3 ms·

"state actor or at least a large organization, and they also have cheaper and simpler ways to plunge a city into chaos." I'm not sure that's true. If I were Ch

by jerf 6y ago

"state actor or at least a large organization, and they also have cheaper and simpler ways to plunge a city into chaos." I'm not sure that's true. If I were China or the US, I would totally be interested in an exploit that would allow me to hack even a single model across the entire country and set the accelerator to be unconditionally floored and the car no longer able to turn off. Heck, that second one is even optional, given how many people are going to panic. Getting multiple models would be an even bigger bonus. As others in the thread point out, we have publicly-known instances of companies that collect vulnerabilities. It's hardly a stretch to imagine that state actors already have the vulnerabilities, or even already have this capability essentially turnkey for whenever they need it. I mean, fund a decent hacker group of ~10 people for a year and they could probably build "the button to crash every Tesla, Ford truck between 2018 and 2020, and all Volvos after 2015 on the road in the US"... our impression of how hard security work is is colored by civilian researchers who are incredibly poorly funded. How many of our reports of deeply broken things come from people working in their spare time? I wouldn't underestimate what someone systematically collecting vulnerabilities could do with not much funding, relatively speaking. The problem is, it's not even that you can turn a whole city into chaos... you can turn a whole country into chaos for cheap enough that it's worth adding to your portfolio. In my opinion, the only reason to be unworried about that is precisely that there are so many other things that can be done that this somehow doesn't even rate as "interesting" and that is far from good news!

cwkoss 6y ago
Some may find 'unconditionally floored' unrealistic, but hackers have already been able to activate the parallel parking feature while a car is travelling forwards - jerking the steering wheel rapidly to the side. If the hacker could detect speed and make the cars swerve when they've been at highway speed for X seconds, it would be pretty horrific.
lazide 6y ago
I'm sure you're right and it is being added to a portfolio somewhere - it's also a valid point that for a state level actor, there are some inexpensive and effective ways to cause mass chaos that they've already got. For instance. the Aquaducts that feed water to the city of LA go through some deserts north of there that are remote - and the giant pipes are exposed. There are no guards, nothing. For a state level actor, a small explosive charge on one of those is probably trivial to do and would lock up LA in fear and panic for a long time - and essentially untraceable. Every major metropolis has some equivalent to this (contamination in a specific water supply, or damage to a specific bridge). Being able to do similar things to vehicles of different types is also interesting, but the space is rapidly changing, and exploits would lose 'potency' rapidly compared to that small block of C4 and knowing someone who would place it for you. So more an R&D type interest than a practical operational capability one. It's also easy for us to look at the trajectory, know the tech, and say 'this will change the world and we need to be prepared' - but most militaries and intelligence agencies tend to focus on what they already have experience with, or what happened last time. The old quote 'Generals always fight the last war' is very applicable. Part of the reason why is because until it has happened, you don't have any real data - just endless speculative paths, all of which are too divergent from each other to prepare for all at once, and too theoretical to justify funding because the projected costs of it happening are too divergent. You saw it with COVID - we suspected something like this would happen soonish, we'd even had some scares recently like H1N1/swine flu - but even if you'd asked the most prepper types of us if they'd be willing to spend 100 billion to stop what happened - they'd go 'yeah right, that's not going to happen', or 'that would be a waste of money' Now, I'm sure you'd get 75% or more of the popular vote on such a measure nation wide and everyone would consider it dirt cheap. Even if the odds of a repeat surprise event are quite low now.
- jerf 6y ago
  "For instance. the Aquaducts that feed water to the city of LA go through some deserts north of there that are remote - and the giant pipes are exposed. There are no guards, nothing." Which is still a body on the ground in one place. These hacks can go country-wide pretty easily. It still seems like something that would be worth digging into because that digital scale can't be replicated by any physical action. Plus attack-in-depth is a thing. If you can cheaply add "mess up all civilian automotives", you might want to do it, even if you are also blowing up aqueducts and such. War sucks.
  - lazide 6y ago
    100% agreed on all points. The cyberwar (hate the term, but it’s what’s used) equivalent of chemical warfare or a nuke is going to be..... incredibly nasty.
- jjav 6y ago
  > For a state level actor, a small explosive charge on one of those is probably trivial to do Remember Oklahoma city bombing. It's trivial to do for a couple guys, never mind anyone more organized.
  - lazide 6y ago
    For sure - what I was referring to is a state level actor can (and almost certainly does) afford to have thousands of those 'couple guys' already identified and in an action plan somewhere in their top secret list of dirty tricks, against pretty much anyone they think likely (or even not likely) to want that kind of ability against some day. Someone COULD go to the store, grab a hammer, and smash my computer. It's a different type of situation however when someone has figured out what model of hammer they would want, from which store (and if it is in stock or not), how they would pay for it, and who they would call to do all these things in a way that I couldn't figure out who ordered or paid for it, to smash my particular workstation at my home on a specific desk tomorrow at 6am - if they wanted to. It's important to keep in mind capabilities, inclinations, and consequences - when that person with that plan is playing against me in competitive gaming the next day, I need that workstation to win, and I just bet them $10k I could beat them in front of all of my friends. Thankfully most of us don't have to deal with this in our daily lives, but we can still be collateral damage when someone else is playing these kinds of games. And nation states do on the regular.

