4 ms·

The bricking shows that all these “smart” cars with remote software control are liable to hacking (and potentially deadly accidents). We should have a choice to

The bricking shows that all these “smart” cars with remote software control are liable to hacking (and potentially deadly accidents). We should have a choice to turn them off selectively. The worst part is that car companies don’t understand software and digital security. https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...

5h 6y ago
Imagine doing that on a busy public highway for a wired.com article ... 'we did it in a safe way' They had no control over the cars behind, anything could have happened. Their attack could have been demonstrated on a parking lot or private road. Their information did need urgently sharing, and while I understand the common need for a bit for drama, this was utterly unsafe & for the good of everyone I hope they've pulled their heads out of their asses since making that video!
- DoingIsLearning 6y ago
  Just for clarity because this Jeep example comes up quite often when talking about cars: I don't know any vehicle with connectivity (other than Jeep and maybe Ford?), which does not have safety critical CAN/FlexRay buses segregated from driver facing 'infotainment' systems. What that means is that the network bus in which your 'compromised' infotainment system is able to operate is completely separate from Engine, ABS, AEB, ESP, Airbags etc. The solutions vary but there is usually a physical gateway that prevents a passthrough MITM attacks, so you cannot simple send a message frame from your infotainment pretending to be an AEB module requesting emergency braking to your ABS system.
  - deleted 6y ago
    [deleted]
LeonM 6y ago
> The bricking shows that all these “smart” cars with remote software control are liable to hacking No, it does not. The way I read the article, the photo is taken at the installation facility where (presumably aftermarket) seats were being installed. The car disabled itself during installation. It was not driving. It was also not "hacked" remotely. I assume the installer also had the key at hand. A certified dealership will have the computer interface and software to reset the anti-theft mode. For those that do not have this software, Ferrari can remote into the car and reset it for you. This requires connectivity though.
nomel 6y ago
This is false. According to the reddit thread [1], the anti-theft tamper safeguard (no network required) was triggered. Since it was triggered when there was no network connectivity, network connectivity could not be used re-enable the car. So, no network connectivity was used to disable or enable the car. 1. https://www.reddit.com/r/Justrolledintotheshop/comments/j9qnh3/final_update_and_there_it_goes_boys_a_true_marvel/?sort=qa https://www.reddit.com/r/Justrolledintotheshop/comments/j9qn...
- Dylan16807 6y ago
  Which part is false? The remote control wasn't used here but it normally works and they tried to use it. So it does show that these cars could be hacked remotely.
  - nomel 6y ago
    This part: > The bricking shows that all these “smart” cars with remote software control are liable to hacking No remote control or wireless communication was used here, so this can't provide evidence that it is liable to hacking.
    - Dylan16807 6y ago
      The bricking shows how deeply integrated the remote control system is, and that it can brick the car. And since it's remote control, it can be hacked (or Ferrari themselves can be hacked). Therefore we can conclude that the bricking shows how badly the car can be affected by remote hacking. It doesn't matter that wireless remote communication didn't happen here. The wireless remote control system was demonstrated. And the comment is making claims about the wireless remote control system. The only way the difference would matter is if you think they're lying about the ability to send signals to the system.
      - nomel 6y ago
        We don't know if it can be enabled remotely from this story. There is no evidence for that beyond your speculation. There is only evidence that it cannot be enabled remotely. This is why I said your claim is false. Looking at other instances, or the documentation, will probably show that it can be enabled remotely, but that evidence is not here. But, it appears your perspective is that if remote control operation exists, so it can be hacked. This is proof that remote control operation exists, so it can be hacked. Framed in that perspective, sure I guess.

5h 6y ago

Imagine doing that on a busy public highway for a wired.com article ... 'we did it in a safe way' They had no control over the cars behind, anything could have happened. Their attack could have been demonstrated on a parking lot or private road. Their information did need urgently sharing, and while I understand the common need for a bit for drama, this was utterly unsafe & for the good of everyone I hope they've pulled their heads out of their asses since making that video!

DoingIsLearning 6y ago
Just for clarity because this Jeep example comes up quite often when talking about cars: I don't know any vehicle with connectivity (other than Jeep and maybe Ford?), which does not have safety critical CAN/FlexRay buses segregated from driver facing 'infotainment' systems. What that means is that the network bus in which your 'compromised' infotainment system is able to operate is completely separate from Engine, ABS, AEB, ESP, Airbags etc. The solutions vary but there is usually a physical gateway that prevents a passthrough MITM attacks, so you cannot simple send a message frame from your infotainment pretending to be an AEB module requesting emergency braking to your ABS system.
- deleted 6y ago
  [deleted]

LeonM 6y ago

> The bricking shows that all these “smart” cars with remote software control are liable to hacking No, it does not. The way I read the article, the photo is taken at the installation facility where (presumably aftermarket) seats were being installed. The car disabled itself during installation. It was not driving. It was also not "hacked" remotely. I assume the installer also had the key at hand. A certified dealership will have the computer interface and software to reset the anti-theft mode. For those that do not have this software, Ferrari can remote into the car and reset it for you. This requires connectivity though.

nomel 6y ago

This is false. According to the reddit thread [1], the anti-theft tamper safeguard (no network required) was triggered. Since it was triggered when there was no network connectivity, network connectivity could not be used re-enable the car. So, no network connectivity was used to disable or enable the car. 1. https://www.reddit.com/r/Justrolledintotheshop/comments/j9qnh3/final_update_and_there_it_goes_boys_a_true_marvel/?sort=qa https://www.reddit.com/r/Justrolledintotheshop/comments/j9qn...

Dylan16807 6y ago
Which part is false? The remote control wasn't used here but it normally works and they tried to use it. So it does show that these cars could be hacked remotely.
- nomel 6y ago
  This part: > The bricking shows that all these “smart” cars with remote software control are liable to hacking No remote control or wireless communication was used here, so this can't provide evidence that it is liable to hacking.
  - Dylan16807 6y ago
    The bricking shows how deeply integrated the remote control system is, and that it can brick the car. And since it's remote control, it can be hacked (or Ferrari themselves can be hacked). Therefore we can conclude that the bricking shows how badly the car can be affected by remote hacking. It doesn't matter that wireless remote communication didn't happen here. The wireless remote control system was demonstrated. And the comment is making claims about the wireless remote control system. The only way the difference would matter is if you think they're lying about the ability to send signals to the system.
    - nomel 6y ago
      We don't know if it can be enabled remotely from this story. There is no evidence for that beyond your speculation. There is only evidence that it cannot be enabled remotely. This is why I said your claim is false. Looking at other instances, or the documentation, will probably show that it can be enabled remotely, but that evidence is not here. But, it appears your perspective is that if remote control operation exists, so it can be hacked. This is proof that remote control operation exists, so it can be hacked. Framed in that perspective, sure I guess.