Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Remotely Attack a Jeep on the Highway

wired.com

Post reply on HN
Print view View original

371–380 of 640 posts

Re: Hackers Remotely Attack a Jeep on the Highway

#371

Post by maxerickson »

MixedFraction wrote: post #239
Someone1234 wrote: post #148

Earlier quoted context omitted.

> but if an accident did happen then I'm not so sure the researchers or journalist would be at fault. So the people that purposely tried to cause the accident wouldn't be at fault for the accident if it occurred..? I find it highly amusing that in your scenario you're using an unpredictable failure as an equal for an intentional act. A better scenario would be: I open your car bonnet while you go to the bathroom. I h…

There's a huge difference between stopping on the highway and decelerating due to lack of engine power. The driver knew what was happening, turned on his hazard lights, and didn't apply the brakes. Slowing down on the highway, although annoying, shouldn't be an unfamiliar or unsafe scenario (ex: construction, traffic backup, etc.) This would be a completely different story if the researchers applied full force to the…

Everything else aside, slowing without good reason is likely to be a traffic infraction (in Missouri, a misdemeanor punishable by 1 year in jail!).

It isn't that convoluted to hold the driver responsible for the vehicle, they knew prior to driving into the area with a minimum speed that there was some intent to tamper with it.

Re: Hackers Remotely Attack a Jeep on the Highway

#372

Post by [deleted] »

Lawtonfogle wrote: post #138
lmm wrote: post #71

Earlier quoted context omitted.

Allowing the flaw was negligent. This test was reckless. The law treats knowingly ignoring a risk as worse than unknowingly allowing one.

Unknowingly allowing a risk is a very generous way to describe policies that cut costs by increasing the chance of these risks. The ones who are endangering a small number of people to try to overall increase safety are currently looking at far more legal harm than those who endangered magnitudes more people for the sake of making more money. Don't contribute to stupidity what can be explained by amoral greed.

[deleted]

Re: Hackers Remotely Attack a Jeep on the Highway

#373

Post by Sgt_Apone »

Gracana wrote: post #312
leoc wrote: post #208

Earlier quoted context omitted.

Let's not forget Wired 's responsibility for this either. I wonder what editor Scott Dadich and owners Condé Nast have to say. OTOH, we don't know for certain that the tale of what really happened on the public highway didn't grow in the telling. EDIT: Holy moly https://twitter.com/CondeNast/status/623533074865893376 .

That looks like a staged shot. Highways don't have corners like that.

It's not staged, it's just a parking lot or something. It's mentioned directly in the article which it seems that most people have not even read:

"They demonstrated as much on the same day as my traumatic experience on I-64; After narrowly averting death by semi-trailer, I managed to roll the lame Jeep down an exit ramp, re-engaged the transmission by turning the ignition off and on, and found an empty lot where I could safely continue the experiment.

Miller and Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch."

Re: Hackers Remotely Attack a Jeep on the Highway

#374

Post by yellowapple »

elektromekatron wrote: post #356
dchichkov wrote: post #338

Earlier quoted context omitted.

They've risked people's lives to produce real life looking footage documenting a life threatening event. Without such event present in the footage, car manufacturers can just say "Meh - no big deal". And continue recklessly risking lives by manufacturing unsafe cars without air gap between CAN bus and Internet. Remember, it's the car manufacturers that are the bad guys here, not the white hats... And just think how h…

Blocking the visibility through the windscreen, then shutting off the transmission of a car, that is driving on an interstate overpass in traffic, is not white hat by any stretch of the imagination.

Perhaps not, but it's necessary to get the attention of auto makers so that they stop building such trivially-compromisable systems. This was a couple of security researchers on one car for a proof-of-concept; better to demonstrate these flaws early and with a more limited sample than to watch the pileup of epic proportions that would happen should someone even less scrupulous acquire such control over vehicles on the road.

I don't exactly condone the ethics (or lack thereof) of the researchers, either, but if that's the only way to get proper attention (after previous, more polite and reasoned attempts were simply dismissed by manufacturers), then so be it.

Re: Hackers Remotely Attack a Jeep on the Highway

#375

Post by yellowapple »

sigzero wrote: post #359
dchichkov wrote: post #338

Earlier quoted context omitted.

