4 ms·

Now imagine the exploit being used by a blackhat. The hackers aren't the problem here. The fact that somebody can even control cars over the Internet at all is.

by Grue3 11y ago

peeters 11y ago
It's not either/or. You're presenting a false dilemma. You can demonstrate the problem without doing it where you put real lives in danger. The researchers acted recklessly.
- yellowapple 11y ago
  > You can demonstrate the problem without doing it where you put real lives in danger. Indeed. And according to the article, they already did. The manufacturers ignored them.
  - peeters 11y ago
    Well, no, the manufacturers didn't ignore them. They responded with a patch, but the researchers didn't like their response. Still doesn't matter though. There are a million shades between quiet disclosure and outright stupidity that would still make headlines. 1) They could have let the "test dummy" in on what was going to happen, so they could give feedback as to when it was safe to do so. 2) They could have ensured constant two-way communication. 3) They could have done it when nobody was on the road.
    - yellowapple 11y ago
      > They responded with a patch, but the researchers didn't like their response. It was my understanding that the patch was released in response to the live highway test, not the prior tests in controlled environments. > They could have let the "test dummy" in on what was going to happen, so they could give feedback as to when it was safe to do so. The article makes it sound like they did. > They could have ensured constant two-way communication. Indeed they could've. I agree with you about the recklessness of this particular element of the test. > They could have done it when nobody was on the road. Perhaps, and I agree that maybe they should've coordinated with local authorities (if they didn't already). However, between "do the test with vehicles on the road" and "don't do the test at all", I'd certainly pick the former. Not to mention that the urgency involved with other vehicles on the road factors into the effectiveness of the demonstration.
      - peeters 11y ago
        Regarding the patch timeline, the article makes it clear they had been working on the patch for months before this went public. > Miller and Valasek have been sharing their research with Chrysler for nearly nine months, enabling the company to quietly release a patch ahead of the Black Hat conference. With respect to letting the driver in on it, it's pretty clear they withheld most information: > Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch And with respect to this: > However, between "do the test with vehicles on the road" and "don't do the test at all", I'd certainly pick the former. Oh look, another false dilemma. Between those two, I'd pick neither, and do the test responsibly.
        yellowapple 11y ago
        > With respect to letting the driver in on it, it's pretty clear they withheld most information: The reporter knew there were going to be attacks in the first place. There was also plenty of reason to believe said attacks could severely impair safety. > Oh look, another false dilemma. It's a trilemma; the concept of "do the test 'responsibly'" was already implied, so I merely provided the other outcomes. There's "perfect execution of demonstration" and "no demonstration"; between that is a spectrum of perfection, on which this demonstration happens to lie somewhere near the lower-middle. I don't disagree that the demo could've been done with more safety precautions, but the desire to do a "live" demonstration like this seems pretty reasonable, and even a demonstration lower on the perfection spectrum is preferable to the bottom end of "nothing at all".
hoopism 11y ago
You seem to be confused. Because a dangerous threat exists does not give a researcher license to endanger the public to prove it. This is especially the case when a safer alternative to demonstrate this exploit easily exists. Robbers could enter your home and hold your family at gunpoint AT ANY TIME. That does not give me the right to prove to you how easy it is by entering your home and scaring the crap out of your family. 1) This is a dangerous exploit 2) This was a dumb way to demonstrate it Those are not mutually exclusive.
- Grue3 11y ago
  First off, a "dangerous thing you can do" and "exploit" are not synonyms. So examples like anthrax attacks or home invasion are stupid and massively miss the point. Secondly, nobody would give a fuck about this exploit if it was performed in controlled environment. The researchers knew it because they did this kind of stuff before. Guess what, the cars did not become any safer! This much should be obvious to anyone with a hacking mindset. The comments in this thread read more like "Moms Against Drunk Driving Bulletin Board" than "Hacker News".
  - hoopism 11y ago
    Actually home invasion is an "exploit" of the home security (i.e. locked doors / windows). Just because they do it from behind a screen doesn't make it a less culpable crime. Computers don't insulate you from ethics... We put locks on our doors to prevent people from entering. They have always been exploitable but we use threat of laws to prevent it. Now we put locks in our software to prevent people from entering it (encryption). Somehow this generation believes that these locks are exempt from decency and law. It's sad that people think exposing vulnerabilities at any cost is righteous. There's plenty of people researching security in responsible ways. These two are not in that camp. Have fun... it's no different than kicking your neighbors door down and tell him to pay you for exposing his security flaw. Still makes you are jerk.
- yellowapple 11y ago
  > This is especially the case when a safer alternative to demonstrate this exploit easily exists. If you read the article, you'd know that said safer alternative was already attempted and presented to auto manufacturers, only to be met with dismissal.
pyre 11y ago
Using your logic, the government doing control biological tests on an unaware population (e.g. to test the spread patterns and inform their response to an actual event) is ok because terrorists/foreign governments could do much worse with (e.g.) weaponized Anthrax. I somehow doubt that you would be ok with such actions by the government (though I could be wrong).

