4 ms·

What's going to be even more fun is when the cars gets hacked, given that their are 100+ (200+) car makers, specially with ev cars (WSJ claimed 140+ makers in C

by nox101 2y ago

What's going to be even more fun is when the cars gets hacked, given that their are 100+ (200+) car makers, specially with ev cars (WSJ claimed 140+ makers in China) Bloomberg claimed 500+. I'm not dissing Chinese makers. I'm only sure that like everything there's an exponential curve of how serious companies take security. I'm guessing, of the car makers out there, Tesla and Rivan are near the top since they are new and have people with security experience? I'd expect traditional car makers (Ford, Chevy, Chrysler, Toyota, Honda, Nissan) to all be pretty mediocre. And then I'd expect all the tiny companies to be no different than the tiny companies that made the TVs above.

MarcusE1W 2y ago
That makes me think, will we have car theft in the future where someone hacks your self driving car and it makes off on itself in the night? The next day you wake up to notice that your car has left you for someone else?
- pdimitar 2y ago
  Only a matter of time IMO, and quite the short one at that. Car thieves are an adaptive bunch.
- dageshi 2y ago
  I think this is one of the reasons (among many) why self driving cars will largely be robo taxi's. I'd trust google to maintain the security in a fleet of robo taxi's where cars can be brought in, modified or replaced relatively quickly over Tesla trying to convince individual owners to do the same...
  - prmoustache 2y ago
    Only if cities remove all permanent parking space and it forces people to switch. People are too attached with property and social status stuff.
    - dageshi 2y ago
      Existing people are, in a world where your teenager has been getting self driving robo taxi's to their friends house since the age of 13 I'm not sure if they'll magically want a car when they reach the legal age to drive, hell there's people now who uber everywhere over learning to drive. Beyond that, it seems like the nature of self driving might be one of gradual incremental improvement, where in order to actually develop it you more or less have to run a fleet of robo taxi's in different places with different climates and different road conditions. Finally, the people most likely to deliver it are google (waymo) and I think they have zero desire to sell cars to consumers but are literally running a taxi service as we speak.
- poikroequ 2y ago
  Self driving cars aren't fully autonomous yet. They occasionally require human intervention to make decisions, which I would guess makes it difficult to steal these cars without being detected. They're constantly cloud connected and so they know where the car is at all times. I imagine these factors may deter theft of self driving cars for a while longer. Repossessing a self driving car, on the other hand...
  - tzs 2y ago
    The plan when having a self driving car help you steal it would not be to have it self-drive from the owner's home in, say, San Francisco, to a chop shop in Tijuana where you gang awaits, thus requiring it to make a long trip without human intervention. It would be have it self-drive from the owner's home to someplace nearby not associated with the the thieves to get it out of sight from the owner's security cameras and whatever other security cameras in the neighborhood might be watching where the gang can disable the cloud connection and then transport it by truck or driving it in manual mode to their chop shop.
deleted 2y ago
[deleted]
Veserv 2y ago
Every company, car or otherwise, has security grossly inadequate for the current and especially the near future threat landscape. Everybody knows everything is easily hacked and companies people tout as exemplars like Apple and Microsoft just keep piling on the abject failures to prove the common wisdom true like it is going out of style. Decades of claimed success followed shortly after by failure after failure should really pound in the lesson: "Fool me once, shame on you. Fool me ten thousand times, shame on me." You need systems secure against teams commercially motivated attackers with 10 M$+ budgets and tens of full-time professionals working for years. Nobody in commercial IT would even dare to claim they could stop such attacks even though they are regular occurrences these days. If they do not even dare to say they can do it, why on Earth would anybody believe those vendors have, what, accidentally made things better than they think? Ranking companies by security is like ranking the relative resistance of individual sheets of toilet paper to bullets. Sure, maybe the single ply toilet paper is not as good as the two ply, but neither of them provide objectively useful degrees of protection. And that is just talking about the bare minimum to protect against current threats. If you can hack every Honda at rush hour to turn off the brakes, slam the accelerator, and drive slightly into oncoming traffic how many people do you think would die in the next minute before anything can be done or people informed to stop driving their cars? 1K? 10K? 100K? 1M? Does Honda survive killing more people than died in most wars? If a criminal organization demonstrates they can and will do it, how much would Honda pay in extortion to avoid being put out of existence and their executives jailed? How much security is adequate to avoid the deaths of thousands to millions? Certainly orders of magnitude more than the 10 M$ attacks that steam roll the "best commercial IT security" available today. Any reasonable number is vastly in excess of what these companies can secure today. 