Winnti: Hackers attacking the heart of German industry • Hacker News Board

Re: Winnti: Hackers attacking the heart of German industry

#141

Post by thesimp » Wed, Jul 24, 2019, 9:06 PM UTC

0xffff2 wrote: post #126

PinguTS wrote: post #74

Earlier quoted context omitted.

Funfact: more than 30% value in a car is software, which is highly interconnected via various type of networks namely, LIN, CAN, MOST, FlexRay, Ethernet. Most current premium cars have more than 10 of those networks and around 100 to 130 ECUs that talk to each other. So much about: they don't know about software. BTW: The difference between IT and automotive aka embedded is that embedded should work even without DevO…

Surely a car only has 1 ECU (Engine control unit). It may well have 100+ micro controllers on board.

That was maybe 15 years ago. These days cars have multiple CANbus networks running and there are control unit everywhere.

Below the details for an Alfa Romeo Giulia, which is interesting because it was a complete new design when introduced in 2016, not a rework of a previous platform:

3 networks run in parallel: These networks and their subnetworks are protected by a Security Gateway Module (SGW).

  - CAN-C (high-speed 500 kb/s)
  - CAN-CH (high-speed 500 kb/s)
  - CAN-IHS (medium-speed 125 kb/s)

Modules connect to 1st network:

  - Body Control Module (BCM)
  - Instrument Panel Cluster (IPC)
  - Occupant Restraint Control (ORC)
  - Radio Frequency Hub (RFH) Module
  - Antilock Brake System Module (ABS)
  - Adaptive Cruise Control Module (ACC)
  - Emergency Assistance Module (EAM)
  - Primary Powertrain Control Module 2.9 V6 (PCM - P)
  - Powertrain Control Module 2.0 I4 DI (PCM)

To 2nd network:

  - ABS Module
  - BCM
  - Electric Steering Lock (ESL)
  - Park Assist Module (PAM)
  - Electric Power Steering (EPS)
  - FFCM - Haptic Lane Feedback (FFCM - HALF)
  - Occupant Restraint Control (ORC)
  - Active Aerodynamic Module Left – Front left Splitter actuator (AAML)
  - Active Aerodynamic Module Right – Front right Splitter actuator (AAMR)
  - Adaptive Front Light System (AFLS)
  - Chassis Domain Control Module (CDCM)
  - Torque Vectoring Module (TVM)

To 3rd network:

  - Instrument Panel Cluster (IPC)
  - Comfort Seat Wheel Module (CSWM)
  - Left Blind Spot Sensor (LBSS)
  - Right Blind Spot Sensor (RBSS)
  - Amplifier (AMP)
  - Trailer Tow Module (TTM)
  - Heating Ventilation and Air Conditioning (HVAC)
  - Entertainment Telematic Module VP2, VP4 (ETM)
  - BCM
  - Entertainment Multimedia Control Module (EMCM)
  - Secondary Powertrain Control Module 2.9 V6 (PCM - S)

Re: Winnti: Hackers attacking the heart of German industry

#142

Post by robocat » Wed, Jul 24, 2019, 9:25 PM UTC

paganel wrote: post #97

trevyn wrote: post #88

Earlier quoted context omitted.

You wouldn't feel confident driving 400 miles in a 2019 German car because of software? What do you envision going wrong?

> you wouldn't feel confident driving 400 miles in a 2019 German car because of software? Because of software and electronics combined, yes. > What do you envision going wrong? One of my closest friends purchased a VW Tiguan last year and not two weeks into his ownership the car left him stranded at the side of the read because of a coolant hose or something similar. If VW cannot make a simple hose not break after on…

Always a good read on the subject:

https://www.yourmechanic.com/article/the-most-and-least-expe...

Re: Winnti: Hackers attacking the heart of German industry

#143

Post by rolltiide » Wed, Jul 24, 2019, 9:26 PM UTC

> Winnti is a highly complex structure that is difficult to penetrate. The term denotes both a sophisticated malware and an actual group of hackers.

Hacking groups are corporations and spread risk away from indictable individuals just as efficiently, with a separation of liability and actions and knowledge

This needs to be understood

Re: Winnti: Hackers attacking the heart of German industry

#144

Post by robocat » Wed, Jul 24, 2019, 9:50 PM UTC

southerndrift wrote: post #139

ChuckNorris89 wrote: post #11

Earlier quoted context omitted.

Germany's tech illiteracy is a self-inflicted consequence of its pitiful salaries in this field, treating IT like a cost center that has to be outsourced to wherever is cheaper and companies' tradition of rewarding management incompetence over technical competence. Consequently, Germany's most brilliant tech minds leave for The Valley, Zurich or London. You reap what you sow.

To add to this: The CDU (conservative party) turned back the decision to role out a fiber network across Germany that would have been constructed from the 80ies until the millenium [1]. If you actively burn your fields, then there is nothing to reap. [1] https://www.heise.de/newsticker/meldung/Missing-Link-Der-Kam...

I really don't get the argument about fibre to the home being good for business.

For working from home, VDSL is pretty much good enough for most working needs (from what I have seen).

Fibre really shines for the consumer - especially video.

We have fibre to the home in New Zealand, and it doesn't make us an IT nation, or meet any of the gushing political waffle about our IT future.

It suspect the costs have a reasonable timeframe for payback as a tax payer: the government "invested" about 500€ per household to cover 80% of the population (1000€ if only 40% of households use it). I would be interested to see numbers to justify it, but is smells ok on the surface.

