5 ms·

Automakers Trying to Prevent Hackers from Commandeering Cars

20 points by shahryc 11y ago

jacquesm 11y ago
That shouldn't be too hard. Disconnect all radios from management computers with an airgap. And if that goes at the cost of some functionality then so be it but the downsides of interconnected systems are heavier than the upsides. At a minimum stick an 'airgap' switch in the dash somewhere and default it to 'on', or label it 'insecure' when off so the users know the risks.
- LoSboccacc 11y ago
  a proper separation model with a bridge controlling which message can go from each zone would work as well without reduced functionality - the problem for now is not even that they had some fault in their security but that there was no security to begin with, everything listen to every other thing and can send messages to (almost) anything over the common car bus.
  - robmcm 11y ago
    Any bridge between an air gap poses a risk. I am not sure why you would need access to the system that controls the breaks/steering/engine. Perhaps to pre-heat the car, or the sat-nav may feed topology to suspension etc. If they introduce over the air software updates I would be more worried :/
    - LoSboccacc 11y ago
      things like the Prius Dashboard, for example. even if information required is one way read only by being read it's not airgapped, and thus requires some deliberate consideration in how the information flows and is filtered, because in a car there are physical wires carrying bit arounds
      - robmcm 11y ago
        Perhaps they could have two systems reading the data separately. Even if it means two battery monitors etc. I know in the Audi Virtual Cockpit (virtual dashboard) they have two graphics cards for the display. I wonder how much of that is for performance, and how much is so if Google maps slows up, your speedometer doesn't freeze.
    - rjsw 11y ago
      The earliest linkage that I know of between the vehicle data network and an entertainment system was to be able to automatically increase the radio/CD volume at higher speeds. This was long before phones were built in to the dashboard so there wasn't as much of a requirement for security, once you are inside the car the diagnostic connector will give you access to the whole network anyway. I don't know of a read-only CAN controller, plus not all data values will be periodically broadcast over the vehicle network so you may need to be able to send out a request for something as well as listen for a reply. The standard firewall tools ought to be easy enough to adapt to filter CAN messages. The first time I updated ECUs over the air would be over 15 years ago, I have not kept up with whether manufacturers were thinking of doing it routinely.
      - robmcm 11y ago
        > increase the radio/CD volume at higher speeds These days we could work around these sorts of things by using microphones, which would then take things like road surface, or opening a window into consideration. > The first time I updated ECUs over the air would be over 15 years ago You had a car with a wireless data connection in 2000? My fear is that it's too late to start thinking about security. How many manufacturers will be willing to re-think their cyber security, and re design it from the ground up, when some are willing to release a car with a faulty ignition to save a few dollars.
- itsmillertime4u 11y ago
  The problem is that doing so removes the ability to do the self parking, or doing something like the remote kill switch that they can invoke in case the vehicle is ever stolen. Me personally, I know how to park and particularly care if my car is stolen..that's my insurance companies problem. So I could live without both of these features, but you can see how some would argue the opposite. I'm sure there are other tie ins, I'm just can't think of any other that as obvious.
  - kazinator 11y ago
    The insurance company could make it your problem, by charging you a higher premium for theft coverage than the next customer if your vehicle doesn't have the feature.
nsns 11y ago
But if these cars can be "commandeered", they (i.e. my movements) could also easily be tracked by the companies themselves (with the information then sold to "trusted partners"). For some reason, that frightens me more.
- Lorento 11y ago
  If you live in the US or UK, your movements are already being tracked by license plate reading cameras.
  - pdkl95 11y ago
    While this is true, it only works where cameras are present, and adding a significant number of cameras costs time and money. COTRAVELER[1] is much easier and costs almost nothing. Just having a cellphone in a car (either in the driver's pocket or "OnStar") - which only needs to be on and giving presence notifications to the local tower - is enough to get very accurate near-realtime tracking information. The only costs are read-only access to the tower logs and a few SQL JOINs. [1] https://www.washingtonpost.com/apps/g/page/world/how-the-nsa-is-tracking-people-right-now/634/ https://www.washingtonpost.com/apps/g/page/world/how-the-nsa...
ohitsdom 11y ago
This title should only be "news" early on in the design stage. Were they not trying to prevent hackers from commandeering cars before they released them? Also as others have said, airgap the systems.
outworlder 11y ago
Can't we just stop using the (admittedly convenient) CAN bus for this sort of communication? It was never designed for what people are using it for these days.
- S_A_P 11y ago
  Part of the reason cars have gotten more reliable in recent decades is due to this sort of standardization and refinement. What would you replace it with? If you replaced CAN, you still would need an in car network of some sort. It would have its own layer of security issues to worry about. Mechanics/Service centers would need an entirely new suite of diagnostic tools, this isn't just something you can quit using.
  - datenwolf 11y ago
    > What would you replace it with? Individual wires transmitting analogue signals; differential voltage or current loop, depending on application. Add a bunch of RC filter networks on either side to limit the bandwidth to the kind of signals going over the wire and you got a pretty tight, hardwired system.
dkx 11y ago
"But two Democratic senators, Edward Markey of Massachusetts and Richard Blumenthal of Connecticut, have introduced a bill that would force the industry to seal off critical computers and add technology to stop hackers in real time." Why do governments feel the need to dictate the little details? Instead of forcing all car manufacturers to secure cars in the exact same way how about just holding them liable for the consequences if a car is hacked? Car makers can then decide how best to secure the car which would lead to a more diverse and hopefully innovative security measures.
- iolothebard 11y ago
  Because by the time it gets to Congress, the auto makers have clearly avoided fixing the issues themselves for pushing a half decade or more. If they did things the right way, we wouldn't be at this point. Now they get the hammer.
- tertius 11y ago
  Holding them liable will kill the automotive industry quicker than competition can meet demand. "Add technology to stop hackers in real tie." Because backdoors never backfire.
- nfriedly 11y ago
  Aren't the car manufacturers already liable?
  - spathi_fwiffo 11y ago
    There is at least one lawsuit over the hackability; so, I guess we will see.
jdc0589 11y ago
This is the easiest problem in the world to fix going forward... The entertainment system (usually the entry point for this kind of stuff) has no business being connected to any core systems (steering, throttle, brakes, ignition). Just keep the core systems separate, without any connectivity to ANYTHING that can be accessed remotely. Boom. problem solved.
- ams6110 11y ago
  Except the cars are not wired that way, and design changes are expensive once cars are in production (kind of like software in that way, only moreso because they are physical things).
- comrh 11y ago
  I had this same thought but someone in another hn thread had a good point about how a lot of features still use the core systems. Remote starting your car (a common aftermarket feature for the last 20 years) from an app now obviously needs access to the engine. Even if you disconnect the "core systems" they're still probably going to be connected to the internet.
deleted 11y ago
[deleted]
kazinator 11y ago
My ideal car has no power-anything: no power windows, door locks, brakes or steering. Accessory-wise, just an AM/FM radio with a 1/8" AUX jack, a 12V outlet and some cup holders. 5 or 6 speed manual transmission, unless it's electric.
- toufka 11y ago
  Seriously, when can this happen? Is there a cad file on TPB yet? I'd download it.
  - spathi_fwiffo 11y ago
    Build yourself a kit car. I'm sure you could get this setup.