20 years ago, the hackers were 18 year olds demanding 300 dollars from grandmas. 10 years ago, the hackers were 28 year olds founding businesses demanding 10 thousand dollars from small businesses. Now they are 38 year olds managing teams demanding millions from billion dollar companies. Soon we will see them demanding billions if the trends continue for 5-10 more years. The software security doomsayers were right, just early. Even Mark Zuckerberg took a decade with huge piles of VC funds to get to a multi-billion dollar valuation; you have to forgive the hacking teenagers who had to bootstrap their criminal enterprises for taking so long.
77pt77 2y ago
> I'm guessing, of the car makers out there, Tesla and Rivan are near the top since they are new and have people with security experience? From what little has been leaked, I really doubt Tesla should be enar the top.
- asynchronous 2y ago
  Tesla is amazingly good at software development practices. It’s the new Fords that are bricking themselves via updates, not Teslas.
  - AlotOfReading 2y ago
    That's not the impression I've gotten from Tesla's software. From the flash wear issue to the numerous vehicle opening issues, to the entire mess of their UDS implementation, there's quite a lot to complain about compared to a hypothetical "best practices" manufacturer, as opposed to the dumpster fire software of other OEMs.
    - zoover2020 2y ago
      It's easy to complain since they're the only manufacturer who opens up your car as an API
      - AlotOfReading 2y ago
        None of the issues I mentioned where discovered via API. The flash wear issue was discovered by bricked cars. Security researchers are pretty good at publishing about remote unlock mechanisms for all manufacturers, though Tesla's bounty program has helped. The UDS implementation issues are non user facing and were discovered by reverse engineering. Ford, as an interesting point of comparison, published a competent (if incomplete) open source UDS server.
        mdaniel 2y ago
        I wanted to say thank you, searching for that phrase[1] produced a ton of fascinating reading, including https://mpese.com/publication/uds_fuzzing/SAE_UDS_Paper.pdf https://mpese.com/publication/uds_fuzzing/SAE_UDS_Paper.pdf "Comparing Open-Source UDS Implementations Through Fuzz Testing" from Apr 2024 which itself linked to a lot of GH repos of the tools they used I didn't find the Ford one specifically, but I also didn't go surfing through the many pages of results 1: https://duckduckgo.com/?q=open+source+UDS+server&ia=web https://duckduckgo.com/?q=open+source+UDS+server&ia=web
wmf 2y ago
The sorry state of IOT security combined with V2V/V2X really worries me.
- defrost 2y ago
  The S in IoT is for Security; the P is for Privacy.
  - mnsc 2y ago
    We need to make SPIT a thing.
  - throwawayQQOWJF 2y ago
    This made me laugh hard :D I’m gonna steal this one from you - it’s quite clever IMO
    - appendix-rock 2y ago
      It’s heavily, heavily recycled. Don’t be surprised if you don’t get similar accolades!
- sulandor 2y ago
  ever tried shutting down a botnet with wheels?
  - blacksmith_tb 2y ago
    We'll just need to set an orange traffic cone on every hood, if Cruise is any indication.
AlotOfReading 2y ago
There's actually a strange tradeoff with automotive companies. Security requirements are a big forcing function driving vehicle electronics architectures to modernize and adopt similar security practices to consumer electronics, away from the traditionally developed and profoundly insecure embedded systems of yesteryear. That brings a lot of security features with secure communications, secure boot, signed updates, etc. It also means that all the exploit development that's been done on consumer electronics becomes applicable to vehicle systems. The teams maintaining all of this usually have a LOC/headcount ratio approaching 1 million too. It's a very different threat model than the old days when every manufacturer had their own systems and trying to craft an exploit required individualized work for all of them.
- dleink 2y ago
  Have any reading or publicly available resources on this?
BiteCode_dev 2y ago
Even if the companies took security seriously (which they don't since it rarely affects their bottom line, even in the event of a breach), it's one of the hardest topics in IT, and there are very few people actually competent in it. With the explosion of the number of those boxes, we added more surface of attack, but the number of good security people didn't increase.

