9 ms·

Imagine ransomware infecting your car that gives you 30 minutes to pay or you'll be rammed into a tree at 90mph. I don't care about any contrived and well-funde

Imagine ransomware infecting your car that gives you 30 minutes to pay or you'll be rammed into a tree at 90mph. I don't care about any contrived and well-funded narratives about how unthinking, unfeeling, driverless cars will somehow save lives. No thanks, I'd rather take my chances continuing to share roads with human drivers who are careful because they fear their own death just as much as I do.

fucking_tragedy 9y ago
Or the inability to drive your car because of an unpaid parking ticket.
- tempestn 9y ago
  Except that with a self-driving car you'll never get a parking ticket in the first place!
Qwertious 9y ago
In all seriousness, ransomware that would kill someone won't be a remotely common thing - for one thing, it will be represented as "$COMPANY's lack of security KILLS PERSON X", and the bill for the ransom will need to be paid by them. And then the cops/secret-service would get involved. If there's a death involved (and reason to believe more will occur in the future, which would be necessary for ransom as a prolonged business model), then they will come down on any ransomware (and responsible negligent parties, such as auto companies with shitty security) like a TON OF BRICKS. Plus, there's still a lucrative malware model that goes like this: Infect the car, then quietly make it steal itself in the middle of the night (or at your moment of choice). Bam, you now have a stolen car that you can't be connected to, and nobody will notice for a while.
- ForHackernews 9y ago
  I think this is correct. Criminals aren't stupid. It'd be much safer (in terms of risk of authorities coming after them) to have ransomware where the car just refuses to go anywhere, or drives you to a far-away location, until you pay up. People will pay a fair amount of money to avoid a major inconvenience, but "my car won't start" is a lot less likely to have the FBI beating down your door.
loup-vaillant 9y ago
The correct answer to that is very simple, and very expensive: just make correct software. Such malware are only possible because the targeted system has vulnerabilities to begin with. One just has to ensure the absence of such vulnerabilities, possibly using machine checked proofs. One obvious approach is to properly isolate the driving software and sensors from external input.
- kbenson 9y ago
  > The correct answer to that is very simple, and very expensive: just make correct software. I used to think that was unlikely. Then I had a few discussions with people about the state of C, and things that could be done to make it default to a slightly more deterministic case by changing how undefined behavior is dealt with in regards to optimization. Now I think it's impossible, because nobody is willing to give up even theoretical unknown performance increases for more security. At least for C. You would have to use something that's much more strict about behavior, like Ada with SPARK, or possibly Rust. I'm willing to bet most the code already written for these projects is C or C++. Good luck getting that changed if so.
  - loup-vaillant 9y ago
    Forcing a change away from C/C++ is easy: regulation. If a software error (or vulnerability) kills anyone, the vendor is to stop all sales and recall all cars immediately. Sales can resume pending an evaluation period, and the evaluation is to be made by independent experts, at the expense of the vendor. (We should heavily imply that such an evaluation can take months, killing the company in the process.) Correct software is expensive. But if we make sure incorrect software is even more expensive, we'll get correct software. Once the industry is forced to get serious about correctness, they will move away from the C/C++ minefield real quick —or at least come up with safe ways of using C and C++.
- dorfsmay 9y ago
  + a mechanical override.
- c22 9y ago
sebleon 9y ago
It can actually be a lot worse - entire countries will be held ransom when car networks gets compromised. Beyond disabling a countries transportation ability, a remote hacker could weaponize every car to attack passengers and pedestrians.
- maverick_iceman 9y ago
  Why wouldn't the same argument apply to electric grid or internet infrastructure?
  - sebleon 9y ago
    The US electric grid is widely considered to be at risk: http://wapo.st/2qd2gFQ http://wapo.st/2qd2gFQ Internet infrastructure is decentralized in nature, making it hard to control. Though rogue individuals can have outsized effects: https://www.wired.com/2008/02/pakistans-accid/ https://www.wired.com/2008/02/pakistans-accid/
MarkMc 9y ago
Check out this graph about airplane accidents: http://cdn.static-economist.com/sites/default/files/images/2014/03/blogs/graphic-detail/20140315_gdc500_0.png http://cdn.static-economist.com/sites/default/files/images/2... Since 1970 total airplane casualties have halved, while there are now 7 times the number of passengers. Much of this improvement has been due taking decisions away from pilots and into the hands of 'unfeeling' automated systems.
- monkmartinez 9y ago
  And look at the cost of planes and those systems. Absolutely out of reach for 97% of the world.
  - Hydraulix989 9y ago
    I don't see how the ownership model affects parent's argument.
  - abawany 9y ago
    But commercial airliners were never intended for private ownership, right? I would say a significantly large proportion of the world is unable to own a large bus and these are quite manual still.
  - maverick_iceman 9y ago
    You do realize that the cost of air travel has become much less since the 70s?
Strom 9y ago
The ransomware scenario is serious, but merely opting out of a connected car yourself won't be enough. You can still get a text demanding payment or other cars on the road will ram into your manual. As for sharing roads with others who fear death as much as I do. That's a wonderful idea, however in my case a pipe dream. I share the roads with people who have no problem speeding, driving under the influence or even refusing to use seatbelts. Ultimately I'm more optimistic about solving the ransomware problem than I am about putting the fear of death into other humans.
mahyarm 9y ago
That could happen today. No car manufacturer is going to admit it's possible, but I'm pretty sure it's there, lurking: Look at this remote shutoff for example. http://latimesblogs.latimes.com/technology/2009/10/onstar-gps-carjacking.html/ http://latimesblogs.latimes.com/technology/2009/10/onstar-gp...
nommm-nommm 9y ago
You're not looking at the whole picture here. What's your odds of being killed by a drunk/inattentive/inexperienced driver vs odds of being killed by randomware? Road fatalities are already the number 1 killer of some age groups, its estimated that over a million people worldwide die on the roads every year. Around 40,000 in the US last year. If we trade 40,000 road deaths for 10,000 ransomware deaths, it's a massive improvement. Ignoring that, that ransomware wont' even exist for a number of reasons, the biggest being it wouldn't be profitable. Ransomware authors aren't going to get a payout, very few people are going to be able to buy Bitcoin in 30 minutes while unable to leave their car even if they wanted to. Not only that, it isn't remotely difficult to have a manual, physical, kill switch that physically stops the car in a life or death situation. Even if you didn't have a kill switch, you could simply call the police and they can lay down a spike strip. >who are careful because they fear their own death just as much as I do. LOL! That's a good one! Have you actually even been on the roads before!?! When I worked drive thru I had people who were so drunk they could hardly form a sentence come through my drive thru. That's just ONE example. You share the road with these upstanding citizens who are clearly very careful and concerned for their own wellbeing: https://www.youtube.com/watch?v=DcnuIWNv8lw https://www.youtube.com/watch?v=DcnuIWNv8lw https://www.youtube.com/watch?v=9hddt4bWNns https://www.youtube.com/watch?v=9hddt4bWNns
- c22 9y ago
  What are the odds of a single drunk driver killing thousands of people?
  - bdamm 9y ago
    What are the odds of many drunk drivers killing thousands of people? p(x)=1.0, it happens every year.
    - rainbowmverse 9y ago
      Humans are bad at risk assessment. You won't convince everyone a self-driving car is safer with math.
maverick_iceman 9y ago
Your car already comes packed with software. If you're worried about hackers gaining access you should be worried right now.

