Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Remotely Attack a Jeep on the Highway

wired.com

Post reply on HN
Print view View original

541–550 of 640 posts

Re: Hackers Remotely Attack a Jeep on the Highway

#541

Post by biot »

jblow wrote: post #121
hoopism wrote: post #86

Earlier quoted context omitted.

Anyone could shoot up a public place... should amateur researches be showing up in malls with firearms to test preparedness? This case is even worse the the one I mentioned as there is a really easy way to safely demonstrate this exploit.

If it were not demonstrated under real conditions, the car companies would just say "this was a fake test not representative of real-world conditions, isn't that true Mr. Journalist?" and the journalist would have to admit that that was true and then they would say "Under real-world conditions our cars are safe; customers have nothing to worry about." This has been their playbook about everything for a long time so I…

In response, the journalist would say "This was absolutely a real test; there was nothing fake about it. The conditions were as real-world as you can get: the vehicle was being operated at highway speeds with an average driver behind the wheel, the car's systems were connected to the internet in the exact same way as every other car of that model is, and the attackers were operating their exploit from a remote location as would be the case with every other vulnerable vehicle on the road. That the test was performed on a closed track is obviously for safety reasons as we did not want to endanger the public by causing the vehicle to fail in the middle of a busy highway."

For bonus points, throw in something like: "It's no different than your vehicle's advertisements displaying 'performed on a closed track' -- surely you're not arguing that the vehicle's performance in those advertisements is completely fake and you're deceiving consumers with said non-real-world advertising, are you?"

Re: Hackers Remotely Attack a Jeep on the Highway

#542

Post by stordoff »

monocasa wrote: post #501
kbenson wrote: post #429

Earlier quoted context omitted.

I suggest you view the video[1] that bengali3 linked. 1: http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005...

The journalist is lying. Carefully look at the tachometer when he says that he can't accelerate, it's running at normal speed.

"It says 43MPH but I'm not going that fast"does make me wonder if the display remains accurate after the engine is cut.

Re: Hackers Remotely Attack a Jeep on the Highway

#543

Post by pavel_lishin »

stonogo wrote: post #436
kazinator wrote: post #23

Earlier quoted context omitted.

The fact that a dashboard system that controls your radio or AC has access to cut your transmission is also a hardware configuration issue. Accessories should be physically secured from ignition and drive train. The internet connected features of the car, in turn, should be severed from both of these. It should not be physically possible to turn on the wipers from the embedded processor that receives packets on the I…

Read up on CAN-BUS. The entire industry is moving to one-wire protocols to reduce the labrynthine copper network that prevailed in the past. If you can put your transmissions diagnostic information on the radio's nice big LCD, why wouldn't you? Some would say "this, this is why", but those people are not responsible for selling and maintaining millions of vehicles.

> If you can put your transmissions diagnostic information on the radio's nice big LCD, why wouldn't you?

Surely there's a way to make this information read-only. I can see information about my engine on my dashboard via the speedometer and tachometer; it would be ludicrous if I could kill my engine by grabbing the little needles and cranking them down to zero.

Re: Hackers Remotely Attack a Jeep on the Highway

#544

Post by whyenot »

yellowapple wrote: post #487
modfodder wrote: post #442

Earlier quoted context omitted.

Why can't we condemn both? And as busy as that highway was in the video, it was far more than just 2 vehicles, especially if one of those vehicles was the 18 wheeler. At the very least they could have done this on a less busy stretch of highway that had a wide shoulder and with control vehicles in front and behind with paramedics at the ready (just like a movie production that is shooting on public streets). Instead…

> Why can't we condemn both? Nobody's saying you can't. I certainly do (I strongly disagree with the researchers' obstruction of communication between themselves and their test subject). My only point is that there's a massive difference in scale between a couple dented fenders and hundreds of thousands of dead/maimed innocents.

Difference of scale? Ok, I agree with you there, but characterizing the risk as "a couple dented fenders" is intellectually dishonest. A high speed accident on an interstate could easily involve serious, even fatal injuries.

Re: Hackers Remotely Attack a Jeep on the Highway

#545

Post by elektromekatron »

yellowapple wrote: post #374
elektromekatron wrote: post #356

Earlier quoted context omitted.

Blocking the visibility through the windscreen, then shutting off the transmission of a car, that is driving on an interstate overpass in traffic, is not white hat by any stretch of the imagination.

Perhaps not, but it's necessary to get the attention of auto makers so that they stop building such trivially-compromisable systems. This was a couple of security researchers on one car for a proof-of-concept; better to demonstrate these flaws early and with a more limited sample than to watch the pileup of epic proportions that would happen should someone even less scrupulous acquire such control over vehicles on th…

If you want to get their attention, you demonstrate it on a test track, for a court, as part of a lawsuit against them, for introducing such dangerous features into their vehicles.

