Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Remotely Attack a Jeep on the Highway

wired.com

Post reply on HN
Print view View original

201–210 of 640 posts

Re: Hackers Remotely Attack a Jeep on the Highway

#201

Post by adamtj »

Should hackers actually kill somebody, I struggle to find a reason why the relevant automotive engineers and their managers shouldn't be charged and convicted of negligent homicide, or worse. After all, somebody had to make the decision to connect a radio receiver to the CAN bus. Others are aware of the wireless and choose not to remove it.

To be a professional is to have a duty to refuse to do stupid stuff like this, even if it's legal and even if your job depends on it. But is it legal? Why would we need any new laws for this? Connecting a wireless receiver to the same network that controls a car's brakes and steering seems to me like reckless endangerment. No need to wait for innocent people to die.

If history has shown us anything, it's that we cannot rely on software to separate two systems sharing a network. Only physics can do that. If we must have wireless for entertainment, then the entertainment and vehicle control networks must be air-gapped.

This seems blindingly obvious to me. What am I missing?

Re: Hackers Remotely Attack a Jeep on the Highway

#202

Post by geofft »

freshyill wrote: post #151
stevendhansen wrote: post #95

Earlier quoted context omitted.

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. But putting many lives in danger is considered acceptable behavior by security researchers? Does it actually matter that it was security researchers? Do security researchers working on banking software need to steal a million dollars in order to prove that they've found an issue? Would calling the police b…

> But putting many lives in danger is considered acceptable behavior by security researchers?

We don't know, for sure, what happened. There might be some creative license in the journalism. There might be some omission of them talking to authorities (even if someone called the highway patrol and they said "oh, we don't know about this," all it proves is there's bureaucracy at the highway patrol). etc.

Calling the cops is invoking a powerful and hard-to-control force. Unless you think that the cops and the legal system are capable of talking to people fairly and understanding security research and making sense of tech journalism and reaching a reliably just outcome, there are better ways to exert your outrage.

For instance, the researchers are very well known in the security community. They're not rogues or mobsters or fugitives. If they recklessly endangered lives, we can pressure them to turn themselves in to the legal system.

I happen to have more faith in the ability of the hacker community to fairly figure out what happened than the legal system to fairly figure out what happened. If I shouldn't, then we have a serious problem as a community.

Re: Hackers Remotely Attack a Jeep on the Highway

#203

Post by danielweber »

feld wrote: post #163
Someone1234 wrote: post #81

Earlier quoted context omitted.

> Was it life threatening? Hardly. Uhh what? It seems you cannot go a week without reading about a pile-up on a freeway. Just last week a big-rig lost a wheel, it rolled into the on-coming lane, and drivers swerving and braking to avoid it actually caused a pile up. Stopping even on the shoulder on a freeway is considered "risky" by most police officers and many (like triple digits) have been killed while stopped in…

Poorly maintained vehicles that break down while driving surprise the driver. This happens daily on public roads. Should we fine them for failing to maintain their vehicle to your standards? There are autonomous vehicles being tested on our roads with a failure mode of "coast to a stop". They may not even have a human inside to react to things around them. Do the operators deserve to be jailed? People modify their ca…

Failure to maintain your vehicle such that it puts other people at risk is against the law.

The people testing self-driving cars had IRBs that go over their test cases. Do these guys even know what IRB stands for?

Re: Hackers Remotely Attack a Jeep on the Highway

#204

Post by omni »

jimbobimbo wrote: post #131
tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

While I agree with the fact that what they did was dangerous, the fact they did it that way will garner much more attention to the root cause of this problem - connected cars allow remote control of car's most basic mechanical features, which they shouldn't. Hopefully, this will result in better safety measures in car systems in the long run. Edit: They could've done it on the parking lot and the article would be put…

Murdering a family of 4 using the hack would garner even more attention. The ends don't justify the means.

Re: Hackers Remotely Attack a Jeep on the Highway

#205

Post by brandon272 »

Raphmedia wrote: post #129
geofft wrote: post #46

Earlier quoted context omitted.

You called the cops on two security researchers and a journalist, because you disagreed with their methods and weren't sure what their plans were and what authorities they'd talked to? (And not just any cops, the cops in St. Louis, for bonus points.) Are we still on Hacker News, or is the transformation to Enablers of Traditional American Power Structure News complete?

