5 ms·

When we will learn that putting doors and windows in buildings make them easy target for thieves? /s Yeah, I'm exaggerating but so are many screaming against an

When we will learn that putting doors and windows in buildings make them easy target for thieves? /s Yeah, I'm exaggerating but so are many screaming against anything connected. Your smartphone and computer were connected to the Internet to read that article and send this message. In the end it's as always in everything and especially in our industry a matter of trade-off. If connectivity gives you huge UX boost and maybe sometimes there might be a security issue, well, you take the connectivity (generally speaking).

palata 3y ago
> In the end it's as always in everything and especially in our industry a matter of trade-off. Exactly, we agree here! > If connectivity gives you huge UX boost and maybe sometimes there might be a security issue, well, you take the connectivity (generally speaking). Maybe you do, I don't. Especially not for a vehicle that can kill me (or others). > Yeah, I'm exaggerating but so are many screaming against anything connected. I work with embedded systems, I can tell you that the state of security in my field is pretty alarming. I personally would not use the products my company sells for anything important.
- darkwater 3y ago
  > Maybe you do, I don't. Especially not for a vehicle that can kill me (or others). I will jump on that bandwagon the day there is a remote, no physical access needed exploit that can intervene on brakes, steer or accelerator in a connected car. Until that happens, I will keep my opinion that advantages are bigger than disadvantages.
  - palata 3y ago
    > I will jump on that bandwagon the day there is a remote, no physical access needed exploit that can intervene on brakes, steer or accelerator in a connected car. Don't Teslas get firmware updates for the self-driving over the internet? Or are you saying that "you don't see a problem because you don't choose the cars that are vulnerable to that"? Because the main topic here is security issues with Tesla cars...
    - darkwater 3y ago
      What would be exactly the threat scenario here? MITM to send a malicious update? Breaking into Tesla servers to upload a malicious update? That could happen, yes, and it can be a valid point, but I honestly think it wouldn't go undetected for a long time. I mean, yes, an attacker can gain access to Tesla network, do some lateral movement, exploit some possible excessive trust on internal software buildchain and plant some sort of rootkit in the car firmware that will contact an external C&C when on wifi to do the next action. And then all cars will go at the highest possible speed against a wall or over a crowded place. But this starts looking like the famous XKCD comic [1], why not just throw some bombs to achieve the same goal? [1] https://xkcd.com/538/ https://xkcd.com/538/
      - Veserv 3y ago
        Because if you can do that you can spend a few million dollars to hack millions of Teslas causing hundreds of thousands of deaths. You are literally comparing a few bombs to Hiroshima. Except nuclear weapons cost billions to develop, billions to produce and deploy, are complex and difficult to successfully use against targets, and are almost impossible to use stealthily. Turns out handing out nuclear weapons for less than the cost of a tank, or you know starting a new McDonald’s franchise, is a serious cause for concern.
        darkwater 3y ago
        An operation like that is not going to be simple, I would not say it's akin to developing your own nuclear bomb but If you have some serious funding your can plant bombs just the same. It's not something that your isolated 30 men terrorist group will pull off.
        Veserv 3y ago
