5 ms·

>This is problematic for a number of reasons. The most important in my mind is that the risk of the vehicle being hacked and carjacked remotely is always presen

>This is problematic for a number of reasons. The most important in my mind is that the risk of the vehicle being hacked and carjacked remotely is always present. Which raises the question: "Why would we engineer vehicles to accept external network connections?" Any communication to/from a vehicle should only be initiated by the vehicle itself. There's no reasonable criteria under which a vehicle should have its systems available to external sources. Or am I missing something important?

belval 5y ago
> Or am I missing something important? We absolutely want to remotely control cars at some point, how else will you send a self-driving taxi to a customers or "ask" a car to comeback to the garage for a recall on the underlying hardware or for general maintenance?
- danuker 5y ago
  That can be implemented by the vehicle initiating a connection and asking "where should I go now?". But any connection poses vulnerability - for example, security certificates to be sure you're talking to the right person become obsolete over time as processing power gets cheaper, and an update can fail and brick the car.
  - nobody9999 5y ago
    >But any connection poses vulnerability - for example, security certificates to be sure you're talking to the right person become obsolete over time as processing power gets cheaper, and an update can fail and brick the car. Exactly. Which is why vehicles (like most other IOT devices) shouldn't connect to the Internet at all. Please define a scenario where internet access would be required (i.e., not replaceable with other, less vulnerable communications mechanisms) for a self-driving vehicle. I can't think of any.
- jedberg 5y ago
  Have it poll once a minute and ask for instructions with a display in the car that says "instructed to go to X, accept?" and then have it auto accept after another minute. Sure that means maybe waiting two minutes for the car to move, but that's not a huge deal, especially if you know that happens and request it two minutes in advance, but it gives anyone in the car the chance to cancel the request if it's invalid.
  - iamthirsty 5y ago
    What if you're asleep and the car is in the drive-way? How would you be able to accept/decline in 60 seconds?
    - jedberg 5y ago
      Make it beep loudly for 60 seconds? Add a function that puts the car into auto-deny mode that you can turn on when you sleep (or whenever you're in the car). There are many ways to solve this problem. The point is that the car won't just take remote instructions but will gather them and allow the occupants the chance to override them.
  - shadowgovt 5y ago
    Replacing accept-incoming-connections with polling just changes the threat story from "An outside attacker can compromise the machine" to "An outside attacker can compromise the machine every sixty seconds."
    - jedberg 5y ago
      Not really, because the server where the request is pulled from would have to be compromised, and it's a lot easier to secure a single remote server than every individual car. It's also a lot easier to monitor a single server for intrusions. Sure, that single server becomes a juicy target, but that's where the defense in depth comes in, where the car still doesn't execute the command until the user accepts it.
      - 5y ago
- nobody9999 5y ago
  >We absolutely want to remotely control cars at some point, how else will you send a self-driving taxi to a customers or "ask" a car to comeback to the garage for a recall on the underlying hardware or for general maintenance? Who is this "we"? You might, but I don't. That's a disaster waiting to happen. What's more, under the circumstances you describe, there's no reason such vehicles need to be internet accessible. Or have we forgotten that communication doesn't require the internet?
  - Dylan16807 5y ago
    > > remotely control cars > What's more, under the circumstances you describe, there's no reason such vehicles need to be internet accessible. Or have we forgotten that communication doesn't require the internet? What kind of remote communication these days doesn't require the internet? Text messages? Special short range base stations with 56k modems? Satellite phone?
