This is a terrible decision. On such a short timescale, they'll only be able to fix the particular bug in their infotainment system. The real problem as everyone has pointed out is that the car control and infotainment should not share channels. There should be a physical gap between them and if really necessary a very tightly controlled message bridge.
The real fix will require much more intervention than just a firmware flash at the garage.
We'll see at Def Con how much Chrysler really screwed up.
No, it's a stopgap. They have to be seen to do something to counter all the bad press. You can be sure they'll be looking at a more definitive and more robust solution in the longer term but in the shorter term they need to be able to say 'this particular hole was plugged'. That's just damage control on their part, nothing more or less.
There is simply no alternative at this point. The press coverage was so big (which I prefer) that they can't hope that 100% of users will do the fw upgrade themselves.
That thing here is a big fucking warning to all other car manufactures for the future.
Regardless it's the only and correct decision they can make at this time. It's honestly not terrible at all. What would be terrible, and valid of the comment "a terrible decision" would be doing nothing at all.
Chrysler doesn't have much of a choice. They have to do a "voluntary" recall for a safety issue, or the NTSB orders an involuntary recall. Since this has terrorism implications, they need to get this done.
That's a good use for formal software proving. While proving the safety of the entire codebase might be currently out of bridge, it would be quite feasible to prove the safety of a message bridge.
> The company added that hacking its vehicles was a "criminal action".
I don't think that's the case, but I still commend them for doing a recall this quick.
Shooting the messenger seems to still be quite a strong reflex for corporations faced with bad news. The way to look at it should be that these guys did Fiat-Chrysler a service. After all, it's not only security researchers that have the ability to write code and that have prolonged access to a vehicle to test.
They seem to be mistaken about the time to write the code, after all, you can write the code and test it on a different vehicle than the one you intend to crash.
Law enforcement typically won't analyze the firmware of all the computers in a car after a single vehicle accident (and it would probably be quite possible to erase the evidence once the car has been given a command sufficient to kill the occupants).
Shooting the messenger isn't just bad PR for corporations. It's deeply ingrained in most enterprise culture, and it's why problems like this occur in the first place.
You know that engineers on the ground were well aware of this vulnerability. You know they tried to warn. But what happened to the warnings? They didn't make it up to the executive levels necessary, because several layers in between feared for their jobs and careers if they said something like "This new feature you're demanding could be used to brick every single Fiat-Chrysler vehicle we make, or even murder people". So the executives were asking for features but flying blind on danger.
And ultimately, this is a failure of the executive structure and the corporate structure (and it's an inherent antipattern in large organizations). Since the nature of hierarchy is for subordinates to hide unpleasant truths from superiors, they should have been actively asking about the hazards. They could have hired outside security reviewers. But they didn't.
The language in the FCA press release (linked in another thread) is softer:
The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action.
So through the process of extensive journalism, unauthorized remote manipulation got turned into hacking vehicles.
>> The company added that hacking its vehicles was a "criminal action".
> I don't think that's the case, but I still commend them for doing a recall this quick.
It is illegal under existing laws. Basically, it falls under the same set of laws as cutting someone break line. You are, at a minimum, in the "Reckless endangerment" category.
It doesn't take new laws, the old ones have seen enough people doing stupid things to other people's cars.
There should be push back against the idea it's inherently a crime to either R&D the operation of your own property, or modify it. There is a long standing tradition of car modification in the U.S. especially, I think it's unacceptable for this to be proscribed by making it a crime or even subject to civil action. Obviously any modification I make, is my liability, but that's a totally different thing that saying it's disallowed.
The messenger did some stunt hacking on a highway to promote their talk, and didn't follow any guidelines of responsible disclosure to the company so they could less drastic steps to fix the problem or have some time and perhaps do it in a way that isn't quite so expensive or rushed.
Should they be criminally charged, no, not for the hack itself, perhaps for the highway theatrics. But they deserve to sweat and hire some lawyers, and perhaps face a civil case for the irresponsible way they disclosed it.
The surest way to get legislative pressure put forward to regulate the info sec industry and put red tape that hampers or outright outlaws security research and activity is to have guys like this being so irresponsible with research that affects people's lives as to give them cause to.