Re: Winnti: Hackers attacking the heart of German industry

#145

Post by trabant00 » Wed, Jul 24, 2019, 10:48 PM UTC

paganel wrote: post #46

lnsru wrote: post #10

As of today we still use shared network drives for everything in major German company. We don’t use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project’s shared…

The state of the German IT industry outside of a few select places (Berlin, mostly) is what makes me very pessimistic about the future of its car industry. They (meaning the big 3: VW, BMW and Mercedes) apparently still think that building the best engines/transmissions and being the best at putting them all together is all it takes in order to make a modern car, unfortunately I think EVs will be more about software…

> VW, BMW and Mercedes) apparently still think that building the best engines/transmissions and being the best at putting them all together

That stopped being true at least 10 years ago. In 2019 I would bet on a Renault engine every time (so does Mercedes btw :P)

Re: Winnti: Hackers attacking the heart of German industry

#146

Post by srrr » Thu, Jul 25, 2019, 12:17 AM UTC

hiram112 wrote: post #140

srrr wrote: post #109

Earlier quoted context omitted.

Many (senior) developers I know in Berlin get 80000€/year gross income. That is in the top 6% of incomes in Germany. (Top 6% income bracket in the USA would be 150000$/year.) I don't even get 80k€/year and have a very luxurious and high quality life in Berlin. Resource: https://wid.world/simulator/

In Germany, with an 80000€ salary, what would be the monthly take home in your pocket? And I'm assuming they would take out taxes for health system, pension, vacation, etc. In the US in an average taxed state, compare a $150K salary: After federal and state taxes, our old person medical and retirement (i.e. FICA), maximum retirement investment of about $19K, health insurance, disability insurance, dental, etc, one wi…

80k€ would net you between 40-50k€ after all taxes, health insurances and a basic retirement fund. The exact number depends on you having a family or not and many other factors.

In addition your employer pays an amount equal to about 10-15% of your gross salary into your health and retirement insurance. And this pay is on top of your salary. (Arbeitgeberanteil)

Holiday is always included with a minimum of 21 days a year for a full time job. And Germany has paid parental leave included if you start a family.

Re: Winnti: Hackers attacking the heart of German industry

#147

Post by esyir » Thu, Jul 25, 2019, 1:57 AM UTC

hef19898 wrote: post #130

guitarbill wrote: post #105

Earlier quoted context omitted.

Seems to be true in the UK, too. I've heard bad things about e.g. Jaguar Land Rover. As another comment says, this is probably an issue with the embedded industry as a whole. There are great tech companies you can work for, which usually have a very high standard (ARM seems to be great). Stuttgart/Baden-Württemberg is quite conservative. The real mystery for me was why their engineering pride of doing things correctl…

My five cents because the basic design philosophies are quite different. And also industry inherent arrogance, especially within the so called premium manufacturers. Bit the the opposite is true as well isn't it? You cannot treat automotive manufacturing like software development. I'd say the first company to successfully blend the two has a huge advantage.

Technically, even though it does to the fev sides of things, isn't this tesla?

Re: Winnti: Hackers attacking the heart of German industry

#148

Post by akuji1993 » Thu, Jul 25, 2019, 6:59 AM UTC

yorwba wrote: post #62

hakantan wrote: post #31

Earlier quoted context omitted.

This is a very good question. By now, there is a git repo ( https://github.com/br-data/2019-winnti-analyse ) for the more technical folks (includes yara, some scripts etc.) We don't have focus groups, but we want to convey to our readers are certain understanding how these operations work. What threat hunting is, why it is important and all that. At some point you have to make some certain decisions. One was not to e…

I didn't expect you to deliver a crash course that would allow even non-technical readers to understand all details, so I realize that you had to leave out a lot. That puts you in an awkward spot where your explanation probably creates more new questions than it answers. Some news websites hesitate to put external links in their articles because they lead readers off the site, but I think they can be helpful to provi…

> Some news websites hesitate to put external links in their articles because they lead readers off the site

For me, this is almost always a sign, that they don't think that high about their own content. If your content is great and you write engaging articles that are interesting to the reader, he will return. Trying to stop the reader from leaving, in a browser tab he can close at any time, is kind of ridiculous to me..

Re: Winnti: Hackers attacking the heart of German industry

#149

Post by mbeex » Thu, Jul 25, 2019, 7:03 AM UTC

mschuster91 wrote: post #132

HeWhoLurksLate wrote: post #75

Earlier quoted context omitted.

Aaaand some people care more about their life than they do their country's politics, thankfully. IMO, politics and stuff is necessary, but I really wish we could argue /debate respectfully without the damn flame wars everywhere of late. It seriously puts me off.

The point is that the current Trump administration has a massive problem with immigration - that may or may not have consequences if you want to emigrate to the US. Or Brexit - if Johnson really delivers a no deal Brexit then UK economy is getting fucked over hard plus the right of free movement for EU citizens vanishes so you can get deported overnight. Politics at this scale are life changing matters, and unfortuna…

You are certainly entitled to your opinion, but other people may make a difference in what "is clear" to them.

Re: Winnti: Hackers attacking the heart of German industry

#150

Post by hef19898 » Thu, Jul 25, 2019, 8:07 AM UTC

esyir wrote: post #147

hef19898 wrote: post #130

Earlier quoted context omitted.

My five cents because the basic design philosophies are quite different. And also industry inherent arrogance, especially within the so called premium manufacturers. Bit the the opposite is true as well isn't it? You cannot treat automotive manufacturing like software development. I'd say the first company to successfully blend the two has a huge advantage.

Technically, even though it does to the fev sides of things, isn't this tesla?

Not so sure about Tesla having figures out automotive mass production. Cannot comment on the software side of things, but I donhave the impression that Tesla is ahead of more traditional car makers there.