3 ms·

Most modules have some feature or other that needs to communicate with infotainment or another module that needs to communicate with infotainment. Error reporti

Most modules have some feature or other that needs to communicate with infotainment or another module that needs to communicate with infotainment. Error reporting is the big one, but there's lots of little ones too. The brake module, for example, may be involved in tire pressure sensing, and also takes configuration for traction control and reports activation. It's hard to find an appropriate segmentation for an air gap without sacrificing features, and most customers won't trade features for "security".

rthomas6 8y ago
You are right of course. But still. Once you can talk over the CAN bus you can spoof pretty much anything, if I recall correctly. You could at least have some intermediary module on both buses that acts as a proxy. Then if someone hacks your radio they can't pretend to be the ECM. Then again, this exact scenario actually happened and having an intermediary didn't help. https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-explained/9493/ https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-e...
mrweasel 8y ago
The infotainment system should only be allowed to read values from the modules related to the actual driving. Configuring things like traction control will just have to be done via a system separate from the infotainment system. I understand that it a little wasteful to not use that big touch screen in the center console to do configuration of the driving experience, but there's no safe way to do so.
- plttn 8y ago
  But the gauge cluster screen is connected to the infotainment system.
marcosdumay 8y ago
An air gap may not be viable, but you can place a firewall there. There is no reason for everything to be on the same bus.
- pipelineist 8y ago
  > An air gap may not be viable, but you can place a firewall there. No idea how it was one or two decades ago, but modern architectures certainly have one. I can't remember the specifics, but the one I looked at was actually pretty beefy hardware-wise, it had three reasonably powerful cores, 1GB RAM, etc. > There is no reason for everything to be on the same bus. It isn't. They would run into bandwidth or (more likely) latency issues anyway.

rthomas6 8y ago

You are right of course. But still. Once you can talk over the CAN bus you can spoof pretty much anything, if I recall correctly. You could at least have some intermediary module on both buses that acts as a proxy. Then if someone hacks your radio they can't pretend to be the ECM. Then again, this exact scenario actually happened and having an intermediary didn't help. https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-explained/9493/ https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-e...

mrweasel 8y ago

The infotainment system should only be allowed to read values from the modules related to the actual driving. Configuring things like traction control will just have to be done via a system separate from the infotainment system. I understand that it a little wasteful to not use that big touch screen in the center console to do configuration of the driving experience, but there's no safe way to do so.

plttn 8y ago
But the gauge cluster screen is connected to the infotainment system.

marcosdumay 8y ago

An air gap may not be viable, but you can place a firewall there. There is no reason for everything to be on the same bus.

pipelineist 8y ago
> An air gap may not be viable, but you can place a firewall there. No idea how it was one or two decades ago, but modern architectures certainly have one. I can't remember the specifics, but the one I looked at was actually pretty beefy hardware-wise, it had three reasonably powerful cores, 1GB RAM, etc. > There is no reason for everything to be on the same bus. It isn't. They would run into bandwidth or (more likely) latency issues anyway.