I don't think they're necessarily asserting that the security researchers carried out a criminal act in demonstrating that the vehicle could be hacked (they almost certainly didn't). But they would be correct to assert that anybody who hacks someone's Jeep without their permission certainly WOULD be carrying out a criminal act. As such, I think they're reasonable in pointing out that this is not a safety issue but rather a protecting-their-customers-from-assholes issue.
I would add that shipping cars with such vulnerabilities should be a criminal action, if it isn't. It's certainly negligent (however unintentionally) and unsafe for consumers.
I assume there was security, no matter how weak, that was bypassed. That's criminal in the US under the DMCA. Hell, even bypassing ROT13 "encryption" is criminal under the DMCA. Furthermore, even if the system was wide open, I have no doubt Chrysler can claim criminal action under the CFAA.
Something I'm big on in life is that the worst thing you can say to someone is that you don't understand them. To not understand someone is to deliberately not give the issue thought because you're so deeply embedded in the idea that you have enough background on an issue to decidedly say that you are right and that the reasoning behind your stance is flawless, and thus that they are wrong. I believe that everyone's beliefs and actions are understandable. They might used flawed logic, or they might value things differently than you, but I believe 100% that everyone on this earth uses reasoning for every action and opinion we have.
But when it comes to politicians trying to ban encryption and automakers trying to ban me from editing bits on a memory chip that I got as a part of purchasing one of their cars, I really am unapologetic when I say I really don't understand them. I completely and utterly lack an ability to get into their heads. It would be fascinating to lose my knowledge of everything I know about computers for a day and give these issues thought. To have computers be mystical voodoo magic would be an amazingly different world.
If I had to give it a guess, that's probably what I'd say. Politicians and automakers and middle aged Edward Snowden haters all lack an idea of what is possible and what is unpractical when it comes to computers. They lack an appreciation for just how much commonality there is between the computer running a McDonald's register and the one making sure their car doesn't kill them.
Politicians think we can just "ban" encryption, as if this isn't some mathematical concept with freely-available professionally made implementations. They think Apple has gone to great lengths just to implement their end-to-end iMessage encryption... when in reality they almost certainly took the path of least resistance and merely stand on the shoulders of giants that collectively implemented encryption for them. PR reps for automakers think of code in such an abstract way that they think modifying it must be terribly difficult and thus inherently malicious, when in reality their programmers stood on the shoulders of giants and used the same common interfaces that every programmer uses. Hacking their car was probably done by a curious man decompiling the firmware which they pulled off via JTAG or a test clip. They think Edward Snowden must have been sneaking around in underground tunnels with a ski mask and plugging his laptop into servers, when in reality this was just a drive that was mounted on a machine he used.
Tl;dr: Programmers all pretty much follow the path of least resistance. The general populations lack of background makes them think that things are much more difficult and thus deliberate than they really are.
That "criminal action" statement was repeated multiple times; obviously they're trying to send a message. We need whistle-blower protection laws so that the auto companies can't try to eliminate this research by sending the researchers to jail.
Law enforcement won't try to analyze the firmware, but class-action lawyers certainly could. Won't do any good if the bad actors have erased their tracks of course.
I see a lot of people thoughtlessly applying computer-security mindset here to vehicle-safety. They're really not the same thing, because they are handling very different risk models. Vehicle safety is about "how will this system perform under typical conditions when something goes wrong?". Computer security is about "how will this system perform if a smart asshole tries to abuse it?". Vehicle safety generally doesn't concern itself with deliberate sabotage. You won't see a product recall for a car because "under some circumstances, a criminal might cut the brake cables". What Chrysler are doing here is, though, effectively that, and why they have to do that for a computer security issue is interesting.
We're all used to the idea that if you put a computer on the internet, it will come under attack. People will try to snoop on the data it handles, or subvert it to use it for their own purposes. So why do we then move on to assume that, if such a system is attached to something safety critical, that those same people who will attack the computer to get at its data or processing power will now move on to attacking the brakes, or the engine, and try to kill people?
Most vehicular crime isn't homicide, it's acquisitive - people will attack vehicle security systems to steal the car, or get access to valuable contents. Sabotaging the vehicle to kill the driver is way down the list.
As a society we tend to assume that physical security is not the only thing that stops random strangers from trying to kill us. We do not all drive around in armored cars in case someone decides to shoot at us from an overpass. We don't all sweep under our car with a mirror for bombs before we get in and start the engine.
