11 ms·

Hacker Finds He Can Remotely Kill Car Engines After Breaking into GPS Tracking

157 points by LinuxBender 8y ago

rossdavidh 8y ago
Well, what a complete and total surprise that adding this kind of functionality to an automobile would result in it being so insecure that it can be hacked into.
- robertAngst 8y ago
  Because a GPS signal gives coordinates to your navigation screen. Your radio has 0 control over an Engine. Or at least, shouldn't. Source: Connected Car is my day job.
  - Haga 8y ago
    Must we use that many ecus? They are horrifically expensive - why not auosar separated squeeze them all together and we hope that row hammer never existed.
    - blcArmadillo 8y ago
      That's what the industry is moving towards. Fewer but higher powered ECUs running either with a SOC that provides isolation of the cores in hardware or a hypervisor to enable running safety critical applications in isolation.
      - Haga 8y ago
        That is what worked so swell for branch prediction.
  - hedora 8y ago
    You’re completely wrong. First of all, many manufacturers market remote engine kill as a subscription service. Second, many cars use CAN busses and connect the radio to it. That makes it very easy for the radio to interfere with crucial functions, like braking. The CAN bus uses realtime time multiplexing for congestion control, so it is very easy to target traffic from a particular device subsystem, even accidentally. Sources: search for “can bus vulnerabilities”. Also, a ~2012 GMC I used to own had a bug in the radio firmware that caused the ABS system to stay on when the engine was off, which ran down the battery overnight. On my current Dodge, there is a recall where the head unit firmware leads to confusing semantics around “park” on the transmission, and a separate firmware update where it refuses to disengage cruise control. On recent Ford mustangs, the radio can display all sorts of engine statistics, and tune the engine in real time. European luxury cars are even more integrated on this front, and have sport modes where the radio changes the response curves for the engine, steering, transmission and suspension. The first generation Prius had the engine control computer physically inside the radio. That covers the major car manufacturers across three continents.
    - jacquesm 8y ago
      > and a separate firmware update where it refuses to disengage cruise control. Wow, that's a bad one.
    - robertAngst 8y ago
      > subscription service. Oh, subscription service. Not GPS signal. I'm completely right.
  - rconti 8y ago
    This isn't about GPS navigation systems in your in-dash screen. This is about hacking into a service linked to a device specifically designed to do what he did with it. From the article: >The hacker, who goes by the name L&M, told Motherboard he hacked into more than 7,000 iTrack accounts and more than 20,000 ProTrack accounts, two apps that companies use to monitor and manage fleets of vehicles through GPS tracking devices. The hacker was able to track vehicles in a handful of countries around the world, including South Africa, Morocco, India, and the Philippines. On some cars, the software has the capability of remotely turning off the engines of vehicles that are stopped or are traveling 12 miles per hour or slower, according to the manufacturer of certain GPS tracking devices.
neuralRiot 8y ago
If the device is correctly installed it should not kill the engine but prevent it from starting, just like smart keys.
- wpearse 8y ago
  Correct; usually the installer instructions will say to wire the hardware so it disables the starter motor. This means that the engine won’t stop, but rather be prevented from starting. Some of the cheaper (AliExpress) hardware installation instructions say that the relay should be wired to the fuel pump. I wonder if the starter vs. fuel pump is a regional difference? Perhaps in countries where vehicle theft is more prevalent/violent installers would lean towards cutting the fuel pump?
  - sokoloff 8y ago
    On a car with a manual transmission, killing the starter doesn't do much as you can bump start the car (get the engine spinning by driving the engine via the transmission rather than the starter).
- tananaev 8y ago
  As far as I know, most of the devices kill the engine, but only when vehicle speed is near zero.
ccnafr 8y ago
Wasn't this article debunked as fake?
- nstart 8y ago
  I tried searching for keywords on Google and Twitter and couldn't find anything to suggest this was the case. Do you have a source that you can suggest for this?
2T1Qka0rEiPr 8y ago
Vaguely related, and would recommend: https://www.goodreads.com/book/show/40718386-the-passengers https://www.goodreads.com/book/show/40718386-the-passengers
tananaev 8y ago
There is surprisingly little security when it comes to GPS tracking. Just a couple of examples: - Majority of GPS tracking devices use un-encrypted TCP or UDP connection to send location and sensor data - There is also no authentication for devices; you can spoof data if you know device identifier (usually IMEI) Source: working on an open source GPS tracking solution for almost 10 years
cdtwoaway 8y ago
