Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Remotely Attack a Jeep on the Highway

wired.com

Post reply on HN
Print view View original

611–620 of 640 posts

Re: Hackers Remotely Attack a Jeep on the Highway

#611

Post by aaron695 »

tombrossman wrote: post #216
stevendhansen wrote: post #95

Earlier quoted context omitted.

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the d…

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and…

> I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up.

The fact you have included their phone number seems to me like you are instigating some sort of lynch mob.

If you actually though it was an issue you would have privately contacted them without telling the world.

Very childish.

This is a big story that the appropriate authorities will be looking at anyway.

Re: Hackers Remotely Attack a Jeep on the Highway

#612

Post by danielweber »

kbenson wrote: post #571
danielweber wrote: post #149

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Institutional_review_board is how normal people deal with this.

No, I think notifying the police, who then notify the IRB is how normal people would deal with this. I don't expect the normal person knows about the IRB (I'm not surprised it exists, but I was unaware of it). In a similar vein, if you notified your local police about a kidnapping they would notify the FBI, because kidnapping is the FBI's jurisdiction.

By "deal with this" I meant "deal with the fact that researchers have giant blind spots about the ethical impacts of their research."

I don't expect Joe Random to know to contact these guys' IRB, when they likely don't have one at all.

Re: Hackers Remotely Attack a Jeep on the Highway

#613

Post by alexivanovs »

tombrossman wrote: post #12

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting…

Wow. You need to cry a little harder.

Re: Hackers Remotely Attack a Jeep on the Highway

#614

Post by innguest »

vernie wrote: post #575
innguest wrote: post #166

If Myth Busters tested some wacky car on a public road at 70mph without telling anyone, we'd all be freaking out. But because they were "researchers" (i.e. the same tribe as most leftist people here) from a university (leftist church) then they get a pass and all sorts of justification for why what they did was OK. EDIT: Leftists go by label. They will heart any "researcher" thinking they must be their peer in their…

I'm getting the sense that you have an issue with leftists.

Your reply is the funniest so I'll answer you. :)

"Leftist" simply means someone on the left side of the political spectrum that goes from Totalitarianism all the way to Free Markets. The reason I say "leftist" is because if I say "democrats" or "liberals" I will be excluding a lot of people; and I'll be talking about US politics. Whereas when I say "leftist" I mean anyone in the world that leans towards centralization of power over free markets without intervention form constituencies.

I have an issue with anyone that wants to change my life via the power of voting, or thinks that is acceptable behavior. I am a non-interventionist when it comes to all relationships, be they between two countries, two people, two companies, a company and a person, etc.

If you think it's OK to allow a third party with a monopoly on violence to whimsically change what you are allowed to do in your private affairs and relationships, then I honestly think you have not read enough cases of people being wrongly convicted.

Start here for a small dose of that reality: http://www.zerohedge.com/news/2015-07-21/american-nightmare-...

Re: Hackers Remotely Attack a Jeep on the Highway

#615

Post by kbenson »

danielweber wrote: post #612
kbenson wrote: post #571

Earlier quoted context omitted.

No, I think notifying the police, who then notify the IRB is how normal people would deal with this. I don't expect the normal person knows about the IRB (I'm not surprised it exists, but I was unaware of it). In a similar vein, if you notified your local police about a kidnapping they would notify the FBI, because kidnapping is the FBI's jurisdiction.

By "deal with this" I meant "deal with the fact that researchers have giant blind spots about the ethical impacts of their research." I don't expect Joe Random to know to contact these guys' IRB, when they likely don't have one at all.

Ah, fair enough. I interpreted it as you saying people should have contacted the IRB, not the police, regarding this breach of ethics in research.

Re: Hackers Remotely Attack a Jeep on the Highway

#616

Post by talmand »

calgoo wrote: post #67
talmand wrote: post #61

Earlier quoted context omitted.

Are you not supposed to report dangerous, and possibly criminal, situations to the authorities? A witness to such events cannot know if it has already been reported or is known about, are they supposed to just go on with their day? Yep, just drive by that car accident with possible injuries without calling it in because I'm sure someone else has already taken care of it. What's the worse that could happen? The author…

Sorry, but the cops lost that trust from me when the started sending swat teams and abusing power way to much. Since then, to me calling the cops has become a last resort. I dont trust ANY of them because of the few a holes that are abusing their power. Mainly caused because of their policies of shutting up and protecting each others. Until they fix this, i will not trust ANY cop again.

I fail to see how that bears any relevance to anything I stated. Not that I necessarily fully disagree with your sentiment, but you're presenting a related yet different topic.

