Automakers Trying to Prevent Hackers from Commandeering Cars • Hacker News Board

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#11

Post by robmcm » Thu, Aug 06, 2015, 1:09 PM UTC

rjsw wrote: post #9

robmcm wrote: post #5

Earlier quoted context omitted.

Any bridge between an air gap poses a risk. I am not sure why you would need access to the system that controls the breaks/steering/engine. Perhaps to pre-heat the car, or the sat-nav may feed topology to suspension etc. If they introduce over the air software updates I would be more worried :/

The earliest linkage that I know of between the vehicle data network and an entertainment system was to be able to automatically increase the radio/CD volume at higher speeds. This was long before phones were built in to the dashboard so there wasn't as much of a requirement for security, once you are inside the car the diagnostic connector will give you access to the whole network anyway. I don't know of a read-only…

> increase the radio/CD volume at higher speeds

These days we could work around these sorts of things by using microphones, which would then take things like road surface, or opening a window into consideration.

> The first time I updated ECUs over the air would be over 15 years ago

You had a car with a wireless data connection in 2000?

My fear is that it's too late to start thinking about security. How many manufacturers will be willing to re-think their cyber security, and re design it from the ground up, when some are willing to release a car with a faulty ignition to save a few dollars.

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#12

Post by outworlder » Thu, Aug 06, 2015, 1:40 PM UTC

Can't we just stop using the (admittedly convenient) CAN bus for this sort of communication? It was never designed for what people are using it for these days.

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#13

Post by dkx » Thu, Aug 06, 2015, 1:58 PM UTC

"But two Democratic senators, Edward Markey of Massachusetts and Richard Blumenthal of Connecticut, have introduced a bill that would force the industry to seal off critical computers and add technology to stop hackers in real time."

Why do governments feel the need to dictate the little details? Instead of forcing all car manufacturers to secure cars in the exact same way how about just holding them liable for the consequences if a car is hacked? Car makers can then decide how best to secure the car which would lead to a more diverse and hopefully innovative security measures.

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#14

Post by Lorento » Thu, Aug 06, 2015, 2:06 PM UTC

nsns wrote: post #4

But if these cars can be "commandeered", they (i.e. my movements) could also easily be tracked by the companies themselves (with the information then sold to "trusted partners"). For some reason, that frightens me more.

If you live in the US or UK, your movements are already being tracked by license plate reading cameras.

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#15

Post by jdc0589 » Thu, Aug 06, 2015, 2:26 PM UTC

This is the easiest problem in the world to fix going forward... The entertainment system (usually the entry point for this kind of stuff) has no business being connected to any core systems (steering, throttle, brakes, ignition). Just keep the core systems separate, without any connectivity to ANYTHING that can be accessed remotely.

Boom. problem solved.

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#16

Post by iolothebard » Thu, Aug 06, 2015, 2:27 PM UTC

dkx wrote: post #13

"But two Democratic senators, Edward Markey of Massachusetts and Richard Blumenthal of Connecticut, have introduced a bill that would force the industry to seal off critical computers and add technology to stop hackers in real time." Why do governments feel the need to dictate the little details? Instead of forcing all car manufacturers to secure cars in the exact same way how about just holding them liable for the c…

Because by the time it gets to Congress, the auto makers have clearly avoided fixing the issues themselves for pushing a half decade or more.

If they did things the right way, we wouldn't be at this point. Now they get the hammer.

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#17

Post by pdkl95 » Thu, Aug 06, 2015, 2:53 PM UTC

Lorento wrote: post #14

nsns wrote: post #4

But if these cars can be "commandeered", they (i.e. my movements) could also easily be tracked by the companies themselves (with the information then sold to "trusted partners"). For some reason, that frightens me more.

If you live in the US or UK, your movements are already being tracked by license plate reading cameras.

While this is true, it only works where cameras are present, and adding a significant number of cameras costs time and money.

COTRAVELER[1] is much easier and costs almost nothing. Just having a cellphone in a car (either in the driver's pocket or "OnStar") - which only needs to be on and giving presence notifications to the local tower - is enough to get very accurate near-realtime tracking information. The only costs are read-only access to the tower logs and a few SQL JOINs.

[1] https://www.washingtonpost.com/apps/g/page/world/how-the-nsa...

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#18

Post by tertius » Thu, Aug 06, 2015, 3:00 PM UTC

dkx wrote: post #13

"But two Democratic senators, Edward Markey of Massachusetts and Richard Blumenthal of Connecticut, have introduced a bill that would force the industry to seal off critical computers and add technology to stop hackers in real time." Why do governments feel the need to dictate the little details? Instead of forcing all car manufacturers to secure cars in the exact same way how about just holding them liable for the c…

Holding them liable will kill the automotive industry quicker than competition can meet demand.

"Add technology to stop hackers in real tie." Because backdoors never backfire.

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#19

Post by ams6110 » Thu, Aug 06, 2015, 3:24 PM UTC

jdc0589 wrote: post #15

This is the easiest problem in the world to fix going forward... The entertainment system (usually the entry point for this kind of stuff) has no business being connected to any core systems (steering, throttle, brakes, ignition). Just keep the core systems separate, without any connectivity to ANYTHING that can be accessed remotely. Boom. problem solved.

Except the cars are not wired that way, and design changes are expensive once cars are in production (kind of like software in that way, only moreso because they are physical things).

Re: Automakers Trying to Prevent Hackers from Commandeering Cars

#20

Post by comrh » Thu, Aug 06, 2015, 3:25 PM UTC

jdc0589 wrote: post #15

This is the easiest problem in the world to fix going forward... The entertainment system (usually the entry point for this kind of stuff) has no business being connected to any core systems (steering, throttle, brakes, ignition). Just keep the core systems separate, without any connectivity to ANYTHING that can be accessed remotely. Boom. problem solved.

I had this same thought but someone in another hn thread had a good point about how a lot of features still use the core systems. Remote starting your car (a common aftermarket feature for the last 20 years) from an app now obviously needs access to the engine. Even if you disconnect the "core systems" they're still probably going to be connected to the internet.