Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#171

Post by seany » Tue, Jul 21, 2015, 4:02 PM UTC

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Really? you called the cops? I agree that my initial thought after reading that part was "maybe this should have been done on a track", but come on. No one was hurt, time to move on.

Re: Hackers Remotely Attack a Jeep on the Highway

#172

Post by _yosefk » Tue, Jul 21, 2015, 4:03 PM UTC

mc32 wrote: post #115

spacehome wrote: post #91

Earlier quoted context omitted.

I'm not sure how this would make calgoo change his mind. * Cops are under no obligation to go into harms way to protect the public. * Cops primarily exist to collect evidence for prosecution after the fact. * Just because criminals and crimes exist doesn't take away from cops' bad behavior. * If calgoo becomes the victim of a crime, cops are unlikely to be able to make him whole again - for bodily injury, prosecution…

There are problems with power and corruption.... But Have you seen what happens to communities when police withdraw? They become overrun by gangs and other less accountable organizations. Even favelas where cops act paramilitarily, say in Caracas, people still want cops because no cops is usually worse, unless you get a private version of cops, which is essentially cops by another name.

Not to disagree with you, but to add a data point (or rather an anecdote) - I heard a few people from Moscow claiming that they're more afraid of cops than criminals.

(Of course, even if it's not an exaggeration and even if it reflects the actual probabilities of getting hurt by cops and criminals there, it does not follow that things wouldn't be even worse without a police force.)

Re: Hackers Remotely Attack a Jeep on the Highway

#173

Post by Zikes » Tue, Jul 21, 2015, 4:03 PM UTC

bluedino wrote: post #157

>> The attacker’s PC had been wired into the vehicles’ onboard diagnostic port, a feature that normally gives repair technicians access to information about the car’s electronically controlled systems. Is this even really considered an issue?

A bit of Arduino magic and a few minutes alone with an unlocked car (or locked but otherwise vulnerable) and that wired port could become wireless.

Re: Hackers Remotely Attack a Jeep on the Highway

#174

Post by keithnoizu » Tue, Jul 21, 2015, 4:04 PM UTC

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

As opposed to the alternative of someone specifically leveraging this with the intent to doreal harm? They could have gone about this in a safer manner but the person you should be upset with is the manufacturer not the person pointing out a large gaping problem.

Re: Hackers Remotely Attack a Jeep on the Highway

#175

Post by danielweber » Tue, Jul 21, 2015, 4:04 PM UTC

1337biz wrote: post #130

usefulcat wrote: post #110

Earlier quoted context omitted.

"A much less aggressive (and thoughtful) move would be to contact the researchers directly." Not conducting this demonstration on a public highway would also have been a much less aggressive and thoughtful move, not to mention less dangerous.

Finally some IT guys getting how the press works and now you want to change their story to something like "how I hacked a car in my backyard".

It's particularly because getting big headlines is so enticing and intoxicating that research labs have review boards.

Re: Hackers Remotely Attack a Jeep on the Highway

#176

Post by mattdotc » Tue, Jul 21, 2015, 4:05 PM UTC

stillsut wrote: post #136

danielweber wrote: post #123

Earlier quoted context omitted.

I don't know where the threshold is, but calling yourself a "security researcher" is not a blank slate to do whatever you want. I think it's 100% OK to test on a private car on a private track.

Had my car stall on the highway once. Pretty scary because you lose power-brakes and power-steering as you're trying to pullover. Was it a hacker? Nope, just a dumb mechanic that got trash deep into the air intake during a routine oil change. How many (dumb mechanics)*(routine oil changes) are there in this country? Five-Six orders of magnitude more than auto hackers, which is why I don't see any harm in one more (wh…

The difference is your 'dumb mechanic' made an unintentional mistake.

These people, on the other hand, knowingly and deliberately disabled a car on a highway. Yes, they had a plan, but they are still running their little experiment on other unwitting drivers on the highway. I don't consider the manner in which they ran their test to be ethical; it should have been performed on a closed track.

Re: Hackers Remotely Attack a Jeep on the Highway

#177

Post by ethbro » Tue, Jul 21, 2015, 4:06 PM UTC

ben_bai wrote: post #57

kazinator wrote: post #23

Earlier quoted context omitted.

The fact that a dashboard system that controls your radio or AC has access to cut your transmission is also a hardware configuration issue. Accessories should be physically secured from ignition and drive train. The internet connected features of the car, in turn, should be severed from both of these. It should not be physically possible to turn on the wipers from the embedded processor that receives packets on the I…

That's why they test on this car. Because the CAN buses are all connected without "firewalls".

It's almost like someone designed a network protocol without thinking about security. First time for everything, I guess...

Re: Hackers Remotely Attack a Jeep on the Highway

#178

Post by dntrkv » Tue, Jul 21, 2015, 4:06 PM UTC

jamespo wrote: post #70

calgoo wrote: post #67

Earlier quoted context omitted.

Sorry, but the cops lost that trust from me when the started sending swat teams and abusing power way to much. Since then, to me calling the cops has become a last resort. I dont trust ANY of them because of the few a holes that are abusing their power. Mainly caused because of their policies of shutting up and protecting each others. Until they fix this, i will not trust ANY cop again.

Until you're a victim of a crime I presume

In my life I've experienced 2 burglaries, 3 vehicle vandalisms, and one time I was seriously assaulted in a beach town by 10 guys with a gun. In every one of those experiences, the police were unprofessional and completely useless.

I will still call the police in the future, but just so they can fill out a police report for insurance claims or potential law suits. Other than that, I don't expect the police to do anything unless they were on the scene and saw somebody break the law.

And even then, one of the times when my car was vandalized, the cops were there and they filed a police report and told me to try to figure out who will pay between the two dudes that jumped on my car and if that doesn't work, give the officer a call and he will help me with the next steps. Obviously those guys didn't wanna pay so I tried to get in touch with that cop and he was avoiding my calls. I called over 10 times over the course of a couple weeks and he was never there and never returned my calls.

Another time my neighbor was throwing eggs at my motorcycle for 3 nights in a row and I got him on video, call the cops and they come by about 12 hours later and just laughed at the video, and then all of a sudden got a call to something more important and bounced. It may seem funny, but me having to pay someone $300 to clean egg out of all of the fairings and tubing is not funny. At the very least, do your job and file a fucking police report.

Re: Hackers Remotely Attack a Jeep on the Highway

#179

Post by jkot » Tue, Jul 21, 2015, 4:07 PM UTC

> The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch

I was in that situation. No brakes, high rocks on one side, 100 meters cliff on other side, 20km of downhill in front off me. I guess I will not be buying Jeep anytime soon.

Re: Hackers Remotely Attack a Jeep on the Highway

#180

Post by aptwebapps » Tue, Jul 21, 2015, 4:07 PM UTC

stillsut wrote: post #136

danielweber wrote: post #123

Earlier quoted context omitted.

I don't know where the threshold is, but calling yourself a "security researcher" is not a blank slate to do whatever you want. I think it's 100% OK to test on a private car on a private track.

Had my car stall on the highway once. Pretty scary because you lose power-brakes and power-steering as you're trying to pullover. Was it a hacker? Nope, just a dumb mechanic that got trash deep into the air intake during a routine oil change. How many (dumb mechanics)*(routine oil changes) are there in this country? Five-Six orders of magnitude more than auto hackers, which is why I don't see any harm in one more (wh…

The fact that the driver knew ahead of time does mitigate the danger but does not excuse the remaining danger. The fact that there are already lots of dangerous stalls seems completely besides the point to me.