9 ms·

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. Whi

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police. While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and remotely disabling a vehicle on a multi-lane interstate highway, like it was a big joke. The reporter in the Jeep literally says "This is dangerous" and asks urgently for help. This all filmed and posted to Wired for the world to see, like they are proud of it. Before working with computers I drove tractor-trailers for a while and was lucky to achieve a million-mile safe driving award. I have a pretty good idea of the dangers here and I know that stretch of road well, I've crossed it many times. I know from experience that a car stopped in the middle of a multi-lane interstate is one of the most dangerous situations you can be in. I've had people hit me who didn't see my huge trailer with flashers on and warning triangles out on a sunny day - it happens quite often. I've seen dozens of people killed in situations exactly like this. You see it coming and a random driver just plows into the stopped vehicle. I exercised my judgement and decided to phone the local Highway Patrol office. I've read the negative comments and I disagree, I still think it was the correct thing to do. If you are a researcher and you do something this dangerous, and are foolish enough to then post it on a high-traffic site like Wired, I think you forfeit any right to a discreet warning and you deserve to have the police show up demanding answers to some tough questions.

mod 11y ago
You've seriously seen "dozens" of people killed?
- Aldo_MX 11y ago
  Many car drivers forget a basic concept of physics named inertia, which is the reason why heavy vehicles (ex. trucks) take ___too long___ to brake. Emphasis in too long, because this is the reason why road signs announce dangerous sections of a road with even miles in advance.
  - toomuchtodo 11y ago
    Whenever I'm hauling >10K lbs with my pickup truck, I get most nervous going downhill through mountains. The only thing between me and hitting something are a thin set of brake pads on all four disc brakes and the extremely limited compression braking on a ~6L engine.
- pyre 11y ago
  Is it really inconceivable that someone who has literally driven tractor trailers more than a million miles has seen dozens of people killed in accidents?
  - throwaway342526 11y ago
    No, not at all. I'm just a regular middle aged driver with perhaps 300k miles under my belt and I've passed numerous fatal accidents on the roadway. I just sat back and tried to estimate (since of course, I don't have a CB in my car and can't follow traffic details like a trucker) but I'd guess I've driven past at least 5 fatalities -- and that's just fatalities I've noticed (body on stretcher, read about it on the news later, etc)
- omegaham 11y ago
  40,000 people a year in the US. I wouldn't be surprised at all if an experienced truck driver has seen dozens of dead people.
osconfused 11y ago
I appreciate your call to the cops and your reasoning. I also have driven a significant number of miles for work and have seen a number of people killed in traffic accidents. This "test" was extremely irresponsible. I know I will be downvoted for saying this, but I think you made the correct decision.
- bengali3 11y ago
  Agreed. I missed the video the first time and didn't believe the text that described the shutdown, video shows the stupidity here, let alone release a recording of it. I expect that will come down soon. Important research but very poorly tested. Wired and Chrysler (research was funded by Chrysler?) legal teams would not like the contents of this video. edit: wired's link to video, jump to 2:00: http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005/9aca04ce-083b-4756-bda9-a37a148bf90flow.webm http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005...
  - kbenson 11y ago
    Reporter: "Seriously, this is fucking dangerous. I need to move." And that was while the security researchers caused the radio to blare so loud that he couldn't hear them on the other end of the phone. The more I see, the more I think they were really negligent in how they planned this out, and I was already firmly in that camp.
  - waterlesscloud 11y ago
    So watching the video, I don't see a vehicle stalled on the highway. What I see is a vehicle slowed considerably, but at least nominally over the legal minimum speed of 40 MPH on highways, and without the driver being able to accelerate on his own. He's travelling in the rightmost lane, explicitly with his hazard lights on. This is not an unusual occurrence on highways. He's then told that to regain control he needs to stop and restart the car, which he does while remaining in motion. I was surprised, since this is quite different from the way it's being talked about here, as if he was stopped in the middle of the freeway. See GGP comment about "a car stopped in the middle of a multi-lane interstate." That's not what happened here.
patcheudor 11y ago
I've seen Mr. Miller present at Black Hat and have talked with him about my own vulnerability reports to automotive vendors (I worked with one about two years ago to fix a rather embarrassing remotely exploitable flaw). However, I do not support testing or demonstrating any of the flaws on open public roads. Unforeseen things can and do happen. If the reporter would have been rear-ended this wouldn't have gone well for either researcher & that's enough right there to justify not doing this on public roads. The term "keep it to the track" which is often applied to the automotive racing scene is more than applicable here. The general public already tends to have a negative view of security researchers and performing "research" like this just re-enforces the perception.
baakss 11y ago
>I exercised my judgement and decided to phone the local Highway Patrol office. That was rash. You called the police within an hour of reading this article? You didn't think it's possible the writer is embellishing or exaggerating the danger he was in here? As of right now, everything they've done has been done in good faith to try to point out the need for extra security. Also, if they get arrested, even convicted of a crime, then what? You have two extremely angry researchers who know how to hack your car, and what, you're hoping some jail time might help them see the error of their ways and use more caution in the future? You can't see any potential problems if one of them feels vindictive about being jailed over your phone call when they weren't trying to do anything wrong in the first place?
- kbenson 11y ago
  I suggest you view the video[1] that bengali3 linked. 1: http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005/9aca04ce-083b-4756-bda9-a37a148bf90flow.webm http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005...
  - monocasa 11y ago
    The journalist is lying. Carefully look at the tachometer when he says that he can't accelerate, it's running at normal speed.
    - kbenson 11y ago
      That doesn't really mean anything. They "cut the transmission", which could mean they forced the vehicle into neutral. The accelerator may be supplying gas to the engine, but if the engine is not supplying power to the wheels, the accelerator will have now bearing on whether you accelerate. Making factual statements contrary to how a situation was reported by those involved is fraught with pitfalls you can't anticipate, from things you don't know about. Until there's careful investigation, or the people involved recant or make factually impossible statements, you should be careful about making assumptions. In any case, their reported actions are what people are upset about. If someone makes false statements about illegal activity and it results in the police showing up, they have only themselves to blame.
