Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#221

Post by danielweber » Tue, Jul 21, 2015, 4:32 PM UTC

innguest wrote: post #166

If Myth Busters tested some wacky car on a public road at 70mph without telling anyone, we'd all be freaking out. But because they were "researchers" (i.e. the same tribe as most leftist people here) from a university (leftist church) then they get a pass and all sorts of justification for why what they did was OK. EDIT: Leftists go by label. They will heart any "researcher" thinking they must be their peer in their…

Were they really at a university? It looks like they were "inspired" by researchers at universities, which universally have review boards that stop idiots from disabling cars on an open road to see what happens.

Re: Hackers Remotely Attack a Jeep on the Highway

#222

Post by geofft » Tue, Jul 21, 2015, 4:33 PM UTC

afarrell wrote: post #190

geofft wrote: post #46

Earlier quoted context omitted.

You called the cops on two security researchers and a journalist, because you disagreed with their methods and weren't sure what their plans were and what authorities they'd talked to? (And not just any cops, the cops in St. Louis, for bonus points.) Are we still on Hacker News, or is the transformation to Enablers of Traditional American Power Structure News complete?

> Because you disagreed with their methods This isn't really engaging with his action. Specifically, because called the cops because he believed that their methods put people in danger of physical harm. This objection isn't coherent without an argument either that: 1) He was unreasonable in his belief that they'd put people in harm's way. or 2) It is not appropriate to contact law enforcement as a result of observing…

Hi! :)

My argument is roughly that we don't know for sure that people were put in harm's way, and we have good reason, as hackers, not to trust the legal system to reliably figure these sorts of things out (and they generally fail in the direction of being worse for both individual researchers and society of a whole). If we did empirically find the legal system reliable and fair, I'd be more convinced that the threshold for objecting should be "unreasonable".

The action is also over right now, and I see no indication that they intend to do so again. So this is either about punishment-as-retribution, or about dissuading future researchers from doing similar things. I don't think retribution is particularly justifiable, and I think there are better ways to dissuade future researchers, like having a conversation about it without the police involved. So I guess I'm arguing the specific sub-case of 2 that if they don't intend to put someone in harms' way again, law enforcement isn't necessarily right.

(You're right about the highway patrol thing, btw. I think I had it confused in my head with some other recent public/police conflict where the highway patrol was worse than the local police, but it looks like the opposite was true of the Ferguson protests.)

Re: Hackers Remotely Attack a Jeep on the Highway

#223

Post by trevor-e » Tue, Jul 21, 2015, 4:33 PM UTC

brandon272 wrote: post #114

stevendhansen wrote: post #95

Earlier quoted context omitted.

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Reminds me of people who will call the police on a loud neighbor instead of just, you know, talking to them first.

You honestly don't think these "security researchers" did anything wrong? They could have easily demonstrated the same vulnerability on a private course and made the same point, no need to recklessly endanger everyday people.

Re: Hackers Remotely Attack a Jeep on the Highway

#224

Post by freshyill » Tue, Jul 21, 2015, 4:33 PM UTC

Lawtonfogle wrote: post #212

freshyill wrote: post #187

Earlier quoted context omitted.

A small risk? Disabling a car on a busy highway is not a small risk. What about this "experiment" could not be done in controlled environment on a track… or a country road… or an empty parking lot. I suppose we could just have infectious disease researchers set up shop on a street corner by this logic. Whatever! It's just a small risk! They're doing it for the sake of increasing safety standards!

Small compared to the risk of under-funding security research as a cost cutting measure knowing that weaken security will allow for these exploits to occur.

OK, just making sure I follow: They should exploit security holes and put people at risk to ensure that security research is not underfunded, which could lead to someone exploiting security holes, which would put people at risk.

