5 ms·

Care to elaborate on why you believe this?

burfog 6y ago
It's like being in 1995 and predicting that Windows botnets will be created. The coming disaster is inevitable. State-sponsored hackers are not going to ignore the opportunity. They probably have the capability already, in dozens of countries, and are just waiting for orders from the leaders. If war is starting, the order will be given. Sanctions could be enough to trigger it.
- thoughtstheseus 6y ago
  I thought it was well known that infrastructure has been a target of state hacking?
  - godelski 6y ago
    I think this is well known to tech literate people. Problem is that that's not most people. On HN we have sampling bias because we're more likely to be associated with people with similar interests, i.e. tech.
- deleted 6y ago
  [deleted]
- gfxgirl 6y ago
  So you predicted botnets in 1995 and ..... nothing much happened. botnets suck but there wasn't some world crashing event like the person above is predicting for computer controlled cars. All Windows computers didn't shut off on one day.
  - actuator 6y ago
    I would disagree, sure botnets can't be used for threatening life directly; but botnets have been proven to be quite effective in attacking services and do denial of services attacks. The one thing we can take from botnets is, vulnerable and unpatched devices can be infiltrated in high numbers and attackers can lie low until they decide to pull the trigger. Imagine even 0.1% cars being controlled, the mayhem and loss of life that they can cause is just immense. Power plants are also dangerous targets in a similar sense, but hopefully there is network separation for control services.
  - peripitea 6y ago
    I'm struggling to understand your point. It's a different threat model; of course it will manifest differently, no? A mothership-style model seems much more vulnerable to every node being compromised than the decentralized vector Win95 botnets have to go through. I could see arguing with the inevitability of the exploit -- Win95 botnets seemed much more inevitable to me than this Tesla mothership threat does. But it seems like you're arguing that they will both have similar impact if exploited. That doesn't make sense to me, because they're completely different threats, but it's possible I'm misunderstanding your argument in some way.
chadlavi 6y ago
I'd guess because posting speculative armchair stuff on the internet is free and easy to do
ghuntley 6y ago
https://www.can-cia.org/can-knowledge/can/can-history/ https://www.can-cia.org/can-knowledge/can/can-history/
- sukilot 6y ago
  In the context of international sabotage, I thought that domain name was for answering questions of the form "Can CIA _____?"
gruez 6y ago
Not the OP, but the precedents are here: Always-connected cars (eg. teslas): check. Being able to take control of a car via the CAN bus[1]: check. The only thing missing in the exploit chain is something that allows the attacker to jump from the modem/infotainment system to the CAN bus or ecu. [1] https://www.wired.com/2016/08/jeep-hackers-return-high-speed-steering-acceleration-hacks/ https://www.wired.com/2016/08/jeep-hackers-return-high-speed...
- vvanders 6y ago
  Tesla uses a pretty different architecture from the dumpster fire that was OnStar. Been a while since I looked in the details but from what I recall only very limited, well scrutinized communication is allowed to bridge the Ethernet subsystem over to the CAN bus.
  - Silhouette 6y ago
    Tesla uses a pretty different architecture from the dumpster fire that was OnStar. And probably other manufacturers will use their own designs. Unfortunately, this is one of those issues where we have to be lucky every time, and the bad guys only have to be lucky once. Given the number of different manufacturers whose systems have demonstrably been compromised in the past, the odds of avoiding catastrophic compromises in the future as cars gain more autonomous features don't look great here.
    - vvanders 6y ago
      I guess we should just give up and leave everything wide open then right? No point in trying to do defense in depth if someone will eventually hack something?
      - Silhouette 6y ago
        I didn't say that at all. One plausible alternative is that we don't deploy systems like this, which have the ability to cause widespread damage including loss of life in moments, until we have worked out how to secure them properly against a single point of catastrophic failure like that. There are things that could be done to mitigate that threat in the meantime. This is set against the knowledge that existing human-driven vehicles are involved in many tragic accidents per year, also causing widespread damage including loss of life. But there are other things that can be done to limit the damage there as well, without relying on autonomous vehicles as a silver bullet.

