32 ms·

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move woul

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the devices that literally have the power of life and death over us. Unfortunately, this is a VERY complicated issue, and no one has a solution yet AFAIK. I watched a talk by Cory Doctorow last year where he suggested validation at the hardware level (a la trusted platform modules), but unlike the typical TPMs that only allow vendor software to be authenticated, these TPMs would allow the user to directly authenticate the firmware. If you know the firmware is good, then each layer can validate the next layer up all the way to the OS. I have yet to hear of a system that allows the user to directly authenticate software/firmware at the hardware level. Is anybody working on research of this nature? Or are there insurmountable problems with this approach?

usefulcat 11y ago
"A much less aggressive (and thoughtful) move would be to contact the researchers directly." Not conducting this demonstration on a public highway would also have been a much less aggressive and thoughtful move, not to mention less dangerous.
- 1337biz 11y ago
  Finally some IT guys getting how the press works and now you want to change their story to something like "how I hacked a car in my backyard".
  - danielweber 11y ago
    It's particularly because getting big headlines is so enticing and intoxicating that research labs have review boards.
  - usefulcat 11y ago
    I understand why they did it this way, and I'm glad that this issue getting more publicity. But that does not mean that the means they chose are justified by the end of greater publicity. They simply did not have the right to endanger the other people on that road without their consent.
brandon272 11y ago
> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Reminds me of people who will call the police on a loud neighbor instead of just, you know, talking to them first.
- meragrin 11y ago
  This isn't just a loud neighbor. This was a drunk loud neighbor waving a loaded gun around. The driver was clearly distressed and they were just laughing it up.
  - brandon272 11y ago
    No, these are knowledgable security researchers doing serious work who are probably amenable to discussing their research methods with concerned party via email or phone instead of the concerned party immediately phoning the police.
    - emerongi 11y ago
      Doesn't matter who they are. They have a loaded gun in their hands. Use it somewhere private or not at all. Anything else is unacceptable and extremely dangerous.
      - brandon272 11y ago
        Well, let's just have these guys arrested for marauding around the freeways with a "loaded gun" and we'll let the Russian hackers figure out the Cherokee's vulnerabilities.
      - deleted 11y ago
        [deleted]
    - scrumper 11y ago
      I don't agree. They breached their own covenant, which doesn't afford them the benefit of the doubt you might assign to 'knowledgeable researchers doing serious work': "We won't do anything life threatening." Then they did precisely that: they disabled the transmission on an uphill freeway ramp with no shoulder, with a very large truck bearing down on the Jeep. Trucks cannot stop quickly. Substantial danger for the driver, the trucker, and everyone around them.
danielweber 11y ago
I don't know where the threshold is, but calling yourself a "security researcher" is not a blank slate to do whatever you want. I think it's 100% OK to test on a private car on a private track.
- stillsut 11y ago
  Had my car stall on the highway once. Pretty scary because you lose power-brakes and power-steering as you're trying to pullover. Was it a hacker? Nope, just a dumb mechanic that got trash deep into the air intake during a routine oil change. How many (dumb mechanics)*(routine oil changes) are there in this country? Five-Six orders of magnitude more than auto hackers, which is why I don't see any harm in one more (where the driver knew ahead of time it was going to happen).
  - danielweber 11y ago
    Cars aren't toys. Just because there are many stalls doesn't mean adding one more becomes acceptable. Here's the good test: since humans were involved, how did they present this to their ethical review board? I'm pretty confident the answer would be "what's an ethical review board?".
    - marxmarv 11y ago
      DARPA don't need no ethics board.
  - mattdotc 11y ago
    The difference is your 'dumb mechanic' made an unintentional mistake. These people, on the other hand, knowingly and deliberately disabled a car on a highway. Yes, they had a plan, but they are still running their little experiment on other unwitting drivers on the highway. I don't consider the manner in which they ran their test to be ethical; it should have been performed on a closed track.
  - aptwebapps 11y ago
    The fact that the driver knew ahead of time does mitigate the danger but does not excuse the remaining danger. The fact that there are already lots of dangerous stalls seems completely besides the point to me.
1337biz 11y ago
Same here. Posts like these make me take the effort to log in just to downvote. Sad to see such a mindset to gain so much traction.
- Canada 11y ago
  Calling the police was completely inappropriate, but downvoting the comment as a way to signal your disapproval with his action in the real world isn't helpful. The comment itself is well written, on topic, and leading to good discussion. I agree with what others have already said: Since nobody was actually hurt he should have contacted the researchers to make his point.
  - 1337biz 11y ago
    It is a never ending discussion around here but my take away is that votes express opinion as well as quality of the posting. We are here not an intellectual debate club were people take pro and contra sides and points are distributed based on the rigor of the argument, but discussions around here are about real world problems. And somebody calling the cops on security researchers just because he read an article on the intern is in my view highly questionable behavior for somebody familiar with the tech community.
  - nnbvv 11y ago
    Right, yesterday my neighbor shot a gun at me several times but since he missed and no one was hurt, it would have been utterly inappropriate for me to contact the authorities.
    - Canada 11y ago
      Being shot at (intentionally or otherwise) is entirely different than a car in front of you slowing to a stop.
      - CamperBob2 11y ago
