5 ms·

Any bridge between an air gap poses a risk. I am not sure why you would need access to the system that controls the breaks/steering/engine. Perhaps to pre-heat

by robmcm 11y ago

Any bridge between an air gap poses a risk. I am not sure why you would need access to the system that controls the breaks/steering/engine. Perhaps to pre-heat the car, or the sat-nav may feed topology to suspension etc. If they introduce over the air software updates I would be more worried :/

LoSboccacc 11y ago
things like the Prius Dashboard, for example. even if information required is one way read only by being read it's not airgapped, and thus requires some deliberate consideration in how the information flows and is filtered, because in a car there are physical wires carrying bit arounds
- robmcm 11y ago
  Perhaps they could have two systems reading the data separately. Even if it means two battery monitors etc. I know in the Audi Virtual Cockpit (virtual dashboard) they have two graphics cards for the display. I wonder how much of that is for performance, and how much is so if Google maps slows up, your speedometer doesn't freeze.
rjsw 11y ago
The earliest linkage that I know of between the vehicle data network and an entertainment system was to be able to automatically increase the radio/CD volume at higher speeds. This was long before phones were built in to the dashboard so there wasn't as much of a requirement for security, once you are inside the car the diagnostic connector will give you access to the whole network anyway. I don't know of a read-only CAN controller, plus not all data values will be periodically broadcast over the vehicle network so you may need to be able to send out a request for something as well as listen for a reply. The standard firewall tools ought to be easy enough to adapt to filter CAN messages. The first time I updated ECUs over the air would be over 15 years ago, I have not kept up with whether manufacturers were thinking of doing it routinely.
- robmcm 11y ago
  > increase the radio/CD volume at higher speeds These days we could work around these sorts of things by using microphones, which would then take things like road surface, or opening a window into consideration. > The first time I updated ECUs over the air would be over 15 years ago You had a car with a wireless data connection in 2000? My fear is that it's too late to start thinking about security. How many manufacturers will be willing to re-think their cyber security, and re design it from the ground up, when some are willing to release a car with a faulty ignition to save a few dollars.

by robmcm 11y ago

LoSboccacc 11y ago

things like the Prius Dashboard, for example. even if information required is one way read only by being read it's not airgapped, and thus requires some deliberate consideration in how the information flows and is filtered, because in a car there are physical wires carrying bit arounds

robmcm 11y ago
Perhaps they could have two systems reading the data separately. Even if it means two battery monitors etc. I know in the Audi Virtual Cockpit (virtual dashboard) they have two graphics cards for the display. I wonder how much of that is for performance, and how much is so if Google maps slows up, your speedometer doesn't freeze.

rjsw 11y ago

The earliest linkage that I know of between the vehicle data network and an entertainment system was to be able to automatically increase the radio/CD volume at higher speeds. This was long before phones were built in to the dashboard so there wasn't as much of a requirement for security, once you are inside the car the diagnostic connector will give you access to the whole network anyway. I don't know of a read-only CAN controller, plus not all data values will be periodically broadcast over the vehicle network so you may need to be able to send out a request for something as well as listen for a reply. The standard firewall tools ought to be easy enough to adapt to filter CAN messages. The first time I updated ECUs over the air would be over 15 years ago, I have not kept up with whether manufacturers were thinking of doing it routinely.

robmcm 11y ago
> increase the radio/CD volume at higher speeds These days we could work around these sorts of things by using microphones, which would then take things like road surface, or opening a window into consideration. > The first time I updated ECUs over the air would be over 15 years ago You had a car with a wireless data connection in 2000? My fear is that it's too late to start thinking about security. How many manufacturers will be willing to re-think their cyber security, and re design it from the ground up, when some are willing to release a car with a faulty ignition to save a few dollars.