Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#361

Post by pyre » Tue, Jul 21, 2015, 6:06 PM UTC

_lce0 wrote: post #251

xirdstl wrote: post #38

Earlier quoted context omitted.

For the same reason I am skeptical of the "Internet of Things". Do we really want every device in our home to be exploitable from someone across the globe? Continually applying firmware updates to appliances to close security holes? Something fundamental has to change about how we handle device security before I want to live in that world.

exactly! I want all my devices to be as dumb as wires. Wired technology just works , out-of-the-box, no setup, no maintenance, no nothing .. just make sure the plug fit in both ends, and done! Wireless technology should work similar, but via the air, like an invisible wire .. not as a open gate to the internet! ..and please let's not add multi-purpose CPU just for the sake of marketing!

What? The Internet of Things is equally exploitable if your devices are connected over ethernet (or ethernet over powerlines). The key factor is whether or not it's connected to the Internet.

Re: Hackers Remotely Attack a Jeep on the Highway

#362

Post by btbuildem » Tue, Jul 21, 2015, 6:06 PM UTC

hoopism wrote: post #100

To recap the facts: - Man drives car on public highway @ speeds of up to 70mph - Hackers turn on windshield wipers and fluid to blur view - Hackers Blare music and obscure any comms link to driver - Hackers disable vehicle on Highway at location with no shoulder And there are people who are not only ok with type of experiment but think there should be more of it. I understand that these exploits need to get attention…

Tell your wife not to tailgate and get off her facebook while driving, and all will be well.

Re: Hackers Remotely Attack a Jeep on the Highway

#363

Post by jbombadil » Tue, Jul 21, 2015, 6:10 PM UTC

Good luck trying to hack my 1971 Volskwagen.

Re: Hackers Remotely Attack a Jeep on the Highway

#364

Post by SonicSoul » Tue, Jul 21, 2015, 6:15 PM UTC

dchichkov wrote: post #338

osconfused wrote: post #253

Earlier quoted context omitted.

I appreciate your call to the cops and your reasoning. I also have driven a significant number of miles for work and have seen a number of people killed in traffic accidents. This "test" was extremely irresponsible. I know I will be downvoted for saying this, but I think you made the correct decision.

They've risked people's lives to produce real life looking footage documenting a life threatening event. Without such event present in the footage, car manufacturers can just say "Meh - no big deal". And continue recklessly risking lives by manufacturing unsafe cars without air gap between CAN bus and Internet. Remember, it's the car manufacturers that are the bad guys here, not the white hats... And just think how h…

That's borderline like saying using crash test dummies is useless because it's not realistic enough for car manufacturers to take it seriously

Re: Hackers Remotely Attack a Jeep on the Highway

#365

Post by geofft » Tue, Jul 21, 2015, 6:16 PM UTC

kbenson wrote: post #332

marssaxman wrote: post #320

Earlier quoted context omitted.

It's hard to imagine how anyone familiar with any part of the police/legal system's pattern of clueless, ham-handed, hierarchy-ridden interaction with technology over the last 30 years could find justification to continue extending them trust.

So what are we supposed to do instead? Rely on self policing by the individuals or the industry? The the police or judicial system is off track, you attempt to correct them, not ignore them and route around them. That may unfortunately end up with injustice for some while the correction is ongoing, but that's the normal state. There's always correction that needs to happen, and there's always injustice, that's the no…

"So what are we supposed to do instead" and "Do I trust the police right now" are different questions.

I don't like the fact that I trust self-policing by any community (even my own) more than the institution that is supposed to be doing policing. But whether I like it doesn't affect things.

I agree that it is important for us, as a free society, to fix policing. In the meantime, the best way to minimize injustice is not to invoke police when there is no immedate threat that can't be otherwise solved.

Re: Hackers Remotely Attack a Jeep on the Highway

#366

Post by daveloyall » Tue, Jul 21, 2015, 6:16 PM UTC

bengali3 wrote: post #329

daveloyall wrote: post #82

So, a HN commentator apparently called the cops on these guys after reading the Wired article. Several commentators more or less agree, arguing that performing these tests on the I-40 was criminally negligent. Stop right there. Grow some balls. These guys are elite, their demo was badass, and I've done stupider things on I-40 for no reason . And wtf you called the cops? head in hand

Make sure you watch the video, i missed it the first time through.

I had missed it, too, thanks.

Okay, okay, I'll admit that they could have done it on an open stretch of road... Which is what I had pictured.