Not surprised. I built automotive test benches for some time. The moment you have something that can remote-access the CAN-bus, you have a problem. There are typically only a few busses in a car. In many cases, there is a LIN bus for entertainment / radio / lights etc that is physically separated from the main CAN bus. This one is mostly harmless. But if you can somehow talk to the main bus... There are like 5 critical ECUs that have to communicate "I'm OK" (engine, breaks etc) - otherwise nothing works. Those communicate with some minor encryption, and that communication is somewhat validated (they send counters to each other etc). But it doesn't matter. First of all, the protocols and databases are similar for different models, and known to A LOT of people who had jobs similar to mine. In order to test or build any ECU, you have to simulate the correct communication, otherwise the ECU won't start up.. Second, just sending nonsense with the right identifier could probably shut down the car or at least make it think there is a major problem. Third, there are messages that simulate power-cycling the bus..
- Zenst 8y ago
  If the LIN bus can access lights, and is bundled up with IMHO unrelated systems like radio/entertainment then that seems wrong by design. I say this as if somebody can remotely control your lights on a car, that in itself at the wrong time could and would prove dangerous.
  - cdtwoaway 8y ago
    Lights for instrumentation (inside the car). At least on the systems I worked with. I'm not much of an expert on that bus. Well, messing with this bus (audio volume.. blinking displays etc) could be disruptive as well, but not as critical as killing the engine.
    - Zenst 8y ago
      I had a read up upon LIN https://en.wikipedia.org/wiki/Local_Interconnect_Network https://en.wikipedia.org/wiki/Local_Interconnect_Network Was introduced as a cheaper alternative to CAN, and to be used for non-critical aspects of cars (intended). Though seat controls are listed as common use for it. Which with some occupants and cars with the seatbelt - would enable the seat to pull the driver away from the controls. So whilst not directly deemed critical - certainly a vector of concern in some permutations of seat/driver position (thinking large 4x4's driven by small people who end up having the seat fully forward and raised, as an example). My initial concern was the main lights, though as you cleared that up to just internal lighting - that again could prove a problem as dark roads, a sudden change in internal lighting would from internal glare reduce visibility. Biggest take away is that the LIN bus has no form of encryption and the only verification would be checksums upon the data packet. I'm sure we will read more about LIN over the years as the ability for car makers to cut-corners is not unheard of and as LIN is cheaper to implement than CAM, can see how that may well play out.
fareesh 8y ago
If an accident took place as a result of something like this would there be any way of finding out during an investigation?
- freeflight 8y ago
  Really depends on how throughout the investigation is/what hardware survives the crash. Depending on the surrounding circumstances of the incident, it would probably not even be considered a possibility because fatal car crashes are so common that "just another accident" is the most probable, and thus most usual answer. That's also the reason why Michael Hastings death is so controversial to this day [0]. [0] https://en.wikipedia.org/wiki/Michael_Hastings_(journalist) https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)
  - paulkon 8y ago
    Do cars have something equivalent to an airplane black box?
    - cdtwoaway 8y ago
      Nope. ECUs have something called a "fault memory" where the last n detected errors are stored, and that can be recovered. This is actually what workshops use for diagnosing a car. This can give lots of information about what happened (faults could be "didn't receive message xyz" "sensor xyz gave signal out of tolerance"). But there is definitely no system trace for the communication - too many messages to really store them I guess.
    - jakeogh 8y ago
      http://harristechnical.com/wp-content/uploads/2016/01/HTS_CDR_List.pdf http://harristechnical.com/wp-content/uploads/2016/01/HTS_CD...
joshe 8y ago
Just want confirm that vehicle security is a trash fire. The CAN bus [1] has no security, you just put packets on it and read packets off it. Like "tell me the speedometer reading" or "activate the brakes" and CAN bus does it. You and I might think, gosh those are radically different things. Well the CAN bus disagrees. Did I mention that there is no encryption? There isn't. To the CAN bus, the packets from the GPS tracker that say "tell me the speedometer reading" and the packets from the manufacturer created by pressing the brake are treated with the same authority. Does vehicle electronics firmware use a weird 20 year old non ANSI version of C? Well of course it does. Does it require signed firmware? Hah! Do most vehicle electronics suppliers not have the top quality security people they need? They do not. Do they have management support for making security conscious decisions? They don't. Anything that can put packets on the CAN bus can completely control the car. So anything that connects the the CAN bus, through bluetooth, wifi, cell service, or a plug needs to be completely secure. I'm a little distrustful of On Star and the like, because I don't think GM is security conscious enough to manage it perfectly. I'd be very distrustful of a company that let you keep a default password for your GPS tracker. Instead purchase the GPS tracker that does NOT read info about the vehicle, the only plug should be for power. Here's a story about hacking Chrysler's Uconnect, with good