        One problem with this reasoning is that the researchers really didn't know what they were doing with 100% certainty. Their code could have accidentally affected the stability control subsystem that most cars have nowadays -- the one that's designed to apply full braking to a single wheel to recover from a skid. In fact, just corrupting the data from the steering-wheel angle sensor could have had that effect (which I personally find rather terrifying in itself.) Good job, guys, now you've caused a 70 MPH rollover in traffic. The right way to do this would have been for the researchers to call the police up front and arrange a demonstration on a closed road with police escort. That would have lent the video more credibility and shielded the researchers from liability, while addressing any concerns about safety or ethics.
Lawtonfogle 11y ago
>Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. There is even a bigger problem. These researchers, even if they were negligent, are far more at risk of legal punishment for creating a small risk for the sake of increasing safety standards overall than the people who choose to cut security funding and put magnitudes more people at risk for the sake of making more money. Isn't it odd that we have a legal system where the ones attempt to expose and fix the problem for the sake of safety are facing far greater legal trouble than those who knowingly allowed for the problem to first occur due to increasing profits?
- danielweber 11y ago
  I think researchers should have complete 100% legal cover if they test private vehicles and private roads. But as someone who says the car manufacturer ought to face legal consequences for failing to fix a remotely exploitable stall-out in a timely manner (even without demonstration of anyone being harmed), I also say that people who fuck with moving cars on the road are a menace as well.
  - the8472 11y ago
    We could easily reverse that reasoning: Security researchers should only be liable for potential risks if we manage to hold those companies for potential risks. If we fail to do the latter it's quite unfair to let individuals bear the brunt of legal enforcement.
    - Lawtonfogle 11y ago
      Unfair but also of great benefit to the corporations creating products with security holes. It reminds me of 'identity theft' where the average citizen bears the risk due to the poor verification practices of loaning institutions instead of the institutions who create the risk as a byproduct of profiting off making the loans. If anyone thinks this is accidental, you should contact me as I have a great deal on this new bridge that is about to hit the market.
  - 11y ago
freshyill 11y ago
> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. But putting many lives in danger is considered acceptable behavior by security researchers? Does it actually matter that it was security researchers? Do security researchers working on banking software need to steal a million dollars in order to prove that they've found an issue? Would calling the police be acceptable in that situation? Actual outrage is acceptable when there's actual danger. Calling the cops on a loud neighbor might not be acceptable, but calling the cops on a neighbor firing a gun in the general direction of your house certainly would be.
- geofft 11y ago
  > But putting many lives in danger is considered acceptable behavior by security researchers? We don't know, for sure, what happened. There might be some creative license in the journalism. There might be some omission of them talking to authorities (even if someone called the highway patrol and they said "oh, we don't know about this," all it proves is there's bureaucracy at the highway patrol). etc. Calling the cops is invoking a powerful and hard-to-control force. Unless you think that the cops and the legal system are capable of talking to people fairly and understanding security research and making sense of tech journalism and reaching a reliably just outcome, there are better ways to exert your outrage. For instance, the researchers are very well known in the security community. They're not rogues or mobsters or fugitives. If they recklessly endangered lives, we can pressure them to turn themselves in to the legal system. I happen to have more faith in the ability of the hacker community to fairly figure out what happened than the legal system to fairly figure out what happened. If I shouldn't, then we have a serious problem as a community.
  - zaitcev 11y ago
    After Alice Goffman, a publication with this kind of journalist involvement has to be seen with a certain suspicion.
  - edanm 11y ago
    Your post basically boils down to: 1. You don't trust the police/legal system. 2. You trust our own community more. Not saying I agree or disagree, but there are a LOT of people who would really disagree with this, and a lot more who would think that someone saying "why involved the actual people the public has chosen to deal with this, we can deal with it ourselves" would be very wrong.
Aldo_MX 11y ago
> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. What would contacting the researchers achieve? They arbitrarily did the experiment in a public highway "to make the headline more shocking". As much as I support any kind of security research, and as much as I support getting the attention of people to raise awareness, contacting the authorities was the correct move; a public highway is not a research lab without the proper permission from authorities.
tombrossman 11y ago
Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and remotely disabling a vehicle on a multi-lane interstate highway, like it was a big joke. The reporter in the Jeep literally says "This is dangerous" and asks urgently for help. This all filmed and posted to Wired for the world to see, like they are proud of it. Before working with computers I drove tractor-trailers for a while and was lucky to achieve a million-mile safe driving award. I have a pretty good idea of the dangers here and I know that stretch of road well, I've crossed it many times. I know from experience that a car stopped in the middle of a multi-lane interstate is one of the most dangerous situations you can be in. I've had people hit me who didn't see my huge trailer with flashers on and warning triangles out on a sunny day - it happens quite often. I've seen dozens of people killed in situations exactly like this. You see it coming and a random driver just plows into the stopped vehicle. I exercised my judgement and decided to phone the local Highway Patrol office. I've read the negative comments and I disagree, I still think it was the correct thing to do. If you are a researcher and you do something this dangerous, and are foolish enough to then post it on a high-traffic site like Wired, I think you forfeit any right to a discreet warning and you deserve to have the police show up demanding answers to some tough questions.