Re: Hackers Remotely Attack a Jeep on the Highway

#546

Post by krackers »

waterlesscloud wrote: post #532
krackers wrote: post #528

Earlier quoted context omitted.

Did they publicize it on Wired like they did with this post? I'm reasonably sure that if they had tested in a private track and made a public article it would have the same effect as what they did in their post. In essence, the publicity factor is the most important, not where they tested it.

Different hackers, over a year ago, in a semi-controlled environment, on Vice. Didn't have much of an effect. http://www.vice.com/video/how-to-hack-a-car

I didn't watch the full video, but at 6:45 it states

"Unlike most previously recorded car hacks, this demonstration was performed wirelessly over cellular networks. The vehicle shown is modified with third-party hardware for demo purposes. In stock form it is not vulnerable to these attacks"

which is quite different from the level of vulnerability showcased in the Wired article.

Re: Hackers Remotely Attack a Jeep on the Highway

#547

Post by thetruthseeker1 »

Research can be done to drive a point without making that into a drama. you can demonstrate the science without the hollywood so to speak. I think what was done here could have been demonstrated without the risk that was taken. I think the risk that was taken was poor judgement.

Re: Hackers Remotely Attack a Jeep on the Highway

#548

Post by kbenson »

marssaxman wrote: post #538
kbenson wrote: post #521

Earlier quoted context omitted.

If you don't want to interact with the police, you shouldn't do illegal things, or present your actions as possibly illegal. If you distrust the police to the degree that you think even if your actions weren't illegal you will still have negative consequences from interacting with them, definitely don't do the above. When someone's actions extend to endangering the public to the degree we see here (which I think is o…

Dude, have you not been paying any attention to the War on Drugs, or the Ferguson thing or really any of the Black Lives Matter stuff? The cops will fuck with you if they want to fuck with you, and they will write up whatever paperwork they need to write up to justify it afterward. The courts will believe their testimony by default. The only way to get around this is to release video afterward showing that the cop li…

You see, the thing is some of us still believe the the police are staff by people, not some faceless conglomeration of drones that all follow the same horrible behavior, and that while there are some, probably many bad police officers, and many systemic problems, they still serve a purpose, and that life without any form of law enforcement would be a big step back in many, many ways. The amount the media reports on something often has no bearing on how common it is.

If I was robbed, I would call the police. If I saw someone waving a gun around in public, I would call the police. If I saw someone using a car as a weapon, I would call the police. If I see a situation where people are endangering the public and someone might get hurt, I would call the police. Not doing so when I clearly knew I should would make me feel somewhat responsible for any negative outcomes otherwise.

I'm not really interesting in continuing a discussion where the other side's position seems to be "the police are racist scumbags and they will ruin your life with the slightest contact, so don't call them on criminals." You might find that characterization unfair, but then again, you're the one over-generalizing using large media events as evidence instead statistics.

Edit: Removed reference to ad-hominem, which wasn't factually correct.

Re: Hackers Remotely Attack a Jeep on the Highway

#549

Post by CamperBob2 »

Canada wrote: post #462
nnbvv wrote: post #269

Earlier quoted context omitted.

Right, yesterday my neighbor shot a gun at me several times but since he missed and no one was hurt, it would have been utterly inappropriate for me to contact the authorities.

Being shot at (intentionally or otherwise) is entirely different than a car in front of you slowing to a stop.

One problem with this reasoning is that the researchers really didn't know what they were doing with 100% certainty. Their code could have accidentally affected the stability control subsystem that most cars have nowadays -- the one that's designed to apply full braking to a single wheel to recover from a skid. In fact, just corrupting the data from the steering-wheel angle sensor could have had that effect (which I personally find rather terrifying in itself.) Good job, guys, now you've caused a 70 MPH rollover in traffic.

The right way to do this would have been for the researchers to call the police up front and arrange a demonstration on a closed road with police escort. That would have lent the video more credibility and shielded the researchers from liability, while addressing any concerns about safety or ethics.

Re: Hackers Remotely Attack a Jeep on the Highway

#550

Post by Wonderdonkey »

ITT: Pussies call the police on their peers, shame-defend their pussy actions as "responsibility," display fear-aggression against people defending the researchers' actions.

> 40 MPH = dead stop   > Blasting the radio = life-threatening   > Enjoying the test by laughing about it = black hat   > 4 years of inaction by car makers = no need for drastic action

It's one thing to be against what these researchers did. It's another to call the police on them.

Pussies.

Also ITT: Wonderdonkey is downvoted into oblivion.

> I regret nothing!

Post reply on HN