details. https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig... If you are writing software/firmware that will control a vehicle, you should hard code the packets it can write and never include dangerous ones. Even though it might seem cool to be able to "stop the vehicle" in an "emergency". If you want to use dangerous commands, you need to level up your security org to google/facebook levels. If you are talking to management that means spending $50 million a year just on security. These are not attacks that require state level NSA/Chinese/Russian attackers. This is well within the reach of an advanced individual. It is very lucky indeed that there is no monetary or other advantage to this, if actuating brakes in cars produced social security numbers we'd have hundreds of excess deaths a year. [1] https://en.wikipedia.org/wiki/CAN_bus https://en.wikipedia.org/wiki/CAN_bus
- cdtwoaway 8y ago
  Yeah, firmware is another issue. You read and flash firmware or parameters often directly over that CAN bus. There is nothing to validate that, for one manufacturer, I needed passwords (casually handed out to every supplier, the same for every unit), for one, the "encryption" was a XOR with the same number that had been used for every model for years. I didn't know why they even bothered. One of the manufacturers at least stopped you from flashing new software to an ECU more than 3 times. Did I mention that we had incredibly high fluctuation (at least production line test benches - brutal deadlines and 2am deployments, working in loud production halls, lots of travel, no technical innovation,..). We basically hired anyone who was alive and somewhat skilled. I don't think anybody ever talked to me about security - ever. What these articles are showing, is amateurs' work. I'm terrified by the idea of what a disgruntled / crazy / .. person with experience in the field could do.
gcb0 8y ago
people in this thread have a crazy assumption of in-car network security. leave this thread with one single knowledge: cars have a single canbus network, with zero security. your radio, turn signal, engine intake computer, are all talking in the open over a single data wire. anything you plug to that network can listen /talk to anything, and instead of security you have a priority bit (or a few of bits, don't remember) that is completely self regulated by each device.
- xiphias2 8y ago
  Tesla is an exception to this: it has a chip that converts high level commands, like stop to low level CAN commands (stopping slowly)
  - gcb0 8y ago
    it's still going ultimately to the can: game over just the same. the problem is not known systems failing. it's malicious actors that are also on the can network.
    - xiphias2 8y ago
      Did you look at the white hat presentation about Tesla from years ago? It's not that hard to take over the Tesla entertainment system, but the security was based on the command translator chip instead of securing the entertainment system.
- Too 8y ago
  Single network? All manufactures i've worked with in recent times have tons of internal networks and buses. Some are more isolated than others, eg connected infotainment and OBD often being behind some kind of secure gateway to not have direct access to engine network. If anyone is aware of manufacturers that don't do this please shout out. But yeah, otherwise the data buses are kindof assumed to be internal and only contain trusted input, only recently some cars are now also starting to have cryptographically signed packets. It's really not such a big deal until you mix connected ecus with secure ecus or install cheap third party stuff yourself on same network, if someone could physically access the data bus there are other more dangerous things they could do anyway.
williesleg 8y ago
Just more FUD. Don't go outside, it'll kill you. Like Global Warming, Global Cooling, etc. We're all gonna die!
Causality1 8y ago
Unless my car can drive itself, I will always disconnect any of this "IoT writ large" bullshit. I have my phone for navigation. My car does not need a cellular transceiver or a GPS antenna and I will happily rip both of them out by the wires.
- wallace_f 8y ago
  You can only go so far with it. Fundamentally it scares me that I no longer have a mechanical connection between myself and the brakes, or other drivetrain components.
  - jondumbau 8y ago
    What do you mean? Brakes must be mechanically connected, I believe it's the law here.
  - jimktrains2 8y ago
    You should be able to pump the breaks with a pedal in the case of a power breaking failure. That doesn't mean the car can engage the break via other means. What gets me is electronic parking breaks, as that feels like it goes against the while purpose of the parking break.
    - wallace_f 8y ago
      https://en.m.wikipedia.org/wiki/Brake-by-wire https://en.m.wikipedia.org/wiki/Brake-by-wire
babuskov 8y ago
> By reverse engineering ProTrack and iTrack’s Android apps, L&M said he realized that all customers are given a default password of 123456 when they sign up. Pretty much sums it up.
- cozzyd 8y ago
  Slightly more secure than the password on my luggage!
cjohansson 8y ago
Sounds like another ’Boeing software bug’ is likely to hit the smart cars business. From working with military computer security I know that nothing directly connected to the Internet should be considered safe. Sounds like a bad design decision
sea001 8y ago
澳洲留学挂科买毕业证书买文凭买学历办墨尔本大学毕业证UM毕业证Q微:202 661 4433成绩单学历认证The University of Melbourne

