Hackers Remotely Attack a Jeep on the Highway • Hacker News Board

Re: Hackers Remotely Attack a Jeep on the Highway

#561

Post by cmdrfred » Tue, Jul 21, 2015, 11:17 PM UTC

stevendhansen wrote: post #95

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

I'm not for agitating the authorities on this one. Sometimes security research like this requires a little performance art to get the message across. Guys like Elon Musk just need a proof of concept to modify his designs, incumbents like Fiat Chrysler need exactly this. Remember Toyota?

Re: Hackers Remotely Attack a Jeep on the Highway

#562

Post by gpcz » Tue, Jul 21, 2015, 11:21 PM UTC

elektromekatron wrote: post #555

gpcz wrote: post #396

Earlier quoted context omitted.

Using violent methods (such as intentionally sabotaging a car on a busy freeway with someone in it) to get media attention in order to further a political goal sounds a lot like the definition of terrorism.

Only if your sense of scale has stopped functioning. It is a dangerous journalistic prank that probably does deserve a telling off from traffic cops, to much the same level as someone who is drunk driving. But I think trying to classify it as terrorism is not helpful or particularly sane.

At what scale would you consider it to be terrorism?

Re: Hackers Remotely Attack a Jeep on the Highway

#563

Post by sul4bh » Tue, Jul 21, 2015, 11:23 PM UTC

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Real world scenario was used to gain more publicity and to get mainstream media sources attention. People get attracted to catchy titles and can relate the incident to themselves because it happened on a highway. Nobody bats an eye if the test was done on a parking lot.

Re: Hackers Remotely Attack a Jeep on the Highway

#564

Post by mzs » Tue, Jul 21, 2015, 11:25 PM UTC

cromulent wrote: post #326

Previous research on this topic from 2010: http://www.autosec.org/pubs/cars-oakland2010.pdf6 Experimental Security Analysis of a Modern Automobile "Even at speeds of up to 40 MPH on the runway, the attack packets had their intended effect, whether it was honking the horn, killing the engine, preventing the car from restarting, or blasting the heat. ... In particular, we were able to release the brakes and actually pr…

There is an extraneous "6" at the end of the paper url, it should instead be:

http://www.autosec.org/pubs/cars-oakland2010.pdf

Re: Hackers Remotely Attack a Jeep on the Highway

#565

Post by mzs » Tue, Jul 21, 2015, 11:28 PM UTC

floatingatoll wrote: post #342

Please take a moment to write the NHTSA about this hack and ask them to issue a recall for the affected vehicles. http://www.nhtsa.gov/Contact

I don't know if it will do much good, even if it did eventually lead to a recall, FCA (parent of Jeep) is under investigation by the NHTSA for allegedly poor handling of recalls.

http://www.detroitnews.com/story/business/autos/chrysler/201...

Re: Hackers Remotely Attack a Jeep on the Highway

#566

Post by mzs » Tue, Jul 21, 2015, 11:35 PM UTC

otikik wrote: post #282

When I studied real time systems, it was clear that critical systems (in this case the brakes, accelerator, wheel) needed to be in a physically separate network from non-critical ones (music, air conditioning). I guess it must be cheaper to build all in a single network, but it sounds irresponsible. Also, this test should not have been done in a public road. That was irresponsible.

There often are multiple CAN buses (though there is a push to a single high speed bus) and the ECU (or BCM and so on) are supposed to make sure the commands are safe. In practice they often communicate with one another (manufactures want to sell features like remote start or use cheaper system such as electric parking brake) and the module does not do as much verification as it should.

Re: Hackers Remotely Attack a Jeep on the Highway

#567

Post by AlexandrB » Tue, Jul 21, 2015, 11:36 PM UTC

pavel_lishin wrote: post #543

stonogo wrote: post #436

Earlier quoted context omitted.

Read up on CAN-BUS. The entire industry is moving to one-wire protocols to reduce the labrynthine copper network that prevailed in the past. If you can put your transmissions diagnostic information on the radio's nice big LCD, why wouldn't you? Some would say "this, this is why", but those people are not responsible for selling and maintaining millions of vehicles.

> If you can put your transmissions diagnostic information on the radio's nice big LCD, why wouldn't you? Surely there's a way to make this information read-only. I can see information about my engine on my dashboard via the speedometer and tachometer; it would be ludicrous if I could kill my engine by grabbing the little needles and cranking them down to zero.

> Surely there's a way to make this information read-only.

There absolutely is a way. Just off the top of my head you could relay the information from the high-sec CAN bus to a low-sec one with a micro-controller. So the low-sec bus can only receive messages from the high-sec one.

Not enabling firmware loading over CAN on the relay is a must as well for obvious reasons, but the key is the code on the relay microcontroller can be kept very simple (easier to audit/secure).

Re: Hackers Remotely Attack a Jeep on the Highway

#568

Post by mzs » Tue, Jul 21, 2015, 11:38 PM UTC

anfedorov wrote: post #430

The two researchers say that even if their code makes it easier for malicious hackers to attack unpatched Jeeps, the release is nonetheless warranted because it allows their work to be proven through peer review. Huh? If they have a video of their turning a care off remotely, do they really need peer review of the details?

Yes, there have been numerous times when security researchers show video and then the peanut gallery argues if it was staged or not. There is just no way to be sure otherwise.

Re: Hackers Remotely Attack a Jeep on the Highway

#569

Post by rebootthesystem » Tue, Jul 21, 2015, 11:39 PM UTC

I revisited this thread and thought: How would I go about running these tests and creating awareness for this issue?

A dynamometer would cover the vast majority of what they wanted to show. There was no need to create the danger they created with this vehicle. They really didn't know how the driver would react, "don't freak out" guarantees nothing. A professional driver (like a stunt driver) would have been far more appropriate.

The business about disabling the breaks should have been done a pile of hay bundles or something like that in front of the car.

For exposure they could have contacted any number of TV stations or networks who would have jumped on this immediately.

In all, the choices they made were reckless, stupid, dangerous and potentially criminal. I don't doubt their tech credentials at all. They are tech-smart people, no question about that. However, they have proven, beyond a reasonable doubt, that they are poster children for that stereotype of socially clueless engineers and/or the other stereotype of scientists/engineers who are so into what they are doing that they are completely blind to the idea that they could seriously harm people through their careless actions or inaction.

Re: Hackers Remotely Attack a Jeep on the Highway

#570

Post by mzs » Tue, Jul 21, 2015, 11:43 PM UTC

asd wrote: post #232

I'm willing to bet FCA wil recall all of these "UConnect" enabled vehicles within a month to patch this. This will blow up fast.

You might lose some money:

http://www.detroitnews.com/story/business/autos/chrysler/201...

There is a patch available, but that is not a recall. A recall takes some time under the best circumstances and FCA pushes back hard on expensive ones.