Now imagine the exploit being used by a blackhat. The hackers aren't the problem here. The fact that somebody can even control cars over the Internet at all is.

by Grue3 11y ago

Now imagine the exploit being used by a blackhat. The hackers aren't the problem here. The fact that somebody can even control cars over the Internet at all is.

peeters 11y ago

It's not either/or. You're presenting a false dilemma. You can demonstrate the problem without doing it where you put real lives in danger. The researchers acted recklessly.

yellowapple 11y ago
> You can demonstrate the problem without doing it where you put real lives in danger. Indeed. And according to the article, they already did. The manufacturers ignored them.
- peeters 11y ago
  Well, no, the manufacturers didn't ignore them. They responded with a patch, but the researchers didn't like their response. Still doesn't matter though. There are a million shades between quiet disclosure and outright stupidity that would still make headlines. 1) They could have let the "test dummy" in on what was going to happen, so they could give feedback as to when it was safe to do so. 2) They could have ensured constant two-way communication. 3) They could have done it when nobody was on the road.
  - yellowapple 11y ago
    > They responded with a patch, but the researchers didn't like their response. It was my understanding that the patch was released in response to the live highway test, not the prior tests in controlled environments. > They could have let the "test dummy" in on what was going to happen, so they could give feedback as to when it was safe to do so. The article makes it sound like they did. > They could have ensured constant two-way communication. Indeed they could've. I agree with you about the recklessness of this particular element of the test. > They could have done it when nobody was on the road. Perhaps, and I agree that maybe they should've coordinated with local authorities (if they didn't already). However, between "do the test with vehicles on the road" and "don't do the test at all", I'd certainly pick the former. Not to mention that the urgency involved with other vehicles on the road factors into the effectiveness of the demonstration.
    - peeters 11y ago
      Regarding the patch timeline, the article makes it clear they had been working on the patch for months before this went public. > Miller and Valasek have been sharing their research with Chrysler for nearly nine months, enabling the company to quietly release a patch ahead of the Black Hat conference. With respect to letting the driver in on it, it's pretty clear they withheld most information: > Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch And with respect to this: > However, between "do the test with vehicles on the road" and "don't do the test at all", I'd certainly pick the former. Oh look, another false dilemma. Between those two, I'd pick neither, and do the test responsibly.
      - yellowapple 11y ago
        > With respect to letting the driver in on it, it's pretty clear they withheld most information: The reporter knew there were going to be attacks in the first place. There was also plenty of reason to believe said attacks could severely impair safety. > Oh look, another false dilemma. It's a trilemma; the concept of "do the test 'responsibly'" was already implied, so I merely provided the other outcomes. There's "perfect execution of demonstration" and "no demonstration"; between that is a spectrum of perfection, on which this demonstration happens to lie somewhere near the lower-middle. I don't disagree that the demo could've been done with more safety precautions, but the desire to do a "live" demonstration like this seems pretty reasonable, and even a demonstration lower on the perfection spectrum is preferable to the bottom end of "nothing at all".

hoopism 11y ago

You seem to be confused. Because a dangerous threat exists does not give a researcher license to endanger the public to prove it. This is especially the case when a safer alternative to demonstrate this exploit easily exists. Robbers could enter your home and hold your family at gunpoint AT ANY TIME. That does not give me the right to prove to you how easy it is by entering your home and scaring the crap out of your family. 1) This is a dangerous exploit 2) This was a dumb way to demonstrate it Those are not mutually exclusive.

Grue3 11y ago
First off, a "dangerous thing you can do" and "exploit" are not synonyms. So examples like anthrax attacks or home invasion are stupid and massively miss the point. Secondly, nobody would give a fuck about this exploit if it was performed in controlled environment. The researchers knew it because they did this kind of stuff before. Guess what, the cars did not become any safer! This much should be obvious to anyone with a hacking mindset. The comments in this thread read more like "Moms Against Drunk Driving Bulletin Board" than "Hacker News".
- hoopism 11y ago
  Actually home invasion is an "exploit" of the home security (i.e. locked doors / windows). Just because they do it from behind a screen doesn't make it a less culpable crime. Computers don't insulate you from ethics... We put locks on our doors to prevent people from entering. They have always been exploitable but we use threat of laws to prevent it. Now we put locks in our software to prevent people from entering it (encryption). Somehow this generation believes that these locks are exempt from decency and law. It's sad that people think exposing vulnerabilities at any cost is righteous. There's plenty of people researching security in responsible ways. These two are not in that camp. Have fun... it's no different than kicking your neighbors door down and tell him to pay you for exposing his security flaw. Still makes you are jerk.
yellowapple 11y ago
> This is especially the case when a safer alternative to demonstrate this exploit easily exists. If you read the article, you'd know that said safer alternative was already attempted and presented to auto manufacturers, only to be met with dismissal.

pyre 11y ago

Using your logic, the government doing control biological tests on an unaware population (e.g. to test the spread patterns and inform their response to an actual event) is ok because terrorists/foreign governments could do much worse with (e.g.) weaponized Anthrax. I somehow doubt that you would be ok with such actions by the government (though I could be wrong).