5 ms·

> What's infuriating is... As many as 89 people may have died so Toyota could claim Bluetooth and MP3s in their latest models. You don't have to stay infuriate

by 2143 4y ago

> What's infuriating is... As many as 89 people may have died so Toyota could claim Bluetooth and MP3s in their latest models. You don't have to stay infuriated anymore. The computers for in-car-entertainment is different and decoupled from the one for engine and throttle management. As for the bloat, my observation (which could be wrong) is that Toyota seems to have comparatively less bloat.

WalterBright 4y ago
> The computers for in-car-entertainment is different and decoupled from the one for engine and throttle management. Learning the lessons from the aviation industry all over again.
RC_ITR 4y ago
>The computers for in-car-entertainment is different and decoupled from the one for engine and throttle management. Somewhat unrelated to this particular case, but terrifyingly, the network isn't and CAN is one of the least secure BUS's imaginable.
- vodou 4y ago
  >... CAN is one of the least secure BUS's imaginable. Can you elaborate on this?
  - kayodelycaon 4y ago
    No security or authentication. IIRC, any attached device has full control over the physical layer by design. I don't really see why this is a problem in a car with isolated buses for safety-critical components.
    - hatsunearu 4y ago
      Yeah... that's like saying a car has a security risk because someone can go in the wheel well and slash the brake lines...
      - RC_ITR 4y ago
        Yeah, that is a security risk We choose to ignore it because it's rarely exploited, but by that logic, we should just ignore all zero-days.
    - leetbulb 4y ago
      Many newer vehicles contain systems, OEM and/or after-market, that are permanently connected to the internet via cellular modem. Other systems with insecure RF tech used for various gimmicks. Other systems that communicate with external and potentially malicious devices like chargers. Etc. Most of these systems have enough access to (in)directly destroy or booby trap the car. My car is able to receive ECU(!), firmware, software updates OTA from the manufacturer. These critical systems are just as "closed" or "isolated" as cloud-enabled "CCTV." Scary stuff.
- fmntf 4y ago
  Even cheap cars have a dedicated powertrain/brake/ABS CAN bus. Separate buses are then interconnected via a gateway.
  - firephonestival 4y ago
    New cars do, but that has not always been the case. The rapid shift to hard bus separation happened after this incident: https://www.eetimes.com/hacked-jeep-whom-to-blame/ https://www.eetimes.com/hacked-jeep-whom-to-blame/
- anyfoo 4y ago
  My car (2014) has seven or so different CAN busses, with a gateway in between. Whether that constitutes a different "network" or not can be argued, but at least something that brings the entertainment CAN bus down, be it just by e.g. shorting it, won't (easily) bring down the other busses.

by 2143 4y ago

WalterBright 4y ago

> The computers for in-car-entertainment is different and decoupled from the one for engine and throttle management. Learning the lessons from the aviation industry all over again.

RC_ITR 4y ago

>The computers for in-car-entertainment is different and decoupled from the one for engine and throttle management. Somewhat unrelated to this particular case, but terrifyingly, the network isn't and CAN is one of the least secure BUS's imaginable.

vodou 4y ago
>... CAN is one of the least secure BUS's imaginable. Can you elaborate on this?
- kayodelycaon 4y ago
  No security or authentication. IIRC, any attached device has full control over the physical layer by design. I don't really see why this is a problem in a car with isolated buses for safety-critical components.
  - hatsunearu 4y ago
    Yeah... that's like saying a car has a security risk because someone can go in the wheel well and slash the brake lines...
    - RC_ITR 4y ago
      Yeah, that is a security risk We choose to ignore it because it's rarely exploited, but by that logic, we should just ignore all zero-days.
  - leetbulb 4y ago
    Many newer vehicles contain systems, OEM and/or after-market, that are permanently connected to the internet via cellular modem. Other systems with insecure RF tech used for various gimmicks. Other systems that communicate with external and potentially malicious devices like chargers. Etc. Most of these systems have enough access to (in)directly destroy or booby trap the car. My car is able to receive ECU(!), firmware, software updates OTA from the manufacturer. These critical systems are just as "closed" or "isolated" as cloud-enabled "CCTV." Scary stuff.
fmntf 4y ago
Even cheap cars have a dedicated powertrain/brake/ABS CAN bus. Separate buses are then interconnected via a gateway.
- firephonestival 4y ago
  New cars do, but that has not always been the case. The rapid shift to hard bus separation happened after this incident: https://www.eetimes.com/hacked-jeep-whom-to-blame/ https://www.eetimes.com/hacked-jeep-whom-to-blame/
anyfoo 4y ago
My car (2014) has seven or so different CAN busses, with a gateway in between. Whether that constitutes a different "network" or not can be argued, but at least something that brings the entertainment CAN bus down, be it just by e.g. shorting it, won't (easily) bring down the other busses.