doktrin 11y ago
I support your decision. Disabling a vehicle in uncontrolled conditions on a freeway is reckless, plain and simple.
- yellowapple 11y ago
  The auto makers were even more reckless in their ignorance of the earlier controlled tests that these researchers performed and presented to said makers. Yet somehow the researchers are the bad guys. #JustHackerNewsThings
  - profinger 11y ago
    It's not about the fact that the Jeep was hackable it's about the fact that the demonstration was done on a crowded highway with civilians around.
    - yellowapple 11y ago
      It's also about the fact that more "reasonable" tests by these researchers were ignored by manufacturers. Hundreds of thousands of potential deaths at the hands of vulnerable vehicles versus maybe a dented bumper or two. I'll take the latter, please.
      - jameshart 11y ago
        You're repeatedly posting on this thread that "the manufacturers" have ignored the researchers' previous tests. That doesn't seem to be true; Chrysler (the singular manufacturer involved) have, after being alerted to the hack prior to this report, already issued a patch. The researchers are practicing responsible disclosure, have the co-operation of the manufacturer, and are going public with the details at Blackhat next month. This Wired piece is NOT part of that responsible vulnerability disclosure, it's a teaser to hype up their blackhat talk. It was not necessary to get this piece in Wired to save "hundreds of thousands" of lives. I guess you could argue that the vividness of this imagery will encourage people to follow through on getting their Jeeps patched, so there's that, I suppose. Since you've repeatedly made this claim, do you have a link to back up the assertion that there are manufacturers who were ignoring this research who will now pay attention because of the crazy stunt Wired pulled?
nostromo 11y ago
There's calling the police, and then there's publishing their phone number in the hopes of directing an angry mob. Angry mobs are dangerous and volatile and can push prosecutors to overreact. And prosecutors and politicians love to overreact when it comes to hacking.
- kbenson 11y ago
  He published the number of the local law enforcement agency. That is not directing an angry mob, that's helping people voice their opinion to the people responsible for enforcing laws.
  - nostromo 11y ago
    Bogging down the local police dispatch isn't a responsible way to voice your opinion. Imagine: you're a local and you're trying to call the police. But, you can't, because the number is busy. Or you wait forever on hold, because people on the internet are angry about a reckless driving incident that happened weeks ago and that the police already know about. OP called the police, that's enough. They know about it now. If you want to express your opinion, write the editor of Wired or, if you're really angry, the local district attorney.
    - kbenson 11y ago
      I think the level of exposure comes into play here. I'm not sure there's enough people that will make that call from the crowd here to cause an actual problem, but if it's an emergency response number better to not risk it, so I do agree with your reasoning to a point. Perhaps directing people to call a number that is not expected to handle emergency requests would have been more appropriate (and I see OP has amended his comment to remove the number).
  - deleted 11y ago
    [deleted]
profinger 11y ago
I agree with your move. Not sure who else was supporting you so I figured I'd offer my support. This was stupid as hell and I'm sure was likely set-up/suggested by Wired as a shock film.
ohitsdom 11y ago
You did the right thing. This was completely irresponsible. I'm shocked that Wired, the author, or either of the researchers have yet posted a "we screwed up, sorry" statement. It's a shame because this is an incredible story and the work they did was great, but what a completely reckless stunt they pulled. Totally unnecessary too, the story would have been just as effective if the demo happened on a test track or empty parking lot.
- chronic40 11y ago
  No he did not do the wrong thing. Reporting them is completely wrong. When we report the people who protect us, well this sounds like a plot to a movie. PS: in movies usually a lot of people suffer before the resolution
  - danielweber 11y ago
    Who protects me from the people who think they are doing the right thing by endangering me?
  - rebootthesystem 11y ago
    You are missing the point by a mile. These people did the exact opposite. They put others in potentially mortal danger. They could have killed someone's daughter, son, mom or dad. Stop and think about that for 10 minutes before you continue posting with this unreasonable point of view. Would your mom, dad or siblings life be worth this test? Imagine they collided with this car and died. Close your eyes and imagine that for a moment. Imagine receiving that call. Going to the hospital. Seeing the, all torn-up and suffering befor they die due to the injuries. And then you find out it was due to two fuckers who thought it'd be funny/interesting/whatever to disable a car remotely. Imagine that.
    - CamperBob2 11y ago
      To be fair, a good proportion of the blame -- and a very good proportion of my subsequent lawsuit -- would be directed at the car company whose negligent engineering made the wreck possible in the first place. Although I do agree with you, I modded you down and the GP up in this case because appeals to emotion aren't the answer. Your post is a form of the "If it saves just one child" thought-ending pattern.
rsync 11y ago
"Before working with computers I drove tractor-trailers for a while and was lucky to achieve a million-mile safe driving award. I have a pretty good idea of the dangers here and I know that stretch of road well, I've crossed it many times." Game, set, match.
fnordfnordfnord 11y ago
I can't say that I completely disagree with you but I do lack your faith in the authorities' ability to respond appropriately. I wouldn't mind if Beavis and Butthead recalibrated their ideas about how to conduct a demonstration. I also hope that they've edited the video for maximum effect, and that the reality was a little less exciting; but the fact is that a stalled automobile is an everyday occurrence that is about as mundane as mundane gets. Minor events such as this cannot be prevented in all cases, and therefore drivers absolutely must watch and be prepared for such an event. It wasn't the safest thing to do, but it isn't outside the normal range of "dangerous" events that one will experience on their commute daily, often more than once daily. IMO it doesn't increase the danger nearly as much as traffic patrol conducting a routine traffic stop on the freeway. If we're prepared to accept traffic patrol on busy freeways, then I don't think it's justified to treat a rare, even if foolish demonstration such as this one as anything more than a nuisance.
aaron695 11y ago
> I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up. The fact you have included their phone number seems to me like you are instigating some sort of lynch mob. If you actually though it was an issue you would have privately contacted them without telling the world. Very childish. This is a big story that the appropriate authorities will be looking at anyway.