        Are you seriously trying to state that killing 100,000 people through a coordinated clandestine bombing campaign in another country is even comparable to the difficulty of just spending a few million dollars to develop that same remote capability via a software attack? It is estimated that a few hundred thousand have died in the Russo-Ukrainian War and that has cost billions and required open warfare. It literally costs 1,000x as much to cause such casualties using traditional techniques. Conflating them makes about as much sense as claiming that Usain Bolt is neck-and-neck with a Atlas V rocket or that Earth is basically the same size as Jupiter.
  - sleepybrett 3y ago
    I don't see why they can't get into the subsystem for the drive by wire stuff, but there are things that can be done that would be quite bad even with the systems that are directly exposed. What about if I can remotely hack into your car, crank up the heater and leave that running overnight so that when you head out to your car in the morning it's sitting at 0 battery, that's certainly super annoying. Could I potentially exploit the battery management system and run your battery to 'actually 0' damaging or potentially destroying your very expensive battery?
  - Veserv 3y ago
    Welcome to 2015? https://www.theverge.com/2015/7/21/9009213/chrysler-uconnect-vulnerability-car-hijack https://www.theverge.com/2015/7/21/9009213/chrysler-uconnect...
    - deleted 3y ago
      [deleted]
- giantg2 3y ago
  "Especially not for a vehicle that can kill me (or others)." I wonder how the conversation would change if it were a plane and not a car. Seems like both Tesla and Boeing are having similar quality control issues. "I personally would not use the products my company sells for anything important." I feel like most products today are not meant to be important. Most seem to be about convenience with the design thought of "if it breaks they can just do it manually", even if that's not always applicable. Or people forget how to do it on thier own like without blind spot detectors or backup cameras. Imagine a hack that randomly disables blind spot detectors or freezes/replays backup cam footage? A whole generation would have severe issues because they trust it.
  - palata 3y ago
    > Seems like both Tesla and Boeing are having similar quality control issues. I really don't get how people are not becoming paranoid about planes. I used to say "it's much safer than taking your car, don't worry". Now, given the problems Boeing has had in the last few years (which was not "bad luck" but rather "poor engineering"), I don't feel like telling people who are scared to fly that planes are particularly safe. Still nobody around me seems to even wonder what plane they will use for their next flight. In many ways the covid vaccines were much more thoroughly tested and therefore safer than (at least Boeing) planes, but still a ton of people were afraid of the vaccines and nobody of the planes :-).
giantg2 3y ago
If you're using that analogy, then it's still a valid concern. What are the deadbolts for the connection? Can we see the failed attempts to gain access like we could with physical damage to the door? There should be some level of reasonable protection in either scenario. I feel like for many connected devices those reasonable protections are absent because most people are more ignorant about cyber security than they are about physical security, so the market isn't really adopting those protections at the scale it should.
sleepybrett 3y ago
Go check out the windows at a Tiffany's. Clearly they considered that windows were an easy target for thieves and hardened the fuck out of them.
- darkwater 3y ago
  Exactly, but not everyone is Tiffany's, so an enough motivated attacker can probably pry open your window in a few minutes. Why aren't we all putting Tiffany's like windows and doors?
  - palata 3y ago
    > Why aren't we all putting Tiffany's like windows and doors? Simple: it's not the same threat model. Tiffany's protects something extremely valuable that they keep behind those windows. If you had the same stuff behind your windows, you would be advised to get the same security.

