Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#351

Post by marssaxman » Tue, Jul 21, 2015, 5:59 PM UTC

kbenson wrote: post #332

marssaxman wrote: post #320

Earlier quoted context omitted.

It's hard to imagine how anyone familiar with any part of the police/legal system's pattern of clueless, ham-handed, hierarchy-ridden interaction with technology over the last 30 years could find justification to continue extending them trust.

So what are we supposed to do instead? Rely on self policing by the individuals or the industry? The the police or judicial system is off track, you attempt to correct them, not ignore them and route around them. That may unfortunately end up with injustice for some while the correction is ongoing, but that's the normal state. There's always correction that needs to happen, and there's always injustice, that's the no…

If an angry bear is terrorizing your campground, then yes, call fish & wildlife so they can shoot it with a tranq dart and haul it off somewhere safe. In the meantime, though, do you go about your life as though nothing is wrong? Hell no, you get the fuck away from the angry bear!

And tossing chocolate bars into your neighbor's campsite in hopes that the angry bear will wreck their stuff is just not cool.

Re: Hackers Remotely Attack a Jeep on the Highway

#352

Post by ripter » Tue, Jul 21, 2015, 6:00 PM UTC

hoopism wrote: post #337

the8472 wrote: post #321

Earlier quoted context omitted.

> but I really can't stop thinking about my wife and kids What about all those wives and kids that would have been endangered if the flaw had continued to go unfixed and exploited in a more malicious manner? Can we please not make "BUT THINK OF THE CHILDREN" arguments? Appealing to emotion makes arguments, well, emotional.

By saying this you are basically saying there was no reasonable alternative method of exposing this. I am unwilling to say that. This argument that somehow the ends justify the means when there was a clearly more safe means has to stop. It's just ignorant.

> By saying this you are basically saying there was no reasonable alternative method of exposing this.

No, he's saying you need a better argument.

Re: Hackers Remotely Attack a Jeep on the Highway

#353

Post by asanagi » Tue, Jul 21, 2015, 6:01 PM UTC

dsfyu404ed wrote: post #35

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

You're not gonna make the news unless the media can spin up a headline that scares people People won't pay attention until they're scared People won't demand action if they're not paying attention Nothing will happened if people don't demand action. If nothing happens the status quo (vulnerable systems) will remain. Until some bad actor (I'm sure several nations states would love that capability) gets into onStar and…

>People won't pay attention until they're scared

You aren't allowed to scare people into social change, Citizen. Only the thugs in uniform are allowed to do that.

Re: Hackers Remotely Attack a Jeep on the Highway

#354

Post by dchichkov » Tue, Jul 21, 2015, 6:02 PM UTC

cmdkeen wrote: post #327

dchichkov wrote: post #308

Earlier quoted context omitted.

To me it seems like it is gross recklessness with public safety from car manufacturers. The car manufacturers are risking lives of all these people by not keeping the air gap between CAN and Internet...

It can be both, security researchers don't get a free pass just because they are exposing a wrong. Had someone died you might (in countries which have it) get corporate manslaughter on a company that ignored security warnings. You absolutely would on the researchers and the journalist for their reckless disregard for the lives of others.

Yes, researchers don't get a free pass. Nothing is free. They've risked lives and their reputations to save lives. It had happened before in the history. And hopefully it will happen again. Some times it is worth it.

(*) without risking lives there wouldn't have been a video documenting these life-threatening vulnerabilities in the cars.

Re: Hackers Remotely Attack a Jeep on the Highway

#355

Post by Animats » Tue, Jul 21, 2015, 6:03 PM UTC

This is very serious, because it can be used on a large scale and has terrorism potential. This could be used to kill people or disrupt an entire city. Where's Homeland Security on this? This is their job.

Meanwhile, do not buy a Chrysler product with the "connectivity group". It's an option that costs about $500-$600.

Re: Hackers Remotely Attack a Jeep on the Highway

#356

Post by elektromekatron » Tue, Jul 21, 2015, 6:03 PM UTC

dchichkov wrote: post #338

osconfused wrote: post #253

Earlier quoted context omitted.

I appreciate your call to the cops and your reasoning. I also have driven a significant number of miles for work and have seen a number of people killed in traffic accidents. This "test" was extremely irresponsible. I know I will be downvoted for saying this, but I think you made the correct decision.

