25 ms·

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2)

Some questions for the researchers, or anyone else who thinks this was okay: 1) Were public roadways and speeds of 70mph absolutely necessary to demo this? 2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others? 3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting the researchers with questions about this demo if they weren't consulted in advance. 4) What's the plan if they trigger a bug in the car software of the people they had tested this with earlier? The article mentions them tracking people remotely as they attempt to learn more about the exploit. I could go on but why bother? In case any of you think this was cool or even remotely (no pun intended) ethical, I'd like to know if you have a problem with letting these two test this on a loved one's car. How about they remotely poke around your husband or wife's car and explore, as long as they promise not to intentionally trigger anything? If I ever learned this had been tested on a vehicle I was in, I'd make sure this cost the researchers dearly. EDIT: I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up. The fact that the vehicle was disabled where there was no shoulder, was impeding traffic, and the demo not cleared with them in advance has them concerned. I'm all for testing exploits and security research, but this isn't the right way to do it. And to film it and post it to a high traffic site is nuts.

alistairSH 11y ago
I had the same thoughts. Testing the exploits on a open highway, at full speed, strikes me as needlessly reckless. There is no excuse for this when there are plenty of lower speed locations available. They should have used a large parking lot or similar.
- callesgg 11y ago
  They are not testing it, they are showing it. Reckless yes and still probably not enough.... I believe people will need to be killed, or get their cars destroys before the rest of the population takes enough of a stance against "neglecting" security.
  - ctdonath 11y ago
    Nowhere near as reckless as missing oncoming traffic by mere feet at speed differentials exceeding 100MPH. Happens billions of times a day without anyone expressing the slightest concern. People are regularly killed and cars destroyed; the rest of the population doesn't care.
- joshuapants 11y ago
  > There is no excuse for this when there are plenty of lower speed locations available. They should have used a large parking lot or similar. At some point you probably want to test it at highway speeds. I agree that a closed course would be the only responsible option, however.
- tripletmass 11y ago
  You're officially wrong per Federal Certifications (some courtesy Jeep, some the dealer,) so that's the Safe way for researchers to have approached it; mountains and no easement would've brought it down to rules for scratch journalists (please try to recover my GoPro...) State (etc.) laws are 80% hate speech against cyclists. Not even tagged Florida; my car's entertainment system made me climb a tree and launch t-shirts at traffic, blister, etc. If they'd done it as a vetted demo in a lot that could have been a Federal lot...insert stdSecLetter, stdClearance, stdDeclarationOfInterest...meh.
marak830 11y ago
I was wondering why they wernt in constant communication(didnt he say he had to grab his phone and ask them to stop?), wjy the f*#@ would you test this at speed? I agree with you, i hope that the author was lying to make his story more interesting (hows that for a bad wish). I completly agree with you, seems to have a total disregard for anyone elses safety.
ablation 11y ago
This was my first thought. To repeat what others have said: why on earth did they do this on open roads and high speeds? I can only assume it was for additional 'shock impact' of the story. Reckless in many, many ways, no matter how interesting the story actually is. In fact it's so reckless that it actually devalues the interesting and important core of the story itself.
- yellowapple 11y ago
  > To repeat what others have said: why on earth did they do this on open roads and high speeds? Because - according to the article, at least - they'd already demonstrated similar exploits in more controlled environments, and said demonstrations were handwaved and dismissed by the auto manufacturers.
  - ablation 11y ago
    The risk still doesn't justify the supposed reward. Why not a lower speed in a quiet street if you absolutely feel you have to do this on open roads?
    - yellowapple 11y ago
      I don't disagree with you; the researchers could have taken better safety measures (most notably, better communication between themselves and the reporter would have eliminated most of the risk by allowing the reporter to cut the experiment early), and had they done so, they would have been more clearly in the right. However, there's some usefulness to the higher speed, since it indicates that the car can be isolated among highway traffic even at high speed. The researchers were also smart to not slam brakes (which would have turned the minimal danger from unpowered coasting into the maximal danger of sudden stops).
eljimmy 11y ago
There was a "documentary" of these guys when they were testing via a hardwire to the car's computers. They were also in the car with the driver as well as in a parking lot and on some non-busy country road. I wonder if the reporter just added in those details about the highway to make it seem like more of a real threat or if they actually did test on a busy public roadway. edit: Found the video - https://www.youtube.com/watch?v=oqe6S6m73Zw https://www.youtube.com/watch?v=oqe6S6m73Zw
- maxerickson 11y ago
  The Wired article has a video of the test on the busy public roadway.
  - eljimmy 11y ago
    Ahh, I skipped right over it to the text. Woopsies. :D
dsfyu404ed 11y ago
You're not gonna make the news unless the media can spin up a headline that scares people People won't pay attention until they're scared People won't demand action if they're not paying attention Nothing will happened if people don't demand action. If nothing happens the status quo (vulnerable systems) will remain. Until some bad actor (I'm sure several nations states would love that capability) gets into onStar and turns every connected vehicle (every GM made in the last 8yr or so) into a brick at an inconvenient time (rush hour on a monday). >I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up. The fact that the vehicle was disabled where there was no shoulder, was impeding traffic, and the demo not cleared with them in advance has them concerned. I'm all for testing exploits and security research, but this isn't the right way to do it. And to film it and post it to a high traffic site is nuts. I'm not sure if you're actually this dense or just trolling. What good can involving the police, after the fact, in a situation where nobody was harmed do? To clarify: If a story involving events of questionable legality, no matter how small to were hit the news the police would be obligated to investigate on some level. Think about the kind of message that "we saw it on the news but we don't think it's worth investigating" would send. By informing them before it hits the general news, one enables the "swat teams and more" knee-jerk response that the police love (if I had cool toys I'd want to play with them too) but without any media scrutiny. For example, law enforcement was plenty eager to screw the guy that "hacked and airplane" (through similar means I might add) until the story became more widespread and they had to use their discretion to act in a manner that would not reflect poorly on them. By alerting the State Police in advance they're I don't expect this to hit the news. University of IIRC Michigan (something with an M) was doing similar things at closer range (bluetooth) on a test track back in 09(?) and nobody cared. And for all the people saying they were "reckless and dangerous, etc, etc," sure, yeah, to a small extent. If they wanted to be reckless they'd have made the car go instead of stop, swapped left and right on the electronic power steering, disabled the brakes on one side or end of the car, etc, etc.
- leereeves 11y ago
  Reckless endangerment/criminal negligence is a crime even if nobody is harmed. The hackers may have crossed the line if they disabled the engine on a narrow stretch of a busy highway. It should be investigated.
geofft 11y ago
You called the cops on two security researchers and a journalist, because you disagreed with their methods and weren't sure what their plans were and what authorities they'd talked to? (And not just any cops, the cops in St. Louis, for bonus points.) Are we still on Hacker News, or is the transformation to Enablers of Traditional American Power Structure News complete?
- epochwolf 11y ago
  There's plenty of safe ways to accomplish this kind of demonstration. The fact they choose to do so in a way that endangered the public is in fact criminal. Being a security researcher or journalist doesn't give you a license to put the public in physical danger.
  - astrodust 11y ago
    I'm sure the police are even more ill-equipped to understand the ramifications of this demonstration and will over-react and start jailing anyone with a laptop and suspicious intent. I can't wait for the pathetic outrage when "racial profiling" now means harassing white kids with laptops that fit the profile of hacker. This is a matter for a company like Google to take on politically, not some beat cop in St. Louis of all places.
    - mattdotc 11y ago
      This has nothing to do with the type of test they ran and everything to do with where and how they ran it.
      - astrodust 11y ago
        I totally agree that there's a problem here, but I strongly disagree with the method of action. Why not engage the FBI? This is not an issue specific to St. Louis. Throwing some researchers in jail solves nothing. This is a way bigger deal than some local offense. You need an agency with the ability to see the bigger picture.
feld 11y ago
You better have the Highway Patrol investigate every single person who doesn't maintain their car properly and takes it on the highway because they're causing far more risk than this demo came close to creating, IMHO. Was it a stunt? Yes. Was it life threatening? Hardly. The real risk is the early 90s Civic with a torn up clutch and bald tires swerving between lanes.