- mod 11y ago
  You've seriously seen "dozens" of people killed?
  - Aldo_MX 11y ago
    Many car drivers forget a basic concept of physics named inertia, which is the reason why heavy vehicles (ex. trucks) take ___too long___ to brake. Emphasis in too long, because this is the reason why road signs announce dangerous sections of a road with even miles in advance.
    - 11y ago
cstross 11y ago
The hackers' behaviour was utterly reckless. Demoing it on a test track with no other vehicles and a volunteer driver with helmet and roll cage -- that'd be acceptable, maybe, with suitable safeguards. But doing it on the open highway with unaware third parties driving past, merely telling the test guinea pig "not to lose control" while being blasted with cold air and loud noise, having the controls disabled, and visibility impaired? That's gross recklessness with public safety. (Here's a clue: you could have put me in that car and given me all the warning in the world and I could not guarantee maintaining control or not causing a potentially fatal accident at 70mph under those conditions.) You shouldn't run experiments on big powerful machines in public places where you can't keep by-standers out. Gross ethical breach. I just hope the journalist is exaggerating or making things up.
- dchichkov 11y ago
  To me it seems like it is gross recklessness with public safety from car manufacturers. The car manufacturers are risking lives of all these people by not keeping the air gap between CAN and Internet...
  - cmdkeen 11y ago
    It can be both, security researchers don't get a free pass just because they are exposing a wrong. Had someone died you might (in countries which have it) get corporate manslaughter on a company that ignored security warnings. You absolutely would on the researchers and the journalist for their reckless disregard for the lives of others.
    - dchichkov 11y ago
      Yes, researchers don't get a free pass. Nothing is free. They've risked lives and their reputations to save lives. It had happened before in the history. And hopefully it will happen again. Some times it is worth it. (*) without risking lives there wouldn't have been a video documenting these life-threatening vulnerabilities in the cars.
it_learnses 11y ago
What would be more thoughtful is for the researchers to plan this better. I think calling the police was the right action in this case. Why do researchers get a free pass? If it were some pranksters publishing the exact same thing on youtube, would you still consider it unacceptable behaviour? No, what I find unacceptable is your hypocrisy in trying to shame the guy who did the right thing.
elektromekatron 11y ago
Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. Who cares what their job title is? They deliberately blocked visibility and then cut the transmission of a vehicle being driven on a public road in traffic. That is well into the territory of criminal negligence.
chapium 11y ago
This is like testing the new trigger safety on a gun by firing into a crowd. Its incredibly negligent and unethical. That section of i-64 is very busy and the police should get involved.
pizza 11y ago
> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior > they cut the transmission. [...] Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed In what world do we not call the police on this kind of behavior?
JabavuAdams 11y ago
Test pilots work from very careful plans in order to gradually test the envelope of huge powerful machines filled with explosive fuels. Their test-engineers don't say "hey, we're going to do some stuff, but try not to kill anyone". Gross negligence. Perhaps you are simply unaware of how dangerous the situation was? Several experts (ex-truckers) have described how they have seen people killed in circumstances like this. If you're being intellectually honest, that should inform your responses.
efuquen 11y ago
> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. So, you don't care about the fact that this experiment on public roads could have killed people? Just because it's for security research it's ok to recklessly endanger lives? What Wow's me is your cavalier attitude, I'm glad he informed the police and I hope they face repercussions. What they did needlessly endangered people's lives and public safety to add a sensational bit to a story, I find that way more "aggressive" than informing the proper authorities of those actions.
bryanbuckley 11y ago
>unlike the typical TPMs that only allow vendor software to be authenticated, these TPMs would allow the user to directly authenticate the firmware. If you know the firmware is good, then each layer can validate the next layer up all the way to the OS. nothing novel there in terms of having to have some "new" TPM. Just OEMs choose to lock down their boot chain. Probably most secure boots are minimally implemented to only support the use case of secure/trusted boot (device/chip/OEM key) xor untrusted boot (no key). If both are supported, whatever functionality that relies on OEM firmware or chain of trust would be disabled if it is an untrusted boot (like fastboot oem unlock for some android devices) situation. May be tricky to enable certain desirable/required features if user wants to run their own firmware. >I have yet to hear of a system that allows the user to directly authenticate software/firmware at the hardware level. Is anybody working on research of this nature? Or are there insurmountable problems with this approach? I think chromebooks/chromeOS folks have been looking at this. Not sure of the current state of things. p.s. TPMs kind of suck if they are not able to be updated OTA.
oh_sigh 11y ago
The security researches behaved irresponsibly by performing this demo on a public highway, especially one with no shoulder. They could have driven around a private track just as easily. Performing the test on a public road endangers the journalist, other drivers, emergency assistance personnel, etc.
cmdrfred 11y ago
I'm not for agitating the authorities on this one. Sometimes security research like this requires a little performance art to get the message across. Guys like Elon Musk just need a proof of concept to modify his designs, incumbents like Fiat Chrysler need exactly this. Remember Toyota?

