6 ms·

It's been shown that people are able to rip headlights out of vehicles, plug into diagnostic ports behind them, unlock the doors and start the car. [1] If crim

It's been shown that people are able to rip headlights out of vehicles, plug into diagnostic ports behind them, unlock the doors and start the car. [1] If criminals are able to figure out and exploit a relatively simple compromise, what other exploitable secrets are auto manufacturers hiding using obscurity that right to repair would expose to the public? Any US residents know if the NHTSA is captured by corporate interests, or are they relatively free of corruption? [1]https://www.thedrive.com/news/shadetree-hackers-are-stealing-cars-by-injecting-code-into-headlight-wiring https://www.thedrive.com/news/shadetree-hackers-are-stealing...

Rantenki 3y ago
This is hardly a new problem though. Thieves used to be able to pull the wires from under the steering column and start a car. For the more serious attacks mentioned, the automakers are essentially saying that they build extremely vulnerable systems and are afraid to disclose that fact. I suspect we're in violent agreement though, that the correct outcome is to fix the vulnerabilities AND to document the repair methods.
- zaroth 3y ago
  Extremely vulnerable is a mischaracterization. Read up on how the CANBUS attack works, it’s actually quite sophisticated. It’s the “evil maid” problem, and it’s extremely difficult to protect against, such that you pay huge premiums to get equipment hardened against these types of attacks.
CoastalCoder 3y ago
> It's been shown that people are able to rip headlights out of vehicles, plug into diagnostic ports behind them, unlock the doors and start the car. [1] Question about the U.S. legal system: If that's true, and if NHTSA's position is based on rule rather than law, then can NHTSA be (successfully) sued because the rule is capricious? IIRC courts have set a really low bar for the rationality of administrative rule-making, but I may not know what I'm talking about.
- JumpCrisscross 3y ago
  > can NHTSA be (successfully) sued because the rule is capricious This is almost certainly what the Massachusetts AG will next do.
mywittyname 3y ago
Physically plugging into a vehicle's CANBUS is not different from physically plugging into a computer's USB ports. We accept that computer security has limits when the attacker has physical access to a machine. Why should this be different with a vehicle? In this example, attackers need to physically rip apart a vehicle to trigger a vulnerability. It's not as though the headlight wiring harness is any more accessible than core components like the engine control unit.
- mindslight 3y ago
  > Physically plugging into a vehicle's CANBUS is not different from physically plugging into a computer's USB ports. That's a bad example. If a computer can be taken over by a USB device, we would say there is a security vulnerability in its USB stack. Firewire is widely criticized for having a protocol based around DMA that naive implementations of are vulnerable in this way.
  - mywittyname 3y ago
    I'm not arguing that a flaw wouldn't be considered a vulnerability - it is. My argument is that cyber security has limitations when an attacker has physical access to the device. Once you can start plugging random devices into random ports, there's bound to be a vulnerability somewhere. And how much is it really worth it to manufactures and customers to pen-test requests sent from a fuel pump? Cyber security doesn't need to be perfect, it just needs to be more difficult than the the brute force solution - in this case, throwing the car on a flatbed tow truck.
    - mindslight 3y ago
      It's not "request from a fuel pump". The CAN bus is a broadcast medium with addresses roughly equivalent to object type tags. So your ABS controller is sitting there repeatedly broadcasting messages like LEFT_FRONT_WHEEL_SPEED = 45mph, or whatever. But anything else connected to that pair of wires can send the same type of message, even though it's not the ABS controller. Like ethernet, this points towards the paradigm for analyzing security of such buses. For example in an office environment, a link trunking a bunch of VLANs is going to be in server rooms or enclosed in conduit/walls/etc, whereas the ports in individual offices are going to be locked down to specific VLANs, perhaps only to specific MAC addresses, etc. In other words, yes there are always vulnerabilities to certain types of physical access. But that does not mean that all physical access implies game over. For instance a computer should be secure against attacks attempted from the USB bus, then you might have a case tamper switch that kills the rig, preventing easy access to the PCIe bus which is much more privileged. Translated to a car, this probably means that non-security-critical devices close to the periphery (like headlights) should be on a separate bus to things like door locks, keyfob receivers, etc. AFAIK my car already has two separate CAN buses, bridged by the gauge cluster. The distinction has to do with hard realtime messages from critical systems (engine, steering, ABS, etc), and less critical messages of turning lights on/off etc. We can imagine one or two more buses with distinctions based on security.

