8 ms·

This is exactly the reason why I'm trying my best to keep my non-smart vehicle running as well as possible for as long as possible. I have no idea what exactly

This is exactly the reason why I'm trying my best to keep my non-smart vehicle running as well as possible for as long as possible. I have no idea what exactly will be exposed to the manufacturer's backend, what can be manipulated and hacked on the front-end, and the possible safety repercussions involved with this. Who's to say some government/corporate espionage results in a manufacturer getting their back-end hacked and having every online vehicle immediately get their brakes applied? Definitely some Black Mirror-esque stuff... Not to mention the convenient ability to surveil any vehicle and their locations with a busted and easily crackable API - why does it take external hackers with a (thankfully good) sense of morals and ethics to bring these things to companies' attention? It'll probably take something hitting national/international news before lawmakers or companies take this security seriously.

Gordonjcp 4y ago
I have a couple of late-90s Range Rovers. They're pretty secure from hacking, having nothing more sophisticated than an FM stereo on board.
- julianz 4y ago
  And also, given that with Range Rover reliability they'll perpetually be in the shop, you'll always know where they are!
  - Gordonjcp 4y ago
    I've never actually had one fail in service. My older one (which is actually a few months newer than my "newer" one which I got a couple of years ago) did over 100,000 miles with only fairly minor repairs, and is currently on 270,000 miles. I'd drive either of them to any spot in the world. I'd carry tools and spares, but I'd still drive them there.
    - hef19898 4y ago
      Still Classics or already P38s?
      - Gordonjcp 4y ago
        P38s, way simpler than RRCs and far less rot-prone.
        hef19898 4y ago
        Rot prone I agree! Nice cars either way!
- WarOnPrivacy 4y ago
  I feel the same way about our 1961 Sunliner. Except it's a 5 tube AM radio.
troyvit 4y ago
Wouldn't it be cool though to use the same back doors to disable all the telemetry automakers are pouring into our cars though? Well I mean cool until somebody steals the car but all you'd have to do is have your own tracker on it.
deleted 4y ago
[deleted]
jollyllama 4y ago
We need an open database correlating make/model and years with connectivity information.
iinnPP 4y ago
With inequality on the rise, I would expect hats to start darkening at increased rates. I've personally sworn off any more responsible disclosures to companies not paying at least $1,000/hr(USD) in rewards or without clearly good intentions. I am not bending and very backwards to find it either. Any shenanigans is instant disclosure and shenanigans exposure. I'm about to be homeless and know of exploits currently working at 20billion dollar companies. They can't even bother responding to emails... There's a point where one has to focus on needs. Morality I want, food I need.
- j0hnyl 4y ago
  This attitude isn't helping anyone, yourself included... but if you leaned into responsible disclosure you might find your way into a job that saves you from homelessness.
- jacquesm 4y ago
  > Morality I want, food I need. Yes, but jail food isn't all that it's cracked up to be and if you are able to get that kind of work done then your choice isn't $1000/hour for undisclosed vulnerabilities or starving, the viable alternative is just to get a job. With those skills you are 10x as employable as most people that are currently jobless. At least.
  - iinnPP 4y ago
    Prison food is okay, depends where you go and how you handle yourself. Low security prison is just adult daycare, which is where a hacker will end up. Hacker knowledge is highly appreciated in prison. I should mention that I don't intend to release or sell anything harmful. I just recently experienced this issue and I came out on the right side(?). I can see someone coming out the other side too, too easily. My intent rather is to stop working for free. I will notice it, note it, eliminate my personal exposure, and ignore it. I would say that puts me somewhere between white and black. It's not easy (for me) to find employment. My last company was in automotive advertising(bankrupt) and I am aware of quite a few more problems than what you see in this disclosure. Though the listed brands are outside of my knowledge.
AlotOfReading 4y ago
There have been many, many past instances of automotive security issues hitting national and international news. The automotive industry has simply been slow to adapt. Manufacturers were almost universally founded in an era when mechanical systems dominated and that's how they want to treat everything. There's been a painful and ongoing learning process for them to realize that software and computerized systems are fundamentally different from the mechanical systems they understand well. On the inside, doing things securely takes a lot of deliberate and careful work. COTS stuff is rarely designed for high security systems. I've sat in more than one pen test where we found a wireless interface unintentionally added by some dev board that was selected for a completely different purpose. I've also seen cases where the security team/software teams were hired/onboarded after the vehicle design was essentially finalized with little consideration for their requirements.
- Silhouette 4y ago
  The automotive industry has simply been slow to adapt. And so have the legislators and regulators who should have been preventing the automotive industry from selling products where it increasingly seems plausible or even likely that a vulnerability will be found and exploited at scale by someone really trying to do harm and the consequences will be catastrophic. The danger has been obvious to many who work in tech for a long time and has been publicly demonstrated often enough against enough different types of vehicles that the threat should be like a giant billboard that is repeated every 100m along every road in the world by now. Someone in power needs to realise that even the kind of intense scrutiny and safety culture that we see in for example aviation or some medical fields or nuclear power stations doesn't scratch the surface of what we need for an industry that sells around 100,000,000 new vehicles every year. The auto industry is infamous for treating the human cost of its failures as a mere financial cost of doing business and operating accordingly. It simply can't be trusted to "adapt". It must be forced through unprecedented levels of oversight, regulation and sanctions for businesses, executives and investors who don't act responsibly.
- vv_ 4y ago
  > Manufacturers were almost universally founded in an era when mechanical systems dominated and that's how they want to treat everything. That is a huge understatement, as they mostly (majorly?) employ electrical/mechanical engineers who end up writing code for the ECU's. Cloud services are mostly an afterthought in design. In my experience, regulation isn't the main problem.
jacquesm 4y ago
Same here, I've pretty much given up on owning a modern vehicle, my daily driver is 25 years old this February and it's the last car I'll own.
- fsckboy 4y ago
  >my daily driver is 25 years old this February and it's the last car I'll own. I've gritted my teeth every time somebody on HN has referred to their computer as their "daily driver", but I will remain silent no more: You, sir, are the daily driver of your automobile, and NOT vice versa. However, I'll allow that to connect any new auto you purchase to your computer, you might need to download new drivers.
- BoorishBears 4y ago
  My threat model must be a bit different. I imagine my odds of being an accident in which 25 years of crash safety advancements help are higher than being hacked. (and for the inevitable flood of "But the A pillars are bigger" comments, if you're safety conscious you can still get cars with reasonably sized A pillars. A few years ago Honda specifically called out smaller, further recessed, A pillars for visibility in the Accord redesign)
  - Roark66 4y ago
    I tend to drive almost exclusively older cars. Once I had an accident in a 15 year old golf (this was around 2015 so the golf was made in around year 2000). This was basically emergency breaking on wet road at motorway speeds(about 130kph or 80mph)followed by loss of traction, then some sideways sliding finished with head on smashing into a side barrier with enough force that the car ended in the middle of the road (it must have bounced, but I have to admit I can't remember the exact moment, I estimate it was probably still going at last 45kph 30mph when it hit). I was perfectly fine except loosing few seconds of time. I managed to jump out of the car and have enough presence of mind to drag it off to the side of the road before incoming traffic crashed into it(thankfully wheels were fine enough for this). The car was totaled, and I didn't even have a scratch. That's an example of now 20 year + car safety...