usefulcat 11y ago

"A much less aggressive (and thoughtful) move would be to contact the researchers directly." Not conducting this demonstration on a public highway would also have been a much less aggressive and thoughtful move, not to mention less dangerous.

1337biz 11y ago
Finally some IT guys getting how the press works and now you want to change their story to something like "how I hacked a car in my backyard".
- danielweber 11y ago
  It's particularly because getting big headlines is so enticing and intoxicating that research labs have review boards.
- usefulcat 11y ago
  I understand why they did it this way, and I'm glad that this issue getting more publicity. But that does not mean that the means they chose are justified by the end of greater publicity. They simply did not have the right to endanger the other people on that road without their consent.

brandon272 11y ago

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. Reminds me of people who will call the police on a loud neighbor instead of just, you know, talking to them first.

meragrin 11y ago
This isn't just a loud neighbor. This was a drunk loud neighbor waving a loaded gun around. The driver was clearly distressed and they were just laughing it up.
- brandon272 11y ago
  No, these are knowledgable security researchers doing serious work who are probably amenable to discussing their research methods with concerned party via email or phone instead of the concerned party immediately phoning the police.
  - emerongi 11y ago
    Doesn't matter who they are. They have a loaded gun in their hands. Use it somewhere private or not at all. Anything else is unacceptable and extremely dangerous.
    - brandon272 11y ago
      Well, let's just have these guys arrested for marauding around the freeways with a "loaded gun" and we'll let the Russian hackers figure out the Cherokee's vulnerabilities.
    - deleted 11y ago
      [deleted]
  - scrumper 11y ago
    I don't agree. They breached their own covenant, which doesn't afford them the benefit of the doubt you might assign to 'knowledgeable researchers doing serious work': "We won't do anything life threatening." Then they did precisely that: they disabled the transmission on an uphill freeway ramp with no shoulder, with a very large truck bearing down on the Jeep. Trucks cannot stop quickly. Substantial danger for the driver, the trucker, and everyone around them.