Rantenki 3y ago

This is hardly a new problem though. Thieves used to be able to pull the wires from under the steering column and start a car. For the more serious attacks mentioned, the automakers are essentially saying that they build extremely vulnerable systems and are afraid to disclose that fact. I suspect we're in violent agreement though, that the correct outcome is to fix the vulnerabilities AND to document the repair methods.

zaroth 3y ago
Extremely vulnerable is a mischaracterization. Read up on how the CANBUS attack works, it’s actually quite sophisticated. It’s the “evil maid” problem, and it’s extremely difficult to protect against, such that you pay huge premiums to get equipment hardened against these types of attacks.

CoastalCoder 3y ago

> It's been shown that people are able to rip headlights out of vehicles, plug into diagnostic ports behind them, unlock the doors and start the car. [1] Question about the U.S. legal system: If that's true, and if NHTSA's position is based on rule rather than law, then can NHTSA be (successfully) sued because the rule is capricious? IIRC courts have set a really low bar for the rationality of administrative rule-making, but I may not know what I'm talking about.

JumpCrisscross 3y ago
> can NHTSA be (successfully) sued because the rule is capricious This is almost certainly what the Massachusetts AG will next do.

mywittyname 3y ago

Physically plugging into a vehicle's CANBUS is not different from physically plugging into a computer's USB ports. We accept that computer security has limits when the attacker has physical access to a machine. Why should this be different with a vehicle? In this example, attackers need to physically rip apart a vehicle to trigger a vulnerability. It's not as though the headlight wiring harness is any more accessible than core components like the engine control unit.

mindslight 3y ago
> Physically plugging into a vehicle's CANBUS is not different from physically plugging into a computer's USB ports. That's a bad example. If a computer can be taken over by a USB device, we would say there is a security vulnerability in its USB stack. Firewire is widely criticized for having a protocol based around DMA that naive implementations of are vulnerable in this way.
- mywittyname 3y ago
  I'm not arguing that a flaw wouldn't be considered a vulnerability - it is. My argument is that cyber security has limitations when an attacker has physical access to the device. Once you can start plugging random devices into random ports, there's bound to be a vulnerability somewhere. And how much is it really worth it to manufactures and customers to pen-test requests sent from a fuel pump? Cyber security doesn't need to be perfect, it just needs to be more difficult than the the brute force solution - in this case, throwing the car on a flatbed tow truck.
  - mindslight 3y ago
    It's not "request from a fuel pump". The CAN bus is a broadcast medium with addresses roughly equivalent to object type tags. So your ABS controller is sitting there repeatedly broadcasting messages like LEFT_FRONT_WHEEL_SPEED = 45mph, or whatever. But anything else connected to that pair of wires can send the same type of message, even though it's not the ABS controller. Like ethernet, this points towards the paradigm for analyzing security of such buses. For example in an office environment, a link trunking a bunch of VLANs is going to be in server rooms or enclosed in conduit/walls/etc, whereas the ports in individual offices are going to be locked down to specific VLANs, perhaps only to specific MAC addresses, etc. In other words, yes there are always vulnerabilities to certain types of physical access. But that does not mean that all physical access implies game over. For instance a computer should be secure against attacks attempted from the USB bus, then you might have a case tamper switch that kills the rig, preventing easy access to the PCIe bus which is much more privileged. Translated to a car, this probably means that non-security-critical devices close to the periphery (like headlights) should be on a separate bus to things like door locks, keyfob receivers, etc. AFAIK my car already has two separate CAN buses, bridged by the gauge cluster. The distinction has to do with hard realtime messages from critical systems (engine, steering, ABS, etc), and less critical messages of turning lights on/off etc. We can imagine one or two more buses with distinctions based on security.