fucking_tragedy 9y ago

Or the inability to drive your car because of an unpaid parking ticket.

tempestn 9y ago
Except that with a self-driving car you'll never get a parking ticket in the first place!

Qwertious 9y ago

In all seriousness, ransomware that would kill someone won't be a remotely common thing - for one thing, it will be represented as "$COMPANY's lack of security KILLS PERSON X", and the bill for the ransom will need to be paid by them. And then the cops/secret-service would get involved. If there's a death involved (and reason to believe more will occur in the future, which would be necessary for ransom as a prolonged business model), then they will come down on any ransomware (and responsible negligent parties, such as auto companies with shitty security) like a TON OF BRICKS. Plus, there's still a lucrative malware model that goes like this: Infect the car, then quietly make it steal itself in the middle of the night (or at your moment of choice). Bam, you now have a stolen car that you can't be connected to, and nobody will notice for a while.

ForHackernews 9y ago
I think this is correct. Criminals aren't stupid. It'd be much safer (in terms of risk of authorities coming after them) to have ransomware where the car just refuses to go anywhere, or drives you to a far-away location, until you pay up. People will pay a fair amount of money to avoid a major inconvenience, but "my car won't start" is a lot less likely to have the FBI beating down your door.

loup-vaillant 9y ago

The correct answer to that is very simple, and very expensive: just make correct software. Such malware are only possible because the targeted system has vulnerabilities to begin with. One just has to ensure the absence of such vulnerabilities, possibly using machine checked proofs. One obvious approach is to properly isolate the driving software and sensors from external input.