And it's certainly not a failing of Chrysler's engineers to adequately consider customer safety that they sell Jeeps which are not bulletproof and which have exposed frameworks on the underside where bombs can be attached.
So why is it that we're so quick to assume that because a safety-critical computer system is exposed to the internet, that this is the worst thing ever?
Is it that as far as physical security of your Jeep goes you only have to trust the people in your neighborhood, but for internet security we have to trust the whole world?
> So why is it that we're so quick to assume that because a safety-critical computer system is exposed to the internet, that this is the worst thing ever?
Because of the Greater Internet Fuckwad Theory (or, more nicely put, the "online disinhibition effect"[1]).
We don't worry as much about random strangers harming us in person because most people are generally well-behaved when they are face to face with someone in real physical space.
On the Internet, where all you see is a screen and all you do is click your mouse, "reality" gets a lot more tenuous. In that environment, people act worse.
If you were walking over an overpass and saw someone left a cinder block up there with a note attached saying "Throw me!" how likely would you be to lumber it up off the ground, carry it to the edge, and heave it over onto to a car you can see passing below, whose occupants are visible to you?
Now imagine you stumble onto a random web page with a button labeled "Click to drop cinder block off overpass". Tempting?
The way our behavior differs in these two circumstances is a big part of why Internet security is so different from physical security. (The other big difference is how data can be replicated for free. It takes 50x as much effort to steal 50 cars. It often takes no more effort to apply the same have 50, or a million times.)
I think it's pretty clear that connecting a computer to the internet is a matter of trusting the whole world, which is a lot harder than trusting local circumstances.
Your assessment of risk has to change when the cost of scanning and attacking your machine from afar in a hard-to-trace manner is dirt cheap.
That doesn't sound like the same vulnerability at all. Cutting brake lines no longer results in someone's death [1], and they'd know at the time they first try to brake, when they'll probably be at low speed anyway.
The Chrysler exploit, by contrast, allows you to silently take control of the vehicle in ways that don't reveal your position until much later (if at all), due to the sound system not being firewalled from the brakes.
That seems fundamentally different from "hey, gangbangers might shoot at you while driving".
So you're okay with spy agencies (from all over the world) as well as drug cartels and other criminal organizations having the power to kill you in an almost untraceable way while you're on the highway?
Also, the US gov has been using these entertainment systems to spy on people for more than a decade...it's already been happening. Unfortunately, I can't find the link now, but it was a post from 2001 or 2003 on NYT and I think they were using Ford Sync to do it.
>Is it that as far as physical security of your Jeep goes you only have to trust the people in your neighborhood, but for internet security we have to trust the whole world?
Yes?
If you connect a system to the internet, you have to consider attempts to attack that system (automated and not) to be part of typical operating conditions.
Interesting questions. I think part of what's going on is that people don't like being exposed to new, unknown threats. Even if this turned out not to be a very big deal in practice -- and I am not sure it won't -- it's still a new risk that's being assumed.
> Sabotaging the vehicle to kill the driver is way down the list.
But if it can be done remotely and untraceably...?
Not too long ago, many decent hackers were no longer interested in causing damage and instead focused on stealing people's identities or credit card information for financial gain.
If Greedy Greg knew public CEO Huge McChecks was driving an exposed vehicle, Greedy Greg could short sale Huge McCheck's company and cause a multi-million dollar crash with Huge McChecks inside... all with a couple strokes on a keyboard from thousands of miles away.
>applying computer-security mindset here to vehicle-safety
That might be a valid complaint if this attack required physical access, but it's a remote exploit. It is computer security, except the target is many times more interesting because it can kill people.
Doesn't Tesla send over-the-air updates for critical systems to its cars? From my understanding, that means there is a way for a similar attack with a fake-firmware. Am I wrong?
With self-driving cars, this is definitely going to be the norm, and this really draws attention to how dangerous they could be, although human-driven cars are also pretty dangerous.
Just an FYI for everyone on the "segregated systems" bandwagon:
If a compromised device can talk on the CAN bus it's game over since (pretty much) everything listens on that bus so you can't (without a lot of time and effort, implement a way to) pick and choose systems to segregate while maintaining wireless connectivity to those critical system.
