4 ms·

We’re going to need OpenWrt but for cars. Ugh that sounds like a headache.

SV_BubbleTime 5y ago
Automotive EE here. There is a big shit show with vehicle security right now. There basically wasn’t any. Which guess what? WORKED GREAT! Until… some moron decided cars needed WiFi hot spots (3G), then OTA flashes, and etc. Wasnt hackable until you hooked it to the internet. So of course they spend as little as possible, with the cheapest network providers. And there is a big public hack by two clowns that were fed info by a letter agency. A Wired article, bla. Fast forward… most mfgs use approx the same firewall now. It blocks data access to between the radio/telematics and rest of car. That was their solution, not to harden the car, not to get rid of the fucking Internet, just put radio and garbage on its own network. Best part? The firewall isn’t a required part of the car. You can just unplug it and tie the bus wires together. Next gen vehicles are using more busses, automotive ethernet, and a much more complex firewall, but still the same idea. Not sure if the new vehicles have checks to make sure the firewall is there. At least with automotive ethernet you’ll need a switch and can’t just jump wires together. So… you aren’t far off with needing an OpenWRT. The issue is the custom hardware. IIRC, the next gen firewalls use a specific 90-pin connector (yazaki?) that only Bosch can buy, that’s the absolute minimum step / issue. Best part though!? The immobilizer won’t be the firewall most likely, it’ll be it’s own module and by 2026 I really expect crypto secure MAC’d messages. So… yea, good luck homie.
- mdp2021 5y ago
  Any chance to ensure a car which "implemented the option" cannot ever be connected? Or will we be stuck with buying old cars? (Of course the idea of an internet connected car is part of the absolute dystopia.)
  - speeder 5y ago
    In EU that seemly is the case, they have a law there where all cars must have a cellphone that automatically calls emergency services when the cars crash. https://www.motor1.com/news/238058/cars-emergency-services-mandatory-europe/ https://www.motor1.com/news/238058/cars-emergency-services-m...
    - mdp2021 5y ago
      The E-call system is not an Internet connection (though: GPS, microphone and telephone - "no thanks", some of us will say). And, you can remove the E-call system: it is foreseen that it cannot be disabled by a user, not by a random mechanic, but it can be disabled by the manufacturer. Of course, it will probably be a nightmare to deal with them and have them do it.

Automotive EE here. There is a big shit show with vehicle security right now. There basically wasn’t any. Which guess what? WORKED GREAT! Until… some moron decided cars needed WiFi hot spots (3G), then OTA flashes, and etc. Wasnt hackable until you hooked it to the internet. So of course they spend as little as possible, with the cheapest network providers. And there is a big public hack by two clowns that were fed info by a letter agency. A Wired article, bla. Fast forward… most mfgs use approx the same firewall now. It blocks data access to between the radio/telematics and rest of car. That was their solution, not to harden the car, not to get rid of the fucking Internet, just put radio and garbage on its own network. Best part? The firewall isn’t a required part of the car. You can just unplug it and tie the bus wires together. Next gen vehicles are using more busses, automotive ethernet, and a much more complex firewall, but still the same idea. Not sure if the new vehicles have checks to make sure the firewall is there. At least with automotive ethernet you’ll need a switch and can’t just jump wires together. So… you aren’t far off with needing an OpenWRT. The issue is the custom hardware. IIRC, the next gen firewalls use a specific 90-pin connector (yazaki?) that only Bosch can buy, that’s the absolute minimum step / issue. Best part though!? The immobilizer won’t be the firewall most likely, it’ll be it’s own module and by 2026 I really expect crypto secure MAC’d messages. So… yea, good luck homie.

mdp2021 5y ago
Any chance to ensure a car which "implemented the option" cannot ever be connected? Or will we be stuck with buying old cars? (Of course the idea of an internet connected car is part of the absolute dystopia.)
- speeder 5y ago
  In EU that seemly is the case, they have a law there where all cars must have a cellphone that automatically calls emergency services when the cars crash. https://www.motor1.com/news/238058/cars-emergency-services-mandatory-europe/ https://www.motor1.com/news/238058/cars-emergency-services-m...
  - mdp2021 5y ago
    The E-call system is not an Internet connection (though: GPS, microphone and telephone - "no thanks", some of us will say). And, you can remove the E-call system: it is foreseen that it cannot be disabled by a user, not by a random mechanic, but it can be disabled by the manufacturer. Of course, it will probably be a nightmare to deal with them and have them do it.