palata 3y ago

> In the end it's as always in everything and especially in our industry a matter of trade-off. Exactly, we agree here! > If connectivity gives you huge UX boost and maybe sometimes there might be a security issue, well, you take the connectivity (generally speaking). Maybe you do, I don't. Especially not for a vehicle that can kill me (or others). > Yeah, I'm exaggerating but so are many screaming against anything connected. I work with embedded systems, I can tell you that the state of security in my field is pretty alarming. I personally would not use the products my company sells for anything important.

darkwater 3y ago
> Maybe you do, I don't. Especially not for a vehicle that can kill me (or others). I will jump on that bandwagon the day there is a remote, no physical access needed exploit that can intervene on brakes, steer or accelerator in a connected car. Until that happens, I will keep my opinion that advantages are bigger than disadvantages.
- palata 3y ago
  > I will jump on that bandwagon the day there is a remote, no physical access needed exploit that can intervene on brakes, steer or accelerator in a connected car. Don't Teslas get firmware updates for the self-driving over the internet? Or are you saying that "you don't see a problem because you don't choose the cars that are vulnerable to that"? Because the main topic here is security issues with Tesla cars...
  - darkwater 3y ago
    What would be exactly the threat scenario here? MITM to send a malicious update? Breaking into Tesla servers to upload a malicious update? That could happen, yes, and it can be a valid point, but I honestly think it wouldn't go undetected for a long time. I mean, yes, an attacker can gain access to Tesla network, do some lateral movement, exploit some possible excessive trust on internal software buildchain and plant some sort of rootkit in the car firmware that will contact an external C&C when on wifi to do the next action. And then all cars will go at the highest possible speed against a wall or over a crowded place. But this starts looking like the famous XKCD comic [1], why not just throw some bombs to achieve the same goal? [1] https://xkcd.com/538/ https://xkcd.com/538/
    - Veserv 3y ago
      Because if you can do that you can spend a few million dollars to hack millions of Teslas causing hundreds of thousands of deaths. You are literally comparing a few bombs to Hiroshima. Except nuclear weapons cost billions to develop, billions to produce and deploy, are complex and difficult to successfully use against targets, and are almost impossible to use stealthily. Turns out handing out nuclear weapons for less than the cost of a tank, or you know starting a new McDonald’s franchise, is a serious cause for concern.
      - darkwater 3y ago
        An operation like that is not going to be simple, I would not say it's akin to developing your own nuclear bomb but If you have some serious funding your can plant bombs just the same. It's not something that your isolated 30 men terrorist group will pull off.
        Veserv 3y ago
        Are you seriously trying to state that killing 100,000 people through a coordinated clandestine bombing campaign in another country is even comparable to the difficulty of just spending a few million dollars to develop that same remote capability via a software attack? It is estimated that a few hundred thousand have died in the Russo-Ukrainian War and that has cost billions and required open warfare. It literally costs 1,000x as much to cause such casualties using traditional techniques. Conflating them makes about as much sense as claiming that Usain Bolt is neck-and-neck with a Atlas V rocket or that Earth is basically the same size as Jupiter.
- sleepybrett 3y ago
  I don't see why they can't get into the subsystem for the drive by wire stuff, but there are things that can be done that would be quite bad even with the systems that are directly exposed. What about if I can remotely hack into your car, crank up the heater and leave that running overnight so that when you head out to your car in the morning it's sitting at 0 battery, that's certainly super annoying. Could I potentially exploit the battery management system and run your battery to 'actually 0' damaging or potentially destroying your very expensive battery?
- Veserv 3y ago
  Welcome to 2015? https://www.theverge.com/2015/7/21/9009213/chrysler-uconnect-vulnerability-car-hijack https://www.theverge.com/2015/7/21/9009213/chrysler-uconnect...
  - deleted 3y ago
    [deleted]
giantg2 3y ago
"Especially not for a vehicle that can kill me (or others)." I wonder how the conversation would change if it were a plane and not a car. Seems like both Tesla and Boeing are having similar quality control issues. "I personally would not use the products my company sells for anything important." I feel like most products today are not meant to be important. Most seem to be about convenience with the design thought of "if it breaks they can just do it manually", even if that's not always applicable. Or people forget how to do it on thier own like without blind spot detectors or backup cameras. Imagine a hack that randomly disables blind spot detectors or freezes/replays backup cam footage? A whole generation would have severe issues because they trust it.
- palata 3y ago
  > Seems like both Tesla and Boeing are having similar quality control issues. I really don't get how people are not becoming paranoid about planes. I used to say "it's much safer than taking your car, don't worry". Now, given the problems Boeing has had in the last few years (which was not "bad luck" but rather "poor engineering"), I don't feel like telling people who are scared to fly that planes are particularly safe. Still nobody around me seems to even wonder what plane they will use for their next flight. In many ways the covid vaccines were much more thoroughly tested and therefore safer than (at least Boeing) planes, but still a ton of people were afraid of the vaccines and nobody of the planes :-).

giantg2 3y ago

If you're using that analogy, then it's still a valid concern. What are the deadbolts for the connection? Can we see the failed attempts to gain access like we could with physical damage to the door? There should be some level of reasonable protection in either scenario. I feel like for many connected devices those reasonable protections are absent because most people are more ignorant about cyber security than they are about physical security, so the market isn't really adopting those protections at the scale it should.

sleepybrett 3y ago

Go check out the windows at a Tiffany's. Clearly they considered that windows were an easy target for thieves and hardened the fuck out of them.

darkwater 3y ago
Exactly, but not everyone is Tiffany's, so an enough motivated attacker can probably pry open your window in a few minutes. Why aren't we all putting Tiffany's like windows and doors?
- palata 3y ago
  > Why aren't we all putting Tiffany's like windows and doors? Simple: it's not the same threat model. Tiffany's protects something extremely valuable that they keep behind those windows. If you had the same stuff behind your windows, you would be advised to get the same security.