Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#511

Post by Semiapies » Tue, Jul 21, 2015, 9:01 PM UTC

yellowapple wrote: post #507

jameshart wrote: post #506

Earlier quoted context omitted.

You're repeatedly posting on this thread that "the manufacturers" have ignored the researchers' previous tests. That doesn't seem to be true; Chrysler (the singular manufacturer involved) have, after being alerted to the hack prior to this report, already issued a patch. The researchers are practicing responsible disclosure, have the co-operation of the manufacturer, and are going public with the details at Blackhat…

My remarks were strictly based on the claims of the article. Nothing more, nothing less. The article claims that the researchers performed prior tests, and that said tests were dismissed by auto manufacturers. If we're going to take one component at face value (the idea of the reporter putting others in danger), it would be unfair to not extend the same courtesy to the rest of the article.

"My remarks were strictly based on the claims of the article. Nothing more, nothing less."

Perhaps you should educate yourself before saying stupid, reckless things. The claims of the article are no defense.

Re: Hackers Remotely Attack a Jeep on the Highway

#512

Post by qu4z-2 » Tue, Jul 21, 2015, 9:03 PM UTC

baakss wrote: post #333

tombrossman wrote: post #216

Earlier quoted context omitted.

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and…

>I exercised my judgement and decided to phone the local Highway Patrol office. That was rash. You called the police within an hour of reading this article? You didn't think it's possible the writer is embellishing or exaggerating the danger he was in here? As of right now, everything they've done has been done in good faith to try to point out the need for extra security. Also, if they get arrested, even convicted o…

While you may question the morality of notifying the Highway Patrol, your second paragraph doesn't address that issue at all. In fact, if you think that's how the security researchers think and behave, then I'd argue notifying the Highway Patrol was definitely the right choice.

EDIT: Formatting.

Re: Hackers Remotely Attack a Jeep on the Highway

#513

Post by andrewfong » Tue, Jul 21, 2015, 9:05 PM UTC

yellowapple wrote: post #490

andrewfong wrote: post #446

Earlier quoted context omitted.

I've read the article. Where does it mention controlled environments? The only mention of exploits being dismissed by manufacturers was in regard to a wired exploit, not a remote one.

The paragraphs after the photo of Charlie Miller describe the process of identifying and isolating wireless exploits, including remote-activation of windshield wipers on a vehicle in one of the researchers' driveways. This did admittedly escalate quickly to passive "tagging" of vulnerable vehicles by VIN, but that's a far cry from the experiment in question. The findings before physical tests (identifying cars with a…

You're reaching.

First, there's no indication in the article that the researchers or Wired presented the remote windshield wiper hack to the car's manufacturer and that they subsequently ignored it.

Second, there is plenty of indication that the exact opposite is true. The remote windshield wiper hack occurred this June, whereas the article states that they've been working with Chrysler on this for nearly nine months and that Chrysler released a patch prior to the publication of this article.

Third, the Cadillac anecdote isn't really relevant here. For starters, it looks like they were contacted by Wired, not the researchers, so it's unclear whether they were contacted before the dangerous freeway demonstration took place. And while the mention of the newer model is a bit odd, the statement also mentions devoting more resources and hiring a new cyber-security officer, making it unfair to characterize it as a "whatever" response.

Sure, it'd be nice if Cadillac was a little more proactive here, but keep in mind that the researchers hacked a Jeep (made by Chrysler), NOT a Cadillac (made by GM). The researchers think the Cadillac is also vulnerable based on its feature set, but absent a specific flaw to patch and given the short amount of time since the initial demonstration (less than two months), it's unclear what GM is supposed to do here.

Re: Hackers Remotely Attack a Jeep on the Highway

#514

Post by waterlesscloud » Tue, Jul 21, 2015, 9:05 PM UTC

bengali3 wrote: post #322

osconfused wrote: post #253

Earlier quoted context omitted.

I appreciate your call to the cops and your reasoning. I also have driven a significant number of miles for work and have seen a number of people killed in traffic accidents. This "test" was extremely irresponsible. I know I will be downvoted for saying this, but I think you made the correct decision.

Agreed. I missed the video the first time and didn't believe the text that described the shutdown, video shows the stupidity here, let alone release a recording of it. I expect that will come down soon. Important research but very poorly tested. Wired and Chrysler (research was funded by Chrysler?) legal teams would not like the contents of this video. edit: wired's link to video, jump to 2:00: http://dp8hsntg6do36.c…

So watching the video, I don't see a vehicle stalled on the highway.

What I see is a vehicle slowed considerably, but at least nominally over the legal minimum speed of 40 MPH on highways, and without the driver being able to accelerate on his own. He's travelling in the rightmost lane, explicitly with his hazard lights on. This is not an unusual occurrence on highways. He's then told that to regain control he needs to stop and restart the car, which he does while remaining in motion.

I was surprised, since this is quite different from the way it's being talked about here, as if he was stopped in the middle of the freeway. See GGP comment about "a car stopped in the middle of a multi-lane interstate."

That's not what happened here.

Re: Hackers Remotely Attack a Jeep on the Highway

#515

Post by [deleted] » Tue, Jul 21, 2015, 9:08 PM UTC

kbenson wrote: post #427

nostromo wrote: post #389

Earlier quoted context omitted.

There's calling the police, and then there's publishing their phone number in the hopes of directing an angry mob. Angry mobs are dangerous and volatile and can push prosecutors to overreact. And prosecutors and politicians love to overreact when it comes to hacking.

He published the number of the local law enforcement agency. That is not directing an angry mob, that's helping people voice their opinion to the people responsible for enforcing laws.