157 points by LinuxBender 8y ago

Well, what a complete and total surprise that adding this kind of functionality to an automobile would result in it being so insecure that it can be hacked into.

robertAngst 8y ago
Because a GPS signal gives coordinates to your navigation screen. Your radio has 0 control over an Engine. Or at least, shouldn't. Source: Connected Car is my day job.
- Haga 8y ago
  Must we use that many ecus? They are horrifically expensive - why not auosar separated squeeze them all together and we hope that row hammer never existed.
  - blcArmadillo 8y ago
    That's what the industry is moving towards. Fewer but higher powered ECUs running either with a SOC that provides isolation of the cores in hardware or a hypervisor to enable running safety critical applications in isolation.
    - Haga 8y ago
      That is what worked so swell for branch prediction.
- hedora 8y ago
  You’re completely wrong. First of all, many manufacturers market remote engine kill as a subscription service. Second, many cars use CAN busses and connect the radio to it. That makes it very easy for the radio to interfere with crucial functions, like braking. The CAN bus uses realtime time multiplexing for congestion control, so it is very easy to target traffic from a particular device subsystem, even accidentally. Sources: search for “can bus vulnerabilities”. Also, a ~2012 GMC I used to own had a bug in the radio firmware that caused the ABS system to stay on when the engine was off, which ran down the battery overnight. On my current Dodge, there is a recall where the head unit firmware leads to confusing semantics around “park” on the transmission, and a separate firmware update where it refuses to disengage cruise control. On recent Ford mustangs, the radio can display all sorts of engine statistics, and tune the engine in real time. European luxury cars are even more integrated on this front, and have sport modes where the radio changes the response curves for the engine, steering, transmission and suspension. The first generation Prius had the engine control computer physically inside the radio. That covers the major car manufacturers across three continents.
  - jacquesm 8y ago
    > and a separate firmware update where it refuses to disengage cruise control. Wow, that's a bad one.
  - robertAngst 8y ago
    > subscription service. Oh, subscription service. Not GPS signal. I'm completely right.
- rconti 8y ago
  This isn't about GPS navigation systems in your in-dash screen. This is about hacking into a service linked to a device specifically designed to do what he did with it. From the article: >The hacker, who goes by the name L&M, told Motherboard he hacked into more than 7,000 iTrack accounts and more than 20,000 ProTrack accounts, two apps that companies use to monitor and manage fleets of vehicles through GPS tracking devices. The hacker was able to track vehicles in a handful of countries around the world, including South Africa, Morocco, India, and the Philippines. On some cars, the software has the capability of remotely turning off the engines of vehicles that are stopped or are traveling 12 miles per hour or slower, according to the manufacturer of certain GPS tracking devices.