- Someone1234 11y ago
  > Was it life threatening? Hardly. Uhh what? It seems you cannot go a week without reading about a pile-up on a freeway. Just last week a big-rig lost a wheel, it rolled into the on-coming lane, and drivers swerving and braking to avoid it actually caused a pile up. Stopping even on the shoulder on a freeway is considered "risky" by most police officers and many (like triple digits) have been killed while stopped in the shoulder due to vehicles drifting, failing to pay attention, or otherwise being distracted. I cannot remotely begin to fathom how anyone can think a car going 0-10 MpH on a freeway ISN'T dangerous. And it is absolutely life threatening. If a car behind didn't notice the change in speed, panicked and either hit you or the concrete barrier(s) that could very easily cost them their life. Or leave them with life-long disabilities. Bigger things like trucks and those "road-trains" are even bigger liabilities. Honestly I'll defend security research strongly in almost all contexts, but when you put people's actual lives in danger you clearly cross a line. There's no shades of gray there, endangering people's lives and health to effectively show off is absolutely immoral and should be illegal (and likely is). Saying "well nobody got hurt" completely misses the point. It is the intent that is wrong, not the result. The result could have multiplied the wrongness of the intent and resulting in tens of years of jail time, but luckily for them their only "crime" this time was the intent of their dangerous actions. And let's be frank here luck is the only reason nobody got hurt. The only reason why these two won't be in jail for many years.
  - SG- 11y ago
    ya well all they did was stall the engine, they didn't tell the car to apply the brakes.
    - 11y ago
deleted 11y ago
[deleted]
- knorby 11y ago
  So either the journalist/researchers did something highly dangerous to the reporter and others on the highway as a stunt, or the journalist has no qualms about making up details for shock value? Sounds ethical.
stevendhansen 11y ago
Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the devices that literally have the power of life and death over us. Unfortunately, this is a VERY complicated issue, and no one has a solution yet AFAIK. I watched a talk by Cory Doctorow last year where he suggested validation at the hardware level (a la trusted platform modules), but unlike the typical TPMs that only allow vendor software to be authenticated, these TPMs would allow the user to directly authenticate the firmware. If you know the firmware is good, then each layer can validate the next layer up all the way to the OS. I have yet to hear of a system that allows the user to directly authenticate software/firmware at the hardware level. Is anybody working on research of this nature? Or are there insurmountable problems with this approach?
- usefulcat 11y ago
  "A much less aggressive (and thoughtful) move would be to contact the researchers directly." Not conducting this demonstration on a public highway would also have been a much less aggressive and thoughtful move, not to mention less dangerous.
  - 1337biz 11y ago
    Finally some IT guys getting how the press works and now you want to change their story to something like "how I hacked a car in my backyard".
    - danielweber 11y ago
      It's particularly because getting big headlines is so enticing and intoxicating that research labs have review boards.
    - usefulcat 11y ago
      I understand why they did it this way, and I'm glad that this issue getting more publicity. But that does not mean that the means they chose are justified by the end of greater publicity. They simply did not have the right to endanger the other people on that road without their consent.
droopybuns 11y ago
Now there are two parties who are making poor choices about how to handle things.
aardshark 11y ago
It's not that your points are irrelevant, it's that they needlessly draw attention from the issue at hand: that the car manufacturers are being criminally negligent.
- danielweber 11y ago
  There is more than one party here who is displaying extreme neglect.
Duhveed 11y ago
I was thinking about how dangerous it was while I was reading it too, but I came away far less concerned than you I guess. The deceleration on the highway was the most worrisome, but it's not even in the ballpark of common driving hazards like distracted folks on cellphones or flying debris. A crash from such a thing is unlikely and the inconvenience is pretty minimal. Even you, the busybody who called the cops because you read an article, said "What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early..." which implies that the trucker would have been following too closely or not paying attention (or both). It's worth pointing out that the driver was aware of the situation and they didn't do anything dramatic like lock the brakes or throw the car in reverse. They chose a gentle deceleration in a stretch of road that had no shoulder to make it feel dangerous, but, on the spectrum of hazards that most drivers face every time they take the car out of the garage, this is pretty tame. The fact is, had something happened, it wouldn't have been the disabled car that was at fault. I think the researchers are in the clear, and for you to have read the article and been bothered enough to call the cops (and post the number for, presumably, the convenience of other hyper-sensitive folk who might otherwise just go back to staring at the neighbor kids from their bedroom window with their phones in their hands and 911 on their speed dial) is nuts.
- meragrin 11y ago
  They intentionally disabled a car in an area with no shoulder. They intentionally introduced a large hazard on the highway. If something happened, they would have been partly responsible. You do not just stop on the highway just because you feel like it.
- danielweber 11y ago
  > "What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early..." which implies that the trucker would have been following too closely or not paying attention (or both). Say there was a person working at a grown-up lab that deals with traffic safety. Like the University of Michigan Transportation Research Institute http://www.umtri.umich.edu/ http://www.umtri.umich.edu/ . The person wants to know what happens when someone slams on their brakes on a 70mph road. He says "don't worry, if anyone hits me, it will be their fault, because they were following too close." What do you suppose the ERB says in response?
warmwaffles 11y ago
Nice job victim blaming.
Miner49er 11y ago
I agree that they definitely took it too far and weren't being very safe, but calling the cops seems to be taking it a little too far, also. What laws were broken? Edit: Actually I've thought it about it, and they could probably be charged with reckless endangerment.
TorKlingberg 11y ago
This is the kind of completely uninteresting side discussion that people on internet forums love to get into. "Somebody did something dangerous on a road" is not a relevant topic on HN.
- danielweber 11y ago
  This is behavior that makes adults think that people calling themselves "security researchers" are bonkers and need to be legislatively controlled. Mature research labs have review boards to govern "researchers" who want to just see what happens when LSD is put in the water supply.
jimbobimbo 11y ago
While I agree with the fact that what they did was dangerous, the fact they did it that way will garner much more attention to the root cause of this problem - connected cars allow remote control of car's most basic mechanical features, which they shouldn't. Hopefully, this will result in better safety measures in car systems in the long run. Edit: They could've done it on the parking lot and the article would be put in a pile "some geeks are doing some geeky stuff" and forgotten. 70 MPH on the public highway is like a billboard with ten foot letters saying "PAY ATTENTION" in your face.
- omni 11y ago
  Murdering a family of 4 using the hack would garner even more attention. The ends don't justify the means.
  - yellowapple 11y ago
    Those particular means are unjustified. What actually happened wasn't nearly as extreme as you're indicating, and given the previous behavior of auto manufacturers to security hole demonstrations in their cars, this sort of demonstration was viewed by the researchers as the next logical step. I don't entirely agree with the methodology, but nobody was hurt, unlike what would would likely be the case should even less ethically-grounded "researchers" demonstrate similar capability - probably on a larger and more dangerous scale, mind you.
    - omni 11y ago
      Nobody was hurt because they rolled the dice and got lucky. There was a non-zero probability of injury or death that was completely unjustified.
      - yellowapple 11y ago
        It was a gradual slowdown. That "non-zero" has enough zeroes after the decimal point for Japan to send the number to Hawaii and have another go at Pearl Harbor. Worst-case scenario, somebody might've been rear-ended. Maybe a bit of whiplash. That's not great, either, but seeing as more-controlled tests by these researchers were outright ignored by auto manufacturers, your priorities have to be incredibly out of whack to villify the researchers over the auto manufacturers - who are willfully endangering hundreds of thousands, if not millions, of Americans every day - in this scenario.
runjake 11y ago
I agree: it was very poor judgment to demonstrate this on a public highway. But when I read that you actually called the authorities and encouraged others to do the same by posting the number, a certain somewhat Tao-istic scene in The Big Lebowski [1] came to mind. 1. https://www.youtube.com/watch?v=uQl5aYhkF3E https://www.youtube.com/watch?v=uQl5aYhkF3E
cousin_it 11y ago
Feynman had a nice story where he figured out a way to crack many of the safes in Los Alamos, then dutifully reported his method to some bigshot general. The general said "hmm interesting, thank you very much", and banned Feynman from entering rooms with safes or something. The safes stayed as unsafe as ever. You remind me of that general. You should be hanging out on Catch The Hacker News, not Hacker News.
- rhino369 11y ago
  Testing on uninformed humans is unethical. Wasn't hackernews just all up in arms about the US military spreading germs to test bioweapons? Isn't this the same exactly thing?
