4 ms·
No no no. The reason you hear about security flaws in newer cars with OTA updates is because research on unpatchable cars is regularly silenced. Multiple frien
by px43 5y ago
No no no.
The reason you hear about security flaws in newer cars with OTA updates is because research on unpatchable cars is regularly silenced. Multiple friends of mine who thought it would be fun to look into bluetooth security in cars have had their work shut down by law enforcement and teams of lawyers, and told to back off.
I'd estimate that at least 90% of cars on the road without OTA updates are vulnerable to some sort of Bluetooth based attack that will never get fixed. Your "write enable" trick does more harm than good in these scenarios.
- swiley 5y agoMaybe critical systems shouldn't have wireless transceivers (especially Bluetooth, the implementations seem to be full of bugs and CVEs.)
- paulryanrogers 5y agoExactly. Why are they not air gapping everything that controls the multi-ton beast?
- mysterydip 5y agoShort answer: because it was easier.
- paulryanrogers 5y agoAren't vehicles and their safety capabilities regulated? Just because new cars are fly-by-wire shouldn't mean the control mechanisms are suddenly exempt. Steering wheels made of cardboard would be easier to manufacture, yet they'd fail safety inspection.
- nonameiguess 5y agoAn FM/AM antenna is a wireless receiver. Not a transceiver (though CB is and is still common in long-haul trucking), but still, it's always been possible for someone to hijack the channel and send an unwanted signal into your speakers. That's how pirate radio worked for a century. If all an attacker can do is send sound into your cabin, that isn't a meaningful vulnerability. They could do that with a megaphone. If car makers are actually hooking the bluetooth chip up to anything except the sound system, that's the problem. Although, assuming a class 2 device, it only has a 10 meter range. If an attacker is that close and wants to shut down your car, they can use a nail strip. The real problem here is hooking up WWAN to control software.
- swiley 5y agoAll they need to get a bluetooth transmitter within a 10 meter range is a shell on your phone, and those are very common.
- HPsquared 5y agoThe trouble is, the sound system is inevitably connected to the rest of the car. For example, in most cars the volume automatically increases with vehicle speed to compensate for increased road noise. These connections could be physically 'one-way' but in practice most modules are simply wired in parallel on a CAN bus and something like the radio would be set up to send data to the car's CAN bus (for diagnostic purposes at least).
- barefootcoder 5y agoMore than just speed sensitive volume now. Replacing the stereo in my van requires a conversion box (Maestro) that deals with the various car settings that are done through the stereo, such as dome lights out duration, dash clock setting, auto door locking, etc. The stereo is way too tightly coupled with the rest of the vehicle.
- Aerroon 5y agoWell, maybe cars shouldn't have Bluetooth in the first place? Also, it's not like these updates are ever going to fix the situation. They'll just be slightly less vulnerable. Not to mention that updates can obviously brick things. Imagine waking up one day and finding out that your car is bricked due to some update.
- thebean11 5y agoI don't really think that's the moral of the story, Bluetooth in car stereos brings value to people, many use it. You could fix this pretty easily with more separation between the stereo and the "important" components.
- Aerroon 5y agoWell, you could buy an aftermarket stereo with Bluetooth then. Something that's not integrated in any way with the rest of the car other than power.
- thebean11 5y ago..sure? The average person who buys a car does not want to do that though, so selling stereo-less cars is completely unrealistic.
- HPsquared 5y agoNot having Bluetooth would cause accidents, as more people would use their phones while driving.
- WalterBright 5y agoCars go in for service. They can be updated then, with the mechanic pressing the "write enable" switch.
- m463 5y agoActually, by default having your car connected to cellular, wifi, bluetooth and more is the problem. But car owners are not given a choice, and most systems are then gradually engineered to depend on online access to function.
- rwallace 5y agoNow I'm curious; who exactly told them to back off, and why?