Re: Hackers Remotely Attack a Jeep on the Highway

#367

Post by shas3 » Tue, Jul 21, 2015, 6:18 PM UTC

Duhveed wrote: post #105

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

I was thinking about how dangerous it was while I was reading it too, but I came away far less concerned than you I guess. The deceleration on the highway was the most worrisome, but it's not even in the ballpark of common driving hazards like distracted folks on cellphones or flying debris. A crash from such a thing is unlikely and the inconvenience is pretty minimal. Even you, the busybody who called the cops becau…

When it comes to ethics and moral responsibility, intent and agency are everything! For ethical purposes, it is similar to injecting a person with a flu virus to test if their acaiberry diet has improved their immunity. Yes, they could, even without your intervention, have caught flu and also spread it to others, but as an agent, you have increased that probability of flu occurring and spreading in the community to close to 100% when it could have been very close to zero.

Similarly, the researchers have increased the probability of a crash from the near-zero probabilities that are typical of actuarial tables to close to 100%.

Re: Hackers Remotely Attack a Jeep on the Highway

#368

Post by facetube » Tue, Jul 21, 2015, 6:19 PM UTC

kbenson wrote: post #316

facetube wrote: post #291

Earlier quoted context omitted.

Grass shoulder: http://www.wired.com/wp-content/uploads/2015/07/IMG_0724-102... I agree that it probably presented some level of danger to the public, but I maintain that (i) the added danger was small relative to the normal everyday danger of driving with humans; and (ii) the media exposure they've achieved by doing this on a public road has the potential to pressure Chrysler to remove tens of thousands of hazards (…

I think the point is that you, and the researchers, have no right to make that decision for other people. It's illegal to purposefully stop in the middle of the highway. It's illegal to cause someone else to do so as well. People who routinely test things that have the capability for real harm learn to take precautions for as many of the the things you don't think off as you can. For example, the Mythbusters are rout…

Point taken. Maybe I'm just being horribly jaded and/or emotionally invested from too much driving, but after a while it gets hard to discern malice from incompetence, and you start (wisely or unwisely) worrying more about actual outcomes than intent. If I'm hit by a security researcher or a drunk driver or a million miler who had one black swan of a bad day, the result is the same to me: I'm hurt or dead.

But perhaps a little more objectively, there's certainly a moral hazard here; if every security researcher did this on public roads it'd likely be chaos. An appropriate response, IMO, would be for the police to make a phone call and tell them not to do it again.

Re: Hackers Remotely Attack a Jeep on the Highway

#369

Post by jblow » Tue, Jul 21, 2015, 6:19 PM UTC

phaylon wrote: post #335

jblow wrote: post #317

Earlier quoted context omitted.

They might be reasonable in isolation but are not being levied remotely in proportion. I just realized what the problem is: this is bikeshedding. Everyone knows about people driving around and feels qualified to have moral indignation in that area, whereas few people know anything about actual cars.

No, when people's lives are at stake, I extremely disagree about calling that "bikeshedding".

Please make an effort to read and understand my point.

Yeah, maybe there was a case when a couple peoples' lives were at stake but nothing happened.

The real issue is that tens of thousands or hundreds of thousands of peoples' lives are at stake RIGHT NOW, under conditions that are much less controlled than what people are deriding as uncontrolled conditions. But people are griping about the 1-2 instead of the 10,000-400,000.

How is this not dead simple to understand? I don't get it.

Re: Hackers Remotely Attack a Jeep on the Highway

#370

Post by cmdkeen » Tue, Jul 21, 2015, 6:21 PM UTC

dchichkov wrote: post #354

cmdkeen wrote: post #327

Earlier quoted context omitted.

It can be both, security researchers don't get a free pass just because they are exposing a wrong. Had someone died you might (in countries which have it) get corporate manslaughter on a company that ignored security warnings. You absolutely would on the researchers and the journalist for their reckless disregard for the lives of others.

Yes, researchers don't get a free pass. Nothing is free. They've risked lives and their reputations to save lives. It had happened before in the history. And hopefully it will happen again. Some times it is worth it. (*) without risking lives there wouldn't have been a video documenting these life-threatening vulnerabilities in the cars.

Rubbish - there would be a video of them on a test track. Much like all the videos proving quite how fast the cars can go. You don't drive a McLaren F1 at 240mph on the Interstate and post it to Wired expecting to get away with it...