Vehicle manufactures get a huge data set sent back to them by vehicles. They use this for stuff like correlating part failures to operational conditions, determining which intermittent wiper setting people use as well as improving the logic for the operation of critical systems (e.g. if my last inputs were $stuff then don't upshift). I wouldn't be surprised if they sold the data as well. McDonalds would love to know where and when people start looking for food. insurance companies would love to have more variables to correlate to risk trivial (e.g. $color cars with $trivial_feature get in accident that cost $really_small_percent $more_or_less than $other_color
To segregate systems you need to be able to pitch to the bean-counters that the cost/benefit of whatever degree of segregation you're proposing beats the cost/benefit of whatever plan the next guy is proposing. These data sets are incredibly valuable to many different parts of the company. The people doing marketing and customer facing stuff would be at a severe competitive disadvantage if they had to wait months (first oil change) o get real world data on feature usage after a re-design.
Sure you could download it at service time..."but we already have a system that does it in near real time, can't we just secure that?"...
TL;DR: Segregating systems involves more than having the engineers wait a few months to figure out if their new tune solved the problem.
The good that comes out if this is that somewhere in the management chain people will feel justified to increase security investment by saying, "remember the Fiat Chrysler recall?"
The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action.
The WIRED story's hackers presumably were authorized by the vehicle's owner or operator, so the demo did not "constitute criminal action."
If researchers really want to underscore a point: hang out outside the IIHS testing facility, and when they're testing the vehicle in question, then mess with the systems.
Maybe IIHS needs to include "remote hackability" as a criterion in their testing?
Auto companies' lax attitudes towards systems security will change when insurance companies start considering such security vulnerabilities as safety issues and adjust their existing safety ratings appropriately.
Based upon my own experience (in another industry), I have no doubt that there were knowledgeable people internally who warned them of this -- if they were not fully cowed by the bureaucracy.
I have zero sympathy for the manufacturers. I only hope that, if they decide to go on a witch hunt, they actually seek and punish the morons in power who, most likely for self-serving purposes, let this slide.
This also should raise a ringing cry to rein in DMCA et al. uses that seek to outlaw such research. In this case, the manufacturer has obviated their authority in the matter.
> The company added that hacking its vehicles was a "criminal action".
screw that attitude.
I hope government will make the equivalent of whistleblower protection for security researchers that report exploitable flaws, because it's the only way to increase security over time.
i.e. I'm scared as hell that planes are allegedly hackable but researchers aren't really talking about it nor testing it properly because fear of lawsuits.
I've been spending a bit of time over the last couple of months reading up on CAN, OBD2, system architectures for automotive systems, attack vectors, various forms of CAN-attacks, building stuff that interfaces with CAN buses, writing software, figuring out how things work etc. And I have to say that many of the comments in this thread are frighteningly uninformed.
I know this is supposed to be The Magic Kingdom where people are only supposed to say positive things and eat happy pills all day, but would it kill people to at least try to read up about the things they so willingly share their "insights" on before posting here?
At the very least, try to understand how CAN works before spouting nonsense grounded in uninformed assumption. Uninformed opinions are not helpful. They just pollute the discussion.
At RSA I was at a car hacking session, and the big take away I got is how some of these systems have none upgradable firmware, and today's designs sent for manufacturing now aren't due for 2017-2018 model year cars. So some of these vulns could be baked in, in a way that have expensive work arounds because the car manufacturers have been so feature driven rather than security conscious. It's the car equivalent of bloat/crap ware on phones. Features that drive up selling the customer. The cars that have OTA firmware updates (BMW was one example) are able to push out fixes faster, and with more complete coverage than recalls so it seems sane to me to make it mandatory such "smart cars" can be OTA updated.
[+] [-] tinco|10 years ago|reply
The real fix will require much more intervention than just a firmware flash at the garage.
We'll see at Def Con how much Chrysler really screwed up.
[+] [-] Xorlev|10 years ago|reply
It's the only one available to them. They can't just refit all existing cars with a new design on a short timeline. Hardware has permanence.
With that in mind, how would you fix the issue for existing vehicles?
[+] [-] jacquesm|10 years ago|reply
[+] [-] chinathrow|10 years ago|reply
That thing here is a big fucking warning to all other car manufactures for the future.