  - yellowapple 11y ago
    There's a pretty significant difference in scale between two nerds putting maybe 2 or 3 vehicles in danger of a dented bumper v. the world's largest military conducting live-fire bioweapon testing.
  - danielweber 11y ago
    There can be times when it is okay to test on uninformed humans. For example, I have relatives who do fire safety. How people do (or don't!) evacuate from buildings when fire alarms go off is a big area of research. The ideal way to test this is to set off the fire alarm in a building where people do not know it is happening, along with some smoke and pyrotechnics. HOWEVER, there are ethical concerns, and a review board would ask questions like: 1. Has anyone else done this study before? If not, why not? How sure are you that no one has done it before? 2. What does the previous research with similar protocols say? What key question are we trying to answer? 3. What is the harm that will be present to people? Are we doing everything we can do to reduce that harm? 4. What more could we do to reduce harm but that might impact the reliability of the research? 5. Quantify how much of a benefit this research would be so we can compare to the risk you are presenting. 6. Demonstrate that you have done all the preliminary work that is necessary to achieve good results, so that we can make sure that the research is used. It would be foolish to put humans at risk and then be unable to use the research because we forgot something we could have taken care of upfront. These researchers would bomb most of these questions. The reason for an INDEPENDENT review board is that researchers tend to follow this flow chart: Have idea. ----> Wait, should I do this? ----> Yes, of course!
keso_77 11y ago
Blame the messenger hey?. How about calling the cops on the company that actually put that crap tech in your car instead? To the OP: You don't have to scare me twice. I'm sporting pre 9/11 PC-hardware and now I'll be driving a pre 9/11 car. If you tell me that someone can remote control my underwear then maybe I'll have to draw the line there because I'm not buying pre 9/11 undies dammit....not yet anyway.
igorgue 11y ago
Oh man, I'd hate to be your neighbor.
tyingq 11y ago
I would put this more on the reporter. He knew full well what the plan was, and chose to put himself in the situation voluntarily. I suspect there's also a bit of embellishment going on.
seany 11y ago
Really? you called the cops? I agree that my initial thought after reading that part was "maybe this should have been done on a track", but come on. No one was hurt, time to move on.
keithnoizu 11y ago
As opposed to the alternative of someone specifically leveraging this with the intent to doreal harm? They could have gone about this in a safer manner but the person you should be upset with is the manufacturer not the person pointing out a large gaping problem.
rgacote 11y ago
Performing this test on an open highway is incredibly irresponsible behavior on all parties. This is why they have test tracks (or even sandlots). Cutting the transmission to a vehicle going 70 miles an hour on an open highway is reckless endangerment -- even if the person behind the wheel knows it is going to happen.
belorn 11y ago
The security industry has unanimous voiced their concern that remote controllable cars and kill switches is one of the worst ideas possible, and will be exploited and cost human lives. Nothing has yet to happen from that. So what should researchers do? Do nothing and keep their hand clean while waiting for the train wreck to happen? Continue in a fruitless effort to warn people on papers only other researchers reads, knowing by historical evidence that no change will come from it. Ask government for permission to do a live test, knowing that it would never be granted. Do a demo test on a demo road, knowing that neither government, industry or public would care. I don't like this either, but it seems to me as a society we only really give researchers one option and that is to do nothing and wait for the bodies to pile up.
- danielweber 11y ago
  > So what should researchers do? Do nothing There is a big world between "do nothing" and "put third-parties at risk by stalling a car on a three-lane highway with concrete barriers." Doing the right thing is often boring and takes lots of work. That's why it's called "doing the right thing" and not "doing the splashy thing" or "doing the easy thing." They already had the attention of the media. Keep on working with the media to get more and more attention. Is it hard? Then do it some more.
FlaceBook 11y ago
..."Posted from my iPhone in rush hour traffic!"
losvedir 11y ago
Wow, I'm shocked at how contentious this comment is. Count me in the "thanks for being a responsible citizen" column. I feel like there's a lot of cargo cult thinking going on here. The situation is _almost_, but not quite, like a lot of other ones where the security researcher is unreasonably blamed. For example, I could easily see some people being up in arms about announcing this exploit at Black Hat. But that's not the case here. I have a healthy fear and respect of a ton of metal flying down the road at 70mph. And this stunt, done just to generate headlines, was needlessly reckless. It could have just as easily been demoed in a private lot or something.
- yellowapple 11y ago
  > t could have just as easily been demoed in a private lot or something. It was previously demoed in parking lots and other controlled environments by these researchers, according to the article. Said demonstrations were ignored by the auto manufacturers, with some manufacturers - like Toyota - trying to claim that their systems were still "secure". The public and the manufacturers need a proper wakeup call. My fear is that even a "reckless" test like this one isn't enough of a wakeup call.
  - danielweber 11y ago
    Life is hard. Sometimes people don't pay attention. Pulling irresponsible stunts isn't an appropriate response "to make people pay the proper amount of attention." If someone had died from this stunt, the total number of deaths from remote hacking of cars would be 1. NB: I highly favor a bounty system where someone who can demonstrate the ability to take over a car without touching it gets paid lots of money, and if the company fails to fix it they get fined even more money. But "someone else is doing something bad, too" is never a good justification.
    - yellowapple 11y ago
      > If someone had died from this stunt, the total number of deaths from remote hacking of cars would be 1. If this stunt had never happened, we'd be in a position where some less-scrupulous actor would demonstrate such exploits on a much bigger scale. I can guarantee you that the total number of deaths from remote hacking of cars would be far greater than 1. If we're going to play the "OH NO THINK OF THE CHILDREN^H^H^H^H^H^H^H^HHYPOTHETICAL DEATHS" game, then let's put this into some goddamn perspective, eh? 1 v. hundreds of thousands (if not millions) that are currently vulnerable to remote hacking right this very instant. In all actuality, of course, that "1" death was highly unlikely; at most, we'd probably see a few dented bumbers and a couple grand in car repairs. Maybe somebody with whiplash.
leoc 11y ago
Let's not forget Wired's responsibility for this either. I wonder what editor Scott Dadich and owners Condé Nast have to say. OTOH, we don't know for certain that the tale of what really happened on the public highway didn't grow in the telling. EDIT: Holy moly https://twitter.com/CondeNast/status/623533074865893376 https://twitter.com/CondeNast/status/623533074865893376 .
- Gracana 11y ago
  That looks like a staged shot. Highways don't have corners like that.
  - leoc 11y ago
    It certainly doesn't seem to be from the main transmission-shutdown incident, at least. I'm much less interested in the photo than in the fact that Condé Nast corporate thought it was a good idea to proudly Tweet this article to the world.
  - Sgt_Apone 11y ago
    It's not staged, it's just a parking lot or something. It's mentioned directly in the article which it seems that most people have not even read: "They demonstrated as much on the same day as my traumatic experience on I-64; After narrowly averting death by semi-trailer, I managed to roll the lame Jeep down an exit ramp, re-engaged the transmission by turning the ignition off and on, and found an empty lot where I could safely continue the experiment. Miller and Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch."
  - deelowe 11y ago
    Did you watch the video? It's not staged. They killed the brakes (only possible below a certain speed).
deleted 11y ago
[deleted]
Phlarp 11y ago
Can you clarify exactly where the line is between what you've done here today, and an outright swatting? I'm not trying to equivocate the two, but it would seem they both exist somewhere on the same continuum of personal information and police involvement. How much do you think your decision to make this call was influenced by your perception of what law enforcement does in Europe vs. what law enforcement does here in the United States?
- kbhn 11y ago
  Outright swatting: "911, my name is <researcher name>, I live at <researcher home address>, and I'm currently holding my girlfriend hostage with a shotgun and plan on killing us both in 30 minutes." What tombrossman did: "911, I saw a video of researchers shutting down a car on a freeway in the middle of the day with little concern to public safety, can you guys investigate and make sure that nobody's life was in danger for this experiment?" I don't think there's even a tangential comparison between the two.
  - Phlarp 11y ago
    Are the police not capable of reading wired on their own? The article is quite public. I can't imagine this could be published without the relevant law enforcement agencies being aware of it on their own. In general, I would feel uncomfortable alerting a local law enforcement agency in _another country_ about something I saw on the internet, both because the premise is silly, and because not all cops are loyal public servants dedicated to protecting people. Many just like the power trip they get from having a badge and a gun to wave at us plebs.
marssaxman 11y ago
What on earth do you think you are going to accomplish that will have any positive effect whatsoever by calling the cops of all people?