They've risked people's lives to produce real life looking footage documenting a life threatening event. Without such event present in the footage, car manufacturers can just say "Meh - no big deal". And continue recklessly risking lives by manufacturing unsafe cars without air gap between CAN bus and Internet. Remember, it's the car manufacturers that are the bad guys here, not the white hats... And just think how h…

Blocking the visibility through the windscreen, then shutting off the transmission of a car, that is driving on an interstate overpass in traffic, is not white hat by any stretch of the imagination.

Re: Hackers Remotely Attack a Jeep on the Highway

#357

Post by dang » Tue, Jul 21, 2015, 6:03 PM UTC

innguest wrote: post #166

If Myth Busters tested some wacky car on a public road at 70mph without telling anyone, we'd all be freaking out. But because they were "researchers" (i.e. the same tribe as most leftist people here) from a university (leftist church) then they get a pass and all sorts of justification for why what they did was OK. EDIT: Leftists go by label. They will heart any "researcher" thinking they must be their peer in their…

> leftist ... leftist ... Leftists ... leftists ... leftists ... leftists ... the leftist brain ... leftists ... leftists ... leftists

We've detached this subthread and marked it off-topic.

Re: Hackers Remotely Attack a Jeep on the Highway

#358

Post by ripter » Tue, Jul 21, 2015, 6:04 PM UTC

peeters wrote: post #287

tantalor wrote: post #248

Lot of comments here are accusing the "hackers" of negligence, but do not forget the writer, camera crew, and editors of WIRED were fully in control of the demonstration. This happened in the context of journalism, not security research. Blame WIRED if you think they screwed up, not the folks behind the computer. It was up to WIRED to ensure the safety of the demonstration, and evidently they failed given this passag…

I think people are quick to single out the researchers because there is more at stake when researchers act recklessly. When a journalist does something reckless, it's a problem with that journalist. The Constitution protects other journalists continuing to do what they do. When a hacker does something reckless, it's usually painted as a problem with all hackers. Which then fuels calls for draconian laws which would h…

I think it's because the article clearly names the two researchers, while WIRED is a faceless organization. It's a lot easier to get mad and blame the one with a face.

Re: Hackers Remotely Attack a Jeep on the Highway

#359

Post by sigzero » Tue, Jul 21, 2015, 6:05 PM UTC

dchichkov wrote: post #338

osconfused wrote: post #253

Earlier quoted context omitted.

I appreciate your call to the cops and your reasoning. I also have driven a significant number of miles for work and have seen a number of people killed in traffic accidents. This "test" was extremely irresponsible. I know I will be downvoted for saying this, but I think you made the correct decision.

They've risked people's lives to produce real life looking footage documenting a life threatening event. Without such event present in the footage, car manufacturers can just say "Meh - no big deal". And continue recklessly risking lives by manufacturing unsafe cars without air gap between CAN bus and Internet. Remember, it's the car manufacturers that are the bad guys here, not the white hats... And just think how h…

No. They absolutely did not have to produce a life threatening event. They could have done it 5MPH and car manufacturers would still take notice because it would still spread like wildfire on the Internet. What they did was supremely irresponsible and the cops should have been called.

Re: Hackers Remotely Attack a Jeep on the Highway

#360

Post by kbenson » Tue, Jul 21, 2015, 6:05 PM UTC

marssaxman wrote: post #351

kbenson wrote: post #332

Earlier quoted context omitted.

So what are we supposed to do instead? Rely on self policing by the individuals or the industry? The the police or judicial system is off track, you attempt to correct them, not ignore them and route around them. That may unfortunately end up with injustice for some while the correction is ongoing, but that's the normal state. There's always correction that needs to happen, and there's always injustice, that's the no…

If an angry bear is terrorizing your campground, then yes, call fish & wildlife so they can shoot it with a tranq dart and haul it off somewhere safe. In the meantime, though, do you go about your life as though nothing is wrong? Hell no, you get the fuck away from the angry bear! And tossing chocolate bars into your neighbor's campsite in hopes that the angry bear will wreck their stuff is just not cool.

I agree, but I fail to see how that relates to the current context.

Unless the unruly bear is these security researchers, the fleeing campers are other security researchers in the same field, and their fleeing is them correctly assessing that some LEA is going to be taking down any bears nearby that even twitch wrong after this.

Bad actors ruin it for everyone.