danielweber 11y ago

I don't know where the threshold is, but calling yourself a "security researcher" is not a blank slate to do whatever you want. I think it's 100% OK to test on a private car on a private track.

stillsut 11y ago
Had my car stall on the highway once. Pretty scary because you lose power-brakes and power-steering as you're trying to pullover. Was it a hacker? Nope, just a dumb mechanic that got trash deep into the air intake during a routine oil change. How many (dumb mechanics)*(routine oil changes) are there in this country? Five-Six orders of magnitude more than auto hackers, which is why I don't see any harm in one more (where the driver knew ahead of time it was going to happen).
- danielweber 11y ago
  Cars aren't toys. Just because there are many stalls doesn't mean adding one more becomes acceptable. Here's the good test: since humans were involved, how did they present this to their ethical review board? I'm pretty confident the answer would be "what's an ethical review board?".
  - marxmarv 11y ago
    DARPA don't need no ethics board.
- mattdotc 11y ago
  The difference is your 'dumb mechanic' made an unintentional mistake. These people, on the other hand, knowingly and deliberately disabled a car on a highway. Yes, they had a plan, but they are still running their little experiment on other unwitting drivers on the highway. I don't consider the manner in which they ran their test to be ethical; it should have been performed on a closed track.
- aptwebapps 11y ago
  The fact that the driver knew ahead of time does mitigate the danger but does not excuse the remaining danger. The fact that there are already lots of dangerous stalls seems completely besides the point to me.

1337biz 11y ago

Same here. Posts like these make me take the effort to log in just to downvote. Sad to see such a mindset to gain so much traction.

Canada 11y ago
Calling the police was completely inappropriate, but downvoting the comment as a way to signal your disapproval with his action in the real world isn't helpful. The comment itself is well written, on topic, and leading to good discussion. I agree with what others have already said: Since nobody was actually hurt he should have contacted the researchers to make his point.
- 1337biz 11y ago
  It is a never ending discussion around here but my take away is that votes express opinion as well as quality of the posting. We are here not an intellectual debate club were people take pro and contra sides and points are distributed based on the rigor of the argument, but discussions around here are about real world problems. And somebody calling the cops on security researchers just because he read an article on the intern is in my view highly questionable behavior for somebody familiar with the tech community.
- nnbvv 11y ago
  Right, yesterday my neighbor shot a gun at me several times but since he missed and no one was hurt, it would have been utterly inappropriate for me to contact the authorities.
  - Canada 11y ago
    Being shot at (intentionally or otherwise) is entirely different than a car in front of you slowing to a stop.
    - CamperBob2 11y ago
      One problem with this reasoning is that the researchers really didn't know what they were doing with 100% certainty. Their code could have accidentally affected the stability control subsystem that most cars have nowadays -- the one that's designed to apply full braking to a single wheel to recover from a skid. In fact, just corrupting the data from the steering-wheel angle sensor could have had that effect (which I personally find rather terrifying in itself.) Good job, guys, now you've caused a 70 MPH rollover in traffic. The right way to do this would have been for the researchers to call the police up front and arrange a demonstration on a closed road with police escort. That would have lent the video more credibility and shielded the researchers from liability, while addressing any concerns about safety or ethics.

Lawtonfogle 11y ago

>Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. There is even a bigger problem. These researchers, even if they were negligent, are far more at risk of legal punishment for creating a small risk for the sake of increasing safety standards overall than the people who choose to cut security funding and put magnitudes more people at risk for the sake of making more money. Isn't it odd that we have a legal system where the ones attempt to expose and fix the problem for the sake of safety are facing far greater legal trouble than those who knowingly allowed for the problem to first occur due to increasing profits?

