Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Remotely Attack a Jeep on the Highway

wired.com

Post reply on HN
Print view View original

381–390 of 640 posts

Re: Hackers Remotely Attack a Jeep on the Highway

#381

Post by kbenson »

facetube wrote: post #368
kbenson wrote: post #316

Earlier quoted context omitted.

I think the point is that you, and the researchers, have no right to make that decision for other people. It's illegal to purposefully stop in the middle of the highway. It's illegal to cause someone else to do so as well. People who routinely test things that have the capability for real harm learn to take precautions for as many of the the things you don't think off as you can. For example, the Mythbusters are rout…

Point taken. Maybe I'm just being horribly jaded and/or emotionally invested from too much driving, but after a while it gets hard to discern malice from incompetence, and you start (wisely or unwisely) worrying more about actual outcomes than intent. If I'm hit by a security researcher or a drunk driver or a million miler who had one black swan of a bad day, the result is the same to me: I'm hurt or dead. But perhap…

I agree, I don't necessarily want them to go to jail, but I would be happy if they were suitably scared shitless for a while as the enormity of how bad they fucked up (if the facts are as they seem) hits them. Part of the benefit of the extreme reactions from the people here is that future security researchers working on interactions between software and hardware appliances that may pose a physical threat will have an example of exactly why you should show your proof in a controlled environment.

It's actually not that different than pure software security research. You don't show a POC for your new DNS exploit by doing it against Comcast or AT&T public DNS servers without expecting some blowback. You set up a test environment.

Re: Hackers Remotely Attack a Jeep on the Highway

#383

Post by JabavuAdams »

stevendhansen wrote: post #95
tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

Test pilots work from very careful plans in order to gradually test the envelope of huge powerful machines filled with explosive fuels.

Their test-engineers don't say "hey, we're going to do some stuff, but try not to kill anyone".

Gross negligence.

Perhaps you are simply unaware of how dangerous the situation was? Several experts (ex-truckers) have described how they have seen people killed in circumstances like this. If you're being intellectually honest, that should inform your responses.

Re: Hackers Remotely Attack a Jeep on the Highway

#384

Post by doktrin »

tombrossman wrote: post #216
stevendhansen wrote: post #95

Earlier quoted context omitted.

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and…

I support your decision. Disabling a vehicle in uncontrolled conditions on a freeway is reckless, plain and simple.

Re: Hackers Remotely Attack a Jeep on the Highway

#385

Post by MichaelGG »

jblow wrote: post #242

This discussion is going insane. I see lots of people arguing about the safety of how these guys conducted the hack. Okay, sure, there is probably an issue there of some degree. But it's a very small issue compared to the fact that hundreds of thousands of vehicles are arbitrarily hackable right now , with more rolling off the assembly line all the time, and people are driving these around right now . Why is most of…

Why? Because this kind of idiocy makes it easier to push for laws that limit security research. Yesterday, Google had a top post on HN about new regulation. And Google's asking for exemptions that benefit them, but would still block a lot of security researchers from publishing as they see fit.

When these guys acted reckless, it hurts all of us. Even if the car company is 1000x worse.

Re: Hackers Remotely Attack a Jeep on the Highway

#386

Post by deelowe »

Gracana wrote: post #312
leoc wrote: post #208

Earlier quoted context omitted.

Let's not forget Wired 's responsibility for this either. I wonder what editor Scott Dadich and owners Condé Nast have to say. OTOH, we don't know for certain that the tale of what really happened on the public highway didn't grow in the telling. EDIT: Holy moly https://twitter.com/CondeNast/status/623533074865893376 .

That looks like a staged shot. Highways don't have corners like that.

Did you watch the video? It's not staged. They killed the brakes (only possible below a certain speed).

Re: Hackers Remotely Attack a Jeep on the Highway

#387

Post by a-dub »

meh. cars stall all the time. if they hadn't gone for the freakout factor with the reporter, there wouldn't be high profile press, embarrassed automotive executives and politicians scrambling to get a handle on the issue.

the real issue is that the automakers are producing fundamentally dangerous vehicles and the federal government is allowing it. these vehicles could be exploited maliciously to cause serious physical harm or death.

this is actually a problem. not some onetime stall of a jeep on the highway.

Re: Hackers Remotely Attack a Jeep on the Highway

#388

Post by kbhn »

Phlarp wrote: post #301
tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Can you clarify exactly where the line is between what you've done here today, and an outright swatting? I'm not trying to equivocate the two, but it would seem they both exist somewhere on the same continuum of personal information and police involvement. How much do you think your decision to make this call was influenced by your perception of what law enforcement does in Europe vs. what law enforcement does here i…

Outright swatting: "911, my name is , I live at , and I'm currently holding my girlfriend hostage with a shotgun and plan on killing us both in 30 minutes."

What tombrossman did: "911, I saw a video of researchers shutting down a car on a freeway in the middle of the day with little concern to public safety, can you guys investigate and make sure that nobody's life was in danger for this experiment?"

I don't think there's even a tangential comparison between the two.

Re: Hackers Remotely Attack a Jeep on the Highway

#389

Post by nostromo »

tombrossman wrote: post #216
stevendhansen wrote: post #95

Earlier quoted context omitted.

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and…

There's calling the police, and then there's publishing their phone number in the hopes of directing an angry mob.

Angry mobs are dangerous and volatile and can push prosecutors to overreact. And prosecutors and politicians love to overreact when it comes to hacking.

Re: Hackers Remotely Attack a Jeep on the Highway

#390

Post by chrisdbaldwin »

adamtj wrote: post #201

Should hackers actually kill somebody, I struggle to find a reason why the relevant automotive engineers and their managers shouldn't be charged and convicted of negligent homicide, or worse. After all, somebody had to make the decision to connect a radio receiver to the CAN bus. Others are aware of the wireless and choose not to remove it. To be a professional is to have a duty to refuse to do stupid stuff like this…

>What am I missing?

The bottom line - a cost/benefit analysis from a corporation.

Post reply on HN