4 ms·

Why link to some dude's twitter, I WONDER, when he links the [actual paper](https://keenlab.tencent.com/en/whitepapers/Experimental_Security_Research_of_Tesla_A

Why link to some dude's twitter, I WONDER, when he links the [actual paper](https://keenlab.tencent.com/en/whitepapers/Experimental_Security_Research_of_Tesla_Autopilot.pdf https://keenlab.tencent.com/en/whitepapers/Experimental_Secu...).

deleted 8y ago
[deleted]
ccnafr 8y ago
Probably because it's 40-pages long. There's even a better summary of the entire research in this Twitter thread: https://twitter.com/campuscodi/status/1112064046369591296 https://twitter.com/campuscodi/status/1112064046369591296 Research is pretty smart, but highly impractical for real world attacks. It's also been patched since 2017, with additional patches in 2018. So, it's also impractical because it doesn't work anymore.
- ady_anr 8y ago
  Exactly. I wouldn't have even attempted to read the 40 page paper. Twitter is more eye catching.
- lucb1e 8y ago
  While I agree about the first and third issue, he's rather dismissive about the second one: "The attack relies on placing dots on the road to trick the car. Lots of them. \n\n I wouldn't worry about it." The demo shows 3 small dots can trigger a lane change. Hypothetically, it could be a very targeted attack if the attacker drives in front of the target to put the paint on the road, and then a car behind the target covers it up. If the cover-up looks just like normal road (no idea how easy that is to achieve), and if nobody is looking for it because it's not a common thing to do, it might never be found. There are probably much better attacks that one could come up with if one gives it more than two minutes' thought, but it seems realistic enough to me to be interesting. Or if not a targeted attack, it can be very disruptive once there is some adoption. Then again, people could already be disruptive and leave stuff on the road or rails, and experience tells us it's very rare (per driven person-kilometer at least). Something about tricking the computer seems more likely to happen than putting physical objects to harm others directly, but that's probably just between my ears.
  - tyingq 8y ago
    "and then a car behind the target covers it up. If the cover-up looks just like normal road (no idea how easy that is to achieve)" Powdered chalk would probably make that trivial. https://cdn-tp3.mozu.com/24645-37138/cms/37138/files/30c19d54-f103-4203-b314-20c2f14f3660?quality=50&_mzcb=_1550506931750 https://cdn-tp3.mozu.com/24645-37138/cms/37138/files/30c19d5...
    - squarefoot 8y ago
      Or drones projecting dots using lasers or collimated powerful leds: no traces, no smoking gun, no foul play. That would be scary at very least.
    - Farradfahren 8y ago
      sunbleached chewing gum should do it?
- vilhelm_s 8y ago
  I guess it's a bit ambiguous, but I think the thing that he says was "patched way back in 2017, and again in 2018" is not the hack to use adversarial dots on the road to fool the system, but the other hack where the they inject malicious code into the autodrive system over Wifi and then the CAM bus, and then take over control of the car from a cellphone. So maybe the lane marking thing is still unfixed? I'm also a bit amused by the suggestion that we should feel even safer because it was fixed twice! :)
  - nothal 8y ago
    Rationally, shouldn’t we feel safer if it’s patched twice? Seems like it’s irrational to prefer a state where it was patched once over one where it was patched twice. It would seem to indicate that they dedicated time and resources to resolve it once then did proper follow up to catch missed cases. It certainly points to it being a pernicious issue but I’m can’t see why you’d presume it’s worse that it’s been patched more.
    - IshKebab 8y ago
      Because the fact that it was patched twice means they didn't fix it the first time, which means they didn't test it properly and might not have fixed it the second time. It's entirely logical.
      - zaroth 8y ago
        I’m not sure the number of patches actually provides any definive information on the current state from a purely logical argument. Zero patches, one, two, or more. That there are patches merely tells you that they tried to respond to an identified threat. It doesn’t tell you the threat was properly mitigated in any case. I think we can say it is strictly better to have more than zero patches in the case where a vulnerability is public. Exactly one patch to me doesn’t guarantee anything about the quality. Multiple patches at least implies persistent effort and dedication to securing the fix. Maybe at some point the number of patches implies incompetence but I’m not sure I’d draw that line at “2”?
      - 8y ago
- sandov 8y ago
  I would agree if Twitter had a usable interface.
jkmcf 8y ago
I know some people prefer linking to the root source, but I find value in seeing who surfaced it.
- jkmcf 8y ago
  I’m going to guess the downvoters get their panties in a bunch if someone prefers Vim or Emacs over the other.
lelf 8y ago
Its title is too boring ;) https://news.ycombinator.com/item?id=19531025 https://news.ycombinator.com/item?id=19531025
ve55 8y ago
I decided to link the tweet as it's difficult to link to a specific portion of the paper and the paper had multiple topics that were hard to include in an 80-character title. As the tweet links to the paper, it's very easy for anyone interested to read about it in full.
- dawnerd 8y ago
  There’s way more interesting stuff than lane assist fails. The remote controlling for example.
- aurelwu 8y ago
  you can link to a specific page in pdfs by adding #page=[PageNumber] to it, for example: https://keenlab.tencent.com/en/whitepapers/Experimental_Security_Research_of_Tesla_Autopilot.pdf#page=20 https://keenlab.tencent.com/en/whitepapers/Experimental_Secu... Or did you mean that there is not a specific page in the pdf which gives an overview?
  - ve55 8y ago
    A combination of reasons: - Linking to a specific page might not work for many setups such as those who use an external program to open the pdf - The tweet is a lot easier for many people to digest who may otherwise pass on reading (even a section of) a 40 page pdf - The full original source (which often I would prefer to link) was easily available in the tweet, so it wouldn't be hard to find for anyone who wanted it - Coming up with a suitable submission title (80 characters or less) for the PDF was difficult as I wanted it to include information about more than one of the sections (such as both remote control + lane changing)
baby 8y ago
Because this is where professional discussions on security usually happens.