[deleted]

Re: Hackers Remotely Attack a Jeep on the Highway

#516

Post by monad2000 » Tue, Jul 21, 2015, 9:09 PM UTC

acaloiar wrote: post #413

yellowapple wrote: post #374

Earlier quoted context omitted.

Perhaps not, but it's necessary to get the attention of auto makers so that they stop building such trivially-compromisable systems. This was a couple of security researchers on one car for a proof-of-concept; better to demonstrate these flaws early and with a more limited sample than to watch the pileup of epic proportions that would happen should someone even less scrupulous acquire such control over vehicles on th…

Had that Jeep run into you or you ran into it as a result of this experiment, you may have found that you have a profoundly different threshold for what is, "necessary to get the attention of auto makers". Just because automakers are seemingly keen on ignoring security vulnerabilities does not justify putting people's lives at risk. And let's face it – a multi-ton vehicle that is not entirely in its driver's control…

Exactly right. This should have been done on a test track.

Re: Hackers Remotely Attack a Jeep on the Highway

#517

Post by freehunter » Tue, Jul 21, 2015, 9:17 PM UTC

marssaxman wrote: post #320

edanm wrote: post #260

Earlier quoted context omitted.

Your post basically boils down to: 1. You don't trust the police/legal system. 2. You trust our own community more. Not saying I agree or disagree, but there are a LOT of people who would really disagree with this, and a lot more who would think that someone saying "why involved the actual people the public has chosen to deal with this, we can deal with it ourselves" would be very wrong.

It's hard to imagine how anyone familiar with any part of the police/legal system's pattern of clueless, ham-handed, hierarchy-ridden interaction with technology over the last 30 years could find justification to continue extending them trust.

Have you seen the damage being caused by "hackers" lately? I don't trust the police, but I don't trust my fellow hackers any more, especially when you consider their clueless, ham-handed interaction with the general public over the last 30 years.

Re: Hackers Remotely Attack a Jeep on the Highway

#518

Post by kbenson » Tue, Jul 21, 2015, 9:18 PM UTC

fnordfnordfnord wrote: post #495

kbenson wrote: post #399

Earlier quoted context omitted.

This is exactly why I don't think self policing is suitable. If someone broke the law and endangered other people, you or I as possible community members should not be able to decide no police action is involved when others are the people that were actually endangered. Do the people on the road during this situation not have a voice? We are not incentivized correctly to handle this situation suitably. The police and…

>Do the people on the road during this situation not have a voice? Of course they do. They can call the highway patrol or 911 and report a disabled vehicle. Let's imagine how that call would go. 911: 911, What's your emergency? Driver: Hi, there was a vehicle travelling slowly on the freeway with its emergency flashers on, I had to switch lanes. Pause... Driver: Hello? 911: Sorry, I was waiting for you to finish. Was…

Exactly. In this situation, the people on the road have less information that we do after the fact. People deserve to know if they were put in danger and why. Since this was done on a public highway, anyone that uses public highways has a right to feel upset about the behavior.

I would like to think that a call to 911 with more information (which of course a fellow driver wouldn't have) would be handled differently:

  911: 911, What's your emergency?
  Driver: Hi, someone on the freeway has purposefully disabled their vehicle in a location without shoulders, and is slowing while driving, impeding traffic.  I'm not sure if the power brakes or steering are functioning, but the driver is definitely not in full control of the vehicle.
  911: We've dispatched an officer to your location.  Has there been an accident yet?  Has the driver recovered control of the vehicle?

Re: Hackers Remotely Attack a Jeep on the Highway

#519

Post by freehunter » Tue, Jul 21, 2015, 9:19 PM UTC

droopybuns wrote: post #349

hoopism wrote: post #100

To recap the facts: - Man drives car on public highway @ speeds of up to 70mph - Hackers turn on windshield wipers and fluid to blur view - Hackers Blare music and obscure any comms link to driver - Hackers disable vehicle on Highway at location with no shoulder And there are people who are not only ok with type of experiment but think there should be more of it. I understand that these exploits need to get attention…

Is there anything more human than to react with fear and anger towards scientists who make a difficult problem easy to understand?

There's one thing more human than that, and that is to react with fear and anger when someone senselessly endangers their lives.

Re: Hackers Remotely Attack a Jeep on the Highway

#520

Post by freehunter » Tue, Jul 21, 2015, 9:24 PM UTC

yellowapple wrote: post #409

hoopism wrote: post #100

To recap the facts: - Man drives car on public highway @ speeds of up to 70mph - Hackers turn on windshield wipers and fluid to blur view - Hackers Blare music and obscure any comms link to driver - Hackers disable vehicle on Highway at location with no shoulder And there are people who are not only ok with type of experiment but think there should be more of it. I understand that these exploits need to get attention…

I take it you also can't stop thinking about your wife and kids being behind someone whose engine stalls, or who slams one's brakes to avoid hitting a deer, or who runs out of gas on an interstate (which has happened to me, thanks to my car's faulty fuel gauge). You must have a lot on your mind. I don't agree with the methodology, either, but based on the information in the article, it sounded like the researchers di…

"I didn't have a choice but to fire a gun in the middle of a crowd of people. It was just a wake up call!. You always have a choice. One of those choices is to do the demo, but with the proper safety authorities helping. One of those choices is to perform the demo in a place where it is safe to pull your car over. One of those choices is to do the demo somewhere where the speeds are a little lower.

All of those things you listed are actual emergency situations that are hard to control. This is one thing where they were in full control of, and still decided to do it anyway. They had a choice, and they chose to endanger the public.