mod 11y ago

You've seriously seen "dozens" of people killed?

Aldo_MX 11y ago
Many car drivers forget a basic concept of physics named inertia, which is the reason why heavy vehicles (ex. trucks) take ___too long___ to brake. Emphasis in too long, because this is the reason why road signs announce dangerous sections of a road with even miles in advance.
- toomuchtodo 11y ago
  Whenever I'm hauling >10K lbs with my pickup truck, I get most nervous going downhill through mountains. The only thing between me and hitting something are a thin set of brake pads on all four disc brakes and the extremely limited compression braking on a ~6L engine.
pyre 11y ago
Is it really inconceivable that someone who has literally driven tractor trailers more than a million miles has seen dozens of people killed in accidents?
- throwaway342526 11y ago
  No, not at all. I'm just a regular middle aged driver with perhaps 300k miles under my belt and I've passed numerous fatal accidents on the roadway. I just sat back and tried to estimate (since of course, I don't have a CB in my car and can't follow traffic details like a trucker) but I'd guess I've driven past at least 5 fatalities -- and that's just fatalities I've noticed (body on stretcher, read about it on the news later, etc)
omegaham 11y ago
40,000 people a year in the US. I wouldn't be surprised at all if an experienced truck driver has seen dozens of dead people.

osconfused 11y ago

I appreciate your call to the cops and your reasoning. I also have driven a significant number of miles for work and have seen a number of people killed in traffic accidents. This "test" was extremely irresponsible. I know I will be downvoted for saying this, but I think you made the correct decision.

