3 ms·

Sounds like Tesla worked with these guys to patch this for all owners before it was disclosed. And they hired Chris Evans from Chrome/Project Zero to lead secu

Sounds like Tesla worked with these guys to patch this for all owners before it was disclosed. And they hired Chris Evans from Chrome/Project Zero to lead security. To me those are signals that they take this seriously.

vilda 11y ago
In first place let's frankly say that interconnecting entertainment system with anything that affects safety is dump idea. They top-notch security professionals should know that. I was developing entertainment system for Volkswagen's cars a while ago. At the time their cars have several networks interconnected with a simple firewall. They were separated into domains, if I remember correctly it was core (engine, steering wheel), first level (reporting, airbags, etc.), second level (opening windows, etc.), and then entertainment system. The firewall was one-way. Systems on lower level are able to intercept some messages from higher levels, but are unable to send anything to higher level (with some exception between core and first level). That also means that the entertainment system is unable to open/close windows for example - you have physical buttons for that. It was a while ago and my memory is rusty. But you get the idea that car systems can be build securely with competent engineers.
- varjag 11y ago
  I'm not sure if it was the case here, but Tesla has an over-the-air update channel, allowing to adjust overall performance envelope including acceleration, braking and suspension via update from the mothership. As long as you allow for that feature, the penetration vector is unavoidable and can't be engineered away.
teacup50 11y ago
If they took this seriously, they wouldn't have their cars connect to anything, or at the very least, the connected parts would be fully air-gapped. How is it that we can be repeating the exact same mistakes made in software over the past 40 years, without anyone questioning whether the dangers of cloud-enabling cars is remotely justified by the features provided?
- chambo622 11y ago
  What makes you think that nobody is questioning it? I'm sure some people are, but the fact that informed consumers are purchasing these cars speaks for itself.
  - teacup50 11y ago
    What does that fact speak for?
    - chambo622 11y ago
      It indicates that "the dangers of cloud-enabling cars" are in fact "justified by the features provided" for a nontrivial number of people.
      - teacup50 11y ago
        That's a nonsensically trivial analysis: 1) The features provided by Tesla extend far beyond those provided by "cloud-enablement"; the fact that "informed consumers" are buying the cars does not indicate that their purchasing decision came down to isolating cloud-enablement relative to cloud-features. 2) Your hypothetical informed consumers don't really exist, unless the only people buying cloud-enabled cars are computer scientists.
        chambo622 11y ago
        1) Sure - it's one factor among many in the purchasing decision. Never said otherwise. It would also be incorrect to assume that this was not a factor at all. 2) Ever looked at a tech company parking lot in South Bay? A lot of people with CS background are buying the Model S. Not all buyers are computer scientists but informed buyers most definitely do exist.
  - Silhouette 11y ago
    How do we know how well-informed or otherwise the people purchasing these vehicles are? There are relatively few people in the world who fully appreciate the implications of security issues and who can make rational risk assessments and take reasonable measures to limit those risks. Of course, even being informed isn't going to help if this sort of poorly secured connectivity becomes the norm for new vehicles, which seems to be happening disturbingly quickly. If you rely on the independence offered by having a car but all cars have similar dangers, you might have only bad alternatives to choose between, but they're still bad. [Edit: That last sentence was ambiguous. My intended meaning was that the alternatives to using a car at all might also be bad, for example incurring significant costs and disruption moving to live somewhere with viable public transport instead.]
FireBeyond 11y ago
I think it's telling that this is the kind of comment that's voted up. Jeep remote exploit: "OMG, are you kidding, what kind of idiots would even allow this to be a possibility? Car control systems remotely accessible, etc?" Tesla: "Kudos to Tesla for taking this seriously and working on it."

vilda 11y ago

In first place let's frankly say that interconnecting entertainment system with anything that affects safety is dump idea. They top-notch security professionals should know that. I was developing entertainment system for Volkswagen's cars a while ago. At the time their cars have several networks interconnected with a simple firewall. They were separated into domains, if I remember correctly it was core (engine, steering wheel), first level (reporting, airbags, etc.), second level (opening windows, etc.), and then entertainment system. The firewall was one-way. Systems on lower level are able to intercept some messages from higher levels, but are unable to send anything to higher level (with some exception between core and first level). That also means that the entertainment system is unable to open/close windows for example - you have physical buttons for that. It was a while ago and my memory is rusty. But you get the idea that car systems can be build securely with competent engineers.

varjag 11y ago
I'm not sure if it was the case here, but Tesla has an over-the-air update channel, allowing to adjust overall performance envelope including acceleration, braking and suspension via update from the mothership. As long as you allow for that feature, the penetration vector is unavoidable and can't be engineered away.

teacup50 11y ago

If they took this seriously, they wouldn't have their cars connect to anything, or at the very least, the connected parts would be fully air-gapped. How is it that we can be repeating the exact same mistakes made in software over the past 40 years, without anyone questioning whether the dangers of cloud-enabling cars is remotely justified by the features provided?

chambo622 11y ago
What makes you think that nobody is questioning it? I'm sure some people are, but the fact that informed consumers are purchasing these cars speaks for itself.
- teacup50 11y ago
  What does that fact speak for?
  - chambo622 11y ago
    It indicates that "the dangers of cloud-enabling cars" are in fact "justified by the features provided" for a nontrivial number of people.
    - teacup50 11y ago
      That's a nonsensically trivial analysis: 1) The features provided by Tesla extend far beyond those provided by "cloud-enablement"; the fact that "informed consumers" are buying the cars does not indicate that their purchasing decision came down to isolating cloud-enablement relative to cloud-features. 2) Your hypothetical informed consumers don't really exist, unless the only people buying cloud-enabled cars are computer scientists.
      - chambo622 11y ago
        1) Sure - it's one factor among many in the purchasing decision. Never said otherwise. It would also be incorrect to assume that this was not a factor at all. 2) Ever looked at a tech company parking lot in South Bay? A lot of people with CS background are buying the Model S. Not all buyers are computer scientists but informed buyers most definitely do exist.
- Silhouette 11y ago
  How do we know how well-informed or otherwise the people purchasing these vehicles are? There are relatively few people in the world who fully appreciate the implications of security issues and who can make rational risk assessments and take reasonable measures to limit those risks. Of course, even being informed isn't going to help if this sort of poorly secured connectivity becomes the norm for new vehicles, which seems to be happening disturbingly quickly. If you rely on the independence offered by having a car but all cars have similar dangers, you might have only bad alternatives to choose between, but they're still bad. [Edit: That last sentence was ambiguous. My intended meaning was that the alternatives to using a car at all might also be bad, for example incurring significant costs and disruption moving to live somewhere with viable public transport instead.]

FireBeyond 11y ago

I think it's telling that this is the kind of comment that's voted up. Jeep remote exploit: "OMG, are you kidding, what kind of idiots would even allow this to be a possibility? Car control systems remotely accessible, etc?" Tesla: "Kudos to Tesla for taking this seriously and working on it."