6 ms·

Year 2022: 'Degoogling' your car. PC/laptops were first, smartphones were done next and now car are too be 'degoogled'. Edit:- 'Smart' TV's were between smart

by i67vw3 4y ago

Year 2022: 'Degoogling' your car. PC/laptops were first, smartphones were done next and now car are too be 'degoogled'. Edit:- 'Smart' TV's were between smartphones and cars.

mdp2021 4y ago
No, that is a comparatively minor detail: a car MUST NOT be Internet connected. Before privacy, security. You do not open to security risks when advantages are negligible or even negative (privacy issues make them negative).
- AlotOfReading 4y ago
  The direction OEMs are going is to try and have their cake and eat it too. Data connection is not optional, so security is achieved through an isolated network interface boxe that talks to the outside and is assumed to be pwned/pwnable. The rest of the architecture is hardened accordingly, with a single internal interface to the rest of the vehicle on a secured bus and attestation/secured computing platform, etc.
  - skummetmaelk 4y ago
    That's great until an unknowing mechanic connects a pwned device to the secure system that infects it and enables it to receive commands from the "assumed pwned" network box.
    - AlotOfReading 4y ago
      They wouldn't have a direct connection regardless, but this is also part of the threat model on every vehicle I've been involved with.
  - shnock 4y ago
    I have layman knowledge of this and do not understand. How does this compare to the level of security described in the GP comment (no connection at all)?
    - AlotOfReading 4y ago
      It might help to imagine there's a data diode between the interface box and the rest of the system. In an ideal world, there should be few differences beyond the actual data being sent. In practice, the analysis is a lot more complicated. I've also seen cases where there should be no connection hardware at all, but someone forgot to disable Bluetooth on a dev board or something and it shows up in a red team exercise.
- i67vw3 4y ago
  Problem is car manufactures have started forcing cars to connect to internet, even concepts like firmware, updates etc. Notorious among them are electric cars like Tesla. Even petrol/diesel car manufactures have started doing same stuff.
  - mdp2021 4y ago
    For a large number of categories today the most extensive research to identify a decent product has become necessary. It is a disaster that cars are now part of it, but - the most extensive research to identify a decent product will be necessary. Edit: what I fear most (second to a market that allows perversions - i.e. buyers of unacceptable products), is cretinous legislation what may remove options.
    - JadeNB 4y ago
      > what I fear most (second to a market that allows perversions - i.e. buyers of unacceptable products) I have a hard time buying this (no pun intended). Your greatest fear is other people being able to buy things? I fear very much my not being able to buy what I want, and I can see knock-on effects from other people being OK with (or not understanding) the violation of their privacy and so indirectly violating my privacy, but it's hard for me to see that raising to the level of my greatest fear. So I wonder if I'm misunderstanding you, or we're frightened by different things.
      - fariszr 4y ago
        A big example of this is phones. And TVs.
        JadeNB 4y ago
        > A big example of this is phones. And TVs. Which 'this' do you mean? There is the 'this' where other people buy stupid things (meaning 'smart' things, in the marketing terminology we've had foisted upon us), and there is the 'this' where I can't buy what I want. Phones and TVs are examples of both, to be sure; but, as I mentioned in the comment to which you are responding, these two phenomena seem different, though linked, and it's not clear to me that the former is inherently bad.
pessimizer 4y ago
TVs between smartphones and cars. There's still plenty of room for expansion, like your door locks and home climate controls, your medical history/treatment, your votes...
- mdp2021 4y ago
  > home climate controls These are already attack objectives - thermostat ransoms.
  - derwiki 4y ago
    Interesting, do you have a link or remember an instance of this?
    - mdp2021 4y ago
      There have been reminders on The Conversation only a few months ago ( https://theconversation.com/considering-buying-a-smart-device-to-protect-your-security-ask-yourself-these-five-questions-176331 https://theconversation.com/considering-buying-a-smart-devic... ), but here is a generic article on The Atlantic from 2016 - year relevant, because there had been cases of actual ransomware for some thermostat models then: https://www.theatlantic.com/technology/archive/2016/01/the-extortionist-in-the-fridge/422742/ https://www.theatlantic.com/technology/archive/2016/01/the-e... Which also contains the line: > When it comes to connected vehicles, the possibilities are even more frightening. And thanks to an experiment where white-hat hackers remotely hijacked a Jeep as it hurtled down a St. Louis highway, they’re not that far-fetched http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ http://www.wired.com/2015/07/hackers-remotely-kill-jeep-high... Which raises another point: security faults in cars have been used to stop them, to take control of them etc. Among the malicious purposes, one can emerge of ransom: "We now control your car. If you want to drive it again...". Nothing new in the crime scene ("We just stole your car. If you want to drive it again...") - only, now through fully avoidable technical holes which should not be there in the first place. -- About the thermostats: Hackers demonstrated first ransomware for IoT thermostats at DEF CON // Ransomware-infected smart thermostats, it's no longer hypothetical. An attacker could crank up the heat and lock the IoT device until sweltering occupants paid a ransom to unlock it (Aug 2016) https://www.computerworld.com/article/3105001/hackers-demonstrated-first-ransomware-for-iot-thermostats-at-def-con.html https://www.computerworld.com/article/3105001/hackers-demons...

by i67vw3 4y ago

Year 2022: 'Degoogling' your car. PC/laptops were first, smartphones were done next and now car are too be 'degoogled'. Edit:- 'Smart' TV's were between smartphones and cars.

mdp2021 4y ago

No, that is a comparatively minor detail: a car MUST NOT be Internet connected. Before privacy, security. You do not open to security risks when advantages are negligible or even negative (privacy issues make them negative).