by nox101 2y ago

MarcusE1W 2y ago

That makes me think, will we have car theft in the future where someone hacks your self driving car and it makes off on itself in the night? The next day you wake up to notice that your car has left you for someone else?

pdimitar 2y ago
Only a matter of time IMO, and quite the short one at that. Car thieves are an adaptive bunch.
dageshi 2y ago
I think this is one of the reasons (among many) why self driving cars will largely be robo taxi's. I'd trust google to maintain the security in a fleet of robo taxi's where cars can be brought in, modified or replaced relatively quickly over Tesla trying to convince individual owners to do the same...
- prmoustache 2y ago
  Only if cities remove all permanent parking space and it forces people to switch. People are too attached with property and social status stuff.
  - dageshi 2y ago
    Existing people are, in a world where your teenager has been getting self driving robo taxi's to their friends house since the age of 13 I'm not sure if they'll magically want a car when they reach the legal age to drive, hell there's people now who uber everywhere over learning to drive. Beyond that, it seems like the nature of self driving might be one of gradual incremental improvement, where in order to actually develop it you more or less have to run a fleet of robo taxi's in different places with different climates and different road conditions. Finally, the people most likely to deliver it are google (waymo) and I think they have zero desire to sell cars to consumers but are literally running a taxi service as we speak.
poikroequ 2y ago
Self driving cars aren't fully autonomous yet. They occasionally require human intervention to make decisions, which I would guess makes it difficult to steal these cars without being detected. They're constantly cloud connected and so they know where the car is at all times. I imagine these factors may deter theft of self driving cars for a while longer. Repossessing a self driving car, on the other hand...
- tzs 2y ago
  The plan when having a self driving car help you steal it would not be to have it self-drive from the owner's home in, say, San Francisco, to a chop shop in Tijuana where you gang awaits, thus requiring it to make a long trip without human intervention. It would be have it self-drive from the owner's home to someplace nearby not associated with the the thieves to get it out of sight from the owner's security cameras and whatever other security cameras in the neighborhood might be watching where the gang can disable the cloud connection and then transport it by truck or driving it in manual mode to their chop shop.

deleted 2y ago

[deleted]

Veserv 2y ago

Every company, car or otherwise, has security grossly inadequate for the current and especially the near future threat landscape. Everybody knows everything is easily hacked and companies people tout as exemplars like Apple and Microsoft just keep piling on the abject failures to prove the common wisdom true like it is going out of style. Decades of claimed success followed shortly after by failure after failure should really pound in the lesson: "Fool me once, shame on you. Fool me ten thousand times, shame on me." You need systems secure against teams commercially motivated attackers with 10 M$+ budgets and tens of full-time professionals working for years. Nobody in commercial IT would even dare to claim they could stop such attacks even though they are regular occurrences these days. If they do not even dare to say they can do it, why on Earth would anybody believe those vendors have, what, accidentally made things better than they think? Ranking companies by security is like ranking the relative resistance of individual sheets of toilet paper to bullets. Sure, maybe the single ply toilet paper is not as good as the two ply, but neither of them provide objectively useful degrees of protection. And that is just talking about the bare minimum to protect against current threats. If you can hack every Honda at rush hour to turn off the brakes, slam the accelerator, and drive slightly into oncoming traffic how many people do you think would die in the next minute before anything can be done or people informed to stop driving their cars? 1K? 10K? 100K? 1M? Does Honda survive killing more people than died in most wars? If a criminal organization demonstrates they can and will do it, how much would Honda pay in extortion to avoid being put out of existence and their executives jailed? How much security is adequate to avoid the deaths of thousands to millions? Certainly orders of magnitude more than the 10 M$ attacks that steam roll the "best commercial IT security" available today. Any reasonable number is vastly in excess of what these companies can secure today. 20 years ago, the hackers were 18 year olds demanding 300 dollars from grandmas. 10 years ago, the hackers were 28 year olds founding businesses demanding 10 thousand dollars from small businesses. Now they are 38 year olds managing teams demanding millions from billion dollar companies. Soon we will see them demanding billions if the trends continue for 5-10 more years. The software security doomsayers were right, just early. Even Mark Zuckerberg took a decade with huge piles of VC funds to get to a multi-billion dollar valuation; you have to forgive the hacking teenagers who had to bootstrap their criminal enterprises for taking so long.

