3 ms·

This where -- literally -- the rubber hits the road and we need extreme regulatory oversight over cybersecurity in cars. I don't like fearmongering but can you

by chx 8y ago

This where -- literally -- the rubber hits the road and we need extreme regulatory oversight over cybersecurity in cars. I don't like fearmongering but can you imagine what would happen if a terrorist group got hold of an exploit like this??

class4behavior 8y ago
We will have to take off our shoes before entering ours cars?
tyingq 8y ago
I don't think there's much regulation for 3rd party alarms. You could regulate the OBD-II port I suppose. Some manufacturers isolate it from the more dangerous internal CAN bus, others don't. Though these high end alarms can be hooked into that too.
drdaeman 8y ago
Does regulation actually improves software security in practice? I'm skeptical it does. I saw a few times how regulated software (certain billing systems) were certified and that was a bad joke. Maybe you have different experience, though. If you want government bodies to spend taxpayers money on something, I'd rather suggest spending it on funding security researchers actively attacking systems and cooperating with manufacturers on fixing the discovered issues (and you can legally mandate such cooperation). This might work, actually improving end-user security. Although you'd have to somehow audit those researchers are actually doing something...
- class4behavior 8y ago
  You can regulate the response time and the required infrastructure for the distribution of patches. For manufacturers to actually listen to security research, you'd need regulation as well. You could also require all or certain software in cars to be open source.
- kalleboo 8y ago
  It might be interesting to require a bug bounty program with high enough reward values. If companies want to indemnify themselves from the potential payouts, insurance companies could step in with their own standards and testing methods
- speedplane 8y ago
  > Does regulation actually improves software security in practice? Yes, it can. DO-178B is a widely used security standard in military equipment. It's difficult and expensive to obtain, and caters to fighter jets, not cell phones, but there is precedent for true technical security improvements through government programs.
  - tialaramex 8y ago
    Hang on, is this DO-178B _different_ from the DO-178B now replaced by DO-178C that is about _safety_ in aircraft systems? It isn't is it. So, you're talking about _safety_ when the parent and article are specifically about _security_. Because confusing safety and security is exactly the kind of awful goof that we're talking about here. I'm sure these car alarms are _safe_ the problem is they don't keep your car _secure_. The security record of military procurements is... not good. Same for the financial industry. Do a bad job, hope nobody finds out, if they do insist you didn't do a bad job and hope nobody who understands the difference is empowered to do anything about it. Let's take something easy, communications. Your generic Android phone is capable of doing secure voice communications over a distance subject only to traffic analysis and other inevitabilities. The British infantry have Bowman. At squad level it's unencrypted spread spectrum voice radio. So, much worse than that Android phone. A sophisticated bad guy (so, not some random bloke who decided to join ISIS last week, but say, a Russian armoured division you've been deployed to counter) can literally listen to everything you say, seamlessly, without giving away their position. Brilliant. Now regulation _can_ improve things by mandating something that people who know what they're doing already recommend. But you're not going to get there with things like DO-178B.
    - speedplane 8y ago
      > Hang on, is this DO-178B _different_ from the DO-178B now replaced by DO-178C that is about _safety_ in aircraft systems? It isn't is it. So, you're talking about _safety_ when the parent and article are specifically about _security_. It's about both. The DO-178B/C standards require software to work as formally specified, and require robust branch testing to ensure the code conforms to the spec. This means different things for different applications, but in an operating system, for example, it means that no process can affect any other process if the two are deemed independent. This requires that the OS prevent all covert channels, strictly limit memory, CPU performance, etc. For example, a fork bomb wouldn't be able to affect other processes, and caches are wiped on every context switch. So yes, it is definitely relevant to security as well as safety (which in military aerospace go hand-in-hand anyway).
zaroth 8y ago
I’ve seen DHS presentations on risks of hijacking networked cars. I can’t say they will effectively manage the threat, but they are absolutely talking about it.
jdietrich 8y ago
This issue is as much a market failure as it is a regulatory failure. Here in the UK, the insurance industry collectively funds Thatcham Research, an independent body that assesses the safety, security and repairability of new cars. Thatcham's assessments are hugely important to motor manufacturers, because they directly influence the cost of insurance; a good rating from Thatcham means a low insurance group rating, which is an important selling point. It's a fantastic example of what happens when everyone's interests are aligned. Thatcham also assess aftermarket security equipment; most insurers offer discounts on premiums where Thatcham-approved equipment is fitted. It is worth noting that neither of the products mentioned in this article are Thatcham approved. https://www.thatcham.org/what-we-do/security/ https://www.thatcham.org/what-we-do/security/
- chx 8y ago
  Very nice. I always thought once you can get a real self driving car human driving will be driven out of existence by insurers.