20 points by shahryc 11y ago

That shouldn't be too hard. Disconnect all radios from management computers with an airgap. And if that goes at the cost of some functionality then so be it but the downsides of interconnected systems are heavier than the upsides. At a minimum stick an 'airgap' switch in the dash somewhere and default it to 'on', or label it 'insecure' when off so the users know the risks.

LoSboccacc 11y ago
a proper separation model with a bridge controlling which message can go from each zone would work as well without reduced functionality - the problem for now is not even that they had some fault in their security but that there was no security to begin with, everything listen to every other thing and can send messages to (almost) anything over the common car bus.
- robmcm 11y ago
  Any bridge between an air gap poses a risk. I am not sure why you would need access to the system that controls the breaks/steering/engine. Perhaps to pre-heat the car, or the sat-nav may feed topology to suspension etc. If they introduce over the air software updates I would be more worried :/
  - LoSboccacc 11y ago
    things like the Prius Dashboard, for example. even if information required is one way read only by being read it's not airgapped, and thus requires some deliberate consideration in how the information flows and is filtered, because in a car there are physical wires carrying bit arounds
    - robmcm 11y ago
      Perhaps they could have two systems reading the data separately. Even if it means two battery monitors etc. I know in the Audi Virtual Cockpit (virtual dashboard) they have two graphics cards for the display. I wonder how much of that is for performance, and how much is so if Google maps slows up, your speedometer doesn't freeze.
  - rjsw 11y ago
    The earliest linkage that I know of between the vehicle data network and an entertainment system was to be able to automatically increase the radio/CD volume at higher speeds. This was long before phones were built in to the dashboard so there wasn't as much of a requirement for security, once you are inside the car the diagnostic connector will give you access to the whole network anyway. I don't know of a read-only CAN controller, plus not all data values will be periodically broadcast over the vehicle network so you may need to be able to send out a request for something as well as listen for a reply. The standard firewall tools ought to be easy enough to adapt to filter CAN messages. The first time I updated ECUs over the air would be over 15 years ago, I have not kept up with whether manufacturers were thinking of doing it routinely.
    - robmcm 11y ago
      > increase the radio/CD volume at higher speeds These days we could work around these sorts of things by using microphones, which would then take things like road surface, or opening a window into consideration. > The first time I updated ECUs over the air would be over 15 years ago You had a car with a wireless data connection in 2000? My fear is that it's too late to start thinking about security. How many manufacturers will be willing to re-think their cyber security, and re design it from the ground up, when some are willing to release a car with a faulty ignition to save a few dollars.
itsmillertime4u 11y ago
The problem is that doing so removes the ability to do the self parking, or doing something like the remote kill switch that they can invoke in case the vehicle is ever stolen. Me personally, I know how to park and particularly care if my car is stolen..that's my insurance companies problem. So I could live without both of these features, but you can see how some would argue the opposite. I'm sure there are other tie ins, I'm just can't think of any other that as obvious.
- kazinator 11y ago
  The insurance company could make it your problem, by charging you a higher premium for theft coverage than the next customer if your vehicle doesn't have the feature.