Re: Hackers Remotely Attack a Jeep on the Highway

#225

Post by linkregister » Tue, Jul 21, 2015, 4:34 PM UTC

bluedino wrote: post #157

>> The attacker’s PC had been wired into the vehicles’ onboard diagnostic port, a feature that normally gives repair technicians access to information about the car’s electronically controlled systems. Is this even really considered an issue?

That was a previous demonstration; this one was done solely wirelessly.

Re: Hackers Remotely Attack a Jeep on the Highway

#226

Post by geofft » Tue, Jul 21, 2015, 4:34 PM UTC

shoeboxam wrote: post #206

epochwolf wrote: post #53

Earlier quoted context omitted.

There's plenty of safe ways to accomplish this kind of demonstration. The fact they choose to do so in a way that endangered the public is in fact criminal. Being a security researcher or journalist doesn't give you a license to put the public in physical danger.

In addition, being a security researcher doesn't give you a license to put the public in any form of danger! That's why we have private disclosures.

The researchers did disclose it privately. As always, the believable pressure of public disclosure makes the process work.

https://twitter.com/0xcharlie/status/623492229714313216

Re: Hackers Remotely Attack a Jeep on the Highway

#227

Post by jerf » Tue, Jul 21, 2015, 4:35 PM UTC

jkot wrote: post #179

> The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch I was in that situation. No brakes, high rocks on one side, 100 meters cliff on other side, 20km of downhill in front off me. I guess I will not be buying Jeep anytime soon.

If you think that "drive-by-wire" is a specifically-Jeep problem, I've got some bad news for you....

It is a safe assumption that these guys just happened to use a Jeep, and with some work almost any modern car could have this done to it.

Re: Hackers Remotely Attack a Jeep on the Highway

#228

Post by Natsu » Tue, Jul 21, 2015, 4:36 PM UTC

Duhveed wrote: post #105

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

I was thinking about how dangerous it was while I was reading it too, but I came away far less concerned than you I guess. The deceleration on the highway was the most worrisome, but it's not even in the ballpark of common driving hazards like distracted folks on cellphones or flying debris. A crash from such a thing is unlikely and the inconvenience is pretty minimal. Even you, the busybody who called the cops becau…

They intentionally put people at risk when there were better, legal alternatives. Responsible researchers do not do tests that subject the general public to risk.

I do think that educating them with regards to better choices would be helpful, but they appear to have committed an offense and documented it on camera in the news. I think they were going to end up in trouble one way or another here.

Re: Hackers Remotely Attack a Jeep on the Highway

#229

Post by facetube » Tue, Jul 21, 2015, 4:36 PM UTC

freshyill wrote: post #151

stevendhansen wrote: post #95

Earlier quoted context omitted.

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. But putting many lives in danger is considered acceptable behavior by security researchers? Does it actually matter that it was security researchers? Do security researchers working on banking software need to steal a million dollars in order to prove that they've found an issue? Would calling the police b…

Slowing down and eventually driving off on to a grass shoulder wouldn't even crack the bottom 1% of crazy shit I've seen people do on highways, on purpose.

IMO, the danger to the public caused by the researchers somewhat-controlled exploit is utterly dwarfed by the danger Jeep/uConnect is causing by directly connecting its cars to the internet. If the researchers are successful in getting car manufacturers to remove features like this entirely, the net result will ultimately save lives.

Re: Hackers Remotely Attack a Jeep on the Highway

#230

Post by danielweber » Tue, Jul 21, 2015, 4:37 PM UTC

daveloyall wrote: post #82

So, a HN commentator apparently called the cops on these guys after reading the Wired article. Several commentators more or less agree, arguing that performing these tests on the I-40 was criminally negligent. Stop right there. Grow some balls. These guys are elite, their demo was badass, and I've done stupider things on I-40 for no reason . And wtf you called the cops? head in hand

In the past, researchers in other fields cared more about "badass" than the basic empathy a dog can demonstrate.

That's why every research lab has an ethical review board.

Scientists failing to care about social consequences is nothing groundbreaking.