As much as it seem over the top, those researcher could have hurt people. Calling the police will not have them go to jail or have their data deleted. It might (rightfully) get them a fine. It will however ensure that their next experiments are done in a safer, more legal way. Calling the police isn't all about emergency. You can call them to talk about issues that worry you such as this one. They will take care of b…

> Calling the police will not have them go to jail or have their data deleted. It might (rightfully) get them a fine. It will however ensure that their next experiments are done in a safer, more legal way.

Or not done at all.

I may not fully agree with their methodology but I'm thankful this work is being done by people with good intentions instead of having these issues come to light when people with malicious intent find the vulnerability and kill or maim countless people.

Re: Hackers Remotely Attack a Jeep on the Highway

#206

Post by shoeboxam »

epochwolf wrote: post #53
geofft wrote: post #46

Earlier quoted context omitted.

You called the cops on two security researchers and a journalist, because you disagreed with their methods and weren't sure what their plans were and what authorities they'd talked to? (And not just any cops, the cops in St. Louis, for bonus points.) Are we still on Hacker News, or is the transformation to Enablers of Traditional American Power Structure News complete?

There's plenty of safe ways to accomplish this kind of demonstration. The fact they choose to do so in a way that endangered the public is in fact criminal. Being a security researcher or journalist doesn't give you a license to put the public in physical danger.

In addition, being a security researcher doesn't give you a license to put the public in any form of danger! That's why we have private disclosures.

Re: Hackers Remotely Attack a Jeep on the Highway

#207

Post by shoeboxam »

epochwolf wrote: post #53
geofft wrote: post #46

Earlier quoted context omitted.

You called the cops on two security researchers and a journalist, because you disagreed with their methods and weren't sure what their plans were and what authorities they'd talked to? (And not just any cops, the cops in St. Louis, for bonus points.) Are we still on Hacker News, or is the transformation to Enablers of Traditional American Power Structure News complete?

There's plenty of safe ways to accomplish this kind of demonstration. The fact they choose to do so in a way that endangered the public is in fact criminal. Being a security researcher or journalist doesn't give you a license to put the public in physical danger.

In addition, being a security researcher doesn't give you a license to put the public in any form of danger! That's why we have private disclosures.

Re: Hackers Remotely Attack a Jeep on the Highway

#208

Post by leoc »

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Let's not forget Wired's responsibility for this either. I wonder what editor Scott Dadich and owners Condé Nast have to say. OTOH, we don't know for certain that the tale of what really happened on the public highway didn't grow in the telling.

EDIT: Holy moly https://twitter.com/CondeNast/status/623533074865893376 .

Re: Hackers Remotely Attack a Jeep on the Highway

#209

Post by astrodust »

mattdotc wrote: post #184
astrodust wrote: post #158

Earlier quoted context omitted.

I'm sure the police are even more ill-equipped to understand the ramifications of this demonstration and will over-react and start jailing anyone with a laptop and suspicious intent. I can't wait for the pathetic outrage when "racial profiling" now means harassing white kids with laptops that fit the profile of hacker . This is a matter for a company like Google to take on politically, not some beat cop in St. Louis…

This has nothing to do with the type of test they ran and everything to do with where and how they ran it.

I totally agree that there's a problem here, but I strongly disagree with the method of action.

Why not engage the FBI? This is not an issue specific to St. Louis. Throwing some researchers in jail solves nothing. This is a way bigger deal than some local offense.

You need an agency with the ability to see the bigger picture.

Re: Hackers Remotely Attack a Jeep on the Highway

#210

Post by danielweber »

Miner49er wrote: post #126
Someone1234 wrote: post #81

Earlier quoted context omitted.

> Was it life threatening? Hardly. Uhh what? It seems you cannot go a week without reading about a pile-up on a freeway. Just last week a big-rig lost a wheel, it rolled into the on-coming lane, and drivers swerving and braking to avoid it actually caused a pile up. Stopping even on the shoulder on a freeway is considered "risky" by most police officers and many (like triple digits) have been killed while stopped in…

They decelerated a car. The brakes weren't even applied. This happens all the time on highways. It is unfortunate that it happened where there was no shoulder on the road, but if an accident did happen then I'm not so sure the researchers or journalist would be at fault. Here's a scenario: Let's say a person is driving a car, when their car engine fails. There's no shoulder for them to drive onto, so they are just sl…

> but if an accident did happen then I'm not so sure the researchers or journalist would be at fault.

Legally, you are required to do what you can to avoid accidents.

Ethically, it's all kinds of fucked up when you rationalize with "well, if someone goes wrong I can blame someone else."

Post reply on HN