator sensors. ISO 21448 (SOTIF) covers system failure to detect and respond to the environment appropriately (e.g. does the radar detect small children?), which is also a common concern for people in my experience.

Both are acceptable standards, but ISO 26262 is a behemoth of a standard that most people have never read. Many companies don't even make the full standard available to their development teams, let alone educate people to employ it effectively. Similarly, MISRA is fine in theory, but the practical usage often ends with running code through an automatic checker that can only detect half the rules.

Re: Ask HN: Risk of unsafe software in automobiles?

#16

Post by SoftTalker »

PaulHoule wrote: post #3

I am scared of the infotainment system myself as it could distract you to death. That goes for cell phone and tablet and the stick-on GPS which gets confused in the most complex urban areas, falls into your lap when the suction cup fails, etc.

My big complaint is with the transition of controls from dedicated, tactile knobs, switches, and levers to touch-screen buttons or menus which demand more visual attention (i.e. distraction from driving) to operate.

Re: Ask HN: Risk of unsafe software in automobiles?

#17

Post by notdonspaulding »

izzydata wrote: post #8

All of that firmware that isn't a self driving autopilot blackbox is probably quite safe. Such as anti-lock breaks and fuel injection timing. I am never going to put my life in the hands of some software doing image analysis using machine learning.

> I am never going to put my life in the hands of some software doing image analysis using machine learning.

Well...on your car, at least. I'm not sure how comforting that approach is when you're surrounded on the interstate by Tesla "FSD"s.

Re: Ask HN: Risk of unsafe software in automobiles?

#18

Post by uncletammy »

mcqueenjordan wrote: post #4

ISO 26262 is the functional safety standard that automobile manufacturers adhere to. Furthermore, companies with a strong safety culture may also have other safety controls, including MISRA, AUTOSAR, and others. I think reputable car companies take this stuff very seriously, but your concern is also well placed.

> I think reputable car companies take this stuff very seriously, but your concern is also well placed.

I trusted Volkswagen because of their reputation. Then the news broke about them systematically lying and breaking the law with respect to engine emissions. Shortly after this came to light, other "reputable car companies" turned out to have been not trustworthy at all.

Yes there are good standards in place and some companies claim to adhere to them but no company should be trusted on their word or reputation alone. The better question is what kind of regulatory oversight is in place to make sure those claiming to adhere to certain standards are actually doing so? Also, how much power do the regulatory organizations have in addressing violators?

Re: Ask HN: Risk of unsafe software in automobiles?

#19

Post by vel0city »

jdminhbg wrote: post #11
weakfortress wrote: post #6

A long time ago I attended a DEFCON where this was discussed. Long before it became a big deal in the industry to have all this tech in cars. CANBUS was broken reliably, and if my memory serves me they even had a car you could take a shot at hacking yourself. After playing with it the entire conference I came to the conclusion I would never own a modern car if I can avoid it. Any car running CANBUS is vulnerable to a…

When it comes to potentially fatal attacks on my car, I'm a lot more worried about drunk drivers than CANBUS.

In which case, having a more modern car with better safety designs is way better than not having a CANBUS.

And I definitely agree; I'm way more likely to be harmed because of a drunk driver or someone running a red because they're just too busy to bother stopping at this light today rather than some hacker remoting into my car to change the car from drive to neutral or remotely disable ABS or something like that.

Re: Ask HN: Risk of unsafe software in automobiles?

#20

Post by jimbomins »

uncletammy wrote: post #18
mcqueenjordan wrote: post #4

ISO 26262 is the functional safety standard that automobile manufacturers adhere to. Furthermore, companies with a strong safety culture may also have other safety controls, including MISRA, AUTOSAR, and others. I think reputable car companies take this stuff very seriously, but your concern is also well placed.

> I think reputable car companies take this stuff very seriously, but your concern is also well placed. I trusted Volkswagen because of their reputation. Then the news broke about them systematically lying and breaking the law with respect to engine emissions. Shortly after this came to light, other "reputable car companies" turned out to have been not trustworthy at all. Yes there are good standards in place and som…

Faking those things is a totally different state of affairs to safe operation. I've been out of automotive for 20 years but never met anyone who would compromise normal operational safety. Let's face it most people who work on cars love to drive cars. They would be putting their own and families lives at risk.
Post reply on HN