danielweber 11y ago
I think researchers should have complete 100% legal cover if they test private vehicles and private roads. But as someone who says the car manufacturer ought to face legal consequences for failing to fix a remotely exploitable stall-out in a timely manner (even without demonstration of anyone being harmed), I also say that people who fuck with moving cars on the road are a menace as well.
- the8472 11y ago
  We could easily reverse that reasoning: Security researchers should only be liable for potential risks if we manage to hold those companies for potential risks. If we fail to do the latter it's quite unfair to let individuals bear the brunt of legal enforcement.
  - Lawtonfogle 11y ago
    Unfair but also of great benefit to the corporations creating products with security holes. It reminds me of 'identity theft' where the average citizen bears the risk due to the poor verification practices of loaning institutions instead of the institutions who create the risk as a byproduct of profiting off making the loans. If anyone thinks this is accidental, you should contact me as I have a great deal on this new bridge that is about to hit the market.
- 11y ago

freshyill 11y ago

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. But putting many lives in danger is considered acceptable behavior by security researchers? Does it actually matter that it was security researchers? Do security researchers working on banking software need to steal a million dollars in order to prove that they've found an issue? Would calling the police be acceptable in that situation? Actual outrage is acceptable when there's actual danger. Calling the cops on a loud neighbor might not be acceptable, but calling the cops on a neighbor firing a gun in the general direction of your house certainly would be.

geofft 11y ago
> But putting many lives in danger is considered acceptable behavior by security researchers? We don't know, for sure, what happened. There might be some creative license in the journalism. There might be some omission of them talking to authorities (even if someone called the highway patrol and they said "oh, we don't know about this," all it proves is there's bureaucracy at the highway patrol). etc. Calling the cops is invoking a powerful and hard-to-control force. Unless you think that the cops and the legal system are capable of talking to people fairly and understanding security research and making sense of tech journalism and reaching a reliably just outcome, there are better ways to exert your outrage. For instance, the researchers are very well known in the security community. They're not rogues or mobsters or fugitives. If they recklessly endangered lives, we can pressure them to turn themselves in to the legal system. I happen to have more faith in the ability of the hacker community to fairly figure out what happened than the legal system to fairly figure out what happened. If I shouldn't, then we have a serious problem as a community.
- zaitcev 11y ago
  After Alice Goffman, a publication with this kind of journalist involvement has to be seen with a certain suspicion.
- edanm 11y ago
  Your post basically boils down to: 1. You don't trust the police/legal system. 2. You trust our own community more. Not saying I agree or disagree, but there are a LOT of people who would really disagree with this, and a lot more who would think that someone saying "why involved the actual people the public has chosen to deal with this, we can deal with it ourselves" would be very wrong.

Aldo_MX 11y ago

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. What would contacting the researchers achieve? They arbitrarily did the experiment in a public highway "to make the headline more shocking". As much as I support any kind of security research, and as much as I support getting the attention of people to raise awareness, contacting the authorities was the correct move; a public highway is not a research lab without the proper permission from authorities.

tombrossman 11y ago

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and remotely disabling a vehicle on a multi-lane interstate highway, like it was a big joke. The reporter in the Jeep literally says "This is dangerous" and asks urgently for help. This all filmed and posted to Wired for the world to see, like they are proud of it. Before working with computers I drove tractor-trailers for a while and was lucky to achieve a million-mile safe driving award. I have a pretty good idea of the dangers here and I know that stretch of road well, I've crossed it many times. I know from experience that a car stopped in the middle of a multi-lane interstate is one of the most dangerous situations you can be in. I've had people hit me who didn't see my huge trailer with flashers on and warning triangles out on a sunny day - it happens quite often. I've seen dozens of people killed in situations exactly like this. You see it coming and a random driver just plows into the stopped vehicle. I exercised my judgement and decided to phone the local Highway Patrol office. I've read the negative comments and I disagree, I still think it was the correct thing to do. If you are a researcher and you do something this dangerous, and are foolish enough to then post it on a high-traffic site like Wired, I think you forfeit any right to a discreet warning and you deserve to have the police show up demanding answers to some tough questions.

mod 11y ago
You've seriously seen "dozens" of people killed?
- Aldo_MX 11y ago
  Many car drivers forget a basic concept of physics named inertia, which is the reason why heavy vehicles (ex. trucks) take ___too long___ to brake. Emphasis in too long, because this is the reason why road signs announce dangerous sections of a road with even miles in advance.
  - 11y ago

cstross 11y ago

The hackers' behaviour was utterly reckless. Demoing it on a test track with no other vehicles and a volunteer driver with helmet and roll cage -- that'd be acceptable, maybe, with suitable safeguards. But doing it on the open highway with unaware third parties driving past, merely telling the test guinea pig "not to lose control" while being blasted with cold air and loud noise, having the controls disabled, and visibility impaired? That's gross recklessness with public safety. (Here's a clue: you could have put me in that car and given me all the warning in the world and I could not guarantee maintaining control or not causing a potentially fatal accident at 70mph under those conditions.) You shouldn't run experiments on big powerful machines in public places where you can't keep by-standers out. Gross ethical breach. I just hope the journalist is exaggerating or making things up.