[+] [-] urda|10 years ago|reply
Regardless it's the only and correct decision they can make at this time. It's honestly not terrible at all. What would be terrible, and valid of the comment "a terrible decision" would be doing nothing at all.
[+] [-] msane|10 years ago|reply
We all acknowledged the issue is architecture, and that can't be fixed by flashing firmware.
[+] [-] Animats|10 years ago|reply
[+] [-] murbard2|10 years ago|reply
[+] [-] jacquesm|10 years ago|reply
I don't think that's the case, but I still commend them for doing a recall this quick.
Shooting the messenger seems to still be quite a strong reflex for corporations faced with bad news. The way to look at it should be that these guys did Fiat-Chrysler a service. After all, it's not only security researchers that have the ability to write code and that have prolonged access to a vehicle to test.
They seem to be mistaken about the time to write the code, after all, you can write the code and test it on a different vehicle than the one you intend to crash.
Law enforcement typically won't analyze the firmware of all the computers in a car after a single vehicle accident (and it would probably be quite possible to erase the evidence once the car has been given a command sufficient to kill the occupants).
[+] [-] beat|10 years ago|reply
You know that engineers on the ground were well aware of this vulnerability. You know they tried to warn. But what happened to the warnings? They didn't make it up to the executive levels necessary, because several layers in between feared for their jobs and careers if they said something like "This new feature you're demanding could be used to brick every single Fiat-Chrysler vehicle we make, or even murder people". So the executives were asking for features but flying blind on danger.
And ultimately, this is a failure of the executive structure and the corporate structure (and it's an inherent antipattern in large organizations). Since the nature of hierarchy is for subordinates to hide unpleasant truths from superiors, they should have been actively asking about the hazards. They could have hired outside security reviewers. But they didn't.
[+] [-] maxerickson|10 years ago|reply
The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action.
So through the process of extensive journalism, unauthorized remote manipulation got turned into hacking vehicles.
[+] [-] protomyth|10 years ago|reply
> I don't think that's the case, but I still commend them for doing a recall this quick.
It is illegal under existing laws. Basically, it falls under the same set of laws as cutting someone break line. You are, at a minimum, in the "Reckless endangerment" category.
It doesn't take new laws, the old ones have seen enough people doing stupid things to other people's cars.
[+] [-] cmurf|10 years ago|reply
[+] [-] surge|10 years ago|reply
Should they be criminally charged, no, not for the hack itself, perhaps for the highway theatrics. But they deserve to sweat and hire some lawyers, and perhaps face a civil case for the irresponsible way they disclosed it.
The surest way to get legislative pressure put forward to regulate the info sec industry and put red tape that hampers or outright outlaws security research and activity is to have guys like this being so irresponsible with research that affects people's lives as to give them cause to.
[+] [-] jameshart|10 years ago|reply
[+] [-] TallGuyShort|10 years ago|reply
[+] [-] joesmo|10 years ago|reply
Ain't America's laws wonderful?
[+] [-] nickysielicki|10 years ago|reply
But when it comes to politicians trying to ban encryption and automakers trying to ban me from editing bits on a memory chip that I got as a part of purchasing one of their cars, I really am unapologetic when I say I really don't understand them. I completely and utterly lack an ability to get into their heads. It would be fascinating to lose my knowledge of everything I know about computers for a day and give these issues thought. To have computers be mystical voodoo magic would be an amazingly different world.
If I had to give it a guess, that's probably what I'd say. Politicians and automakers and middle aged Edward Snowden haters all lack an idea of what is possible and what is unpractical when it comes to computers. They lack an appreciation for just how much commonality there is between the computer running a McDonald's register and the one making sure their car doesn't kill them.
Politicians think we can just "ban" encryption, as if this isn't some mathematical concept with freely-available professionally made implementations. They think Apple has gone to great lengths just to implement their end-to-end iMessage encryption... when in reality they almost certainly took the path of least resistance and merely stand on the shoulders of giants that collectively implemented encryption for them. PR reps for automakers think of code in such an abstract way that they think modifying it must be terribly difficult and thus inherently malicious, when in reality their programmers stood on the shoulders of giants and used the same common interfaces that every programmer uses. Hacking their car was probably done by a curious man decompiling the firmware which they pulled off via JTAG or a test clip. They think Edward Snowden must have been sneaking around in underground tunnels with a ski mask and plugging his laptop into servers, when in reality this was just a drive that was mounted on a machine he used.