nsns 11y ago

But if these cars can be "commandeered", they (i.e. my movements) could also easily be tracked by the companies themselves (with the information then sold to "trusted partners"). For some reason, that frightens me more.

Lorento 11y ago
If you live in the US or UK, your movements are already being tracked by license plate reading cameras.
- pdkl95 11y ago
  While this is true, it only works where cameras are present, and adding a significant number of cameras costs time and money. COTRAVELER[1] is much easier and costs almost nothing. Just having a cellphone in a car (either in the driver's pocket or "OnStar") - which only needs to be on and giving presence notifications to the local tower - is enough to get very accurate near-realtime tracking information. The only costs are read-only access to the tower logs and a few SQL JOINs. [1] https://www.washingtonpost.com/apps/g/page/world/how-the-nsa-is-tracking-people-right-now/634/ https://www.washingtonpost.com/apps/g/page/world/how-the-nsa...

ohitsdom 11y ago

This title should only be "news" early on in the design stage. Were they not trying to prevent hackers from commandeering cars before they released them? Also as others have said, airgap the systems.

outworlder 11y ago

Can't we just stop using the (admittedly convenient) CAN bus for this sort of communication? It was never designed for what people are using it for these days.

S_A_P 11y ago
Part of the reason cars have gotten more reliable in recent decades is due to this sort of standardization and refinement. What would you replace it with? If you replaced CAN, you still would need an in car network of some sort. It would have its own layer of security issues to worry about. Mechanics/Service centers would need an entirely new suite of diagnostic tools, this isn't just something you can quit using.
- datenwolf 11y ago
  > What would you replace it with? Individual wires transmitting analogue signals; differential voltage or current loop, depending on application. Add a bunch of RC filter networks on either side to limit the bandwidth to the kind of signals going over the wire and you got a pretty tight, hardwired system.

dkx 11y ago

"But two Democratic senators, Edward Markey of Massachusetts and Richard Blumenthal of Connecticut, have introduced a bill that would force the industry to seal off critical computers and add technology to stop hackers in real time." Why do governments feel the need to dictate the little details? Instead of forcing all car manufacturers to secure cars in the exact same way how about just holding them liable for the consequences if a car is hacked? Car makers can then decide how best to secure the car which would lead to a more diverse and hopefully innovative security measures.

iolothebard 11y ago
Because by the time it gets to Congress, the auto makers have clearly avoided fixing the issues themselves for pushing a half decade or more. If they did things the right way, we wouldn't be at this point. Now they get the hammer.
tertius 11y ago
Holding them liable will kill the automotive industry quicker than competition can meet demand. "Add technology to stop hackers in real tie." Because backdoors never backfire.
nfriedly 11y ago
Aren't the car manufacturers already liable?
- spathi_fwiffo 11y ago
  There is at least one lawsuit over the hackability; so, I guess we will see.

jdc0589 11y ago

This is the easiest problem in the world to fix going forward... The entertainment system (usually the entry point for this kind of stuff) has no business being connected to any core systems (steering, throttle, brakes, ignition). Just keep the core systems separate, without any connectivity to ANYTHING that can be accessed remotely. Boom. problem solved.

ams6110 11y ago
Except the cars are not wired that way, and design changes are expensive once cars are in production (kind of like software in that way, only moreso because they are physical things).
comrh 11y ago
I had this same thought but someone in another hn thread had a good point about how a lot of features still use the core systems. Remote starting your car (a common aftermarket feature for the last 20 years) from an app now obviously needs access to the engine. Even if you disconnect the "core systems" they're still probably going to be connected to the internet.

deleted 11y ago

[deleted]

kazinator 11y ago

My ideal car has no power-anything: no power windows, door locks, brakes or steering. Accessory-wise, just an AM/FM radio with a 1/8" AUX jack, a 12V outlet and some cup holders. 5 or 6 speed manual transmission, unless it's electric.

toufka 11y ago
Seriously, when can this happen? Is there a cad file on TPB yet? I'd download it.
- spathi_fwiffo 11y ago
  Build yourself a kit car. I'm sure you could get this setup.