5 ms·

> "Every single electrical and radiological device can be utilized to transmit data. What's the baud of opening and closing HVAC vents and reading them from spa

by csours 9y ago

> "Every single electrical and radiological device can be utilized to transmit data. What's the baud of opening and closing HVAC vents and reading them from space satellites?" https://www.wired.com/2017/02/malware-sends-stolen-data-drone-just-pcs-blinking-led/ https://www.wired.com/2017/02/malware-sends-stolen-data-dron... Also reminds me of the stories of reverse engineers using, lights, motors, speakers, etc to exfiltrate boot images. > "If hacking a Jeep is as straightforward as hacking a server, and servers are routinely breached, then where are all the hacked cars? It's a bit like the Fermi Paradox." One barrier to entry is the actual cost of acquiring a vehicle. You can buy a lot of iPhones to hack on for the price of a Tesla. > "We think of Teslas as cars just like we think of an iPhone as a phone, but a more accurate account of reality is that they're both just computers." It's actually kind of worse than that, cars are actually rolling datacenters with multiple computers and multiple networks. (CAN bus[es], Ethernet, proprietary networks) //Disclaimer: I work for GM, but not on any of this.

hinkley 9y ago
I know things change over time, but the old advice on hackers was that most of them are not as malicious as they seem. For instance, many viruses have been accidentally more damaging than the creator intended. Hacking a car to kill people is a lot different than kicking someone out of a video game. Even people who SWAT don't anticipate their rival/victim being killed. They want the person to be miserable, not dead. It's cruel and vindictive, but it's not homicidal. Or at least not most of the time.
- c3534l 9y ago
  The world isn't short of homicidal maniacs. All that is needed is a perverse ideological motivation and a single person could, theoretically, cause unprecedented harm.
  - crpatino 9y ago
    The thing is when you have two or more pretty unlikely traits as required components of X, X's likelyhood becomes negligible. That's why the weapons of choice for homicidal maniacs are everyday tools like kitchen knives or baseball clubs. Even the use of handguns sugest the involvement of a more purpose-driven kind of homicidal. So, IMHO, what you need to fear is not a hacker going homicidal. Rather, it is the raise of a black market of "assasination thru tech"; specially if there's enough separation of labour so that unethical but otherwise non-violent hackers can enable the efforts of conventional assassins in order to accomplish their grim deeds.
- cracell 9y ago
  There's been a number of suspicious reporter deaths with vehicles malfunctions, possibly due to hack (https://encrypted.google.com/search?hl=en&q=suspicious%20reporter%20vehicle%20deaths https://encrypted.google.com/search?hl=en&q=suspicious%20rep...). The most recent high profile one being Michael Hastings(https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)#Controversy_over_alleged_foul_play https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)#...) Could be paranoid nonsense. But white hat researchers have demonstrated a disturbing number of attack vectors that could be used for this sort of thing.
  - hinkley 9y ago
    State actors have a myriad of options. I was simply trying to answer the question of why this isn't happening all the time. If it is happening all the time (a point I won't dispute) then the question is wrong.
    - jethro_tell 9y ago
      Do we know that it isn't happening all the time? We are already so conditioned to driving being one of the most dangerous things yet we absolutely take it for granted. It would be easy enough for it to more or less blend in. Especially as I'd assume the current traffic investigation work force in the field isn't going to have the chops to do this kind of work. This may be happening, and just being written off as user error like all the rest of the massive number auto accidents we live with everyday.
      - hinkley 9y ago
        Alan Turing was doing statistical modeling to make sure we didn’t blow up more U boats than could be mistaken for bad luck. That was more than seventy years ago so who knows.
- reaperducer 9y ago
  > Hacking a car to kill people is a lot different than kicking someone out of a video game. Even people who SWAT don't anticipate their rival/victim being killed. Sounds like you've never been to 4chan.
- PhasmaFelis 9y ago
  > I know things change over time, but the old advice on hackers was that most of them are not as malicious as they seem. For instance, many viruses have been accidentally more damaging than the creator intended. That hasn't been true in a while. Most malware these days is about money or political goals.
- Piskvorrr 9y ago
  That's, indeed, old advice. It's not 2000 any more (and how I wish it were!).
golergka 9y ago
> One barrier to entry is the actual cost of acquiring a vehicle. You can buy a lot of iPhones to hack on for the price of a Tesla. Assuming you're just a random person and not a serious organization (which would have money to buy cars), can't you just get a job at an auto repair shop to fool around with their computer systems in the evening?
- PhasmaFelis 9y ago
  Sure, if you're willing and able to quit your current job and work full-time fixing cars.
  - brokenmachine 9y ago
    Also you still risk bricking a customers car if you're actively trying to compromise it.
- skgoa 9y ago
  That's not all that practical. Modern cars are rolling datacenters. Most have 50-100 computers in them that are on several different networks. Features are distributed over several nodes ("ECUs") and everything is statically linked and scheduled. (i.e. almost no OS akin to what you would find on a PC or smartphone) It's very difficult to do anything complex without having special tools and know-how. Which someone at a shop just won't ahve, because a shop does not debug the software. They just fix hardware issues, which as far as ECUs are concerned just means changing faulty parts for new ones. source: I work on this, but not for GM.
  - Balgair 9y ago
    Truth. Most of the time, you just get the factory reset code if you think there is something borked in the OBCs. That or just replace the computers entirely. Alldata is the HN of techs (kinda): http://www.alldata.com/alldata-repair http://www.alldata.com/alldata-repair Protip for home mechanics, get one of these: https://www.amazon.com/Reader-Diagnostic-Check-Engine-Light/dp/B004IV58AY https://www.amazon.com/Reader-Diagnostic-Check-Engine-Light/...