neuralRiot 8y ago

If the device is correctly installed it should not kill the engine but prevent it from starting, just like smart keys.

wpearse 8y ago
Correct; usually the installer instructions will say to wire the hardware so it disables the starter motor. This means that the engine won’t stop, but rather be prevented from starting. Some of the cheaper (AliExpress) hardware installation instructions say that the relay should be wired to the fuel pump. I wonder if the starter vs. fuel pump is a regional difference? Perhaps in countries where vehicle theft is more prevalent/violent installers would lean towards cutting the fuel pump?
- sokoloff 8y ago
  On a car with a manual transmission, killing the starter doesn't do much as you can bump start the car (get the engine spinning by driving the engine via the transmission rather than the starter).
tananaev 8y ago
As far as I know, most of the devices kill the engine, but only when vehicle speed is near zero.

ccnafr 8y ago

Wasn't this article debunked as fake?

nstart 8y ago
I tried searching for keywords on Google and Twitter and couldn't find anything to suggest this was the case. Do you have a source that you can suggest for this?

2T1Qka0rEiPr 8y ago

Vaguely related, and would recommend: https://www.goodreads.com/book/show/40718386-the-passengers https://www.goodreads.com/book/show/40718386-the-passengers

tananaev 8y ago

There is surprisingly little security when it comes to GPS tracking. Just a couple of examples: - Majority of GPS tracking devices use un-encrypted TCP or UDP connection to send location and sensor data - There is also no authentication for devices; you can spoof data if you know device identifier (usually IMEI) Source: working on an open source GPS tracking solution for almost 10 years

cdtwoaway 8y ago

Not surprised. I built automotive test benches for some time. The moment you have something that can remote-access the CAN-bus, you have a problem. There are typically only a few busses in a car. In many cases, there is a LIN bus for entertainment / radio / lights etc that is physically separated from the main CAN bus. This one is mostly harmless. But if you can somehow talk to the main bus... There are like 5 critical ECUs that have to communicate "I'm OK" (engine, breaks etc) - otherwise nothing works. Those communicate with some minor encryption, and that communication is somewhat validated (they send counters to each other etc). But it doesn't matter. First of all, the protocols and databases are similar for different models, and known to A LOT of people who had jobs similar to mine. In order to test or build any ECU, you have to simulate the correct communication, otherwise the ECU won't start up.. Second, just sending nonsense with the right identifier could probably shut down the car or at least make it think there is a major problem. Third, there are messages that simulate power-cycling the bus..

