This is scary. Malice or incompetence I think it's unacceptable for systems handling the breaks and other crucial functions of the car to be anywhere close to interacting with internet connection.
I am going to stick to old style cars for a while. This is really scary.
Hackers Remotely Attack a Jeep on the Highway
491–500 of 640 posts
Re: Hackers Remotely Attack a Jeep on the Highway
#492Earlier quoted context omitted.
It was a gradual slowdown. That "non-zero" has enough zeroes after the decimal point for Japan to send the number to Hawaii and have another go at Pearl Harbor. Worst-case scenario, somebody might've been rear-ended. Maybe a bit of whiplash. That's not great, either, but seeing as more-controlled tests by these researchers were outright ignored by auto manufacturers, your priorities have to be incredibly out of whack…
I feel like we might be in an Internet fight here but the line about Pearl Harbor is the best thing I've read all day, thanks for that.
No problem. :)
And I wouldn't call this a fight. Just an ethical debate. One that'll probably be a bit heated, of course, given the circumstances, but it's one that needs to be had.
Re: Hackers Remotely Attack a Jeep on the Highway
#493Earlier quoted context omitted.
Life is hard. Sometimes people don't pay attention. Pulling irresponsible stunts isn't an appropriate response "to make people pay the proper amount of attention." If someone had died from this stunt, the total number of deaths from remote hacking of cars would be 1. NB: I highly favor a bounty system where someone who can demonstrate the ability to take over a car without touching it gets paid lots of money, and if…
> If someone had died from this stunt, the total number of deaths from remote hacking of cars would be 1. If this stunt had never happened, we'd be in a position where some less-scrupulous actor would demonstrate such exploits on a much bigger scale. I can guarantee you that the total number of deaths from remote hacking of cars would be far greater than 1. If we're going to play the "OH NO THINK OF THE CHILDREN^H^H^…
I'd like to see the assessment they provided to their review board comparing the risk of their actions with the risk of not doing their actions.
Re: Hackers Remotely Attack a Jeep on the Highway
#494"...whether the Internet-connected computers were properly isolated from critical driving systems, and whether those critical systems had “cyberphysical” components—whether digital commands could trigger physical actions like turning the wheel or activating brakes." Shouldn't this be the most basic design consideration for any company building autos? The liability from litigation should bankrupt any company that does…
It probably depends on how the exploit works. If you can OTA update a firmware that allows wireless control, that is a huge flaw.
But this article doesn't really talk about how the exploit is triggered. This is pure speculation, but I bet it requires some physical access to install. And then the wireless control works.
Why do I suspect that? Why else would the journalist have to travel all the way to St. Louis to test it.
Imagine how huge the story would be if these guys disabled a car they never got within 1000 miles of over the internet.
There is probably some CPU in the Navigation/Entertainment display that needs access to the CANBUS for stuff like warnings, speed, airpressures, etc. and also is connected to the UConnect thing for entertainment purposes. You can't airgap because you need the car data.
So the lazy solution is to just firewall it. Make sure the CANBus controller for the entertainment system only sends data and doesn't receive any. Maybe you encrypt all data transfers on the bus for good measure.
But with temp physical access you can reflash that controller to allow it to give commands it receives from the internet connected entertainment system.
Re: Hackers Remotely Attack a Jeep on the Highway
#495Earlier quoted context omitted.
"So what are we supposed to do instead" and "Do I trust the police right now" are different questions. I don't like the fact that I trust self-policing by any community (even my own) more than the institution that is supposed to be doing policing. But whether I like it doesn't affect things. I agree that it is important for us, as a free society, to fix policing. In the meantime, the best way to minimize injustice is…
This is exactly why I don't think self policing is suitable. If someone broke the law and endangered other people, you or I as possible community members should not be able to decide no police action is involved when others are the people that were actually endangered. Do the people on the road during this situation not have a voice? We are not incentivized correctly to handle this situation suitably. The police and…
>Do the people on the road during this situation not have a voice?
Of course they do. They can call the highway patrol or 911 and report a disabled vehicle. Let's imagine how that call would go.
911: 911, What's your emergency?
Driver: Hi, there was a vehicle travelling slowly on the freeway with its emergency flashers on, I had to switch lanes.
Pause...
Driver: Hello?
911: Sorry, I was waiting for you to finish. Was there any other information? Did the driver or occupants appear to be in distress?
Driver: I don't think so, he was alone and appeared to be talking to someone, perhaps on hands-free, or maybe On-Star?
911: 911 is for emergencies only, in the future please report events of this type to local authorities' non-emergency number accessible via 411. Goodbye.Re: Hackers Remotely Attack a Jeep on the Highway
#496Earlier quoted context omitted.
The IRB as it currently stands it too strict with its regulations. Also, why should the researchers be regulated when the ones producing the things that are initially putting people into danger are not regulated (or are regulated by bureaucrats who couldn't tell you the difference between a buffer overflow and a SQL injection).
> The IRB as it currently stands it too strict with its regulations. WTF are you talking about? There is no the IRB.
>The IRBs as they currently stand are too strict with their regulations.
Better?
Re: Hackers Remotely Attack a Jeep on the Highway
#497Earlier quoted context omitted.
I totally agree that there's a problem here, but I strongly disagree with the method of action. Why not engage the FBI? This is not an issue specific to St. Louis. Throwing some researchers in jail solves nothing. This is a way bigger deal than some local offense. You need an agency with the ability to see the bigger picture.
How is deliberately disabling a vehicle on a highway the FBI's jurisdiction?
How is it not given they could have disabled any vehicle with that vulnerability?
This basically suggests thousands of cars could be driven off the road and deliberately crashed right now. I'd say that's a threat that they need to deal with at the national level on an immediate basis.
Would you rather wait for a malicious actor like North Korea to get involved before the FBI makes a move?
What I'm trying to say is I'd rather the FBI gets involved and works with these researchers to develop an expedient fix for this problem than some beat cop in St. Louis to bust them and throw them in jail where they help nobody and the threat remains extremely grave.
Re: Hackers Remotely Attack a Jeep on the Highway
#498I don't get it. Everyone seems to be either upset at the researchers for their test or defending them.
Why is no one upset at car companies putting tech in our cars that allows for remote shutdown of said car. Is this what we bailed them out for?
Re: Hackers Remotely Attack a Jeep on the Highway
#499Earlier quoted context omitted.
Look at what Toyota did with the whole unintentional acceleration thing. About as irresponsible as you can get.
The ones that turned out to be mostly old people hitting the gas instead of the accelerator?
Perfect point! The fact that you think that was the outcome of the investigation is due to the huge amount of money Toyota spent denying the problem.
Re: Hackers Remotely Attack a Jeep on the Highway
#500Did anyone bother to read the full article? If so, you would find out that it was a [somewhat] controlled experiment. > To better simulate the experience of driving a vehicle while it’s being hijacked by an invisible, virtual force, Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch from Miller’s laptop in his house 10 miles west. > Instead, they merely assured me that th…
be sure to check out the video http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005...
All right, I concede. I did not watch the video but only read the article - that was a bit insane of them.
When I read the article, in my mind, I pictured them driving the car on an empty-ish highway/road. That was clearly not the case.