Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#61

Post by talmand » Tue, Jul 21, 2015, 2:25 PM UTC

geofft wrote: post #46

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

You called the cops on two security researchers and a journalist, because you disagreed with their methods and weren't sure what their plans were and what authorities they'd talked to? (And not just any cops, the cops in St. Louis, for bonus points.) Are we still on Hacker News, or is the transformation to Enablers of Traditional American Power Structure News complete?

Are you not supposed to report dangerous, and possibly criminal, situations to the authorities? A witness to such events cannot know if it has already been reported or is known about, are they supposed to just go on with their day? Yep, just drive by that car accident with possible injuries without calling it in because I'm sure someone else has already taken care of it. What's the worse that could happen? The authorities tell you they are already aware of the situation, thank you? Are we now people who should no longer care what's going on around us or are we careless souls more worried about ourselves to not care over fellow human beings?

Re: Hackers Remotely Attack a Jeep on the Highway

#62

Post by shkkmo » Tue, Jul 21, 2015, 2:28 PM UTC

genericuser wrote: post #47

dsfyu404ed wrote: post #35

Earlier quoted context omitted.

You're not gonna make the news unless the media can spin up a headline that scares people People won't pay attention until they're scared People won't demand action if they're not paying attention Nothing will happened if people don't demand action. If nothing happens the status quo (vulnerable systems) will remain. Until some bad actor (I'm sure several nations states would love that capability) gets into onStar and…

I agree they may not make news if they did this in a safe manner. However, the goal of people researching security, shouldn't be to make news. And these people while admittedly working with Chrysler to see it fixed, seem to be forgetting that. Especially since they plan to release their code, despite the fact that Chrysler has to get people to manually update their cars. "The two researchers say that even if their co…

They could have made still made the news if they had taken a few extra precautions to reduce the risk of an accident.

However, they do need to make the news. Them making the news makers it easier and more likely that politicians will prioritize the political capital of working to solve this over the lobbyist from the automotive industry.

If Chrysler and other car manufacturers were taking this sufficiently seriously the releases might not be necessary. They gave Chrysler plenty of warning, Chrysler could have issued a recall (and still can), the consequences are on Chrysler, not on the security researchers.

Re: Hackers Remotely Attack a Jeep on the Highway

#63

Post by [deleted] » Tue, Jul 21, 2015, 2:29 PM UTC

bennyg wrote: post #40

maxerickson wrote: post #6

Earlier quoted context omitted.

Are you pointing to the stellar security record of the software industry here?

Exactly. I'd like to see the perfect security implementations over large scale systems that exist in the software industry today.

[deleted]

Re: Hackers Remotely Attack a Jeep on the Highway

#64

Post by shkkmo » Tue, Jul 21, 2015, 2:31 PM UTC

hoopism wrote: post #30

Wow. Just because you are savvy enough to do the research does not make you a researcher. These two really need to rethink the way they are "testing" this and perhaps educate themselves on ethics in research. Their judgement collectively was worse than a pack of 5th graders with high grade fireworks.

They could certainly have done a much better job of demoing this safely.

On the other hand, I'd rather that they be doing this work with the way they did it than not at all...

Re: Hackers Remotely Attack a Jeep on the Highway

#65

Post by jblow » Tue, Jul 21, 2015, 2:32 PM UTC

hoopism wrote: post #30

Wow. Just because you are savvy enough to do the research does not make you a researcher. These two really need to rethink the way they are "testing" this and perhaps educate themselves on ethics in research. Their judgement collectively was worse than a pack of 5th graders with high grade fireworks.

I don't think you understand. Anyone in the world can do this. Right now. Any time.

Re: Hackers Remotely Attack a Jeep on the Highway

#66

Post by Lawtonfogle » Tue, Jul 21, 2015, 2:33 PM UTC

lmm wrote: post #13

adamgravitis wrote: post #4

So, it's becoming abundantly clear that vehicle companies (autos, jets...) have approximately zero knowledge how to hire software engineers. Presumably they're somewhat more successful hiring mechanical engineers because that's always been their "thing". It's all well and good for us to chuckle at the terrifying software/systems decisions being made by these teams, but how do we address the root of the problem? It's…

People, and businesses, respond to incentives. The company probably did the economically rational thing here - the money they make from their remote-access features is more than the money they will lose for the insecurity. Companies in industries that need to find ways to make secure software; it's not a hard problem if you're willing to throw enough money at it. But as long as customers don't care whether their prod…

People do care if it makes the news. But the current official ways of doing the testing doesn't make the news and testing that is news worth gets the cops called on you. How convenient that testing a security flaw is viewed as more negligent than allowing them in the first place as a cost saving measure.

Re: Hackers Remotely Attack a Jeep on the Highway

#67

Post by calgoo » Tue, Jul 21, 2015, 2:35 PM UTC

talmand wrote: post #61

geofft wrote: post #46

Earlier quoted context omitted.

You called the cops on two security researchers and a journalist, because you disagreed with their methods and weren't sure what their plans were and what authorities they'd talked to? (And not just any cops, the cops in St. Louis, for bonus points.) Are we still on Hacker News, or is the transformation to Enablers of Traditional American Power Structure News complete?

Are you not supposed to report dangerous, and possibly criminal, situations to the authorities? A witness to such events cannot know if it has already been reported or is known about, are they supposed to just go on with their day? Yep, just drive by that car accident with possible injuries without calling it in because I'm sure someone else has already taken care of it. What's the worse that could happen? The author…

Sorry, but the cops lost that trust from me when the started sending swat teams and abusing power way to much. Since then, to me calling the cops has become a last resort. I dont trust ANY of them because of the few aholes that are abusing their power. Mainly caused because of their policies of shutting up and protecting each others. Until they fix this, i will not trust ANY cop again.

Re: Hackers Remotely Attack a Jeep on the Highway

#68

Post by jblow » Tue, Jul 21, 2015, 2:37 PM UTC

Given that cars get recalled all the time for "this one part is kind of flimsy and might break 3% of the time", I am not sure why "some guy in China can drive your car off a cliff" is not grounds for an immediate and full recall.

If you talk to auto manufacturers in a way that they understand, they will understand.

Re: Hackers Remotely Attack a Jeep on the Highway

#69

Post by mojoB » Tue, Jul 21, 2015, 2:40 PM UTC

a3n wrote: post #11

I think a basic idea should be: panic stops disconnect all wireless access. Which will probably result in lots of calls from people after they avoid hitting a dog. But still.

Isn't the car calling their service center / 911 one of the major selling points of the service?

The root problem is that they were able to flash an ECU with custom code. From there they are 'trusted' on the vehicle network and can trigger or emulate any other component.

Requiring the firmware image to be signed, or not accepting a bootload from the physical interface that's connected to the internet would be a more comprehensive solution.

Re: Hackers Remotely Attack a Jeep on the Highway

#70

Post by jamespo » Tue, Jul 21, 2015, 2:42 PM UTC

calgoo wrote: post #67

talmand wrote: post #61

Earlier quoted context omitted.

Are you not supposed to report dangerous, and possibly criminal, situations to the authorities? A witness to such events cannot know if it has already been reported or is known about, are they supposed to just go on with their day? Yep, just drive by that car accident with possible injuries without calling it in because I'm sure someone else has already taken care of it. What's the worse that could happen? The author…

Sorry, but the cops lost that trust from me when the started sending swat teams and abusing power way to much. Since then, to me calling the cops has become a last resort. I dont trust ANY of them because of the few a holes that are abusing their power. Mainly caused because of their policies of shutting up and protecting each others. Until they fix this, i will not trust ANY cop again.

Until you're a victim of a crime I presume