4 ms·

In general the likelihood an exploit will be exploited can be thought of as a relationship between it's ease and payoff. Just because something is exploitable d

by kypro 6y ago

In general the likelihood an exploit will be exploited can be thought of as a relationship between it's ease and payoff. Just because something is exploitable doesn't mean it's likely to be exploited unless it's easy to do so or there is a good reason to put in the effort required. I guess if it was possible to remotely take over or disable the brakes on an entire fleet of self-driving cars then we could have problems. Likewise, if it was possible for school kids to "prank" their teacher by downloading some exploit software from the internet we could have problems. But in both cases you would hope security would at least be good enough that these types of events could not happen. Remember someone with a bit of knowledge could easily tamper with your mechanical car today if they wanted to. Digital tech provides new attack vectors for someone seeking to do damage, but if designed correctly any new digital attack vector shouldn't present any greater risk than the existing mechanical attack vectors.

angry_octet 6y ago
It's actually quite difficult to tamper with a car. You have to find the car in an unattended and out of sight place. That opportunity isn't available for high value targets, and doesn't scale to 100k cars. In contrast, there are tens to hundreds of thousands of popular car models sold every year. Eg 55k Ford Focus sold in the UK in 2019. https://www.statista.com/statistics/463148/ford-focus-annual-sales-in-great-britain/ https://www.statista.com/statistics/463148/ford-focus-annual... Just a DOS attack would require every car to be taken by tow truck to the garage or visited by a tech to patch it, and the resulting reputational damage would be huge. I'm sure Ford/Toyota/etc would pay a ransom to avoid that.
MauranKilom 6y ago
Right, but direct physical access is a bit different from "can mess with your car from 100 m away". A security camera will effectively deter one but not the other.
sleepybrett 6y ago
Everyone is focusing on the assassination angle but I stopped when it said that it could unlock the doors and trunks. Sure we exist in a world where people break into cars a lot, but generally it's at least somewhat destructive. No-one is 'picking' locks (because picking increases the time they are 'on target' and could get caught), they are smashing windows or are forcing locks with leverage. These actions look to an observer like what they are. In this new scenario, someone could have a remote rootkit loaded on their phone. Trigger it from across a parking lot or approaching the target and then simply walk up to the car and pull anything valuable out of it. They would look like the owner to most observers.
- HALtheWise 6y ago
  In some parts of Europe, digital attacks on proximity unlock systems are becoming a common way to break into cars. Especially for a system based on Bluetooth, it's difficult to defend against an amplification attack. The key here is that one person can make a tool and sell it to many common criminals, and even if the auto manufacturer notices that they are doing this, there isn't an easy way to patch the issue. For something like a Tesla, it's difficult to imagine a software vulnerability that cannot be fixed with an OTA update, but for a manufacturer that doesn't have OTA update capabilities, I could definitely see cyber hacking tools being distributed and used in a similar way.

by kypro 6y ago

angry_octet 6y ago

It's actually quite difficult to tamper with a car. You have to find the car in an unattended and out of sight place. That opportunity isn't available for high value targets, and doesn't scale to 100k cars. In contrast, there are tens to hundreds of thousands of popular car models sold every year. Eg 55k Ford Focus sold in the UK in 2019. https://www.statista.com/statistics/463148/ford-focus-annual-sales-in-great-britain/ https://www.statista.com/statistics/463148/ford-focus-annual... Just a DOS attack would require every car to be taken by tow truck to the garage or visited by a tech to patch it, and the resulting reputational damage would be huge. I'm sure Ford/Toyota/etc would pay a ransom to avoid that.

MauranKilom 6y ago

Right, but direct physical access is a bit different from "can mess with your car from 100 m away". A security camera will effectively deter one but not the other.

sleepybrett 6y ago

Everyone is focusing on the assassination angle but I stopped when it said that it could unlock the doors and trunks. Sure we exist in a world where people break into cars a lot, but generally it's at least somewhat destructive. No-one is 'picking' locks (because picking increases the time they are 'on target' and could get caught), they are smashing windows or are forcing locks with leverage. These actions look to an observer like what they are. In this new scenario, someone could have a remote rootkit loaded on their phone. Trigger it from across a parking lot or approaching the target and then simply walk up to the car and pull anything valuable out of it. They would look like the owner to most observers.

HALtheWise 6y ago
In some parts of Europe, digital attacks on proximity unlock systems are becoming a common way to break into cars. Especially for a system based on Bluetooth, it's difficult to defend against an amplification attack. The key here is that one person can make a tool and sell it to many common criminals, and even if the auto manufacturer notices that they are doing this, there isn't an easy way to patch the issue. For something like a Tesla, it's difficult to imagine a software vulnerability that cannot be fixed with an OTA update, but for a manufacturer that doesn't have OTA update capabilities, I could definitely see cyber hacking tools being distributed and used in a similar way.