Gordonjcp 4y ago

I have a couple of late-90s Range Rovers. They're pretty secure from hacking, having nothing more sophisticated than an FM stereo on board.

julianz 4y ago
And also, given that with Range Rover reliability they'll perpetually be in the shop, you'll always know where they are!
- Gordonjcp 4y ago
  I've never actually had one fail in service. My older one (which is actually a few months newer than my "newer" one which I got a couple of years ago) did over 100,000 miles with only fairly minor repairs, and is currently on 270,000 miles. I'd drive either of them to any spot in the world. I'd carry tools and spares, but I'd still drive them there.
  - hef19898 4y ago
    Still Classics or already P38s?
    - Gordonjcp 4y ago
      P38s, way simpler than RRCs and far less rot-prone.
      - hef19898 4y ago
        Rot prone I agree! Nice cars either way!
WarOnPrivacy 4y ago
I feel the same way about our 1961 Sunliner. Except it's a 5 tube AM radio.

troyvit 4y ago

Wouldn't it be cool though to use the same back doors to disable all the telemetry automakers are pouring into our cars though? Well I mean cool until somebody steals the car but all you'd have to do is have your own tracker on it.

deleted 4y ago

[deleted]

jollyllama 4y ago

We need an open database correlating make/model and years with connectivity information.

iinnPP 4y ago

With inequality on the rise, I would expect hats to start darkening at increased rates. I've personally sworn off any more responsible disclosures to companies not paying at least $1,000/hr(USD) in rewards or without clearly good intentions. I am not bending and very backwards to find it either. Any shenanigans is instant disclosure and shenanigans exposure. I'm about to be homeless and know of exploits currently working at 20billion dollar companies. They can't even bother responding to emails... There's a point where one has to focus on needs. Morality I want, food I need.

