Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Remotely Attack a Jeep on the Highway

wired.com

Post reply on HN
Print view View original

141–150 of 640 posts

Re: Hackers Remotely Attack a Jeep on the Highway

#141

Post by slantyyz »

timtadh wrote: post #89
genericuser wrote: post #47

Earlier quoted context omitted.

I agree they may not make news if they did this in a safe manner. However, the goal of people researching security, shouldn't be to make news. And these people while admittedly working with Chrysler to see it fixed, seem to be forgetting that. Especially since they plan to release their code, despite the fact that Chrysler has to get people to manually update their cars. "The two researchers say that even if their co…

I saw a presentation at a departmental colloquium 3 years ago which demonstrated similar capabilities. The point is, car companies are not responding well to this threat even though it is well known to them . In such situations it is in the public's best interest that information about the vulnerabilities be widely disseminated in order to keep the general public safe. Those with know how can already exploit these fl…

>> The point is, car companies are not responding well to this threat even though it is well known to them.

I think the problem is related to core competencies (sorry to throw in the MBA speak).

The old-school car companies are good at making cars, and not secure computer systems.

You can likely say the same about the skill sets of the decision-makers running these companies. Many of them just can't wrap their head around security implications, because they don't fully understand them.

Re: Hackers Remotely Attack a Jeep on the Highway

#142

Post by danielweber »

SG- wrote: post #96
Someone1234 wrote: post #81

Earlier quoted context omitted.

> Was it life threatening? Hardly. Uhh what? It seems you cannot go a week without reading about a pile-up on a freeway. Just last week a big-rig lost a wheel, it rolled into the on-coming lane, and drivers swerving and braking to avoid it actually caused a pile up. Stopping even on the shoulder on a freeway is considered "risky" by most police officers and many (like triple digits) have been killed while stopped in…

ya well all they did was stall the engine, they didn't tell the car to apply the brakes.

With what certainty did they know that was going to happen?

Re: Hackers Remotely Attack a Jeep on the Highway

#143

Post by joncfoo7 »

Did anyone bother to read the full article? If so, you would find out that it was a [somewhat] controlled experiment.

> To better simulate the experience of driving a vehicle while it’s being hijacked by an invisible, virtual force, Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch from Miller’s laptop in his house 10 miles west.

> Instead, they merely assured me that they wouldn’t do anything life-threatening.

> Then they told me to drive the Jeep onto the highway. “Remember, Andy,” Miller had said through my iPhone’s speaker just before I pulled onto the Interstate 64 on-ramp, “no matter what happens, don’t panic.”

Re: Hackers Remotely Attack a Jeep on the Highway

#144

Post by shkkmo »

hoopism wrote: post #84
shkkmo wrote: post #64

Earlier quoted context omitted.

They could certainly have done a much better job of demoing this safely. On the other hand, I'd rather that they be doing this work with the way they did it than not at all...

"On the other hand, I'd rather that they be doing this work with the way they did it than not at all..." That's such a stupid tradeoff. Putting it as an either/or is silly. Doing this safely and demonstrating the alarming conclusion are not mutually exclusive. I'd go as far as to say that the way they demonstrated this actually diminishes the message of the danger of this exploit and put's the focus on their stupidit…

> I'd go as far as to say that the way they demonstrated this actually diminishes the message of the danger of this exploit and put's the focus on their stupidity.

Doing it the way they did clearly increases the impact of their message. To believe otherwise belies ignorance of the way information gets spread in our culture. The question is only if the increased impact was properly balanced against the increased risk.

Re: Hackers Remotely Attack a Jeep on the Highway

#145

Post by danielweber »

TorKlingberg wrote: post #117
tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

This is the kind of completely uninteresting side discussion that people on internet forums love to get into. "Somebody did something dangerous on a road" is not a relevant topic on HN.

This is behavior that makes adults think that people calling themselves "security researchers" are bonkers and need to be legislatively controlled.

