5 ms·

This will be interesting. A Jeep Cherokee was hacked a couple years ago. The results are pretty bad. It cost Chrysler a lot of money in recalls to fix the issue

• joezydeco 8y ago
  Seems like Tesla could fix security holes remotely. Chrysler could not.
  • rootusrootus 8y ago
    The ability to remotely patch a car seems like a double edged sword. Hasn't Tesla already had at least one example of introducing a bug through OTA updates?
    • HeyLaughingBoy 8y ago
      I consider that an issue with the software quality, not with the update mechanism. The bug would still have been introduced even if it required a trip to the dealer to plug in a programming cable.
      • falcolas 8y ago
        At least, when it's updated by a dealer and a cable, you know when to expect changed behavior. With OTA, the vehicle's driving behavior could (and has) quite literally change overnight.
        • HALtheWise 8y ago
          I'm pretty sure you still need manual confirmation in the car, and it shows you patch notes when you next get in, so you should have reason to expect changed behavior.
      • close04 8y ago
        The only problem I can see with the OTA updates is that they remove the need for physical access to the car. This is very convenient and allows for fast updates but it does slightly decrease the security and lowers the bar for successfully hacking the car remotely.
    • stanmancan 8y ago
      That same bug could have been introduced whether or not the update was OTA. At least they could fix it OTA as well...!
  • LoSboccacc 8y ago
    assuming it's a remote exploit then you can't trust the update code that's on board, because that could be compromised and just pretending to run the update. when a system is breached with methods that don't leave a signature a clean reinstall from scratch is the only option. once one to all your system are potentially breached by remote exploits it's recall time. local exploit that require access to the car innards could potentially be patched over the air if the method allows the owner to know if the car was breached into. then it'd be update for safe car and recall for breached cars.
  • vibrio 8y ago
    Not at all a Tech/software/hardware guy, but based on my experience with OTA firmware updates with my Netgear router, I'd be cautious.
    • 282883392 8y ago
      Teslas get regular OTA updates. They sometimes fail, but they've been remotely patching their vehicles for years.
  • Angostura 8y ago
    Assuming the attacker doesn't devise some malware that silently blocks subsequent OTA updates.
    • moftz 8y ago
      All it would take would be for Tesla to send out a verification check to get software signatures from all running that have phoned home anytime in the last 6 months. If something doesn't match, Tesla calls you up and tells you your car is fucked and to come get it serviced. If your car doesn't phone home yet still is pulling data from the internet, Tesla would know and suspect it's compromised.
      • jcranmer 8y ago
        And what prevents the compromised Tesla system from lying about its software signatures? When you have a compromised system, literally everything that system tells you or is capable of telling you is suspect.
        • fastball 8y ago
          You can't fake cryptographic signatures.
          • NotHereNotThere 8y ago
            How so? Telsa would most likely communicate with an API on the car and not directly running file hashes remotely. What prevents an attacker from overriding some validateFile("path","hash") call to always return 0 ?
            • fastball 8y ago
              Because you could ask for a checksum of the firmware and if it doesn't return the right hash you know something isn't right. You also never store the hash, so once a user has gained access to the car it's impossible to get the right hash (as you would've had to modify the firmware/filesystem/etc in some way to gain entry). You would also need to include a timestamp/car serial in the hash so that you couldn't reuse an old hash from before your entry (that you had MITM'd) or use a hash from a different car that still had its integrity.
  • wil421 8y ago
    My car, the Grand Cherokee, can get OTA updates. Not sure if the 2014 Cherokee is able to get them. According to autoweek Cherokee owners could download the update themselves and install from a USB stick.[1] Chrysler issued the TSB to try and force people to come in and get an update who couldn’t or wouldn’t do it themselves. [1]https://autoweek.com/article/car-news/your-jeep-cherokee-vulnerable-hackers-heres-how-fix-it https://autoweek.com/article/car-news/your-jeep-cherokee-vul...
• LeonM 8y ago
  There is a big difference between Chrystler (or any other car manufacturer) and Tesla in terms if impact. Tesla's are designed to receive software updates on a regular basis using a cellular connection, whereas with every other car brand you'll need to bring the car to a certified dealership to have a mechanic (!= computer engineer) install the new firmware. So: a nasty bug in a 'regular' car means the manufacturer must consider a recall of all affected cars, where Tesla will simply push an update to all cars in the field. This also means that Tesla can run the update before the vuln is disclosed. Musk said he regards Tesla as a software company, their software just so happens to have a car attached to it. I highly doubt other car manufacturers see it that way, they probably see the software development as an expense.
  • jlarocco 8y ago
    > So: a nasty bug in a 'regular' car means the manufacturer must consider a recall of all affected cars, where Tesla will simply push an update to all cars in the field. This also means that Tesla can run the update before the vuln is disclosed. Maybe, but that sounds optimistic. What if the hack turns that off? What if the hack bricks a piece of hardware? Should remote updates be trusted if the car's been infected with malware? > Musk said he regards Tesla as a software company, their software just so happens to have a car attached to it. I highly doubt other car manufacturers see it that way, they probably see the software development as an expense. Software companies write most of the software bugs, so that doesn't make me feel any better...
  • wil421 8y ago
    I have a Grand Cherokee that receives OTA updates and has an LTE connection as do the new Wranglers. I can even use it for a hotspot. My parents Lexus can also receive OTA updates. Your statement is untrue about OTA updates. Tesla might have been the first to do it in 2012 but most companies are doing it already or plan to. GM and Ford plan it for 2020 and Mercedes and BMW have announced it in the past year. The Japanese makers are usually more reluctant to adopt new tech.
  • SEJeff 8y ago
    The software updates in Tesla generally only happen over Wifi, not cellular. I had to lay conduit from my home to my garage, drill through the masonry, run some more conduit inside the garage, pull CAT6 through from my basement through the conduit to my garage... Then fish the cable through the ceiling and mount a Unifi AC Pro access point in my garage because I wanted the latest autopilot update. Yeah...