Tl;dr: Programmers all pretty much follow the path of least resistance. The general populations lack of background makes them think that things are much more difficult and thus deliberate than they really are.
[+] [-] mark-r|10 years ago|reply
Law enforcement won't try to analyze the firmware, but class-action lawyers certainly could. Won't do any good if the bad actors have erased their tracks of course.
[+] [-] new_hackers|10 years ago|reply
[+] [-] jameshart|10 years ago|reply
We're all used to the idea that if you put a computer on the internet, it will come under attack. People will try to snoop on the data it handles, or subvert it to use it for their own purposes. So why do we then move on to assume that, if such a system is attached to something safety critical, that those same people who will attack the computer to get at its data or processing power will now move on to attacking the brakes, or the engine, and try to kill people?
Most vehicular crime isn't homicide, it's acquisitive - people will attack vehicle security systems to steal the car, or get access to valuable contents. Sabotaging the vehicle to kill the driver is way down the list.
As a society we tend to assume that physical security is not the only thing that stops random strangers from trying to kill us. We do not all drive around in armored cars in case someone decides to shoot at us from an overpass. We don't all sweep under our car with a mirror for bombs before we get in and start the engine.
And it's certainly not a failing of Chrysler's engineers to adequately consider customer safety that they sell Jeeps which are not bulletproof and which have exposed frameworks on the underside where bombs can be attached.
So why is it that we're so quick to assume that because a safety-critical computer system is exposed to the internet, that this is the worst thing ever?
Is it that as far as physical security of your Jeep goes you only have to trust the people in your neighborhood, but for internet security we have to trust the whole world?
[+] [-] munificent|10 years ago|reply
Because of the Greater Internet Fuckwad Theory (or, more nicely put, the "online disinhibition effect"[1]).
We don't worry as much about random strangers harming us in person because most people are generally well-behaved when they are face to face with someone in real physical space.
On the Internet, where all you see is a screen and all you do is click your mouse, "reality" gets a lot more tenuous. In that environment, people act worse.
If you were walking over an overpass and saw someone left a cinder block up there with a note attached saying "Throw me!" how likely would you be to lumber it up off the ground, carry it to the edge, and heave it over onto to a car you can see passing below, whose occupants are visible to you?
Now imagine you stumble onto a random web page with a button labeled "Click to drop cinder block off overpass". Tempting?
The way our behavior differs in these two circumstances is a big part of why Internet security is so different from physical security. (The other big difference is how data can be replicated for free. It takes 50x as much effort to steal 50 cars. It often takes no more effort to apply the same have 50, or a million times.)
[1]: https://en.wikipedia.org/wiki/Online_disinhibition_effect
[+] [-] threatofrain|10 years ago|reply
Your assessment of risk has to change when the cost of scanning and attacking your machine from afar in a hard-to-trace manner is dirt cheap.
[+] [-] SilasX|10 years ago|reply
The Chrysler exploit, by contrast, allows you to silently take control of the vehicle in ways that don't reveal your position until much later (if at all), due to the sound system not being firewalled from the brakes.
That seems fundamentally different from "hey, gangbangers might shoot at you while driving".
[1] http://www.quora.com/Is-cutting-someones-brake-line-prior-to...
[+] [-] higherpurpose|10 years ago|reply
Also, the US gov has been using these entertainment systems to spy on people for more than a decade...it's already been happening. Unfortunately, I can't find the link now, but it was a post from 2001 or 2003 on NYT and I think they were using Ford Sync to do it.
[+] [-] krapp|10 years ago|reply
Yes?
If you connect a system to the internet, you have to consider attempts to attack that system (automated and not) to be part of typical operating conditions.
[+] [-] ScottBurson|10 years ago|reply
> Sabotaging the vehicle to kill the driver is way down the list.
But if it can be done remotely and untraceably...?
[+] [-] amwang217|10 years ago|reply
If Greedy Greg knew public CEO Huge McChecks was driving an exposed vehicle, Greedy Greg could short sale Huge McCheck's company and cause a multi-million dollar crash with Huge McChecks inside... all with a couple strokes on a keyboard from thousands of miles away.