by chx 8y ago

class4behavior 8y ago

We will have to take off our shoes before entering ours cars?

tyingq 8y ago

I don't think there's much regulation for 3rd party alarms. You could regulate the OBD-II port I suppose. Some manufacturers isolate it from the more dangerous internal CAN bus, others don't. Though these high end alarms can be hooked into that too.

drdaeman 8y ago

Does regulation actually improves software security in practice? I'm skeptical it does. I saw a few times how regulated software (certain billing systems) were certified and that was a bad joke. Maybe you have different experience, though. If you want government bodies to spend taxpayers money on something, I'd rather suggest spending it on funding security researchers actively attacking systems and cooperating with manufacturers on fixing the discovered issues (and you can legally mandate such cooperation). This might work, actually improving end-user security. Although you'd have to somehow audit those researchers are actually doing something...

class4behavior 8y ago
You can regulate the response time and the required infrastructure for the distribution of patches. For manufacturers to actually listen to security research, you'd need regulation as well. You could also require all or certain software in cars to be open source.
kalleboo 8y ago
It might be interesting to require a bug bounty program with high enough reward values. If companies want to indemnify themselves from the potential payouts, insurance companies could step in with their own standards and testing methods
speedplane 8y ago
> Does regulation actually improves software security in practice? Yes, it can. DO-178B is a widely used security standard in military equipment. It's difficult and expensive to obtain, and caters to fighter jets, not cell phones, but there is precedent for true technical security improvements through government programs.
- tialaramex 8y ago
  Hang on, is this DO-178B _different_ from the DO-178B now replaced by DO-178C that is about _safety_ in aircraft systems? It isn't is it. So, you're talking about _safety_ when the parent and article are specifically about _security_. Because confusing safety and security is exactly the kind of awful goof that we're talking about here. I'm sure these car alarms are _safe_ the problem is they don't keep your car _secure_. The security record of military procurements is... not good. Same for the financial industry. Do a bad job, hope nobody finds out, if they do insist you didn't do a bad job and hope nobody who understands the difference is empowered to do anything about it. Let's take something easy, communications. Your generic Android phone is capable of doing secure voice communications over a distance subject only to traffic analysis and other inevitabilities. The British infantry have Bowman. At squad level it's unencrypted spread spectrum voice radio. So, much worse than that Android phone. A sophisticated bad guy (so, not some random bloke who decided to join ISIS last week, but say, a Russian armoured division you've been deployed to counter) can literally listen to everything you say, seamlessly, without giving away their position. Brilliant. Now regulation _can_ improve things by mandating something that people who know what they're doing already recommend. But you're not going to get there with things like DO-178B.
  - speedplane 8y ago
    > Hang on, is this DO-178B _different_ from the DO-178B now replaced by DO-178C that is about _safety_ in aircraft systems? It isn't is it. So, you're talking about _safety_ when the parent and article are specifically about _security_. It's about both. The DO-178B/C standards require software to work as formally specified, and require robust branch testing to ensure the code conforms to the spec. This means different things for different applications, but in an operating system, for example, it means that no process can affect any other process if the two are deemed independent. This requires that the OS prevent all covert channels, strictly limit memory, CPU performance, etc. For example, a fork bomb wouldn't be able to affect other processes, and caches are wiped on every context switch. So yes, it is definitely relevant to security as well as safety (which in military aerospace go hand-in-hand anyway).

zaroth 8y ago

I’ve seen DHS presentations on risks of hijacking networked cars. I can’t say they will effectively manage the threat, but they are absolutely talking about it.

jdietrich 8y ago

This issue is as much a market failure as it is a regulatory failure. Here in the UK, the insurance industry collectively funds Thatcham Research, an independent body that assesses the safety, security and repairability of new cars. Thatcham's assessments are hugely important to motor manufacturers, because they directly influence the cost of insurance; a good rating from Thatcham means a low insurance group rating, which is an important selling point. It's a fantastic example of what happens when everyone's interests are aligned. Thatcham also assess aftermarket security equipment; most insurers offer discounts on premiums where Thatcham-approved equipment is fitted. It is worth noting that neither of the products mentioned in this article are Thatcham approved. https://www.thatcham.org/what-we-do/security/ https://www.thatcham.org/what-we-do/security/

chx 8y ago
Very nice. I always thought once you can get a real self driving car human driving will be driven out of existence by insurers.