pc86 11y ago
> If I ever learned this had been tested on a vehicle I was in, I'd make sure this cost the researchers dearly. That's not how civil court works, as I'm sure you're referring to filing a suit against them, for... some nebulous thing? You have to prove damages to be awarded anything in a civil court. Theoretically let's say that they tested some remote tracking on your vehicle without your consent. What then? If you can prove there was some damage to your vehicle, great, you'll be reimbursed for it. Otherwise? Content aside, the self-satisfaction and smug attitude of this comment is disgusting.
deelowe 11y ago
Thank you. This was very irresponsible. Ignore the vigilantes saying this doesn't cause harm. My family had a close friend killed on the freeway when she ran into a stalled tractor trailer and it decapitated her. We've had 2 MAJOR accidents just recently by my house (I-85 near Atlanta) due to foreign objects and/or stalled vehicles. Anyone who thinks this isn't unsafe is absolutely delusional. Any unexpected failure is hazardous on the interstate. Especially failures to the drivetrain, suspension, steering, or braking system. Beyond that, I hope everyone can agree spraying the windshield with washer-fluid and thereby completely obscuring the vision of the driver while he was traveling at 70mph is absolutely a hazard (what if the car in front had stopped for some reason).
mzs 11y ago
I would like to give some other perspective. FCA (parent co. of Jeep) have been slow about a number of safety recalls and are under increased scrutiny by NHTSA: http://www.detroitnews.com/story/business/autos/chrysler/2015/05/18/nhtsa-fiat-chrysler/27531693/ http://www.detroitnews.com/story/business/autos/chrysler/201... Here is a choice quote about the culture relating to safety at Fiat - Sergio Marchionne is CEO: >> Marchionne said in January that the auto industry may have “overreacted” to some safety issues, especially the massive air bag recalls, which may have been “overkill,” he said. << This is about the Takata recall in the news where the detonators can produce deadly shrapnel. So yes the demonstration described in this article was somewhat reckless, but the facts that FCA has not notified owners beyond a posting online about a firmware update (who checks that?), tacitly condemns security researchers' decision to publish some details in their communications with Wired, all the while stonewalling recalls - for example in Jeep vehicles where they catch fire in rear end collisions, killing occupants - that upsets me much more. In my opinion, when a company is notified of a safety or security issue, they should do all that can be done as quickly as possible, here instead FCA has once again done the minimum plus has the gall to respond in writing, "We appreciate the contributions of cybersecurity advocates to augment the industry’s understanding of potential vulnerabilities. However, we caution advocates that in the pursuit of improved public safety they not, in fact, compromise public safety." I guess I embrace hacker spirit more than anything else I considered here is what it boils down to. So I would have written to the NHTSA trying to make this yet another recall if I thought it would have done any good, but in that culture of 21%-compliance-is-acceptable, I don't think it would do a lick of good, so I won't bother. Also, I accidentally clicked on "flag" above when I wanted to click on "parent." I am sorry, that was not my intention, I just wanted to refer back to the Wired article as I was responding, and they are small and right next to each other. Ah, I notice when I refresh there is an unflag option, I have just taken that action, again sorry.
- Nadya 11y ago
  >Also, I accidentally clicked on "flag" above when I wanted to click on "parent." I am sorry, that was not my intention, I just wanted to refer back to the Wired article as I was responding, and they are small and right next to each other. There should be an "unflag" where "flag" used to be.
robinrob 11y ago
Yep, totally agree with you. Good job for phoning the police. People need to know that's not ok!
notNow 11y ago
I can't believe that you snitched on these guys and you're proud to share it with us! WoW! The guy consented to their experiment and he voluntarily engaged with them. It is not like they set him up for this. Maybe you could argue that they could have jeopardized the lives of people on the highway with their reckless behavior esp the engine shutdown stunt and I believe that they didn't exercise wise judgement in doing so but didn't they instruct the driver to switch off and back on to regain control of his vehicle and move ahead? You also claimed that they're boasting of their act by publishing this video when it was Wired that produced and made the whole report and experiment and not them. The reporter himself the subject of this experiment didn't file any report with the authorities so you come and act more royal than the king! What a mess! What was that snitching for? This is completely uncalled for. This is a knee jerk reaction from you and testament of your true character. You should be ashamed of yourself snitching on your colleagues like this and your phony outrage at this act is not fooling anyone. Grow up you are not in elementary school anymore!
tombozi 11y ago
Sure it was not a smart move but you're really overreacting.
toolsadmin 11y ago
You're garbage.
appleadam 11y ago
Well done. I agree.. there is no way they should have jeopardize safety of people who were on the road. They could have easily demo'ed it in million other ways. Kudos for the hack but shame for the demo.
rebootthesystem 11y ago
Absolutely the right thing to do. I don't care how technically gifted these people are. They are morons who deserve whatever legal consequences this might bring on. This isn't about security researchers. There's a HUGE GAP between security research and setting up a situation that could kill someone's daughter, son, mom or dad. That incredibly stupid at the least and criminal at worst. There are levels of this in tech all over. I don't know if it is about social isolation or something else. Things ranging from the kinds of privacy decisions made by people coding social networks to the totalitarian and inhumane approach seen in dealing with various large web players. It's almost like you are dealing with a non-human race (the Borg?) that is almost completely devoid of human feelings, emotion, consideration, respect, a sense of community and simply making decisions that are humane rather than cold and mechanistic. The other one is morons flying multicopters above people, neighborhoods and around firefighting aircraft. How does a human being go there mentally? I don't know. I applaud your actions. What's worst is that it is likely this was not the first time they did this.
downandout 11y ago
> I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up. The fact that the vehicle was disabled where there was no shoulder, was impeding traffic, and the demo not cleared with them in advance has them concerned. I'm all for testing exploits and security research, but this isn't the right way to do it. And to film it and post it to a high traffic site is nuts. WTF is wrong with you?
joeldg 11y ago
what a fucking retard you are
deleted 11y ago
[deleted]
sul4bh 11y ago
Real world scenario was used to gain more publicity and to get mainstream media sources attention. People get attracted to catchy titles and can relate the incident to themselves because it happened on a highway. Nobody bats an eye if the test was done on a parking lot.
joepie91_ 11y ago
Do people need to be reminded of what happens when these kind of issues are not disclosed out-of-the-blue? Well, here you go (search for 'Volkswagen'): http://attrition.org/errata/legal_threats/ http://attrition.org/errata/legal_threats/
ajnin 11y ago
Agreed, and now the headline reads more like "Hackers endanger people on public highways" instead of the more interesting (in its consequences) "Jeep cars can be taken over almost completely over an Internet connection while they are running". I'm sure this generates tons of traffic for Wired but this does not bring the necessary focus on the security issue.
alexivanovs 11y ago
Wow. You need to cry a little harder.
joe1 11y ago
Jesus, just google similar researches in 2011, which has been done in "safe environment" without naming manufacturers etc. etc. and in 2015, after 4 years we see that manufacturers did say "meh, thank you but no, we aint gonna do shit about it" How about that - "Fiat Chrysler now says that 10 vehicles from its 2013, 2014 and 2015 model years are vulnerable to hacking, including five 2013-2014 Ram truck models, the 2014 Jeep Cherokee and Grand Cherokee, the 2014 Dodge Durango and 2014 Dodge Viper, and some 2015 Chrysler 200s." and that - "Miller and his associate, Chris Valasek, director of vehicle security research at the consultancy IOActive, estimates that hundreds of thousands of Fiat Chrysler vehicles on the road today could be vulnerable. That’s unsettling." just read people! 2013 models. And now, this a hole calling police because this guys opened your eyes. Wouldn't it be better if they made "safe" test again, manufacturers ignore it AGAIN & then some sick bastard simply crashed thousand of those? And yes the main thing I like is - “Customers can either download and install this particular update themselves or, if preferred, their dealer can complete this one-time update at no cost to customers.” DOWNLOAD & INSTALL THEMSELVES? What? but yeah right blame the researches of course. "In case any of you think this was cool or even remotely (no pun intended) ethical, I'd like to know if you have a problem with letting these two test this on a loved one's car. How about they remotely poke around your husband or wife's car and explore, as long as they promise not to intentionally trigger anything?" I would certainly let this guys to check on my car and my wife's car, just to make sure that if it can be hacked then I'd better get rid of that crap and sue a holes which let me drive a car which can be controlled remotely. Cause I would rather trust ex NSA and current director of vehicle security research at the consultancy IOActive, rather than have even a 0,00001% chance that some unknown hacked crew can end my life sipping coffee in starbucks.