[+] [-] superuser2|10 years ago|reply
That might be a valid complaint if this attack required physical access, but it's a remote exploit. It is computer security, except the target is many times more interesting because it can kill people.
[+] [-] skimmas|10 years ago|reply
[+] [-] imglorp|10 years ago|reply
source: http://www.bbc.com/news/technology-33622298
[+] [-] netrus|10 years ago|reply
[+] [-] justizin|10 years ago|reply
[+] [-] joesmo|10 years ago|reply
[+] [-] dsfyu404ed|10 years ago|reply
If a compromised device can talk on the CAN bus it's game over since (pretty much) everything listens on that bus so you can't (without a lot of time and effort, implement a way to) pick and choose systems to segregate while maintaining wireless connectivity to those critical system.
Vehicle manufactures get a huge data set sent back to them by vehicles. They use this for stuff like correlating part failures to operational conditions, determining which intermittent wiper setting people use as well as improving the logic for the operation of critical systems (e.g. if my last inputs were $stuff then don't upshift). I wouldn't be surprised if they sold the data as well. McDonalds would love to know where and when people start looking for food. insurance companies would love to have more variables to correlate to risk trivial (e.g. $color cars with $trivial_feature get in accident that cost $really_small_percent $more_or_less than $other_color
To segregate systems you need to be able to pitch to the bean-counters that the cost/benefit of whatever degree of segregation you're proposing beats the cost/benefit of whatever plan the next guy is proposing. These data sets are incredibly valuable to many different parts of the company. The people doing marketing and customer facing stuff would be at a severe competitive disadvantage if they had to wait months (first oil change) o get real world data on feature usage after a re-design.
Sure you could download it at service time..."but we already have a system that does it in near real time, can't we just secure that?"...
TL;DR: Segregating systems involves more than having the engineers wait a few months to figure out if their new tune solved the problem.
[+] [-] gandalfu|10 years ago|reply
"No defect has been found. FCA US is conducting this campaign out of an abundance of caution."
What the hell?
[+] [-] bradgessler|10 years ago|reply
[+] [-] tantalor|10 years ago|reply
The WIRED story's hackers presumably were authorized by the vehicle's owner or operator, so the demo did not "constitute criminal action."
[+] [-] jasimq|10 years ago|reply
[+] [-] discardorama|10 years ago|reply
Maybe IIHS needs to include "remote hackability" as a criterion in their testing?
[+] [-] blahblah3|10 years ago|reply
[+] [-] ryandrake|10 years ago|reply
[+] [-] pasbesoin|10 years ago|reply
I have zero sympathy for the manufacturers. I only hope that, if they decide to go on a witch hunt, they actually seek and punish the morons in power who, most likely for self-serving purposes, let this slide.
This also should raise a ringing cry to rein in DMCA et al. uses that seek to outlaw such research. In this case, the manufacturer has obviated their authority in the matter.
[+] [-] LoSboccacc|10 years ago|reply
screw that attitude.
I hope government will make the equivalent of whistleblower protection for security researchers that report exploitable flaws, because it's the only way to increase security over time.
i.e. I'm scared as hell that planes are allegedly hackable but researchers aren't really talking about it nor testing it properly because fear of lawsuits.
[+] [-] rasz_pl|10 years ago|reply
http://blog.caranddriver.com/fiat-chrysler-quality-chief-res...
http://www.autonews.com/article/20141028/OEM02/141029851/bet...
http://www.techtimes.com/articles/70582/20150721/apple-hires...
because nothing screams quality like a 'decided to leave one day after yet another drop in Consumer Report rankings' and 1.4m car recall!
[+] [-] bborud|10 years ago|reply
I know this is supposed to be The Magic Kingdom where people are only supposed to say positive things and eat happy pills all day, but would it kill people to at least try to read up about the things they so willingly share their "insights" on before posting here?
At the very least, try to understand how CAN works before spouting nonsense grounded in uninformed assumption. Uninformed opinions are not helpful. They just pollute the discussion.
[+] [-] cmurf|10 years ago|reply
[+] [-] JustSomeNobody|10 years ago|reply
I know I'll get down voted, but it has to be asked.
[+] [-] mizzao|10 years ago|reply
[+] [-] unknown|10 years ago|reply
[deleted]