by csours 9y ago

hinkley 9y ago

I know things change over time, but the old advice on hackers was that most of them are not as malicious as they seem. For instance, many viruses have been accidentally more damaging than the creator intended. Hacking a car to kill people is a lot different than kicking someone out of a video game. Even people who SWAT don't anticipate their rival/victim being killed. They want the person to be miserable, not dead. It's cruel and vindictive, but it's not homicidal. Or at least not most of the time.

c3534l 9y ago
The world isn't short of homicidal maniacs. All that is needed is a perverse ideological motivation and a single person could, theoretically, cause unprecedented harm.
- crpatino 9y ago
  The thing is when you have two or more pretty unlikely traits as required components of X, X's likelyhood becomes negligible. That's why the weapons of choice for homicidal maniacs are everyday tools like kitchen knives or baseball clubs. Even the use of handguns sugest the involvement of a more purpose-driven kind of homicidal. So, IMHO, what you need to fear is not a hacker going homicidal. Rather, it is the raise of a black market of "assasination thru tech"; specially if there's enough separation of labour so that unethical but otherwise non-violent hackers can enable the efforts of conventional assassins in order to accomplish their grim deeds.
cracell 9y ago
There's been a number of suspicious reporter deaths with vehicles malfunctions, possibly due to hack (https://encrypted.google.com/search?hl=en&q=suspicious%20reporter%20vehicle%20deaths https://encrypted.google.com/search?hl=en&q=suspicious%20rep...). The most recent high profile one being Michael Hastings(https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)#Controversy_over_alleged_foul_play https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)#...) Could be paranoid nonsense. But white hat researchers have demonstrated a disturbing number of attack vectors that could be used for this sort of thing.
- hinkley 9y ago
  State actors have a myriad of options. I was simply trying to answer the question of why this isn't happening all the time. If it is happening all the time (a point I won't dispute) then the question is wrong.
  - jethro_tell 9y ago
    Do we know that it isn't happening all the time? We are already so conditioned to driving being one of the most dangerous things yet we absolutely take it for granted. It would be easy enough for it to more or less blend in. Especially as I'd assume the current traffic investigation work force in the field isn't going to have the chops to do this kind of work. This may be happening, and just being written off as user error like all the rest of the massive number auto accidents we live with everyday.
    - hinkley 9y ago
      Alan Turing was doing statistical modeling to make sure we didn’t blow up more U boats than could be mistaken for bad luck. That was more than seventy years ago so who knows.
reaperducer 9y ago
> Hacking a car to kill people is a lot different than kicking someone out of a video game. Even people who SWAT don't anticipate their rival/victim being killed. Sounds like you've never been to 4chan.
PhasmaFelis 9y ago
> I know things change over time, but the old advice on hackers was that most of them are not as malicious as they seem. For instance, many viruses have been accidentally more damaging than the creator intended. That hasn't been true in a while. Most malware these days is about money or political goals.
Piskvorrr 9y ago
That's, indeed, old advice. It's not 2000 any more (and how I wish it were!).

golergka 9y ago

> One barrier to entry is the actual cost of acquiring a vehicle. You can buy a lot of iPhones to hack on for the price of a Tesla. Assuming you're just a random person and not a serious organization (which would have money to buy cars), can't you just get a job at an auto repair shop to fool around with their computer systems in the evening?

PhasmaFelis 9y ago
Sure, if you're willing and able to quit your current job and work full-time fixing cars.
- brokenmachine 9y ago
  Also you still risk bricking a customers car if you're actively trying to compromise it.
skgoa 9y ago
That's not all that practical. Modern cars are rolling datacenters. Most have 50-100 computers in them that are on several different networks. Features are distributed over several nodes ("ECUs") and everything is statically linked and scheduled. (i.e. almost no OS akin to what you would find on a PC or smartphone) It's very difficult to do anything complex without having special tools and know-how. Which someone at a shop just won't ahve, because a shop does not debug the software. They just fix hardware issues, which as far as ECUs are concerned just means changing faulty parts for new ones. source: I work on this, but not for GM.
- Balgair 9y ago
  Truth. Most of the time, you just get the factory reset code if you think there is something borked in the OBCs. That or just replace the computers entirely. Alldata is the HN of techs (kinda): http://www.alldata.com/alldata-repair http://www.alldata.com/alldata-repair Protip for home mechanics, get one of these: https://www.amazon.com/Reader-Diagnostic-Check-Engine-Light/dp/B004IV58AY https://www.amazon.com/Reader-Diagnostic-Check-Engine-Light/...