77pt77 2y ago

> I'm guessing, of the car makers out there, Tesla and Rivan are near the top since they are new and have people with security experience? From what little has been leaked, I really doubt Tesla should be enar the top.

asynchronous 2y ago
Tesla is amazingly good at software development practices. It’s the new Fords that are bricking themselves via updates, not Teslas.
- AlotOfReading 2y ago
  That's not the impression I've gotten from Tesla's software. From the flash wear issue to the numerous vehicle opening issues, to the entire mess of their UDS implementation, there's quite a lot to complain about compared to a hypothetical "best practices" manufacturer, as opposed to the dumpster fire software of other OEMs.
  - zoover2020 2y ago
    It's easy to complain since they're the only manufacturer who opens up your car as an API
    - AlotOfReading 2y ago
      None of the issues I mentioned where discovered via API. The flash wear issue was discovered by bricked cars. Security researchers are pretty good at publishing about remote unlock mechanisms for all manufacturers, though Tesla's bounty program has helped. The UDS implementation issues are non user facing and were discovered by reverse engineering. Ford, as an interesting point of comparison, published a competent (if incomplete) open source UDS server.
      - mdaniel 2y ago
        I wanted to say thank you, searching for that phrase[1] produced a ton of fascinating reading, including https://mpese.com/publication/uds_fuzzing/SAE_UDS_Paper.pdf https://mpese.com/publication/uds_fuzzing/SAE_UDS_Paper.pdf "Comparing Open-Source UDS Implementations Through Fuzz Testing" from Apr 2024 which itself linked to a lot of GH repos of the tools they used I didn't find the Ford one specifically, but I also didn't go surfing through the many pages of results 1: https://duckduckgo.com/?q=open+source+UDS+server&ia=web https://duckduckgo.com/?q=open+source+UDS+server&ia=web

wmf 2y ago

The sorry state of IOT security combined with V2V/V2X really worries me.

defrost 2y ago
The S in IoT is for Security; the P is for Privacy.
- mnsc 2y ago
  We need to make SPIT a thing.
- throwawayQQOWJF 2y ago
  This made me laugh hard :D I’m gonna steal this one from you - it’s quite clever IMO
  - appendix-rock 2y ago
    It’s heavily, heavily recycled. Don’t be surprised if you don’t get similar accolades!
sulandor 2y ago
ever tried shutting down a botnet with wheels?
- blacksmith_tb 2y ago
  We'll just need to set an orange traffic cone on every hood, if Cruise is any indication.

AlotOfReading 2y ago

There's actually a strange tradeoff with automotive companies. Security requirements are a big forcing function driving vehicle electronics architectures to modernize and adopt similar security practices to consumer electronics, away from the traditionally developed and profoundly insecure embedded systems of yesteryear. That brings a lot of security features with secure communications, secure boot, signed updates, etc. It also means that all the exploit development that's been done on consumer electronics becomes applicable to vehicle systems. The teams maintaining all of this usually have a LOC/headcount ratio approaching 1 million too. It's a very different threat model than the old days when every manufacturer had their own systems and trying to craft an exploit required individualized work for all of them.

dleink 2y ago
Have any reading or publicly available resources on this?

BiteCode_dev 2y ago

Even if the companies took security seriously (which they don't since it rarely affects their bottom line, even in the event of a breach), it's one of the hardest topics in IT, and there are very few people actually competent in it. With the explosion of the number of those boxes, we added more surface of attack, but the number of good security people didn't increase.