by jerf 6y ago

cwkoss 6y ago

Some may find 'unconditionally floored' unrealistic, but hackers have already been able to activate the parallel parking feature while a car is travelling forwards - jerking the steering wheel rapidly to the side. If the hacker could detect speed and make the cars swerve when they've been at highway speed for X seconds, it would be pretty horrific.

lazide 6y ago

I'm sure you're right and it is being added to a portfolio somewhere - it's also a valid point that for a state level actor, there are some inexpensive and effective ways to cause mass chaos that they've already got. For instance. the Aquaducts that feed water to the city of LA go through some deserts north of there that are remote - and the giant pipes are exposed. There are no guards, nothing. For a state level actor, a small explosive charge on one of those is probably trivial to do and would lock up LA in fear and panic for a long time - and essentially untraceable. Every major metropolis has some equivalent to this (contamination in a specific water supply, or damage to a specific bridge). Being able to do similar things to vehicles of different types is also interesting, but the space is rapidly changing, and exploits would lose 'potency' rapidly compared to that small block of C4 and knowing someone who would place it for you. So more an R&D type interest than a practical operational capability one. It's also easy for us to look at the trajectory, know the tech, and say 'this will change the world and we need to be prepared' - but most militaries and intelligence agencies tend to focus on what they already have experience with, or what happened last time. The old quote 'Generals always fight the last war' is very applicable. Part of the reason why is because until it has happened, you don't have any real data - just endless speculative paths, all of which are too divergent from each other to prepare for all at once, and too theoretical to justify funding because the projected costs of it happening are too divergent. You saw it with COVID - we suspected something like this would happen soonish, we'd even had some scares recently like H1N1/swine flu - but even if you'd asked the most prepper types of us if they'd be willing to spend 100 billion to stop what happened - they'd go 'yeah right, that's not going to happen', or 'that would be a waste of money' Now, I'm sure you'd get 75% or more of the popular vote on such a measure nation wide and everyone would consider it dirt cheap. Even if the odds of a repeat surprise event are quite low now.

jerf 6y ago
"For instance. the Aquaducts that feed water to the city of LA go through some deserts north of there that are remote - and the giant pipes are exposed. There are no guards, nothing." Which is still a body on the ground in one place. These hacks can go country-wide pretty easily. It still seems like something that would be worth digging into because that digital scale can't be replicated by any physical action. Plus attack-in-depth is a thing. If you can cheaply add "mess up all civilian automotives", you might want to do it, even if you are also blowing up aqueducts and such. War sucks.
- lazide 6y ago
  100% agreed on all points. The cyberwar (hate the term, but it’s what’s used) equivalent of chemical warfare or a nuke is going to be..... incredibly nasty.
jjav 6y ago
> For a state level actor, a small explosive charge on one of those is probably trivial to do Remember Oklahoma city bombing. It's trivial to do for a couple guys, never mind anyone more organized.
- lazide 6y ago
  For sure - what I was referring to is a state level actor can (and almost certainly does) afford to have thousands of those 'couple guys' already identified and in an action plan somewhere in their top secret list of dirty tricks, against pretty much anyone they think likely (or even not likely) to want that kind of ability against some day. Someone COULD go to the store, grab a hammer, and smash my computer. It's a different type of situation however when someone has figured out what model of hammer they would want, from which store (and if it is in stock or not), how they would pay for it, and who they would call to do all these things in a way that I couldn't figure out who ordered or paid for it, to smash my particular workstation at my home on a specific desk tomorrow at 6am - if they wanted to. It's important to keep in mind capabilities, inclinations, and consequences - when that person with that plan is playing against me in competitive gaming the next day, I need that workstation to win, and I just bet them $10k I could beat them in front of all of my friends. Thankfully most of us don't have to deal with this in our daily lives, but we can still be collateral damage when someone else is playing these kinds of games. And nation states do on the regular.