j0hnyl 4y ago
This attitude isn't helping anyone, yourself included... but if you leaned into responsible disclosure you might find your way into a job that saves you from homelessness.
jacquesm 4y ago
> Morality I want, food I need. Yes, but jail food isn't all that it's cracked up to be and if you are able to get that kind of work done then your choice isn't $1000/hour for undisclosed vulnerabilities or starving, the viable alternative is just to get a job. With those skills you are 10x as employable as most people that are currently jobless. At least.
- iinnPP 4y ago
  Prison food is okay, depends where you go and how you handle yourself. Low security prison is just adult daycare, which is where a hacker will end up. Hacker knowledge is highly appreciated in prison. I should mention that I don't intend to release or sell anything harmful. I just recently experienced this issue and I came out on the right side(?). I can see someone coming out the other side too, too easily. My intent rather is to stop working for free. I will notice it, note it, eliminate my personal exposure, and ignore it. I would say that puts me somewhere between white and black. It's not easy (for me) to find employment. My last company was in automotive advertising(bankrupt) and I am aware of quite a few more problems than what you see in this disclosure. Though the listed brands are outside of my knowledge.

AlotOfReading 4y ago

There have been many, many past instances of automotive security issues hitting national and international news. The automotive industry has simply been slow to adapt. Manufacturers were almost universally founded in an era when mechanical systems dominated and that's how they want to treat everything. There's been a painful and ongoing learning process for them to realize that software and computerized systems are fundamentally different from the mechanical systems they understand well. On the inside, doing things securely takes a lot of deliberate and careful work. COTS stuff is rarely designed for high security systems. I've sat in more than one pen test where we found a wireless interface unintentionally added by some dev board that was selected for a completely different purpose. I've also seen cases where the security team/software teams were hired/onboarded after the vehicle design was essentially finalized with little consideration for their requirements.

Silhouette 4y ago
The automotive industry has simply been slow to adapt. And so have the legislators and regulators who should have been preventing the automotive industry from selling products where it increasingly seems plausible or even likely that a vulnerability will be found and exploited at scale by someone really trying to do harm and the consequences will be catastrophic. The danger has been obvious to many who work in tech for a long time and has been publicly demonstrated often enough against enough different types of vehicles that the threat should be like a giant billboard that is repeated every 100m along every road in the world by now. Someone in power needs to realise that even the kind of intense scrutiny and safety culture that we see in for example aviation or some medical fields or nuclear power stations doesn't scratch the surface of what we need for an industry that sells around 100,000,000 new vehicles every year. The auto industry is infamous for treating the human cost of its failures as a mere financial cost of doing business and operating accordingly. It simply can't be trusted to "adapt". It must be forced through unprecedented levels of oversight, regulation and sanctions for businesses, executives and investors who don't act responsibly.
vv_ 4y ago
> Manufacturers were almost universally founded in an era when mechanical systems dominated and that's how they want to treat everything. That is a huge understatement, as they mostly (majorly?) employ electrical/mechanical engineers who end up writing code for the ECU's. Cloud services are mostly an afterthought in design. In my experience, regulation isn't the main problem.

jacquesm 4y ago

Same here, I've pretty much given up on owning a modern vehicle, my daily driver is 25 years old this February and it's the last car I'll own.

fsckboy 4y ago
>my daily driver is 25 years old this February and it's the last car I'll own. I've gritted my teeth every time somebody on HN has referred to their computer as their "daily driver", but I will remain silent no more: You, sir, are the daily driver of your automobile, and NOT vice versa. However, I'll allow that to connect any new auto you purchase to your computer, you might need to download new drivers.
BoorishBears 4y ago
My threat model must be a bit different. I imagine my odds of being an accident in which 25 years of crash safety advancements help are higher than being hacked. (and for the inevitable flood of "But the A pillars are bigger" comments, if you're safety conscious you can still get cars with reasonably sized A pillars. A few years ago Honda specifically called out smaller, further recessed, A pillars for visibility in the Accord redesign)
- Roark66 4y ago
  I tend to drive almost exclusively older cars. Once I had an accident in a 15 year old golf (this was around 2015 so the golf was made in around year 2000). This was basically emergency breaking on wet road at motorway speeds(about 130kph or 80mph)followed by loss of traction, then some sideways sliding finished with head on smashing into a side barrier with enough force that the car ended in the middle of the road (it must have bounced, but I have to admit I can't remember the exact moment, I estimate it was probably still going at last 45kph 30mph when it hit). I was perfectly fine except loosing few seconds of time. I managed to jump out of the car and have enough presence of mind to drag it off to the side of the road before incoming traffic crashed into it(thankfully wheels were fine enough for this). The car was totaled, and I didn't even have a scratch. That's an example of now 20 year + car safety...