kbenson 9y ago
> The correct answer to that is very simple, and very expensive: just make correct software. I used to think that was unlikely. Then I had a few discussions with people about the state of C, and things that could be done to make it default to a slightly more deterministic case by changing how undefined behavior is dealt with in regards to optimization. Now I think it's impossible, because nobody is willing to give up even theoretical unknown performance increases for more security. At least for C. You would have to use something that's much more strict about behavior, like Ada with SPARK, or possibly Rust. I'm willing to bet most the code already written for these projects is C or C++. Good luck getting that changed if so.
- loup-vaillant 9y ago
  Forcing a change away from C/C++ is easy: regulation. If a software error (or vulnerability) kills anyone, the vendor is to stop all sales and recall all cars immediately. Sales can resume pending an evaluation period, and the evaluation is to be made by independent experts, at the expense of the vendor. (We should heavily imply that such an evaluation can take months, killing the company in the process.) Correct software is expensive. But if we make sure incorrect software is even more expensive, we'll get correct software. Once the industry is forced to get serious about correctness, they will move away from the C/C++ minefield real quick —or at least come up with safe ways of using C and C++.
dorfsmay 9y ago
+ a mechanical override.
c22 9y ago

sebleon 9y ago

It can actually be a lot worse - entire countries will be held ransom when car networks gets compromised. Beyond disabling a countries transportation ability, a remote hacker could weaponize every car to attack passengers and pedestrians.

maverick_iceman 9y ago
Why wouldn't the same argument apply to electric grid or internet infrastructure?
- sebleon 9y ago
  The US electric grid is widely considered to be at risk: http://wapo.st/2qd2gFQ http://wapo.st/2qd2gFQ Internet infrastructure is decentralized in nature, making it hard to control. Though rogue individuals can have outsized effects: https://www.wired.com/2008/02/pakistans-accid/ https://www.wired.com/2008/02/pakistans-accid/

MarkMc 9y ago

Check out this graph about airplane accidents: http://cdn.static-economist.com/sites/default/files/images/2014/03/blogs/graphic-detail/20140315_gdc500_0.png http://cdn.static-economist.com/sites/default/files/images/2... Since 1970 total airplane casualties have halved, while there are now 7 times the number of passengers. Much of this improvement has been due taking decisions away from pilots and into the hands of 'unfeeling' automated systems.

monkmartinez 9y ago
And look at the cost of planes and those systems. Absolutely out of reach for 97% of the world.
- Hydraulix989 9y ago
  I don't see how the ownership model affects parent's argument.
- abawany 9y ago
  But commercial airliners were never intended for private ownership, right? I would say a significantly large proportion of the world is unable to own a large bus and these are quite manual still.
- maverick_iceman 9y ago
  You do realize that the cost of air travel has become much less since the 70s?

Strom 9y ago

The ransomware scenario is serious, but merely opting out of a connected car yourself won't be enough. You can still get a text demanding payment or other cars on the road will ram into your manual. As for sharing roads with others who fear death as much as I do. That's a wonderful idea, however in my case a pipe dream. I share the roads with people who have no problem speeding, driving under the influence or even refusing to use seatbelts. Ultimately I'm more optimistic about solving the ransomware problem than I am about putting the fear of death into other humans.

mahyarm 9y ago

That could happen today. No car manufacturer is going to admit it's possible, but I'm pretty sure it's there, lurking: Look at this remote shutoff for example. http://latimesblogs.latimes.com/technology/2009/10/onstar-gps-carjacking.html/ http://latimesblogs.latimes.com/technology/2009/10/onstar-gp...

nommm-nommm 9y ago

You're not looking at the whole picture here. What's your odds of being killed by a drunk/inattentive/inexperienced driver vs odds of being killed by randomware? Road fatalities are already the number 1 killer of some age groups, its estimated that over a million people worldwide die on the roads every year. Around 40,000 in the US last year. If we trade 40,000 road deaths for 10,000 ransomware deaths, it's a massive improvement. Ignoring that, that ransomware wont' even exist for a number of reasons, the biggest being it wouldn't be profitable. Ransomware authors aren't going to get a payout, very few people are going to be able to buy Bitcoin in 30 minutes while unable to leave their car even if they wanted to. Not only that, it isn't remotely difficult to have a manual, physical, kill switch that physically stops the car in a life or death situation. Even if you didn't have a kill switch, you could simply call the police and they can lay down a spike strip. >who are careful because they fear their own death just as much as I do. LOL! That's a good one! Have you actually even been on the roads before!?! When I worked drive thru I had people who were so drunk they could hardly form a sentence come through my drive thru. That's just ONE example. You share the road with these upstanding citizens who are clearly very careful and concerned for their own wellbeing: https://www.youtube.com/watch?v=DcnuIWNv8lw https://www.youtube.com/watch?v=DcnuIWNv8lw https://www.youtube.com/watch?v=9hddt4bWNns https://www.youtube.com/watch?v=9hddt4bWNns

c22 9y ago
What are the odds of a single drunk driver killing thousands of people?
- bdamm 9y ago
  What are the odds of many drunk drivers killing thousands of people? p(x)=1.0, it happens every year.
  - rainbowmverse 9y ago
    Humans are bad at risk assessment. You won't convince everyone a self-driving car is safer with math.

maverick_iceman 9y ago

Your car already comes packed with software. If you're worried about hackers gaining access you should be worried right now.