    - nobody9999 5y ago
      >What kind of remote communication these days doesn't require the internet? Pretty much any low power radio application (CB/HAM radio, key fobs, walkie talkies, POTS lines and dozens more), or higher power (although those require FCC licenses) don't require the internet. Besides, I'm referring to the software that makes the vehicle operate. That software/system should never be exposed to remote sources. Otherwise, you're pretty much begging to be locked in your car and taken on a joyride which ends with you rolling off a cliff.
      - Dylan16807 5y ago
        Your car is not going to have a Ham license, and I already mentioned POTS; do you really think having your car sit close to a special phone-based communication station is the answer? Key fobs and walkie talkies and LoRaWAN do not have enough range to fully enable this kind of use. > Otherwise, you're pretty much begging to be locked in your car and taken on a joyride which ends with you rolling off a cliff. If hacks while driving are your concern, you could have the car isolate from the internet when the key is inside it and/or someone hits a stop button. If hacks before driving are your concern, I don't think any of your suggested radio applications are safe either. And I don't really see why half of them are better than an internet connection in the first place.
akoster 5y ago
While I agree with you, so many new cars offer remote start/remote engine heating block initiation or even the ability to summon your vehicle from a parking garage and have it drive toward the exit. Many consumers will not purchase cars without these new features, all of which require an external server to issue commands to a vehicle. Definitely a huge security risk, especially with lack of manual controls. Where are the “low-chip-count” new cars with VFD radio displays, dials, traditional keys, no screens and especially no cellular modem?
- OmahaBoy69 5y ago
  Agreed on all but remote start. Maybe it's different on fancier vehicles (I have a '13 Mustang), but it's usually just a radio that starts the engine and nothing more. Hardly a security risk.
  - a_t48 5y ago
    My 2021 jetta can be started from the VW app, over 4G.
- thinkmassive 5y ago
  Remote start has been available for nearly 40 years. Pre-heating engines has been going on for nearly a century. Neither of these requires a computer, let alone contacting a remote server. You state the security risks of connected vehicles, so I’m not sure why you lead with these incorrect statements.
ssklash 5y ago
Think of all the attention you could monetize with a captive audience in a self-driving car. I fully expect it to be exploited by ad companies. And subsequently by hackers.
- deleted 5y ago
  [deleted]
tsimionescu 5y ago
Not accepting connections is not enough to be protected on the internet. A connection is just a special case of an incoming packet, any incoming packet is potentially malicious, even if the source IP:Port are ones you initiated a connection with. For example, most web-based malware is downloaded from connections you initiated.
- nobody9999 5y ago
  >Not accepting connections is not enough to be protected on the internet. Where is the requirement (or even a good reason) that a vehicle be connected to the internet? Which is the same question to be asked about ovens, toilets and a raft of other stuff too. I'd say "none."
  - cf141q5325 5y ago
    The answer is patches. The more complex and "smart" something gets the more patches you need. And since you dont want to go to the mechanic every time, firmware over the air it is.
    - nobody9999 5y ago
      >The answer is patches. The more complex and "smart" something gets the more patches you need. And since you dont want to go to the mechanic every time, firmware over the air it is. Maybe in your vehicle. But certainly never in mine. Any vehicle whose software can be remotely modified is one I'll never buy. As I said, that's a disaster waiting to happen.
      - signatoremo 5y ago
        A bug that affects your car that don’t get patched timely is also a disaster waiting to happen. Clearly it’s a risk model that you are willing to accept. I am not.
        deleted 5y ago
        [deleted]