alistairSH 11y ago

I had the same thoughts. Testing the exploits on a open highway, at full speed, strikes me as needlessly reckless. There is no excuse for this when there are plenty of lower speed locations available. They should have used a large parking lot or similar.

callesgg 11y ago
They are not testing it, they are showing it. Reckless yes and still probably not enough.... I believe people will need to be killed, or get their cars destroys before the rest of the population takes enough of a stance against "neglecting" security.
- ctdonath 11y ago
  Nowhere near as reckless as missing oncoming traffic by mere feet at speed differentials exceeding 100MPH. Happens billions of times a day without anyone expressing the slightest concern. People are regularly killed and cars destroyed; the rest of the population doesn't care.
joshuapants 11y ago
> There is no excuse for this when there are plenty of lower speed locations available. They should have used a large parking lot or similar. At some point you probably want to test it at highway speeds. I agree that a closed course would be the only responsible option, however.
tripletmass 11y ago
You're officially wrong per Federal Certifications (some courtesy Jeep, some the dealer,) so that's the Safe way for researchers to have approached it; mountains and no easement would've brought it down to rules for scratch journalists (please try to recover my GoPro...) State (etc.) laws are 80% hate speech against cyclists. Not even tagged Florida; my car's entertainment system made me climb a tree and launch t-shirts at traffic, blister, etc. If they'd done it as a vetted demo in a lot that could have been a Federal lot...insert stdSecLetter, stdClearance, stdDeclarationOfInterest...meh.

marak830 11y ago

I was wondering why they wernt in constant communication(didnt he say he had to grab his phone and ask them to stop?), wjy the f*#@ would you test this at speed? I agree with you, i hope that the author was lying to make his story more interesting (hows that for a bad wish). I completly agree with you, seems to have a total disregard for anyone elses safety.

ablation 11y ago

This was my first thought. To repeat what others have said: why on earth did they do this on open roads and high speeds? I can only assume it was for additional 'shock impact' of the story. Reckless in many, many ways, no matter how interesting the story actually is. In fact it's so reckless that it actually devalues the interesting and important core of the story itself.

yellowapple 11y ago
> To repeat what others have said: why on earth did they do this on open roads and high speeds? Because - according to the article, at least - they'd already demonstrated similar exploits in more controlled environments, and said demonstrations were handwaved and dismissed by the auto manufacturers.
- ablation 11y ago
  The risk still doesn't justify the supposed reward. Why not a lower speed in a quiet street if you absolutely feel you have to do this on open roads?
  - yellowapple 11y ago
    I don't disagree with you; the researchers could have taken better safety measures (most notably, better communication between themselves and the reporter would have eliminated most of the risk by allowing the reporter to cut the experiment early), and had they done so, they would have been more clearly in the right. However, there's some usefulness to the higher speed, since it indicates that the car can be isolated among highway traffic even at high speed. The researchers were also smart to not slam brakes (which would have turned the minimal danger from unpowered coasting into the maximal danger of sudden stops).

eljimmy 11y ago

There was a "documentary" of these guys when they were testing via a hardwire to the car's computers. They were also in the car with the driver as well as in a parking lot and on some non-busy country road. I wonder if the reporter just added in those details about the highway to make it seem like more of a real threat or if they actually did test on a busy public roadway. edit: Found the video - https://www.youtube.com/watch?v=oqe6S6m73Zw https://www.youtube.com/watch?v=oqe6S6m73Zw

maxerickson 11y ago
The Wired article has a video of the test on the busy public roadway.
- eljimmy 11y ago
  Ahh, I skipped right over it to the text. Woopsies. :D

dsfyu404ed 11y ago

You're not gonna make the news unless the media can spin up a headline that scares people People won't pay attention until they're scared People won't demand action if they're not paying attention Nothing will happened if people don't demand action. If nothing happens the status quo (vulnerable systems) will remain. Until some bad actor (I'm sure several nations states would love that capability) gets into onStar and turns every connected vehicle (every GM made in the last 8yr or so) into a brick at an inconvenient time (rush hour on a monday). >I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up. The fact that the vehicle was disabled where there was no shoulder, was impeding traffic, and the demo not cleared with them in advance has them concerned. I'm all for testing exploits and security research, but this isn't the right way to do it. And to film it and post it to a high traffic site is nuts. I'm not sure if you're actually this dense or just trolling. What good can involving the police, after the fact, in a situation where nobody was harmed do? To clarify: If a story involving events of questionable legality, no matter how small to were hit the news the police would be obligated to investigate on some level. Think about the kind of message that "we saw it on the news but we don't think it's worth investigating" would send. By informing them before it hits the general news, one enables the "swat teams and more" knee-jerk response that the police love (if I had cool toys I'd want to play with them too) but without any media scrutiny. For example, law enforcement was plenty eager to screw the guy that "hacked and airplane" (through similar means I might add) until the story became more widespread and they had to use their discretion to act in a manner that would not reflect poorly on them. By alerting the State Police in advance they're I don't expect this to hit the news. University of IIRC Michigan (something with an M) was doing similar things at closer range (bluetooth) on a test track back in 09(?) and nobody cared. And for all the people saying they were "reckless and dangerous, etc, etc," sure, yeah, to a small extent. If they wanted to be reckless they'd have made the car go instead of stop, swapped left and right on the electronic power steering, disabled the brakes on one side or end of the car, etc, etc.

leereeves 11y ago
Reckless endangerment/criminal negligence is a crime even if nobody is harmed. The hackers may have crossed the line if they disabled the engine on a narrow stretch of a busy highway. It should be investigated.

geofft 11y ago

You called the cops on two security researchers and a journalist, because you disagreed with their methods and weren't sure what their plans were and what authorities they'd talked to? (And not just any cops, the cops in St. Louis, for bonus points.) Are we still on Hacker News, or is the transformation to Enablers of Traditional American Power Structure News complete?

epochwolf 11y ago
There's plenty of safe ways to accomplish this kind of demonstration. The fact they choose to do so in a way that endangered the public is in fact criminal. Being a security researcher or journalist doesn't give you a license to put the public in physical danger.
- astrodust 11y ago
  I'm sure the police are even more ill-equipped to understand the ramifications of this demonstration and will over-react and start jailing anyone with a laptop and suspicious intent. I can't wait for the pathetic outrage when "racial profiling" now means harassing white kids with laptops that fit the profile of hacker. This is a matter for a company like Google to take on politically, not some beat cop in St. Louis of all places.
  - mattdotc 11y ago
    This has nothing to do with the type of test they ran and everything to do with where and how they ran it.
    - astrodust 11y ago
      I totally agree that there's a problem here, but I strongly disagree with the method of action. Why not engage the FBI? This is not an issue specific to St. Louis. Throwing some researchers in jail solves nothing. This is a way bigger deal than some local offense. You need an agency with the ability to see the bigger picture.

feld 11y ago

You better have the Highway Patrol investigate every single person who doesn't maintain their car properly and takes it on the highway because they're causing far more risk than this demo came close to creating, IMHO. Was it a stunt? Yes. Was it life threatening? Hardly. The real risk is the early 90s Civic with a torn up clutch and bald tires swerving between lanes.