bengali3 11y ago
Agreed. I missed the video the first time and didn't believe the text that described the shutdown, video shows the stupidity here, let alone release a recording of it. I expect that will come down soon. Important research but very poorly tested. Wired and Chrysler (research was funded by Chrysler?) legal teams would not like the contents of this video. edit: wired's link to video, jump to 2:00: http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005/9aca04ce-083b-4756-bda9-a37a148bf90flow.webm http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005...
- kbenson 11y ago
  Reporter: "Seriously, this is fucking dangerous. I need to move." And that was while the security researchers caused the radio to blare so loud that he couldn't hear them on the other end of the phone. The more I see, the more I think they were really negligent in how they planned this out, and I was already firmly in that camp.
- waterlesscloud 11y ago
  So watching the video, I don't see a vehicle stalled on the highway. What I see is a vehicle slowed considerably, but at least nominally over the legal minimum speed of 40 MPH on highways, and without the driver being able to accelerate on his own. He's travelling in the rightmost lane, explicitly with his hazard lights on. This is not an unusual occurrence on highways. He's then told that to regain control he needs to stop and restart the car, which he does while remaining in motion. I was surprised, since this is quite different from the way it's being talked about here, as if he was stopped in the middle of the freeway. See GGP comment about "a car stopped in the middle of a multi-lane interstate." That's not what happened here.

patcheudor 11y ago

I've seen Mr. Miller present at Black Hat and have talked with him about my own vulnerability reports to automotive vendors (I worked with one about two years ago to fix a rather embarrassing remotely exploitable flaw). However, I do not support testing or demonstrating any of the flaws on open public roads. Unforeseen things can and do happen. If the reporter would have been rear-ended this wouldn't have gone well for either researcher & that's enough right there to justify not doing this on public roads. The term "keep it to the track" which is often applied to the automotive racing scene is more than applicable here. The general public already tends to have a negative view of security researchers and performing "research" like this just re-enforces the perception.

baakss 11y ago

>I exercised my judgement and decided to phone the local Highway Patrol office. That was rash. You called the police within an hour of reading this article? You didn't think it's possible the writer is embellishing or exaggerating the danger he was in here? As of right now, everything they've done has been done in good faith to try to point out the need for extra security. Also, if they get arrested, even convicted of a crime, then what? You have two extremely angry researchers who know how to hack your car, and what, you're hoping some jail time might help them see the error of their ways and use more caution in the future? You can't see any potential problems if one of them feels vindictive about being jailed over your phone call when they weren't trying to do anything wrong in the first place?

kbenson 11y ago
I suggest you view the video[1] that bengali3 linked. 1: http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005/9aca04ce-083b-4756-bda9-a37a148bf90flow.webm http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005...
- monocasa 11y ago
  The journalist is lying. Carefully look at the tachometer when he says that he can't accelerate, it's running at normal speed.
  - kbenson 11y ago
    That doesn't really mean anything. They "cut the transmission", which could mean they forced the vehicle into neutral. The accelerator may be supplying gas to the engine, but if the engine is not supplying power to the wheels, the accelerator will have now bearing on whether you accelerate. Making factual statements contrary to how a situation was reported by those involved is fraught with pitfalls you can't anticipate, from things you don't know about. Until there's careful investigation, or the people involved recant or make factually impossible statements, you should be careful about making assumptions. In any case, their reported actions are what people are upset about. If someone makes false statements about illegal activity and it results in the police showing up, they have only themselves to blame.

doktrin 11y ago

I support your decision. Disabling a vehicle in uncontrolled conditions on a freeway is reckless, plain and simple.

yellowapple 11y ago
The auto makers were even more reckless in their ignorance of the earlier controlled tests that these researchers performed and presented to said makers. Yet somehow the researchers are the bad guys. #JustHackerNewsThings
- profinger 11y ago
  It's not about the fact that the Jeep was hackable it's about the fact that the demonstration was done on a crowded highway with civilians around.
  - yellowapple 11y ago
    It's also about the fact that more "reasonable" tests by these researchers were ignored by manufacturers. Hundreds of thousands of potential deaths at the hands of vulnerable vehicles versus maybe a dented bumper or two. I'll take the latter, please.
    - jameshart 11y ago
      You're repeatedly posting on this thread that "the manufacturers" have ignored the researchers' previous tests. That doesn't seem to be true; Chrysler (the singular manufacturer involved) have, after being alerted to the hack prior to this report, already issued a patch. The researchers are practicing responsible disclosure, have the co-operation of the manufacturer, and are going public with the details at Blackhat next month. This Wired piece is NOT part of that responsible vulnerability disclosure, it's a teaser to hype up their blackhat talk. It was not necessary to get this piece in Wired to save "hundreds of thousands" of lives. I guess you could argue that the vividness of this imagery will encourage people to follow through on getting their Jeeps patched, so there's that, I suppose. Since you've repeatedly made this claim, do you have a link to back up the assertion that there are manufacturers who were ignoring this research who will now pay attention because of the crazy stunt Wired pulled?

