3 ms·
Just because the car has external connectivity doesn't mean the car has abusable vulnerabilities. Of course, some vendors are going to be better than others whe
by bdamm 6y ago
Just because the car has external connectivity doesn't mean the car has abusable vulnerabilities. Of course, some vendors are going to be better than others when it comes to hardening, pen-testing, and good operational security.
- mysterydip 6y agoEven if the only allowable connection is the legitimate manufacturer's, the manufacturer itself could be compromised one day (if not already), allowing malicious commands to be sent on the trusted downlink. Or an "oops I found a bug in the code you just pushed to 100,000 cars" could happen accodentally.
- Retric 6y agoIt’s unlikely but possible for an over the airway connection to actually be inherently secure. One example is an isolated system that could monitor say engine temperatures and oil pressure and nothing else.
- compiler-guy 6y agoThat sort of system is totally _possible_, but not the way any modern automotive connectivity works.
- outworlder 6y agoModern automotive connectivity is via the CAN bus. It is not a given that the system that's internet connected is even able to talk to the CAN bus.
- Dylan16807 6y agoHow's it going to unlock the car if it's not talking to the important parts? Sure someone could make a dedicated secure unlock wire or something, but they don't.
- novok 6y agoMost are. GM OnStar systems & Tesla I know for sure are designed in a way that a malicious hack of HQ computers + research into car firmware could lead to a push that would kill potentially millions of people simultaneously. If I really dived into the others, I wouldn't be surprised if ford, VW, toyota and others had similar system design issues. We are just lucky we live in a world where even 'hackers' don't go that low. I hope future regulation will mandate remote access airgaps. I don't think it's a big price to pay for non-entertainment / GPS software updates to require a physical connection
- tatersolid 6y ago> We are just lucky we live in a world where even 'hackers' don't go that low. Unfortunately they do go that low. There have been multiple murders committed by ransomware gangs attacking European and US hospitals in recent months. Example: https://arstechnica.com/information-technology/2020/09/patient-dies-after-ransomware-attack-reroutes-her-to-remote-hospital/ https://arstechnica.com/information-technology/2020/09/patie...
- novok 6y agoThat's more spray and pray damage then a specific hack on hospitals.
- tatersolid 6y agoModern ransomware attacks do recon and exfiltration for weeks or months before pulling the encryption trigger. The attackers knew it was a hospital network and clearly didn’t care that people would die.