Someone1234 11y ago
> Was it life threatening? Hardly. Uhh what? It seems you cannot go a week without reading about a pile-up on a freeway. Just last week a big-rig lost a wheel, it rolled into the on-coming lane, and drivers swerving and braking to avoid it actually caused a pile up. Stopping even on the shoulder on a freeway is considered "risky" by most police officers and many (like triple digits) have been killed while stopped in the shoulder due to vehicles drifting, failing to pay attention, or otherwise being distracted. I cannot remotely begin to fathom how anyone can think a car going 0-10 MpH on a freeway ISN'T dangerous. And it is absolutely life threatening. If a car behind didn't notice the change in speed, panicked and either hit you or the concrete barrier(s) that could very easily cost them their life. Or leave them with life-long disabilities. Bigger things like trucks and those "road-trains" are even bigger liabilities. Honestly I'll defend security research strongly in almost all contexts, but when you put people's actual lives in danger you clearly cross a line. There's no shades of gray there, endangering people's lives and health to effectively show off is absolutely immoral and should be illegal (and likely is). Saying "well nobody got hurt" completely misses the point. It is the intent that is wrong, not the result. The result could have multiplied the wrongness of the intent and resulting in tens of years of jail time, but luckily for them their only "crime" this time was the intent of their dangerous actions. And let's be frank here luck is the only reason nobody got hurt. The only reason why these two won't be in jail for many years.
- SG- 11y ago
  ya well all they did was stall the engine, they didn't tell the car to apply the brakes.
  - 11y ago

deleted 11y ago

[deleted]

knorby 11y ago
So either the journalist/researchers did something highly dangerous to the reporter and others on the highway as a stunt, or the journalist has no qualms about making up details for shock value? Sounds ethical.

stevendhansen 11y ago

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the devices that literally have the power of life and death over us. Unfortunately, this is a VERY complicated issue, and no one has a solution yet AFAIK. I watched a talk by Cory Doctorow last year where he suggested validation at the hardware level (a la trusted platform modules), but unlike the typical TPMs that only allow vendor software to be authenticated, these TPMs would allow the user to directly authenticate the firmware. If you know the firmware is good, then each layer can validate the next layer up all the way to the OS. I have yet to hear of a system that allows the user to directly authenticate software/firmware at the hardware level. Is anybody working on research of this nature? Or are there insurmountable problems with this approach?

usefulcat 11y ago
"A much less aggressive (and thoughtful) move would be to contact the researchers directly." Not conducting this demonstration on a public highway would also have been a much less aggressive and thoughtful move, not to mention less dangerous.
- 1337biz 11y ago
  Finally some IT guys getting how the press works and now you want to change their story to something like "how I hacked a car in my backyard".
  - danielweber 11y ago
    It's particularly because getting big headlines is so enticing and intoxicating that research labs have review boards.
  - usefulcat 11y ago
    I understand why they did it this way, and I'm glad that this issue getting more publicity. But that does not mean that the means they chose are justified by the end of greater publicity. They simply did not have the right to endanger the other people on that road without their consent.

droopybuns 11y ago

Now there are two parties who are making poor choices about how to handle things.

aardshark 11y ago

It's not that your points are irrelevant, it's that they needlessly draw attention from the issue at hand: that the car manufacturers are being criminally negligent.

danielweber 11y ago
There is more than one party here who is displaying extreme neglect.

Duhveed 11y ago

I was thinking about how dangerous it was while I was reading it too, but I came away far less concerned than you I guess. The deceleration on the highway was the most worrisome, but it's not even in the ballpark of common driving hazards like distracted folks on cellphones or flying debris. A crash from such a thing is unlikely and the inconvenience is pretty minimal. Even you, the busybody who called the cops because you read an article, said "What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early..." which implies that the trucker would have been following too closely or not paying attention (or both). It's worth pointing out that the driver was aware of the situation and they didn't do anything dramatic like lock the brakes or throw the car in reverse. They chose a gentle deceleration in a stretch of road that had no shoulder to make it feel dangerous, but, on the spectrum of hazards that most drivers face every time they take the car out of the garage, this is pretty tame. The fact is, had something happened, it wouldn't have been the disabled car that was at fault. I think the researchers are in the clear, and for you to have read the article and been bothered enough to call the cops (and post the number for, presumably, the convenience of other hyper-sensitive folk who might otherwise just go back to staring at the neighbor kids from their bedroom window with their phones in their hands and 911 on their speed dial) is nuts.

meragrin 11y ago
They intentionally disabled a car in an area with no shoulder. They intentionally introduced a large hazard on the highway. If something happened, they would have been partly responsible. You do not just stop on the highway just because you feel like it.
danielweber 11y ago
> "What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early..." which implies that the trucker would have been following too closely or not paying attention (or both). Say there was a person working at a grown-up lab that deals with traffic safety. Like the University of Michigan Transportation Research Institute http://www.umtri.umich.edu/ http://www.umtri.umich.edu/ . The person wants to know what happens when someone slams on their brakes on a 70mph road. He says "don't worry, if anyone hits me, it will be their fault, because they were following too close." What do you suppose the ERB says in response?

warmwaffles 11y ago

Nice job victim blaming.

Miner49er 11y ago

I agree that they definitely took it too far and weren't being very safe, but calling the cops seems to be taking it a little too far, also. What laws were broken? Edit: Actually I've thought it about it, and they could probably be charged with reckless endangerment.

TorKlingberg 11y ago

This is the kind of completely uninteresting side discussion that people on internet forums love to get into. "Somebody did something dangerous on a road" is not a relevant topic on HN.

danielweber 11y ago
This is behavior that makes adults think that people calling themselves "security researchers" are bonkers and need to be legislatively controlled. Mature research labs have review boards to govern "researchers" who want to just see what happens when LSD is put in the water supply.

jimbobimbo 11y ago

While I agree with the fact that what they did was dangerous, the fact they did it that way will garner much more attention to the root cause of this problem - connected cars allow remote control of car's most basic mechanical features, which they shouldn't. Hopefully, this will result in better safety measures in car systems in the long run. Edit: They could've done it on the parking lot and the article would be put in a pile "some geeks are doing some geeky stuff" and forgotten. 70 MPH on the public highway is like a billboard with ten foot letters saying "PAY ATTENTION" in your face.

omni 11y ago
Murdering a family of 4 using the hack would garner even more attention. The ends don't justify the means.
- yellowapple 11y ago
  Those particular means are unjustified. What actually happened wasn't nearly as extreme as you're indicating, and given the previous behavior of auto manufacturers to security hole demonstrations in their cars, this sort of demonstration was viewed by the researchers as the next logical step. I don't entirely agree with the methodology, but nobody was hurt, unlike what would would likely be the case should even less ethically-grounded "researchers" demonstrate similar capability - probably on a larger and more dangerous scale, mind you.
  - omni 11y ago
    Nobody was hurt because they rolled the dice and got lucky. There was a non-zero probability of injury or death that was completely unjustified.
    - yellowapple 11y ago
      It was a gradual slowdown. That "non-zero" has enough zeroes after the decimal point for Japan to send the number to Hawaii and have another go at Pearl Harbor. Worst-case scenario, somebody might've been rear-ended. Maybe a bit of whiplash. That's not great, either, but seeing as more-controlled tests by these researchers were outright ignored by auto manufacturers, your priorities have to be incredibly out of whack to villify the researchers over the auto manufacturers - who are willfully endangering hundreds of thousands, if not millions, of Americans every day - in this scenario.

runjake 11y ago

I agree: it was very poor judgment to demonstrate this on a public highway. But when I read that you actually called the authorities and encouraged others to do the same by posting the number, a certain somewhat Tao-istic scene in The Big Lebowski [1] came to mind. 1. https://www.youtube.com/watch?v=uQl5aYhkF3E https://www.youtube.com/watch?v=uQl5aYhkF3E

cousin_it 11y ago

Feynman had a nice story where he figured out a way to crack many of the safes in Los Alamos, then dutifully reported his method to some bigshot general. The general said "hmm interesting, thank you very much", and banned Feynman from entering rooms with safes or something. The safes stayed as unsafe as ever. You remind me of that general. You should be hanging out on Catch The Hacker News, not Hacker News.