Zenst 8y ago
If the LIN bus can access lights, and is bundled up with IMHO unrelated systems like radio/entertainment then that seems wrong by design. I say this as if somebody can remotely control your lights on a car, that in itself at the wrong time could and would prove dangerous.
- cdtwoaway 8y ago
  Lights for instrumentation (inside the car). At least on the systems I worked with. I'm not much of an expert on that bus. Well, messing with this bus (audio volume.. blinking displays etc) could be disruptive as well, but not as critical as killing the engine.
  - Zenst 8y ago
    I had a read up upon LIN https://en.wikipedia.org/wiki/Local_Interconnect_Network https://en.wikipedia.org/wiki/Local_Interconnect_Network Was introduced as a cheaper alternative to CAN, and to be used for non-critical aspects of cars (intended). Though seat controls are listed as common use for it. Which with some occupants and cars with the seatbelt - would enable the seat to pull the driver away from the controls. So whilst not directly deemed critical - certainly a vector of concern in some permutations of seat/driver position (thinking large 4x4's driven by small people who end up having the seat fully forward and raised, as an example). My initial concern was the main lights, though as you cleared that up to just internal lighting - that again could prove a problem as dark roads, a sudden change in internal lighting would from internal glare reduce visibility. Biggest take away is that the LIN bus has no form of encryption and the only verification would be checksums upon the data packet. I'm sure we will read more about LIN over the years as the ability for car makers to cut-corners is not unheard of and as LIN is cheaper to implement than CAM, can see how that may well play out.

fareesh 8y ago

If an accident took place as a result of something like this would there be any way of finding out during an investigation?

freeflight 8y ago
Really depends on how throughout the investigation is/what hardware survives the crash. Depending on the surrounding circumstances of the incident, it would probably not even be considered a possibility because fatal car crashes are so common that "just another accident" is the most probable, and thus most usual answer. That's also the reason why Michael Hastings death is so controversial to this day [0]. [0] https://en.wikipedia.org/wiki/Michael_Hastings_(journalist) https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)
- paulkon 8y ago
  Do cars have something equivalent to an airplane black box?
  - cdtwoaway 8y ago
    Nope. ECUs have something called a "fault memory" where the last n detected errors are stored, and that can be recovered. This is actually what workshops use for diagnosing a car. This can give lots of information about what happened (faults could be "didn't receive message xyz" "sensor xyz gave signal out of tolerance"). But there is definitely no system trace for the communication - too many messages to really store them I guess.
  - jakeogh 8y ago
    http://harristechnical.com/wp-content/uploads/2016/01/HTS_CDR_List.pdf http://harristechnical.com/wp-content/uploads/2016/01/HTS_CD...

joshe 8y ago

Just want confirm that vehicle security is a trash fire. The CAN bus [1] has no security, you just put packets on it and read packets off it. Like "tell me the speedometer reading" or "activate the brakes" and CAN bus does it. You and I might think, gosh those are radically different things. Well the CAN bus disagrees. Did I mention that there is no encryption? There isn't. To the CAN bus, the packets from the GPS tracker that say "tell me the speedometer reading" and the packets from the manufacturer created by pressing the brake are treated with the same authority. Does vehicle electronics firmware use a weird 20 year old non ANSI version of C? Well of course it does. Does it require signed firmware? Hah! Do most vehicle electronics suppliers not have the top quality security people they need? They do not. Do they have management support for making security conscious decisions? They don't. Anything that can put packets on the CAN bus can completely control the car. So anything that connects the the CAN bus, through bluetooth, wifi, cell service, or a plug needs to be completely secure. I'm a little distrustful of On Star and the like, because I don't think GM is security conscious enough to manage it perfectly. I'd be very distrustful of a company that let you keep a default password for your GPS tracker. Instead purchase the GPS tracker that does NOT read info about the vehicle, the only plug should be for power. Here's a story about hacking Chrysler's Uconnect, with good details. https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig... If you are writing software/firmware that will control a vehicle, you should hard code the packets it can write and never include dangerous ones. Even though it might seem cool to be able to "stop the vehicle" in an "emergency". If you want to use dangerous commands, you need to level up your security org to google/facebook levels. If you are talking to management that means spending $50 million a year just on security. These are not attacks that require state level NSA/Chinese/Russian attackers. This is well within the reach of an advanced individual. It is very lucky indeed that there is no monetary or other advantage to this, if actuating brakes in cars produced social security numbers we'd have hundreds of excess deaths a year. [1] https://en.wikipedia.org/wiki/CAN_bus https://en.wikipedia.org/wiki/CAN_bus

