Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#251

Post by _lce0 » Tue, Jul 21, 2015, 4:46 PM UTC

xirdstl wrote: post #38

adamgravitis wrote: post #4

So, it's becoming abundantly clear that vehicle companies (autos, jets...) have approximately zero knowledge how to hire software engineers. Presumably they're somewhat more successful hiring mechanical engineers because that's always been their "thing". It's all well and good for us to chuckle at the terrifying software/systems decisions being made by these teams, but how do we address the root of the problem? It's…

For the same reason I am skeptical of the "Internet of Things". Do we really want every device in our home to be exploitable from someone across the globe? Continually applying firmware updates to appliances to close security holes? Something fundamental has to change about how we handle device security before I want to live in that world.

exactly!

I want all my devices to be as dumb as wires.

Wired technology just works, out-of-the-box, no setup, no maintenance, no nothing .. just make sure the plug fit in both ends, and done!

Wireless technology should work similar, but via the air, like an invisible wire .. not as a open gate to the internet!

..and please let's not add multi-purpose CPU just for the sake of marketing!

Re: Hackers Remotely Attack a Jeep on the Highway

#252

Post by Aldo_MX » Tue, Jul 21, 2015, 4:46 PM UTC

mod wrote: post #219

tombrossman wrote: post #216

Earlier quoted context omitted.

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and…

You've seriously seen "dozens" of people killed?

Many car drivers forget a basic concept of physics named inertia, which is the reason why heavy vehicles (ex. trucks) take ___too long___ to brake.

Emphasis in too long, because this is the reason why road signs announce dangerous sections of a road with even miles in advance.

Re: Hackers Remotely Attack a Jeep on the Highway

#253

Post by osconfused » Tue, Jul 21, 2015, 4:47 PM UTC

tombrossman wrote: post #216

stevendhansen wrote: post #95

Earlier quoted context omitted.

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and…

I appreciate your call to the cops and your reasoning. I also have driven a significant number of miles for work and have seen a number of people killed in traffic accidents. This "test" was extremely irresponsible. I know I will be downvoted for saying this, but I think you made the correct decision.

Re: Hackers Remotely Attack a Jeep on the Highway

#254

Post by pyre » Tue, Jul 21, 2015, 4:48 PM UTC

mod wrote: post #219

tombrossman wrote: post #216

Earlier quoted context omitted.

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and…

You've seriously seen "dozens" of people killed?

Is it really inconceivable that someone who has literally driven tractor trailers more than a million miles has seen dozens of people killed in accidents?

Re: Hackers Remotely Attack a Jeep on the Highway

#255

Post by Semiapies » Tue, Jul 21, 2015, 4:48 PM UTC

jimbobimbo wrote: post #131

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

While I agree with the fact that what they did was dangerous, the fact they did it that way will garner much more attention to the root cause of this problem - connected cars allow remote control of car's most basic mechanical features, which they shouldn't. Hopefully, this will result in better safety measures in car systems in the long run. Edit: They could've done it on the parking lot and the article would be put…

They did it on a public highway to sell ads on Wired.

Re: Hackers Remotely Attack a Jeep on the Highway

#256

Post by raisedbyninjas » Tue, Jul 21, 2015, 4:49 PM UTC

Someone1234 wrote: post #107

daveloyall wrote: post #82

So, a HN commentator apparently called the cops on these guys after reading the Wired article. Several commentators more or less agree, arguing that performing these tests on the I-40 was criminally negligent. Stop right there. Grow some balls. These guys are elite, their demo was badass, and I've done stupider things on I-40 for no reason . And wtf you called the cops? head in hand

> These guys are elite, their demo was badass, and I've done stupider things on I-40 for no reason. "Elite," seriously? Is it 1995? Is the movie "Hackers" some type of inspiration to you? I'm almost surprised you didn't go all l33t speak. They endangered people's lives. It is as simple as that. If you too endanger people's lives "for no reason" on I-40 I hope they get you too.

"You're doomed!" I'm imagining these clowns giving each other high-fives and teabagging their laptop as a traffic pile-up ensues.

Re: Hackers Remotely Attack a Jeep on the Highway

#257

Post by untog » Tue, Jul 21, 2015, 4:50 PM UTC

innguest wrote: post #166

If Myth Busters tested some wacky car on a public road at 70mph without telling anyone, we'd all be freaking out. But because they were "researchers" (i.e. the same tribe as most leftist people here) from a university (leftist church) then they get a pass and all sorts of justification for why what they did was OK. EDIT: Leftists go by label. They will heart any "researcher" thinking they must be their peer in their…

Leftists go by label

Your entire post was using a label ("leftist") to justify your statement. Maybe examine yourself before casting the net out to others.

Re: Hackers Remotely Attack a Jeep on the Highway

#258

Post by laacz » Tue, Jul 21, 2015, 4:51 PM UTC

I'm baffled (reporting ethics aside).

One would think that car industry would be the one which has learnt about road safety the hard way. That experience should have manifested into extreme caution when adopting and implementing anything new, open and complex.

Sadly it is starting to look that everything they learn, they do by trial and error. Not by doing those things we take for granted from engineering and IT perspective.

Re: Hackers Remotely Attack a Jeep on the Highway

#259

Post by nhf » Tue, Jul 21, 2015, 4:51 PM UTC

gortok wrote: post #211

All the researchers and the journalist had to do was to talk to the Highway Patrol and say, "We'd like to test this on a highway; what do we need to do to make that happen?" That's it. Maybe the State Patrol would say, "Sorry, there's nothing you can do to test this here legally", or maybe they would have said, "Pay for overtime for 10 troopers and you can do it." The point is, we don't know. We can speculate, but we…

> This was an extremely childish move that had the propensity to hurt our industry more than help it. It is incumbent upon us take safety seriously in conducting these experiments. We can't count on level heads from outside the tech industry if we aren't willing to show that we care about people's lives and their safety when we're conducting these experiments.

Agreed. I would have no problems with them doing this on a test track, closed highway, or even a quiet road at low speeds. Even if we take the best possible negative scenario—say, the car is disabled going at 25 miles an hour, the driver can't handle manual steering, and then runs into someone's fence—the insurance companies are going to throw the book at the driver when they learn that they purposefully disabled their car and engaged in dangerous behavior on a public street.

I'm all for pushing the boundaries of security research (there are people in the labs all around me right now doing crazy stuff), but at least we in the academic world get our crazy stuff signed off on by a panel of competent experts.

Re: Hackers Remotely Attack a Jeep on the Highway

#260

Post by edanm » Tue, Jul 21, 2015, 4:52 PM UTC

geofft wrote: post #202

freshyill wrote: post #151

Earlier quoted context omitted.

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. But putting many lives in danger is considered acceptable behavior by security researchers? Does it actually matter that it was security researchers? Do security researchers working on banking software need to steal a million dollars in order to prove that they've found an issue? Would calling the police b…

> But putting many lives in danger is considered acceptable behavior by security researchers? We don't know, for sure, what happened. There might be some creative license in the journalism. There might be some omission of them talking to authorities (even if someone called the highway patrol and they said "oh, we don't know about this," all it proves is there's bureaucracy at the highway patrol). etc. Calling the cop…

Your post basically boils down to:

1. You don't trust the police/legal system.

2. You trust our own community more.

Not saying I agree or disagree, but there are a LOT of people who would really disagree with this, and a lot more who would think that someone saying "why involved the actual people the public has chosen to deal with this, we can deal with it ourselves" would be very wrong.