rhino369 11y ago
Testing on uninformed humans is unethical. Wasn't hackernews just all up in arms about the US military spreading germs to test bioweapons? Isn't this the same exactly thing?
- yellowapple 11y ago
  There's a pretty significant difference in scale between two nerds putting maybe 2 or 3 vehicles in danger of a dented bumper v. the world's largest military conducting live-fire bioweapon testing.
- danielweber 11y ago
  There can be times when it is okay to test on uninformed humans. For example, I have relatives who do fire safety. How people do (or don't!) evacuate from buildings when fire alarms go off is a big area of research. The ideal way to test this is to set off the fire alarm in a building where people do not know it is happening, along with some smoke and pyrotechnics. HOWEVER, there are ethical concerns, and a review board would ask questions like: 1. Has anyone else done this study before? If not, why not? How sure are you that no one has done it before? 2. What does the previous research with similar protocols say? What key question are we trying to answer? 3. What is the harm that will be present to people? Are we doing everything we can do to reduce that harm? 4. What more could we do to reduce harm but that might impact the reliability of the research? 5. Quantify how much of a benefit this research would be so we can compare to the risk you are presenting. 6. Demonstrate that you have done all the preliminary work that is necessary to achieve good results, so that we can make sure that the research is used. It would be foolish to put humans at risk and then be unable to use the research because we forgot something we could have taken care of upfront. These researchers would bomb most of these questions. The reason for an INDEPENDENT review board is that researchers tend to follow this flow chart: Have idea. ----> Wait, should I do this? ----> Yes, of course!

keso_77 11y ago

Blame the messenger hey?. How about calling the cops on the company that actually put that crap tech in your car instead? To the OP: You don't have to scare me twice. I'm sporting pre 9/11 PC-hardware and now I'll be driving a pre 9/11 car. If you tell me that someone can remote control my underwear then maybe I'll have to draw the line there because I'm not buying pre 9/11 undies dammit....not yet anyway.

igorgue 11y ago

Oh man, I'd hate to be your neighbor.

tyingq 11y ago

I would put this more on the reporter. He knew full well what the plan was, and chose to put himself in the situation voluntarily. I suspect there's also a bit of embellishment going on.

seany 11y ago

Really? you called the cops? I agree that my initial thought after reading that part was "maybe this should have been done on a track", but come on. No one was hurt, time to move on.

keithnoizu 11y ago

As opposed to the alternative of someone specifically leveraging this with the intent to doreal harm? They could have gone about this in a safer manner but the person you should be upset with is the manufacturer not the person pointing out a large gaping problem.

rgacote 11y ago

Performing this test on an open highway is incredibly irresponsible behavior on all parties. This is why they have test tracks (or even sandlots). Cutting the transmission to a vehicle going 70 miles an hour on an open highway is reckless endangerment -- even if the person behind the wheel knows it is going to happen.

belorn 11y ago

The security industry has unanimous voiced their concern that remote controllable cars and kill switches is one of the worst ideas possible, and will be exploited and cost human lives. Nothing has yet to happen from that. So what should researchers do? Do nothing and keep their hand clean while waiting for the train wreck to happen? Continue in a fruitless effort to warn people on papers only other researchers reads, knowing by historical evidence that no change will come from it. Ask government for permission to do a live test, knowing that it would never be granted. Do a demo test on a demo road, knowing that neither government, industry or public would care. I don't like this either, but it seems to me as a society we only really give researchers one option and that is to do nothing and wait for the bodies to pile up.

danielweber 11y ago
> So what should researchers do? Do nothing There is a big world between "do nothing" and "put third-parties at risk by stalling a car on a three-lane highway with concrete barriers." Doing the right thing is often boring and takes lots of work. That's why it's called "doing the right thing" and not "doing the splashy thing" or "doing the easy thing." They already had the attention of the media. Keep on working with the media to get more and more attention. Is it hard? Then do it some more.

FlaceBook 11y ago

..."Posted from my iPhone in rush hour traffic!"

losvedir 11y ago

Wow, I'm shocked at how contentious this comment is. Count me in the "thanks for being a responsible citizen" column. I feel like there's a lot of cargo cult thinking going on here. The situation is _almost_, but not quite, like a lot of other ones where the security researcher is unreasonably blamed. For example, I could easily see some people being up in arms about announcing this exploit at Black Hat. But that's not the case here. I have a healthy fear and respect of a ton of metal flying down the road at 70mph. And this stunt, done just to generate headlines, was needlessly reckless. It could have just as easily been demoed in a private lot or something.

yellowapple 11y ago
> t could have just as easily been demoed in a private lot or something. It was previously demoed in parking lots and other controlled environments by these researchers, according to the article. Said demonstrations were ignored by the auto manufacturers, with some manufacturers - like Toyota - trying to claim that their systems were still "secure". The public and the manufacturers need a proper wakeup call. My fear is that even a "reckless" test like this one isn't enough of a wakeup call.
- danielweber 11y ago
  Life is hard. Sometimes people don't pay attention. Pulling irresponsible stunts isn't an appropriate response "to make people pay the proper amount of attention." If someone had died from this stunt, the total number of deaths from remote hacking of cars would be 1. NB: I highly favor a bounty system where someone who can demonstrate the ability to take over a car without touching it gets paid lots of money, and if the company fails to fix it they get fined even more money. But "someone else is doing something bad, too" is never a good justification.
  - yellowapple 11y ago
    > If someone had died from this stunt, the total number of deaths from remote hacking of cars would be 1. If this stunt had never happened, we'd be in a position where some less-scrupulous actor would demonstrate such exploits on a much bigger scale. I can guarantee you that the total number of deaths from remote hacking of cars would be far greater than 1. If we're going to play the "OH NO THINK OF THE CHILDREN^H^H^H^H^H^H^H^HHYPOTHETICAL DEATHS" game, then let's put this into some goddamn perspective, eh? 1 v. hundreds of thousands (if not millions) that are currently vulnerable to remote hacking right this very instant. In all actuality, of course, that "1" death was highly unlikely; at most, we'd probably see a few dented bumbers and a couple grand in car repairs. Maybe somebody with whiplash.

leoc 11y ago

Let's not forget Wired's responsibility for this either. I wonder what editor Scott Dadich and owners Condé Nast have to say. OTOH, we don't know for certain that the tale of what really happened on the public highway didn't grow in the telling. EDIT: Holy moly https://twitter.com/CondeNast/status/623533074865893376 https://twitter.com/CondeNast/status/623533074865893376 .

Gracana 11y ago
That looks like a staged shot. Highways don't have corners like that.
- leoc 11y ago
  It certainly doesn't seem to be from the main transmission-shutdown incident, at least. I'm much less interested in the photo than in the fact that Condé Nast corporate thought it was a good idea to proudly Tweet this article to the world.
- Sgt_Apone 11y ago
  It's not staged, it's just a parking lot or something. It's mentioned directly in the article which it seems that most people have not even read: "They demonstrated as much on the same day as my traumatic experience on I-64; After narrowly averting death by semi-trailer, I managed to roll the lame Jeep down an exit ramp, re-engaged the transmission by turning the ignition off and on, and found an empty lot where I could safely continue the experiment. Miller and Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch."
- deelowe 11y ago
  Did you watch the video? It's not staged. They killed the brakes (only possible below a certain speed).

deleted 11y ago

[deleted]

Phlarp 11y ago

Can you clarify exactly where the line is between what you've done here today, and an outright swatting? I'm not trying to equivocate the two, but it would seem they both exist somewhere on the same continuum of personal information and police involvement. How much do you think your decision to make this call was influenced by your perception of what law enforcement does in Europe vs. what law enforcement does here in the United States?

kbhn 11y ago
Outright swatting: "911, my name is <researcher name>, I live at <researcher home address>, and I'm currently holding my girlfriend hostage with a shotgun and plan on killing us both in 30 minutes." What tombrossman did: "911, I saw a video of researchers shutting down a car on a freeway in the middle of the day with little concern to public safety, can you guys investigate and make sure that nobody's life was in danger for this experiment?" I don't think there's even a tangential comparison between the two.
- Phlarp 11y ago
  Are the police not capable of reading wired on their own? The article is quite public. I can't imagine this could be published without the relevant law enforcement agencies being aware of it on their own. In general, I would feel uncomfortable alerting a local law enforcement agency in _another country_ about something I saw on the internet, both because the premise is silly, and because not all cops are loyal public servants dedicated to protecting people. Many just like the power trip they get from having a badge and a gun to wave at us plebs.

marssaxman 11y ago

What on earth do you think you are going to accomplish that will have any positive effect whatsoever by calling the cops of all people?

pc86 11y ago

> If I ever learned this had been tested on a vehicle I was in, I'd make sure this cost the researchers dearly. That's not how civil court works, as I'm sure you're referring to filing a suit against them, for... some nebulous thing? You have to prove damages to be awarded anything in a civil court. Theoretically let's say that they tested some remote tracking on your vehicle without your consent. What then? If you can prove there was some damage to your vehicle, great, you'll be reimbursed for it. Otherwise? Content aside, the self-satisfaction and smug attitude of this comment is disgusting.