belval 5y ago

> Or am I missing something important? We absolutely want to remotely control cars at some point, how else will you send a self-driving taxi to a customers or "ask" a car to comeback to the garage for a recall on the underlying hardware or for general maintenance?

danuker 5y ago
That can be implemented by the vehicle initiating a connection and asking "where should I go now?". But any connection poses vulnerability - for example, security certificates to be sure you're talking to the right person become obsolete over time as processing power gets cheaper, and an update can fail and brick the car.
- nobody9999 5y ago
  >But any connection poses vulnerability - for example, security certificates to be sure you're talking to the right person become obsolete over time as processing power gets cheaper, and an update can fail and brick the car. Exactly. Which is why vehicles (like most other IOT devices) shouldn't connect to the Internet at all. Please define a scenario where internet access would be required (i.e., not replaceable with other, less vulnerable communications mechanisms) for a self-driving vehicle. I can't think of any.
jedberg 5y ago
Have it poll once a minute and ask for instructions with a display in the car that says "instructed to go to X, accept?" and then have it auto accept after another minute. Sure that means maybe waiting two minutes for the car to move, but that's not a huge deal, especially if you know that happens and request it two minutes in advance, but it gives anyone in the car the chance to cancel the request if it's invalid.
- iamthirsty 5y ago
  What if you're asleep and the car is in the drive-way? How would you be able to accept/decline in 60 seconds?
  - jedberg 5y ago
    Make it beep loudly for 60 seconds? Add a function that puts the car into auto-deny mode that you can turn on when you sleep (or whenever you're in the car). There are many ways to solve this problem. The point is that the car won't just take remote instructions but will gather them and allow the occupants the chance to override them.
- shadowgovt 5y ago
  Replacing accept-incoming-connections with polling just changes the threat story from "An outside attacker can compromise the machine" to "An outside attacker can compromise the machine every sixty seconds."
  - jedberg 5y ago
    Not really, because the server where the request is pulled from would have to be compromised, and it's a lot easier to secure a single remote server than every individual car. It's also a lot easier to monitor a single server for intrusions. Sure, that single server becomes a juicy target, but that's where the defense in depth comes in, where the car still doesn't execute the command until the user accepts it.
    - 5y ago
nobody9999 5y ago
>We absolutely want to remotely control cars at some point, how else will you send a self-driving taxi to a customers or "ask" a car to comeback to the garage for a recall on the underlying hardware or for general maintenance? Who is this "we"? You might, but I don't. That's a disaster waiting to happen. What's more, under the circumstances you describe, there's no reason such vehicles need to be internet accessible. Or have we forgotten that communication doesn't require the internet?
- Dylan16807 5y ago
  > > remotely control cars > What's more, under the circumstances you describe, there's no reason such vehicles need to be internet accessible. Or have we forgotten that communication doesn't require the internet? What kind of remote communication these days doesn't require the internet? Text messages? Special short range base stations with 56k modems? Satellite phone?
  - nobody9999 5y ago
    >What kind of remote communication these days doesn't require the internet? Pretty much any low power radio application (CB/HAM radio, key fobs, walkie talkies, POTS lines and dozens more), or higher power (although those require FCC licenses) don't require the internet. Besides, I'm referring to the software that makes the vehicle operate. That software/system should never be exposed to remote sources. Otherwise, you're pretty much begging to be locked in your car and taken on a joyride which ends with you rolling off a cliff.
    - Dylan16807 5y ago
      Your car is not going to have a Ham license, and I already mentioned POTS; do you really think having your car sit close to a special phone-based communication station is the answer? Key fobs and walkie talkies and LoRaWAN do not have enough range to fully enable this kind of use. > Otherwise, you're pretty much begging to be locked in your car and taken on a joyride which ends with you rolling off a cliff. If hacks while driving are your concern, you could have the car isolate from the internet when the key is inside it and/or someone hits a stop button. If hacks before driving are your concern, I don't think any of your suggested radio applications are safe either. And I don't really see why half of them are better than an internet connection in the first place.

akoster 5y ago

While I agree with you, so many new cars offer remote start/remote engine heating block initiation or even the ability to summon your vehicle from a parking garage and have it drive toward the exit. Many consumers will not purchase cars without these new features, all of which require an external server to issue commands to a vehicle. Definitely a huge security risk, especially with lack of manual controls. Where are the “low-chip-count” new cars with VFD radio displays, dials, traditional keys, no screens and especially no cellular modem?

OmahaBoy69 5y ago
Agreed on all but remote start. Maybe it's different on fancier vehicles (I have a '13 Mustang), but it's usually just a radio that starts the engine and nothing more. Hardly a security risk.
- a_t48 5y ago
  My 2021 jetta can be started from the VW app, over 4G.
thinkmassive 5y ago
Remote start has been available for nearly 40 years. Pre-heating engines has been going on for nearly a century. Neither of these requires a computer, let alone contacting a remote server. You state the security risks of connected vehicles, so I’m not sure why you lead with these incorrect statements.

ssklash 5y ago

Think of all the attention you could monetize with a captive audience in a self-driving car. I fully expect it to be exploited by ad companies. And subsequently by hackers.

deleted 5y ago
[deleted]

tsimionescu 5y ago

Not accepting connections is not enough to be protected on the internet. A connection is just a special case of an incoming packet, any incoming packet is potentially malicious, even if the source IP:Port are ones you initiated a connection with. For example, most web-based malware is downloaded from connections you initiated.

nobody9999 5y ago
>Not accepting connections is not enough to be protected on the internet. Where is the requirement (or even a good reason) that a vehicle be connected to the internet? Which is the same question to be asked about ovens, toilets and a raft of other stuff too. I'd say "none."
- cf141q5325 5y ago
  The answer is patches. The more complex and "smart" something gets the more patches you need. And since you dont want to go to the mechanic every time, firmware over the air it is.
  - nobody9999 5y ago
    >The answer is patches. The more complex and "smart" something gets the more patches you need. And since you dont want to go to the mechanic every time, firmware over the air it is. Maybe in your vehicle. But certainly never in mine. Any vehicle whose software can be remotely modified is one I'll never buy. As I said, that's a disaster waiting to happen.
    - signatoremo 5y ago
      A bug that affects your car that don’t get patched timely is also a disaster waiting to happen. Clearly it’s a risk model that you are willing to accept. I am not.
      - deleted 5y ago
        [deleted]