Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#191

Post by brandon272 » Tue, Jul 21, 2015, 4:15 PM UTC

meragrin wrote: post #152

brandon272 wrote: post #114

Earlier quoted context omitted.

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Reminds me of people who will call the police on a loud neighbor instead of just, you know, talking to them first.

This isn't just a loud neighbor. This was a drunk loud neighbor waving a loaded gun around. The driver was clearly distressed and they were just laughing it up.

No, these are knowledgable security researchers doing serious work who are probably amenable to discussing their research methods with concerned party via email or phone instead of the concerned party immediately phoning the police.

Re: Hackers Remotely Attack a Jeep on the Highway

#192

Post by danielweber » Tue, Jul 21, 2015, 4:15 PM UTC

Duhveed wrote: post #105

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

I was thinking about how dangerous it was while I was reading it too, but I came away far less concerned than you I guess. The deceleration on the highway was the most worrisome, but it's not even in the ballpark of common driving hazards like distracted folks on cellphones or flying debris. A crash from such a thing is unlikely and the inconvenience is pretty minimal. Even you, the busybody who called the cops becau…

> "What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early..." which implies that the trucker would have been following too closely or not paying attention (or both).

Say there was a person working at a grown-up lab that deals with traffic safety. Like the University of Michigan Transportation Research Institute http://www.umtri.umich.edu/ .

The person wants to know what happens when someone slams on their brakes on a 70mph road. He says "don't worry, if anyone hits me, it will be their fault, because they were following too close."

What do you suppose the ERB says in response?

Re: Hackers Remotely Attack a Jeep on the Highway

#193

Post by discardorama » Tue, Jul 21, 2015, 4:15 PM UTC

geofft wrote: post #46

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

You called the cops on two security researchers and a journalist, because you disagreed with their methods and weren't sure what their plans were and what authorities they'd talked to? (And not just any cops, the cops in St. Louis, for bonus points.) Are we still on Hacker News, or is the transformation to Enablers of Traditional American Power Structure News complete?

"Hacking" is not what's portrayed in movies.

The researchers could have achieved the exact same results (albeit with fewer clicks) by conducting this experiment in a remote parking lot or a private road. Heck, if the writer had contacted the cops, they could have given him an escort to make sure nothing bad happens.

If you ask me, it is this kind of behavior that makes the work of real researchers harder, as the media is quick to paint all security researchers as clueless nerds who will put people at risk.

Re: Hackers Remotely Attack a Jeep on the Highway

#194

Post by upofadown » Tue, Jul 21, 2015, 4:15 PM UTC

That was a lot of uninformative text to plow though...

Apparently someone has found a remote exploit that affects some model of Jeep. It requires an attacker to find the IP address of the Jeep. Which implies that a Jeep has an IP address. The communication between the Jeep and the world is something called Uconnect.

Re: Hackers Remotely Attack a Jeep on the Highway

#195

Post by belorn » Tue, Jul 21, 2015, 4:16 PM UTC

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

The security industry has unanimous voiced their concern that remote controllable cars and kill switches is one of the worst ideas possible, and will be exploited and cost human lives. Nothing has yet to happen from that.

So what should researchers do? Do nothing and keep their hand clean while waiting for the train wreck to happen? Continue in a fruitless effort to warn people on papers only other researchers reads, knowing by historical evidence that no change will come from it. Ask government for permission to do a live test, knowing that it would never be granted. Do a demo test on a demo road, knowing that neither government, industry or public would care.

I don't like this either, but it seems to me as a society we only really give researchers one option and that is to do nothing and wait for the bodies to pile up.

Re: Hackers Remotely Attack a Jeep on the Highway

#196

Post by brandon272 » Tue, Jul 21, 2015, 4:18 PM UTC

linker3000 wrote: post #165

brandon272 wrote: post #114

Earlier quoted context omitted.

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Reminds me of people who will call the police on a loud neighbor instead of just, you know, talking to them first.

You have not met our neighbours! Drug dealers, they run a vehicle repair 'service' from their garden despite local council enforcement notices. They regularly have fights in the street, my wife has been verbally abused and followed on numerous occcasions and there have been two police 'drugs raids' that have resulted in absolutlely nothing useful happening. I could go on, but it's not relevant. This has no bearing on…

You're certainly right, you can't debate nicely with everyone. Is there evidence here that the researchers in question aren't open to critique or aren't willing to discuss the safety issues involved with their research methods?

Re: Hackers Remotely Attack a Jeep on the Highway

#197

Post by FlaceBook » Tue, Jul 21, 2015, 4:18 PM UTC

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

..."Posted from my iPhone in rush hour traffic!"

Re: Hackers Remotely Attack a Jeep on the Highway

#198

Post by maxerickson » Tue, Jul 21, 2015, 4:18 PM UTC

bluedino wrote: post #157

>> The attacker’s PC had been wired into the vehicles’ onboard diagnostic port, a feature that normally gives repair technicians access to information about the car’s electronically controlled systems. Is this even really considered an issue?

Here's the context:

Back then, however, their hacks had a comforting limitation: The attacker’s PC had been wired into the vehicles’ onboard diagnostic port, a feature that normally gives repair technicians access to information about the car’s electronically controlled systems.

A mere two years later, that carjacking has gone wireless.

So the issue is right there in the surrounding text.

Re: Hackers Remotely Attack a Jeep on the Highway

#199

Post by 1337biz » Tue, Jul 21, 2015, 4:18 PM UTC

Canada wrote: post #154

1337biz wrote: post #124

Earlier quoted context omitted.

Same here. Posts like these make me take the effort to log in just to downvote. Sad to see such a mindset to gain so much traction.

Calling the police was completely inappropriate, but downvoting the comment as a way to signal your disapproval with his action in the real world isn't helpful. The comment itself is well written, on topic, and leading to good discussion. I agree with what others have already said: Since nobody was actually hurt he should have contacted the researchers to make his point.

It is a never ending discussion around here but my take away is that votes express opinion as well as quality of the posting.

We are here not an intellectual debate club were people take pro and contra sides and points are distributed based on the rigor of the argument, but discussions around here are about real world problems.

And somebody calling the cops on security researchers just because he read an article on the intern is in my view highly questionable behavior for somebody familiar with the tech community.

Re: Hackers Remotely Attack a Jeep on the Highway

#200

Post by losvedir » Tue, Jul 21, 2015, 4:19 PM UTC

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Wow, I'm shocked at how contentious this comment is. Count me in the "thanks for being a responsible citizen" column.

I feel like there's a lot of cargo cult thinking going on here. The situation is _almost_, but not quite, like a lot of other ones where the security researcher is unreasonably blamed. For example, I could easily see some people being up in arms about announcing this exploit at Black Hat.

But that's not the case here. I have a healthy fear and respect of a ton of metal flying down the road at 70mph. And this stunt, done just to generate headlines, was needlessly reckless. It could have just as easily been demoed in a private lot or something.