deelowe 11y ago

Thank you. This was very irresponsible. Ignore the vigilantes saying this doesn't cause harm. My family had a close friend killed on the freeway when she ran into a stalled tractor trailer and it decapitated her. We've had 2 MAJOR accidents just recently by my house (I-85 near Atlanta) due to foreign objects and/or stalled vehicles. Anyone who thinks this isn't unsafe is absolutely delusional. Any unexpected failure is hazardous on the interstate. Especially failures to the drivetrain, suspension, steering, or braking system. Beyond that, I hope everyone can agree spraying the windshield with washer-fluid and thereby completely obscuring the vision of the driver while he was traveling at 70mph is absolutely a hazard (what if the car in front had stopped for some reason).

mzs 11y ago

I would like to give some other perspective. FCA (parent co. of Jeep) have been slow about a number of safety recalls and are under increased scrutiny by NHTSA: http://www.detroitnews.com/story/business/autos/chrysler/2015/05/18/nhtsa-fiat-chrysler/27531693/ http://www.detroitnews.com/story/business/autos/chrysler/201... Here is a choice quote about the culture relating to safety at Fiat - Sergio Marchionne is CEO: >> Marchionne said in January that the auto industry may have “overreacted” to some safety issues, especially the massive air bag recalls, which may have been “overkill,” he said. << This is about the Takata recall in the news where the detonators can produce deadly shrapnel. So yes the demonstration described in this article was somewhat reckless, but the facts that FCA has not notified owners beyond a posting online about a firmware update (who checks that?), tacitly condemns security researchers' decision to publish some details in their communications with Wired, all the while stonewalling recalls - for example in Jeep vehicles where they catch fire in rear end collisions, killing occupants - that upsets me much more. In my opinion, when a company is notified of a safety or security issue, they should do all that can be done as quickly as possible, here instead FCA has once again done the minimum plus has the gall to respond in writing, "We appreciate the contributions of cybersecurity advocates to augment the industry’s understanding of potential vulnerabilities. However, we caution advocates that in the pursuit of improved public safety they not, in fact, compromise public safety." I guess I embrace hacker spirit more than anything else I considered here is what it boils down to. So I would have written to the NHTSA trying to make this yet another recall if I thought it would have done any good, but in that culture of 21%-compliance-is-acceptable, I don't think it would do a lick of good, so I won't bother. Also, I accidentally clicked on "flag" above when I wanted to click on "parent." I am sorry, that was not my intention, I just wanted to refer back to the Wired article as I was responding, and they are small and right next to each other. Ah, I notice when I refresh there is an unflag option, I have just taken that action, again sorry.

Nadya 11y ago
>Also, I accidentally clicked on "flag" above when I wanted to click on "parent." I am sorry, that was not my intention, I just wanted to refer back to the Wired article as I was responding, and they are small and right next to each other. There should be an "unflag" where "flag" used to be.

robinrob 11y ago

Yep, totally agree with you. Good job for phoning the police. People need to know that's not ok!

notNow 11y ago

I can't believe that you snitched on these guys and you're proud to share it with us! WoW! The guy consented to their experiment and he voluntarily engaged with them. It is not like they set him up for this. Maybe you could argue that they could have jeopardized the lives of people on the highway with their reckless behavior esp the engine shutdown stunt and I believe that they didn't exercise wise judgement in doing so but didn't they instruct the driver to switch off and back on to regain control of his vehicle and move ahead? You also claimed that they're boasting of their act by publishing this video when it was Wired that produced and made the whole report and experiment and not them. The reporter himself the subject of this experiment didn't file any report with the authorities so you come and act more royal than the king! What a mess! What was that snitching for? This is completely uncalled for. This is a knee jerk reaction from you and testament of your true character. You should be ashamed of yourself snitching on your colleagues like this and your phony outrage at this act is not fooling anyone. Grow up you are not in elementary school anymore!

tombozi 11y ago

Sure it was not a smart move but you're really overreacting.

toolsadmin 11y ago

You're garbage.

appleadam 11y ago

Well done. I agree.. there is no way they should have jeopardize safety of people who were on the road. They could have easily demo'ed it in million other ways. Kudos for the hack but shame for the demo.

rebootthesystem 11y ago

Absolutely the right thing to do. I don't care how technically gifted these people are. They are morons who deserve whatever legal consequences this might bring on. This isn't about security researchers. There's a HUGE GAP between security research and setting up a situation that could kill someone's daughter, son, mom or dad. That incredibly stupid at the least and criminal at worst. There are levels of this in tech all over. I don't know if it is about social isolation or something else. Things ranging from the kinds of privacy decisions made by people coding social networks to the totalitarian and inhumane approach seen in dealing with various large web players. It's almost like you are dealing with a non-human race (the Borg?) that is almost completely devoid of human feelings, emotion, consideration, respect, a sense of community and simply making decisions that are humane rather than cold and mechanistic. The other one is morons flying multicopters above people, neighborhoods and around firefighting aircraft. How does a human being go there mentally? I don't know. I applaud your actions. What's worst is that it is likely this was not the first time they did this.

downandout 11y ago

> I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up. The fact that the vehicle was disabled where there was no shoulder, was impeding traffic, and the demo not cleared with them in advance has them concerned. I'm all for testing exploits and security research, but this isn't the right way to do it. And to film it and post it to a high traffic site is nuts. WTF is wrong with you?

joeldg 11y ago

what a fucking retard you are

deleted 11y ago

[deleted]

sul4bh 11y ago

Real world scenario was used to gain more publicity and to get mainstream media sources attention. People get attracted to catchy titles and can relate the incident to themselves because it happened on a highway. Nobody bats an eye if the test was done on a parking lot.

joepie91_ 11y ago

Do people need to be reminded of what happens when these kind of issues are not disclosed out-of-the-blue? Well, here you go (search for 'Volkswagen'): http://attrition.org/errata/legal_threats/ http://attrition.org/errata/legal_threats/

ajnin 11y ago

Agreed, and now the headline reads more like "Hackers endanger people on public highways" instead of the more interesting (in its consequences) "Jeep cars can be taken over almost completely over an Internet connection while they are running". I'm sure this generates tons of traffic for Wired but this does not bring the necessary focus on the security issue.

alexivanovs 11y ago

Wow. You need to cry a little harder.

joe1 11y ago

Jesus, just google similar researches in 2011, which has been done in "safe environment" without naming manufacturers etc. etc. and in 2015, after 4 years we see that manufacturers did say "meh, thank you but no, we aint gonna do shit about it" How about that - "Fiat Chrysler now says that 10 vehicles from its 2013, 2014 and 2015 model years are vulnerable to hacking, including five 2013-2014 Ram truck models, the 2014 Jeep Cherokee and Grand Cherokee, the 2014 Dodge Durango and 2014 Dodge Viper, and some 2015 Chrysler 200s." and that - "Miller and his associate, Chris Valasek, director of vehicle security research at the consultancy IOActive, estimates that hundreds of thousands of Fiat Chrysler vehicles on the road today could be vulnerable. That’s unsettling." just read people! 2013 models. And now, this a hole calling police because this guys opened your eyes. Wouldn't it be better if they made "safe" test again, manufacturers ignore it AGAIN & then some sick bastard simply crashed thousand of those? And yes the main thing I like is - “Customers can either download and install this particular update themselves or, if preferred, their dealer can complete this one-time update at no cost to customers.” DOWNLOAD & INSTALL THEMSELVES? What? but yeah right blame the researches of course. "In case any of you think this was cool or even remotely (no pun intended) ethical, I'd like to know if you have a problem with letting these two test this on a loved one's car. How about they remotely poke around your husband or wife's car and explore, as long as they promise not to intentionally trigger anything?" I would certainly let this guys to check on my car and my wife's car, just to make sure that if it can be hacked then I'd better get rid of that crap and sue a holes which let me drive a car which can be controlled remotely. Cause I would rather trust ex NSA and current director of vehicle security research at the consultancy IOActive, rather than have even a 0,00001% chance that some unknown hacked crew can end my life sipping coffee in starbucks.