7 ms·

> But it can't actually drive the car. Hopefully. Remember this vulnerability: https://www.csoonline.com/article/2951746/hackers-remotely-take-control-of-jeep

by jjav 6y ago

> But it can't actually drive the car. Hopefully. Remember this vulnerability: https://www.csoonline.com/article/2951746/hackers-remotely-take-control-of-jeep.html https://www.csoonline.com/article/2951746/hackers-remotely-t... The initial intrusion was through the infotainment system but from there they moved to the more critical systems.

ajross 6y ago
Exactly! Because in the Jeep case there was an architectural failure where the attack surface (the radio controller) was connected directly to the vehicle control system via a CAN bus, speaking bare unauthenticated protocols that were designed before the idea of internet-accessible cars was conceived. So once your initial attack face was compromised, the game was up. This is the writeup if you want details, certainly I'm no expert on this particular hack: http://illmatics.com/Remote%20Car%20Hacking.pdf http://illmatics.com/Remote%20Car%20Hacking.pdf What I'm saying is that Tesla seems to have learned from that experience and gone with a very different architecture where vehicle commands simply aren't accessible to the public-facing computer, from which motor/brake/steering control systems only get general direction (e.g. waypoints). That's not saying it can't have a hole. But they don't seem to have made the kind of messup that would permit an attack like the Jeep hack.
- nuker 6y ago
  > Tesla seems to have learned from that experience and gone with a very different architecture Have circuit diagrams?
- jjav 6y ago
  > What I'm saying is that Tesla seems to have learned from that experience Maybe. From a few decades in the industry in and around security, I have no faith in assuming that a serious vulnerability triggers any kind of change in the culture that led to it. Remember Cisco and curl? https://news.ycombinator.com/item?id=19507225 https://news.ycombinator.com/item?id=19507225

by jjav 6y ago

ajross 6y ago

Exactly! Because in the Jeep case there was an architectural failure where the attack surface (the radio controller) was connected directly to the vehicle control system via a CAN bus, speaking bare unauthenticated protocols that were designed before the idea of internet-accessible cars was conceived. So once your initial attack face was compromised, the game was up. This is the writeup if you want details, certainly I'm no expert on this particular hack: http://illmatics.com/Remote%20Car%20Hacking.pdf http://illmatics.com/Remote%20Car%20Hacking.pdf What I'm saying is that Tesla seems to have learned from that experience and gone with a very different architecture where vehicle commands simply aren't accessible to the public-facing computer, from which motor/brake/steering control systems only get general direction (e.g. waypoints). That's not saying it can't have a hole. But they don't seem to have made the kind of messup that would permit an attack like the Jeep hack.

nuker 6y ago
> Tesla seems to have learned from that experience and gone with a very different architecture Have circuit diagrams?
jjav 6y ago
> What I'm saying is that Tesla seems to have learned from that experience Maybe. From a few decades in the industry in and around security, I have no faith in assuming that a serious vulnerability triggers any kind of change in the culture that led to it. Remember Cisco and curl? https://news.ycombinator.com/item?id=19507225 https://news.ycombinator.com/item?id=19507225