Mature research labs have review boards to govern "researchers" who want to just see what happens when LSD is put in the water supply.

Re: Hackers Remotely Attack a Jeep on the Highway

#146

Post by Lawtonfogle »

stevendhansen wrote: post #95
tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

>Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior.

There is even a bigger problem. These researchers, even if they were negligent, are far more at risk of legal punishment for creating a small risk for the sake of increasing safety standards overall than the people who choose to cut security funding and put magnitudes more people at risk for the sake of making more money.

Isn't it odd that we have a legal system where the ones attempt to expose and fix the problem for the sake of safety are facing far greater legal trouble than those who knowingly allowed for the problem to first occur due to increasing profits?

Re: Hackers Remotely Attack a Jeep on the Highway

#147

Post by danielweber »

aardshark wrote: post #104
tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

It's not that your points are irrelevant, it's that they needlessly draw attention from the issue at hand: that the car manufacturers are being criminally negligent.

There is more than one party here who is displaying extreme neglect.

Re: Hackers Remotely Attack a Jeep on the Highway

#148

Post by Someone1234 »

Miner49er wrote: post #126
Someone1234 wrote: post #81

Earlier quoted context omitted.

> Was it life threatening? Hardly. Uhh what? It seems you cannot go a week without reading about a pile-up on a freeway. Just last week a big-rig lost a wheel, it rolled into the on-coming lane, and drivers swerving and braking to avoid it actually caused a pile up. Stopping even on the shoulder on a freeway is considered "risky" by most police officers and many (like triple digits) have been killed while stopped in…

They decelerated a car. The brakes weren't even applied. This happens all the time on highways. It is unfortunate that it happened where there was no shoulder on the road, but if an accident did happen then I'm not so sure the researchers or journalist would be at fault. Here's a scenario: Let's say a person is driving a car, when their car engine fails. There's no shoulder for them to drive onto, so they are just sl…

> but if an accident did happen then I'm not so sure the researchers or journalist would be at fault.

So the people that purposely tried to cause the accident wouldn't be at fault for the accident if it occurred..?

I find it highly amusing that in your scenario you're using an unpredictable failure as an equal for an intentional act.

A better scenario would be:

I open your car bonnet while you go to the bathroom. I half-cut some cables knowing that they will fail when you knock them a few more times. You come out, get in your car, and drive down the freeway. A few miles later your car stops suddenly in the fast lane, and a big rig crashes into you while you sit there stopped going 70 MpH and you die. According to you I am not, at all, responsible for your death.

Or better yet still:

You just stop on the freeway just for fun/see what would happen. Someone drives into the back of you at 70 MpH and THEY die. According to you, you aren't at all responsible for that.

Re: Hackers Remotely Attack a Jeep on the Highway

#149

Post by danielweber »

hoopism wrote: post #100

To recap the facts: - Man drives car on public highway @ speeds of up to 70mph - Hackers turn on windshield wipers and fluid to blur view - Hackers Blare music and obscure any comms link to driver - Hackers disable vehicle on Highway at location with no shoulder And there are people who are not only ok with type of experiment but think there should be more of it. I understand that these exploits need to get attention…

https://en.wikipedia.org/wiki/Institutional_review_board is how normal people deal with this.

Re: Hackers Remotely Attack a Jeep on the Highway

#150

Post by m3talridl3y »

daveloyall wrote: post #82

So, a HN commentator apparently called the cops on these guys after reading the Wired article. Several commentators more or less agree, arguing that performing these tests on the I-40 was criminally negligent. Stop right there. Grow some balls. These guys are elite, their demo was badass, and I've done stupider things on I-40 for no reason . And wtf you called the cops? head in hand

There are perfectly good test tracks out there, that'll let you screw around to your heart's content. Hell, drive around a walmart parking lot at 3am if you have to. Doing this on public roads? Sorry, you need to follow the laws like the rest of us.
Post reply on HN