Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#311

Post by kedean » Tue, Jul 21, 2015, 5:31 PM UTC

mtabini wrote: post #28

adamgravitis wrote: post #4

So, it's becoming abundantly clear that vehicle companies (autos, jets...) have approximately zero knowledge how to hire software engineers. Presumably they're somewhat more successful hiring mechanical engineers because that's always been their "thing". It's all well and good for us to chuckle at the terrifying software/systems decisions being made by these teams, but how do we address the root of the problem? It's…

I don't think this has necessarily anything to do with engineering competence. From a business perspective, security isn't a marketable feature until it becomes a problem—you don't install safety belts, or airbags, or protection against malware until after people start suffering from their absence in a vehicle. Why? Because while you're busy building a well-secured system, your competitors are busy implementing new f…

In addition to your third paragraph, auto makers are disincentivized toward adding security features because they CAN'T advertise them. If Toyota started advertising the all new Prius with the feature "your ability to brake won't be taken away from you while you're barrelling down the highway at 70 mph", consumers wouldn't just not care, they would question why the fuck that wasn't there in the first place. This sort of stuff is expected to have been there from the start by consumers, so at this point its nothing but a cost sink to add it.

Re: Hackers Remotely Attack a Jeep on the Highway

#312

Post by Gracana » Tue, Jul 21, 2015, 5:31 PM UTC

leoc wrote: post #208

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Let's not forget Wired 's responsibility for this either. I wonder what editor Scott Dadich and owners Condé Nast have to say. OTOH, we don't know for certain that the tale of what really happened on the public highway didn't grow in the telling. EDIT: Holy moly https://twitter.com/CondeNast/status/623533074865893376 .

That looks like a staged shot. Highways don't have corners like that.

Re: Hackers Remotely Attack a Jeep on the Highway

#313

Post by marssaxman » Tue, Jul 21, 2015, 5:32 PM UTC

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

What on earth do you think you are going to accomplish that will have any positive effect whatsoever by calling the cops of all people?

Re: Hackers Remotely Attack a Jeep on the Highway

#314

Post by godgod » Tue, Jul 21, 2015, 5:32 PM UTC

Michael Hastings. Look into it.

Re: Hackers Remotely Attack a Jeep on the Highway

#315

Post by elektromekatron » Tue, Jul 21, 2015, 5:33 PM UTC

stevendhansen wrote: post #95

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior.

Who cares what their job title is? They deliberately blocked visibility and then cut the transmission of a vehicle being driven on a public road in traffic. That is well into the territory of criminal negligence.

Re: Hackers Remotely Attack a Jeep on the Highway

#316

Post by kbenson » Tue, Jul 21, 2015, 5:33 PM UTC

facetube wrote: post #291

pyre wrote: post #265

Earlier quoted context omitted.

> Slowing down and eventually driving off on to a grass shoulder wouldn't even crack the bottom 1% of crazy shit I've seen people do on highways, on purpose. The article claims that the transmission was cut on a section of the freeway with no shoulder, so I'm curious how being stuck in the middle of the freeway translates to "slowing down and eventually driving off onto a grass shoulder." (And just because something…

Grass shoulder: http://www.wired.com/wp-content/uploads/2015/07/IMG_0724-102... I agree that it probably presented some level of danger to the public, but I maintain that (i) the added danger was small relative to the normal everyday danger of driving with humans; and (ii) the media exposure they've achieved by doing this on a public road has the potential to pressure Chrysler to remove tens of thousands of hazards (…

I think the point is that you, and the researchers, have no right to make that decision for other people. It's illegal to purposefully stop in the middle of the highway. It's illegal to cause someone else to do so as well.

People who routinely test things that have the capability for real harm learn to take precautions for as many of the the things you don't think off as you can. For example, the Mythbusters are routinely testing things with cars and other bits of machinery that can cause physical harm if something goes wrong. They also routinely retire to abandoned airforce bases, remote locations, and the salt flats to test things.

Re: Hackers Remotely Attack a Jeep on the Highway

#317

Post by jblow » Tue, Jul 21, 2015, 5:35 PM UTC

phaylon wrote: post #274

jblow wrote: post #242

This discussion is going insane. I see lots of people arguing about the safety of how these guys conducted the hack. Okay, sure, there is probably an issue there of some degree. But it's a very small issue compared to the fact that hundreds of thousands of vehicles are arbitrarily hackable right now , with more rolling off the assembly line all the time, and people are driving these around right now . Why is most of…

> Why is most of the discussion here about the minor issue? Why is everyone so eager to derail discussion from the major issue? I thought HN was trying to be a reasonable place. I find these criticisms _extremely_ reasonable. Plus, the big discussion is not about them doing something illegal, the big discussion is about people here being totally fine with it. And given that the topic you (I assume) want to discuss is…

They might be reasonable in isolation but are not being levied remotely in proportion.

I just realized what the problem is: this is bikeshedding. Everyone knows about people driving around and feels qualified to have moral indignation in that area, whereas few people know anything about actual cars.

Re: Hackers Remotely Attack a Jeep on the Highway

#318

Post by jblow » Tue, Jul 21, 2015, 5:36 PM UTC

ohitsdom wrote: post #234

jblow wrote: post #121

Earlier quoted context omitted.

If it were not demonstrated under real conditions, the car companies would just say "this was a fake test not representative of real-world conditions, isn't that true Mr. Journalist?" and the journalist would have to admit that that was true and then they would say "Under real-world conditions our cars are safe; customers have nothing to worry about." This has been their playbook about everything for a long time so I…

There is no way a "not real-world conditions" argument could be made if this same test was done on a test track. No automaker would even try it because it would generate even more bad press. The "researchers" did the test on a public, in-use highway for better press/cool factor. Completely irresponsible.

Look at what Toyota did with the whole unintentional acceleration thing. About as irresponsible as you can get.

Re: Hackers Remotely Attack a Jeep on the Highway

#319

Post by toomuchtodo » Tue, Jul 21, 2015, 5:37 PM UTC

Aldo_MX wrote: post #252

mod wrote: post #219

Earlier quoted context omitted.

You've seriously seen "dozens" of people killed?

Many car drivers forget a basic concept of physics named inertia , which is the reason why heavy vehicles (ex. trucks) take ___too long___ to brake. Emphasis in too long, because this is the reason why road signs announce dangerous sections of a road with even miles in advance.

Whenever I'm hauling >10K lbs with my pickup truck, I get most nervous going downhill through mountains. The only thing between me and hitting something are a thin set of brake pads on all four disc brakes and the extremely limited compression braking on a ~6L engine.

Re: Hackers Remotely Attack a Jeep on the Highway

#320

Post by marssaxman » Tue, Jul 21, 2015, 5:38 PM UTC

edanm wrote: post #260

geofft wrote: post #202

Earlier quoted context omitted.

> But putting many lives in danger is considered acceptable behavior by security researchers? We don't know, for sure, what happened. There might be some creative license in the journalism. There might be some omission of them talking to authorities (even if someone called the highway patrol and they said "oh, we don't know about this," all it proves is there's bureaucracy at the highway patrol). etc. Calling the cop…

Your post basically boils down to: 1. You don't trust the police/legal system. 2. You trust our own community more. Not saying I agree or disagree, but there are a LOT of people who would really disagree with this, and a lot more who would think that someone saying "why involved the actual people the public has chosen to deal with this, we can deal with it ourselves" would be very wrong.

It's hard to imagine how anyone familiar with any part of the police/legal system's pattern of clueless, ham-handed, hierarchy-ridden interaction with technology over the last 30 years could find justification to continue extending them trust.