deleted 8y ago

[deleted]

ccnafr 8y ago

Probably because it's 40-pages long. There's even a better summary of the entire research in this Twitter thread: https://twitter.com/campuscodi/status/1112064046369591296 https://twitter.com/campuscodi/status/1112064046369591296 Research is pretty smart, but highly impractical for real world attacks. It's also been patched since 2017, with additional patches in 2018. So, it's also impractical because it doesn't work anymore.

ady_anr 8y ago
Exactly. I wouldn't have even attempted to read the 40 page paper. Twitter is more eye catching.
lucb1e 8y ago
While I agree about the first and third issue, he's rather dismissive about the second one: "The attack relies on placing dots on the road to trick the car. Lots of them. \n\n I wouldn't worry about it." The demo shows 3 small dots can trigger a lane change. Hypothetically, it could be a very targeted attack if the attacker drives in front of the target to put the paint on the road, and then a car behind the target covers it up. If the cover-up looks just like normal road (no idea how easy that is to achieve), and if nobody is looking for it because it's not a common thing to do, it might never be found. There are probably much better attacks that one could come up with if one gives it more than two minutes' thought, but it seems realistic enough to me to be interesting. Or if not a targeted attack, it can be very disruptive once there is some adoption. Then again, people could already be disruptive and leave stuff on the road or rails, and experience tells us it's very rare (per driven person-kilometer at least). Something about tricking the computer seems more likely to happen than putting physical objects to harm others directly, but that's probably just between my ears.
- tyingq 8y ago
  "and then a car behind the target covers it up. If the cover-up looks just like normal road (no idea how easy that is to achieve)" Powdered chalk would probably make that trivial. https://cdn-tp3.mozu.com/24645-37138/cms/37138/files/30c19d54-f103-4203-b314-20c2f14f3660?quality=50&_mzcb=_1550506931750 https://cdn-tp3.mozu.com/24645-37138/cms/37138/files/30c19d5...
  - squarefoot 8y ago
    Or drones projecting dots using lasers or collimated powerful leds: no traces, no smoking gun, no foul play. That would be scary at very least.
  - Farradfahren 8y ago
    sunbleached chewing gum should do it?
vilhelm_s 8y ago
I guess it's a bit ambiguous, but I think the thing that he says was "patched way back in 2017, and again in 2018" is not the hack to use adversarial dots on the road to fool the system, but the other hack where the they inject malicious code into the autodrive system over Wifi and then the CAM bus, and then take over control of the car from a cellphone. So maybe the lane marking thing is still unfixed? I'm also a bit amused by the suggestion that we should feel even safer because it was fixed twice! :)
- nothal 8y ago
  Rationally, shouldn’t we feel safer if it’s patched twice? Seems like it’s irrational to prefer a state where it was patched once over one where it was patched twice. It would seem to indicate that they dedicated time and resources to resolve it once then did proper follow up to catch missed cases. It certainly points to it being a pernicious issue but I’m can’t see why you’d presume it’s worse that it’s been patched more.
  - IshKebab 8y ago
    Because the fact that it was patched twice means they didn't fix it the first time, which means they didn't test it properly and might not have fixed it the second time. It's entirely logical.
    - zaroth 8y ago
      I’m not sure the number of patches actually provides any definive information on the current state from a purely logical argument. Zero patches, one, two, or more. That there are patches merely tells you that they tried to respond to an identified threat. It doesn’t tell you the threat was properly mitigated in any case. I think we can say it is strictly better to have more than zero patches in the case where a vulnerability is public. Exactly one patch to me doesn’t guarantee anything about the quality. Multiple patches at least implies persistent effort and dedication to securing the fix. Maybe at some point the number of patches implies incompetence but I’m not sure I’d draw that line at “2”?
    - 8y ago
sandov 8y ago
I would agree if Twitter had a usable interface.

jkmcf 8y ago

I know some people prefer linking to the root source, but I find value in seeing who surfaced it.

jkmcf 8y ago
I’m going to guess the downvoters get their panties in a bunch if someone prefers Vim or Emacs over the other.

lelf 8y ago

Its title is too boring ;) https://news.ycombinator.com/item?id=19531025 https://news.ycombinator.com/item?id=19531025

ve55 8y ago

I decided to link the tweet as it's difficult to link to a specific portion of the paper and the paper had multiple topics that were hard to include in an 80-character title. As the tweet links to the paper, it's very easy for anyone interested to read about it in full.

dawnerd 8y ago
There’s way more interesting stuff than lane assist fails. The remote controlling for example.
aurelwu 8y ago
you can link to a specific page in pdfs by adding #page=[PageNumber] to it, for example: https://keenlab.tencent.com/en/whitepapers/Experimental_Security_Research_of_Tesla_Autopilot.pdf#page=20 https://keenlab.tencent.com/en/whitepapers/Experimental_Secu... Or did you mean that there is not a specific page in the pdf which gives an overview?
- ve55 8y ago
  A combination of reasons: - Linking to a specific page might not work for many setups such as those who use an external program to open the pdf - The tweet is a lot easier for many people to digest who may otherwise pass on reading (even a section of) a 40 page pdf - The full original source (which often I would prefer to link) was easily available in the tweet, so it wouldn't be hard to find for anyone who wanted it - Coming up with a suitable submission title (80 characters or less) for the PDF was difficult as I wanted it to include information about more than one of the sections (such as both remote control + lane changing)

baby 8y ago

Because this is where professional discussions on security usually happens.