cdtwoaway 8y ago
Yeah, firmware is another issue. You read and flash firmware or parameters often directly over that CAN bus. There is nothing to validate that, for one manufacturer, I needed passwords (casually handed out to every supplier, the same for every unit), for one, the "encryption" was a XOR with the same number that had been used for every model for years. I didn't know why they even bothered. One of the manufacturers at least stopped you from flashing new software to an ECU more than 3 times. Did I mention that we had incredibly high fluctuation (at least production line test benches - brutal deadlines and 2am deployments, working in loud production halls, lots of travel, no technical innovation,..). We basically hired anyone who was alive and somewhat skilled. I don't think anybody ever talked to me about security - ever. What these articles are showing, is amateurs' work. I'm terrified by the idea of what a disgruntled / crazy / .. person with experience in the field could do.

gcb0 8y ago

people in this thread have a crazy assumption of in-car network security. leave this thread with one single knowledge: cars have a single canbus network, with zero security. your radio, turn signal, engine intake computer, are all talking in the open over a single data wire. anything you plug to that network can listen /talk to anything, and instead of security you have a priority bit (or a few of bits, don't remember) that is completely self regulated by each device.

xiphias2 8y ago
Tesla is an exception to this: it has a chip that converts high level commands, like stop to low level CAN commands (stopping slowly)
- gcb0 8y ago
  it's still going ultimately to the can: game over just the same. the problem is not known systems failing. it's malicious actors that are also on the can network.
  - xiphias2 8y ago
    Did you look at the white hat presentation about Tesla from years ago? It's not that hard to take over the Tesla entertainment system, but the security was based on the command translator chip instead of securing the entertainment system.
Too 8y ago
Single network? All manufactures i've worked with in recent times have tons of internal networks and buses. Some are more isolated than others, eg connected infotainment and OBD often being behind some kind of secure gateway to not have direct access to engine network. If anyone is aware of manufacturers that don't do this please shout out. But yeah, otherwise the data buses are kindof assumed to be internal and only contain trusted input, only recently some cars are now also starting to have cryptographically signed packets. It's really not such a big deal until you mix connected ecus with secure ecus or install cheap third party stuff yourself on same network, if someone could physically access the data bus there are other more dangerous things they could do anyway.

williesleg 8y ago

Just more FUD. Don't go outside, it'll kill you. Like Global Warming, Global Cooling, etc. We're all gonna die!

Causality1 8y ago

Unless my car can drive itself, I will always disconnect any of this "IoT writ large" bullshit. I have my phone for navigation. My car does not need a cellular transceiver or a GPS antenna and I will happily rip both of them out by the wires.

wallace_f 8y ago
You can only go so far with it. Fundamentally it scares me that I no longer have a mechanical connection between myself and the brakes, or other drivetrain components.
- jondumbau 8y ago
  What do you mean? Brakes must be mechanically connected, I believe it's the law here.
- jimktrains2 8y ago
  You should be able to pump the breaks with a pedal in the case of a power breaking failure. That doesn't mean the car can engage the break via other means. What gets me is electronic parking breaks, as that feels like it goes against the while purpose of the parking break.
  - wallace_f 8y ago
    https://en.m.wikipedia.org/wiki/Brake-by-wire https://en.m.wikipedia.org/wiki/Brake-by-wire

babuskov 8y ago

> By reverse engineering ProTrack and iTrack’s Android apps, L&M said he realized that all customers are given a default password of 123456 when they sign up. Pretty much sums it up.

cozzyd 8y ago
Slightly more secure than the password on my luggage!

cjohansson 8y ago

Sounds like another ’Boeing software bug’ is likely to hit the smart cars business. From working with military computer security I know that nothing directly connected to the Internet should be considered safe. Sounds like a bad design decision

sea001 8y ago

澳洲留学挂科买毕业证书买文凭买学历办墨尔本大学毕业证UM毕业证Q微:202 661 4433成绩单学历认证The University of Melbourne