Re: Hackers Remotely Attack a Jeep on the Highway

#617

Post by anfedorov »

mzs wrote: post #568
anfedorov wrote: post #430

The two researchers say that even if their code makes it easier for malicious hackers to attack unpatched Jeeps, the release is nonetheless warranted because it allows their work to be proven through peer review. Huh? If they have a video of their turning a care off remotely, do they really need peer review of the details?

Yes, there have been numerous times when security researchers show video and then the peanut gallery argues if it was staged or not. There is just no way to be sure otherwise.

OK. Then you put a journalist in the video, who makes sure it wasn't staged, and we trust them because their careers depend on their integrity.

Re: Hackers Remotely Attack a Jeep on the Highway

#618

Post by kbenson »

waterlesscloud wrote: post #599
Natsu wrote: post #586

Earlier quoted context omitted.

Here's my attempt at a partial transcript starting from shortly after they disable the accelerator: Driver: "It says 43 miles an hour, but it's not really that fast." [voiceover omitted] Driver: "Guys, I'm stuck on the highway." Researcher A: "I think he's panicking." Researcher A: "He's not going to be able to hear us with that radio. So loud." Driver: "Guys, I need the accelerator to work again." Researcher A: "The…

Right, but the video never shows the car stalled on the highway. It's moving in every highway shot. It's in the righthand lane, not in the center. The driver is somewhat panicked. We can see how fast he's moving relative to the background. This discussion has been distorted and sensationalized, and it has not been based on observable recorded facts.

A car stalling does not necessarily indicate it is stopped. Stalled can indicate the vehicle is stopped, or it can also indicate the motor has stopped. Airplanes stall, and obviously they are not entirely stopped, it's just an indication that the motor has stopped. It's unclear as to whether the motor actually stopped, but it's not without precedent to use "stall" to indicate no power available for propulsion.

I don't think this discussion has been distorted. It's based on the information they provided. They put a vehicle on a public highway traveling at the faster end of what's legal in the US on public roads, and then removed a large portion of the drivers ability to control the vehicle. It's unclear whether this affected the steering or brakes, which in a modern vehicle would both be power assisted, generally through the vacuum system of the vehicle. The vacuum is provided by the engine, so if the engine was actually off (which is unknown, but I think it's more likely they just forced the car into neutral), then they removed a large portion of his ability to control the car.

The bottom line is that they put a driver in a situation not only unsafe to himself (which they could have gotten consent to), but unsafe for the other drivers on the road. They did not have consent from the other people on the road to do this (indeed, it's not possible they could have), and if what they purport to happen in the article and video did happen, then they endangered those people. I've seen accidents from stopped cars being hit by others. If the highway is busy enough, the initial accident isn't even necessarily the largest damage, but it moves vehicles into even more obstructing positions and causes follow-on accidents.

https://www.google.com/search?q=stalled+car+accident&tbm=isc...

Re: Hackers Remotely Attack a Jeep on the Highway

#619

Post by daveloyall »

daveloyall wrote: post #366
bengali3 wrote: post #329

Earlier quoted context omitted.

Make sure you watch the video, i missed it the first time through.

I had missed it, too, thanks. Okay, okay, I'll admit that they could have done it on an open stretch of road... Which is what I had pictured.

So, I apologize.

I thought about this thread during my drive home. I thought about hacking my own car's systems while driving...

I immediately realized: no WAY. No, no, no. What if I accidentally BRICK the thing, while driving?

Remember that model of car that lost steering and braking when the ignition key fell out due to a manufacturing defect? What if the Jeep would lose steering when bricked?

It is morally unforgivable to even try to change the radio station while a human is sitting in the "brick" if said brick is moving at 70mph. Especially since the software is known to be faulty.

"Known to be faulty" does bring us back to the manufacturer. I think that much of the anger directed at the hackers should be directed back at the manufacturer.

That being said... Back to the original topic of this particular comment: I apologize. Thanks HN for making me think a little harder.

Re: Hackers Remotely Attack a Jeep on the Highway

#620

Post by kbenson »

Canada wrote: post #462
nnbvv wrote: post #269

Earlier quoted context omitted.

Right, yesterday my neighbor shot a gun at me several times but since he missed and no one was hurt, it would have been utterly inappropriate for me to contact the authorities.

Being shot at (intentionally or otherwise) is entirely different than a car in front of you slowing to a stop.

Firing a gun at someone is dangerous. A car slowing down and/or with reduced visibility on a busy highway is dangerous. Then either of these situations happen by accident, we understand that there's not a lot to do about them because there was no intentional behavior that needs correction. When they are purposefully done, that's endangering people, and is unacceptable behavior that needs correcting. In this respect, they are no different.
Post reply on HN