They've risked people's lives to produce real life looking footage documenting a life threatening event. Without such event present in the footage, car manufacturers can just say "Meh - no big deal". And continue recklessly risking lives by manufacturing unsafe cars without air gap between CAN bus and Internet. Remember, it's the car manufacturers that are the bad guys here, not the white hats... And just think how h…

No. They absolutely did not have to produce a life threatening event. They could have done it 5MPH and car manufacturers would still take notice because it would still spread like wildfire on the Internet. What they did was supremely irresponsible and the cops should have been called.

They already did do it at slower speeds in parking lots. Manufacturers didn't care. They probably still won't care, which means that it's a matter of time before someone even less morally-bound decides to wreak havoc on traffic.

Re: Hackers Remotely Attack a Jeep on the Highway

#376

Post by pizza »

stevendhansen wrote: post #95
tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior

> they cut the transmission. [...] Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed

In what world do we not call the police on this kind of behavior?

Re: Hackers Remotely Attack a Jeep on the Highway

#377

Post by JabavuAdams »

dchichkov wrote: post #338
osconfused wrote: post #253

Earlier quoted context omitted.

I appreciate your call to the cops and your reasoning. I also have driven a significant number of miles for work and have seen a number of people killed in traffic accidents. This "test" was extremely irresponsible. I know I will be downvoted for saying this, but I think you made the correct decision.

They've risked people's lives to produce real life looking footage documenting a life threatening event. Without such event present in the footage, car manufacturers can just say "Meh - no big deal". And continue recklessly risking lives by manufacturing unsafe cars without air gap between CAN bus and Internet. Remember, it's the car manufacturers that are the bad guys here, not the white hats... And just think how h…

So demo it at a race track. The essential point here is that the uninvolved public were placed at real risk of maiming or death.

Your argument is ludicrous, because you're attempting to cast the actors as either good or bad. IMHO they are guys with a good idea and motivation who did a bad thing.

Re: Hackers Remotely Attack a Jeep on the Highway

#378

Post by pc86 »

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

> If I ever learned this had been tested on a vehicle I was in, I'd make sure this cost the researchers dearly.

That's not how civil court works, as I'm sure you're referring to filing a suit against them, for... some nebulous thing? You have to prove damages to be awarded anything in a civil court.

Theoretically let's say that they tested some remote tracking on your vehicle without your consent. What then? If you can prove there was some damage to your vehicle, great, you'll be reimbursed for it. Otherwise?

Content aside, the self-satisfaction and smug attitude of this comment is disgusting.

Re: Hackers Remotely Attack a Jeep on the Highway

#379

Post by pixl97 »

geofft wrote: post #365
kbenson wrote: post #332

Earlier quoted context omitted.

So what are we supposed to do instead? Rely on self policing by the individuals or the industry? The the police or judicial system is off track, you attempt to correct them, not ignore them and route around them. That may unfortunately end up with injustice for some while the correction is ongoing, but that's the normal state. There's always correction that needs to happen, and there's always injustice, that's the no…

"So what are we supposed to do instead" and "Do I trust the police right now" are different questions. I don't like the fact that I trust self-policing by any community (even my own) more than the institution that is supposed to be doing policing. But whether I like it doesn't affect things. I agree that it is important for us, as a free society, to fix policing. In the meantime, the best way to minimize injustice is…

With other recent news releases about insiders being fired in internal affairs departments for findings against the police, I believe, we must assume that the police are self-policing in their own right.

Re: Hackers Remotely Attack a Jeep on the Highway

#380

Post by rhino369 »

stillsut wrote: post #136
danielweber wrote: post #123

Earlier quoted context omitted.

I don't know where the threshold is, but calling yourself a "security researcher" is not a blank slate to do whatever you want. I think it's 100% OK to test on a private car on a private track.

Had my car stall on the highway once. Pretty scary because you lose power-brakes and power-steering as you're trying to pullover. Was it a hacker? Nope, just a dumb mechanic that got trash deep into the air intake during a routine oil change. How many (dumb mechanics)*(routine oil changes) are there in this country? Five-Six orders of magnitude more than auto hackers, which is why I don't see any harm in one more (wh…

Your recklessness is judged by the extra harm risked.

You can't just waive it away because other risk is more dangerous across the entire nation. Under that standard: One little murder is a rounding error compared to the 2.5 mil who die each year.

Post reply on HN