AlotOfReading 4y ago
The direction OEMs are going is to try and have their cake and eat it too. Data connection is not optional, so security is achieved through an isolated network interface boxe that talks to the outside and is assumed to be pwned/pwnable. The rest of the architecture is hardened accordingly, with a single internal interface to the rest of the vehicle on a secured bus and attestation/secured computing platform, etc.
- skummetmaelk 4y ago
  That's great until an unknowing mechanic connects a pwned device to the secure system that infects it and enables it to receive commands from the "assumed pwned" network box.
  - AlotOfReading 4y ago
    They wouldn't have a direct connection regardless, but this is also part of the threat model on every vehicle I've been involved with.
- shnock 4y ago
  I have layman knowledge of this and do not understand. How does this compare to the level of security described in the GP comment (no connection at all)?
  - AlotOfReading 4y ago
    It might help to imagine there's a data diode between the interface box and the rest of the system. In an ideal world, there should be few differences beyond the actual data being sent. In practice, the analysis is a lot more complicated. I've also seen cases where there should be no connection hardware at all, but someone forgot to disable Bluetooth on a dev board or something and it shows up in a red team exercise.
i67vw3 4y ago
Problem is car manufactures have started forcing cars to connect to internet, even concepts like firmware, updates etc. Notorious among them are electric cars like Tesla. Even petrol/diesel car manufactures have started doing same stuff.
- mdp2021 4y ago
  For a large number of categories today the most extensive research to identify a decent product has become necessary. It is a disaster that cars are now part of it, but - the most extensive research to identify a decent product will be necessary. Edit: what I fear most (second to a market that allows perversions - i.e. buyers of unacceptable products), is cretinous legislation what may remove options.
  - JadeNB 4y ago
    > what I fear most (second to a market that allows perversions - i.e. buyers of unacceptable products) I have a hard time buying this (no pun intended). Your greatest fear is other people being able to buy things? I fear very much my not being able to buy what I want, and I can see knock-on effects from other people being OK with (or not understanding) the violation of their privacy and so indirectly violating my privacy, but it's hard for me to see that raising to the level of my greatest fear. So I wonder if I'm misunderstanding you, or we're frightened by different things.
    - fariszr 4y ago
      A big example of this is phones. And TVs.
      - JadeNB 4y ago
        > A big example of this is phones. And TVs. Which 'this' do you mean? There is the 'this' where other people buy stupid things (meaning 'smart' things, in the marketing terminology we've had foisted upon us), and there is the 'this' where I can't buy what I want. Phones and TVs are examples of both, to be sure; but, as I mentioned in the comment to which you are responding, these two phenomena seem different, though linked, and it's not clear to me that the former is inherently bad.

pessimizer 4y ago

TVs between smartphones and cars. There's still plenty of room for expansion, like your door locks and home climate controls, your medical history/treatment, your votes...

mdp2021 4y ago
> home climate controls These are already attack objectives - thermostat ransoms.
- derwiki 4y ago
  Interesting, do you have a link or remember an instance of this?
  - mdp2021 4y ago
    There have been reminders on The Conversation only a few months ago ( https://theconversation.com/considering-buying-a-smart-device-to-protect-your-security-ask-yourself-these-five-questions-176331 https://theconversation.com/considering-buying-a-smart-devic... ), but here is a generic article on The Atlantic from 2016 - year relevant, because there had been cases of actual ransomware for some thermostat models then: https://www.theatlantic.com/technology/archive/2016/01/the-extortionist-in-the-fridge/422742/ https://www.theatlantic.com/technology/archive/2016/01/the-e... Which also contains the line: > When it comes to connected vehicles, the possibilities are even more frightening. And thanks to an experiment where white-hat hackers remotely hijacked a Jeep as it hurtled down a St. Louis highway, they’re not that far-fetched http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ http://www.wired.com/2015/07/hackers-remotely-kill-jeep-high... Which raises another point: security faults in cars have been used to stop them, to take control of them etc. Among the malicious purposes, one can emerge of ransom: "We now control your car. If you want to drive it again...". Nothing new in the crime scene ("We just stole your car. If you want to drive it again...") - only, now through fully avoidable technical holes which should not be there in the first place. -- About the thermostats: Hackers demonstrated first ransomware for IoT thermostats at DEF CON // Ransomware-infected smart thermostats, it's no longer hypothetical. An attacker could crank up the heat and lock the IoT device until sweltering occupants paid a ransom to unlock it (Aug 2016) https://www.computerworld.com/article/3105001/hackers-demonstrated-first-ransomware-for-iot-thermostats-at-def-con.html https://www.computerworld.com/article/3105001/hackers-demons...