Automakers try to scuttle Massachusetts ‘right to repair’ law
1–10 of 137 posts
Re: Automakers try to scuttle Massachusetts ‘right to repair’ law
#2BS? I thought at least one Federal agency suggested that compliance is in fact a Federal crime.
Re: Automakers try to scuttle Massachusetts ‘right to repair’ law
#3BS? I thought at least one Federal agency suggested that compliance is in fact a Federal crime.
I was not aware of this. Citation: https://www.thedrive.com/news/feds-tell-automakers-to-ignore...
Re: Automakers try to scuttle Massachusetts ‘right to repair’ law
#4Current cybersecurity standards enforced in the automotive industry will probably completely kill the possibility of after-market car parts and the usage of used parts in cars.
I say this as someone working in this field that has asked a couple of people doing work in this exact direction. I point blank asked them if this will happen, and they just shrugged their shoulders and said... yeah, kinda'.
Re: Automakers try to scuttle Massachusetts ‘right to repair’ law
#5Current cybersecurity standards enforced in the automotive industry will probably completely kill the possibility of after-market car parts and the usage of used parts in cars. I say this as someone working in this field that has asked a couple of people doing work in this exact direction. I point blank asked them if this will happen, and they just shrugged their shoulders and said... yeah, kinda'.
From the article: "federal regulators claim that malevolent third parties could "utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently."
Which really means auto makers built a terribly insecure system and hope to hide the fact behind security as obscurity? If so, that's the real problem. The vulnerabilities described should not be there in the first place.
Re: Automakers try to scuttle Massachusetts ‘right to repair’ law
#6Here's a hot take: legislate an airgap between operation control and infotainment/convenience horseshit.
Re: Automakers try to scuttle Massachusetts ‘right to repair’ law
#7Here's a hot take: legislate an airgap between operation control and infotainment/convenience horseshit.
Exactly. The infotainment bullshit should be in zero way connected to the actual operation of the vehicle. There is zero reason why the laggy, nonsensical software that controls my radio should control my engine. Someone correct me if I am wrong, please.
Re: Automakers try to scuttle Massachusetts ‘right to repair’ law
#8Current cybersecurity standards enforced in the automotive industry will probably completely kill the possibility of after-market car parts and the usage of used parts in cars. I say this as someone working in this field that has asked a couple of people doing work in this exact direction. I point blank asked them if this will happen, and they just shrugged their shoulders and said... yeah, kinda'.
From the article: "federal regulators claim that malevolent third parties could "utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently." Which really means auto makers built a terribly insecure system and hope to hide the fact behind security as obscurity? If so, that's the real problem. The vulnerabilities described should not be there in the…
It's an open secret in the industry that the CAN bus is not authenticated. If you connect, you can read the data on the bus and inject the data on bus.
But, that does require physical access to the car and hooking to the wires. Nobody complains that if you hook to the buses on a PC you can own it.
Now they have this security concept where every ECU on the car will have their own private key in their own secure enclave. You need that key to put authenticated data on bus and it can only be updated by the OEM's.
The authenticated bus infra will probably not protect against remote attacks ( since if you own the ECU SW you have the cert and you will still be able to publish signed messages) but will kill ability to change HW.
I really would not like to kill our ability to fix our vehicles but I feel this is the thing that is going to happen.
Re: Automakers try to scuttle Massachusetts ‘right to repair’ law
#9Current cybersecurity standards enforced in the automotive industry will probably completely kill the possibility of after-market car parts and the usage of used parts in cars. I say this as someone working in this field that has asked a couple of people doing work in this exact direction. I point blank asked them if this will happen, and they just shrugged their shoulders and said... yeah, kinda'.
I also work in the industry and tend to agree. Right now if you get an official replacement ECU on a secured CAN network the device comes from the OEM already set up with the matching SecOC (AES-128) key that the OEM recorded in their backend database at time of manufacturing.
But how would this work with a 3rd party ECU?
Re: Automakers try to scuttle Massachusetts ‘right to repair’ law
#10Current cybersecurity standards enforced in the automotive industry will probably completely kill the possibility of after-market car parts and the usage of used parts in cars. I say this as someone working in this field that has asked a couple of people doing work in this exact direction. I point blank asked them if this will happen, and they just shrugged their shoulders and said... yeah, kinda'.
From the article: "federal regulators claim that malevolent third parties could "utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently." Which really means auto makers built a terribly insecure system and hope to hide the fact behind security as obscurity? If so, that's the real problem. The vulnerabilities described should not be there in the…
It's not about security by obscurity. A better analogy would be the fight over "tivoization". In safety-critical and highly-regulated systems like automotive and health care, there's a meaningful regulatory interest in ensuring that the devices as sold and authorized to be on the road (or in patients' hospital rooms) don't get modified in dangerous ways. That means that the software and firmware running on each of the dozens of ECUs in a vehicle is part of the (regulated) functional safety spec of the system. There are real, meaningful technical challenges to overcome if you want to meet both the goal of ensuring that dangerous and malicious software can't run in safety-critical domains, and the goal of allowing users to modify their vehicles as they see fit.
I'm speaking as one of the authors of the Uptane standard for secure software updates in vehicles, and as a life-long proponent of user freedom and open access to the computers we buy. There are possible solutions here, but they are not easy.