nostromo 11y ago

There's calling the police, and then there's publishing their phone number in the hopes of directing an angry mob. Angry mobs are dangerous and volatile and can push prosecutors to overreact. And prosecutors and politicians love to overreact when it comes to hacking.

kbenson 11y ago
He published the number of the local law enforcement agency. That is not directing an angry mob, that's helping people voice their opinion to the people responsible for enforcing laws.
- nostromo 11y ago
  Bogging down the local police dispatch isn't a responsible way to voice your opinion. Imagine: you're a local and you're trying to call the police. But, you can't, because the number is busy. Or you wait forever on hold, because people on the internet are angry about a reckless driving incident that happened weeks ago and that the police already know about. OP called the police, that's enough. They know about it now. If you want to express your opinion, write the editor of Wired or, if you're really angry, the local district attorney.
  - kbenson 11y ago
    I think the level of exposure comes into play here. I'm not sure there's enough people that will make that call from the crowd here to cause an actual problem, but if it's an emergency response number better to not risk it, so I do agree with your reasoning to a point. Perhaps directing people to call a number that is not expected to handle emergency requests would have been more appropriate (and I see OP has amended his comment to remove the number).
- deleted 11y ago
  [deleted]

profinger 11y ago

I agree with your move. Not sure who else was supporting you so I figured I'd offer my support. This was stupid as hell and I'm sure was likely set-up/suggested by Wired as a shock film.

ohitsdom 11y ago

You did the right thing. This was completely irresponsible. I'm shocked that Wired, the author, or either of the researchers have yet posted a "we screwed up, sorry" statement. It's a shame because this is an incredible story and the work they did was great, but what a completely reckless stunt they pulled. Totally unnecessary too, the story would have been just as effective if the demo happened on a test track or empty parking lot.

chronic40 11y ago
No he did not do the wrong thing. Reporting them is completely wrong. When we report the people who protect us, well this sounds like a plot to a movie. PS: in movies usually a lot of people suffer before the resolution
- danielweber 11y ago
  Who protects me from the people who think they are doing the right thing by endangering me?
- rebootthesystem 11y ago
  You are missing the point by a mile. These people did the exact opposite. They put others in potentially mortal danger. They could have killed someone's daughter, son, mom or dad. Stop and think about that for 10 minutes before you continue posting with this unreasonable point of view. Would your mom, dad or siblings life be worth this test? Imagine they collided with this car and died. Close your eyes and imagine that for a moment. Imagine receiving that call. Going to the hospital. Seeing the, all torn-up and suffering befor they die due to the injuries. And then you find out it was due to two fuckers who thought it'd be funny/interesting/whatever to disable a car remotely. Imagine that.
  - CamperBob2 11y ago
    To be fair, a good proportion of the blame -- and a very good proportion of my subsequent lawsuit -- would be directed at the car company whose negligent engineering made the wreck possible in the first place. Although I do agree with you, I modded you down and the GP up in this case because appeals to emotion aren't the answer. Your post is a form of the "If it saves just one child" thought-ending pattern.

rsync 11y ago

"Before working with computers I drove tractor-trailers for a while and was lucky to achieve a million-mile safe driving award. I have a pretty good idea of the dangers here and I know that stretch of road well, I've crossed it many times." Game, set, match.

fnordfnordfnord 11y ago

I can't say that I completely disagree with you but I do lack your faith in the authorities' ability to respond appropriately. I wouldn't mind if Beavis and Butthead recalibrated their ideas about how to conduct a demonstration. I also hope that they've edited the video for maximum effect, and that the reality was a little less exciting; but the fact is that a stalled automobile is an everyday occurrence that is about as mundane as mundane gets. Minor events such as this cannot be prevented in all cases, and therefore drivers absolutely must watch and be prepared for such an event. It wasn't the safest thing to do, but it isn't outside the normal range of "dangerous" events that one will experience on their commute daily, often more than once daily. IMO it doesn't increase the danger nearly as much as traffic patrol conducting a routine traffic stop on the freeway. If we're prepared to accept traffic patrol on busy freeways, then I don't think it's justified to treat a rare, even if foolish demonstration such as this one as anything more than a nuisance.

aaron695 11y ago

> I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up. The fact you have included their phone number seems to me like you are instigating some sort of lynch mob. If you actually though it was an issue you would have privately contacted them without telling the world. Very childish. This is a big story that the appropriate authorities will be looking at anyway.