It's like being in 1995 and predicting that Windows botnets will be created. The coming disaster is inevitable. State-sponsored hackers are not going to ignore the opportunity. They probably have the capability already, in dozens of countries, and are just waiting for orders from the leaders. If war is starting, the order will be given. Sanctions could be enough to trigger it.

thoughtstheseus 6y ago
I thought it was well known that infrastructure has been a target of state hacking?
- godelski 6y ago
  I think this is well known to tech literate people. Problem is that that's not most people. On HN we have sampling bias because we're more likely to be associated with people with similar interests, i.e. tech.
deleted 6y ago
[deleted]
gfxgirl 6y ago
So you predicted botnets in 1995 and ..... nothing much happened. botnets suck but there wasn't some world crashing event like the person above is predicting for computer controlled cars. All Windows computers didn't shut off on one day.
- actuator 6y ago
  I would disagree, sure botnets can't be used for threatening life directly; but botnets have been proven to be quite effective in attacking services and do denial of services attacks. The one thing we can take from botnets is, vulnerable and unpatched devices can be infiltrated in high numbers and attackers can lie low until they decide to pull the trigger. Imagine even 0.1% cars being controlled, the mayhem and loss of life that they can cause is just immense. Power plants are also dangerous targets in a similar sense, but hopefully there is network separation for control services.
- peripitea 6y ago
  I'm struggling to understand your point. It's a different threat model; of course it will manifest differently, no? A mothership-style model seems much more vulnerable to every node being compromised than the decentralized vector Win95 botnets have to go through. I could see arguing with the inevitability of the exploit -- Win95 botnets seemed much more inevitable to me than this Tesla mothership threat does. But it seems like you're arguing that they will both have similar impact if exploited. That doesn't make sense to me, because they're completely different threats, but it's possible I'm misunderstanding your argument in some way.

chadlavi 6y ago

I'd guess because posting speculative armchair stuff on the internet is free and easy to do

ghuntley 6y ago

https://www.can-cia.org/can-knowledge/can/can-history/ https://www.can-cia.org/can-knowledge/can/can-history/

sukilot 6y ago
In the context of international sabotage, I thought that domain name was for answering questions of the form "Can CIA _____?"

gruez 6y ago

Not the OP, but the precedents are here: Always-connected cars (eg. teslas): check. Being able to take control of a car via the CAN bus[1]: check. The only thing missing in the exploit chain is something that allows the attacker to jump from the modem/infotainment system to the CAN bus or ecu. [1] https://www.wired.com/2016/08/jeep-hackers-return-high-speed-steering-acceleration-hacks/ https://www.wired.com/2016/08/jeep-hackers-return-high-speed...

vvanders 6y ago
Tesla uses a pretty different architecture from the dumpster fire that was OnStar. Been a while since I looked in the details but from what I recall only very limited, well scrutinized communication is allowed to bridge the Ethernet subsystem over to the CAN bus.
- Silhouette 6y ago
  Tesla uses a pretty different architecture from the dumpster fire that was OnStar. And probably other manufacturers will use their own designs. Unfortunately, this is one of those issues where we have to be lucky every time, and the bad guys only have to be lucky once. Given the number of different manufacturers whose systems have demonstrably been compromised in the past, the odds of avoiding catastrophic compromises in the future as cars gain more autonomous features don't look great here.
  - vvanders 6y ago
    I guess we should just give up and leave everything wide open then right? No point in trying to do defense in depth if someone will eventually hack something?
    - Silhouette 6y ago
      I didn't say that at all. One plausible alternative is that we don't deploy systems like this, which have the ability to cause widespread damage including loss of life in moments, until we have worked out how to secure them properly against a single point of catastrophic failure like that. There are things that could be done to mitigate that threat in the meantime. This is set against the knowledge that existing human-driven vehicles are involved in many tragic accidents per year, also causing widespread damage including loss of life. But there are other things that can be done to limit the damage there as well, without relying on autonomous vehicles as a silver bullet.