dchichkov 11y ago
To me it seems like it is gross recklessness with public safety from car manufacturers. The car manufacturers are risking lives of all these people by not keeping the air gap between CAN and Internet...
- cmdkeen 11y ago
  It can be both, security researchers don't get a free pass just because they are exposing a wrong. Had someone died you might (in countries which have it) get corporate manslaughter on a company that ignored security warnings. You absolutely would on the researchers and the journalist for their reckless disregard for the lives of others.
  - dchichkov 11y ago
    Yes, researchers don't get a free pass. Nothing is free. They've risked lives and their reputations to save lives. It had happened before in the history. And hopefully it will happen again. Some times it is worth it. (*) without risking lives there wouldn't have been a video documenting these life-threatening vulnerabilities in the cars.

it_learnses 11y ago

What would be more thoughtful is for the researchers to plan this better. I think calling the police was the right action in this case. Why do researchers get a free pass? If it were some pranksters publishing the exact same thing on youtube, would you still consider it unacceptable behaviour? No, what I find unacceptable is your hypocrisy in trying to shame the guy who did the right thing.

elektromekatron 11y ago

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. Who cares what their job title is? They deliberately blocked visibility and then cut the transmission of a vehicle being driven on a public road in traffic. That is well into the territory of criminal negligence.

chapium 11y ago

This is like testing the new trigger safety on a gun by firing into a crowd. Its incredibly negligent and unethical. That section of i-64 is very busy and the police should get involved.

pizza 11y ago

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior > they cut the transmission. [...] Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed In what world do we not call the police on this kind of behavior?

JabavuAdams 11y ago

Test pilots work from very careful plans in order to gradually test the envelope of huge powerful machines filled with explosive fuels. Their test-engineers don't say "hey, we're going to do some stuff, but try not to kill anyone". Gross negligence. Perhaps you are simply unaware of how dangerous the situation was? Several experts (ex-truckers) have described how they have seen people killed in circumstances like this. If you're being intellectually honest, that should inform your responses.

efuquen 11y ago

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow. So, you don't care about the fact that this experiment on public roads could have killed people? Just because it's for security research it's ok to recklessly endanger lives? What Wow's me is your cavalier attitude, I'm glad he informed the police and I hope they face repercussions. What they did needlessly endangered people's lives and public safety to add a sensational bit to a story, I find that way more "aggressive" than informing the proper authorities of those actions.

bryanbuckley 11y ago

>unlike the typical TPMs that only allow vendor software to be authenticated, these TPMs would allow the user to directly authenticate the firmware. If you know the firmware is good, then each layer can validate the next layer up all the way to the OS. nothing novel there in terms of having to have some "new" TPM. Just OEMs choose to lock down their boot chain. Probably most secure boots are minimally implemented to only support the use case of secure/trusted boot (device/chip/OEM key) xor untrusted boot (no key). If both are supported, whatever functionality that relies on OEM firmware or chain of trust would be disabled if it is an untrusted boot (like fastboot oem unlock for some android devices) situation. May be tricky to enable certain desirable/required features if user wants to run their own firmware. >I have yet to hear of a system that allows the user to directly authenticate software/firmware at the hardware level. Is anybody working on research of this nature? Or are there insurmountable problems with this approach? I think chromebooks/chromeOS folks have been looking at this. Not sure of the current state of things. p.s. TPMs kind of suck if they are not able to be updated OTA.

oh_sigh 11y ago

The security researches behaved irresponsibly by performing this demo on a public highway, especially one with no shoulder. They could have driven around a private track just as easily. Performing the test on a public road endangers the journalist, other drivers, emergency assistance personnel, etc.

cmdrfred 11y ago

I'm not for agitating the authorities on this one. Sometimes security research like this requires a little performance art to get the message across. Guys like Elon Musk just need a proof of concept to modify his designs, incumbents like Fiat Chrysler need exactly this. Remember Toyota?