21 ms·

Fiat Chrysler recalls 1.4M cars after Jeep hack

251 points by vvanders 11y ago

gandalfu 11y ago
From the press release: http://www.media.chrysler.com/newsrelease.do?id=16849&mid=1 http://www.media.chrysler.com/newsrelease.do?id=16849&mid=1 "No defect has been found. FCA US is conducting this campaign out of an abundance of caution." What the hell?
- freehunter 11y ago
  That's probably the wording their lawyers asked them to use so they would not be liable for damages. If they admit fault, they're legally to blame for any accidents or damage.
- beambot 11y ago
  Preemptively admitting fault probably creates issues if there is future litigation.
- maxerickson 11y ago
  Defect appears to have a particular meaning in relation to vehicle safety. I'm just basing that on the way it is used here: http://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm http://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm I guess it isn't that big a stretch to use such defensive language, there are a lot of things that can be tampered with on a vehicle that arise out of engineering trade offs. I don't mean to dismiss the problem at hand, but it is only an issue if someone makes an effort to tamper with a vehicle, which is different than a critical part failing prematurely or whatever.
  - gandalfu 11y ago
    Unfortunately your argument makes sense.
- rhino369 11y ago
  Legally a defect in a product means you are stictly liable for all damage it causes. But also the hackers haven't demo'd the exploit in an untampered with car. I still wonder if you need physical access to do this.
  - fnordfnordfnord 11y ago
    If my understanding is correct, Uconnect/Bluetooth security is the weakest link, which isn't much comfort.
skimmas 11y ago
One got to love bright minds who ever thought connecting any relevant part of a cars control mechanisms to the internet was a good idea.
- hueving 11y ago
  The issue is the stupid media center. People want that to have Internet. Then at the same time they want it to display all of the climate details and other system info that comes off the CAN.
  - jasimq 11y ago
    But surely they can be isolated systems
    - jacquesm 11y ago
      They can be but they're not. Once you share a wire all bets are off.
      - UnoriginalGuy 11y ago
        By that logic there's no security on the internet at all. Everything "shares a wire" after all. Security is about degrees and nuances. These kind of black & white statements are unhelpful and unrealistic.
        justizin 11y ago
        > By that logic there's no security on the internet at all. Have you /been/ on the internet, lately? ;)
    - brudgers 11y ago
      Two systems that accept input from the same touchscreen can't be isolated in hardware. From the software side, any portion of each system's interface that overlaps at the touchscreen cannot be isolated. On top of that, if the touchscreen is reprogrammable, then it can be attacked directly and touchscreens are commodity devices not normally considered part of the security infrastructure.
jasimq 11y ago
If you missed it, this is related: http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ http://www.wired.com/2015/07/hackers-remotely-kill-jeep-high...
- maxerickson 11y ago
  Discussed here: https://news.ycombinator.com/item?id=9921557 https://news.ycombinator.com/item?id=9921557 Also related: https://news.ycombinator.com/item?id=9929177 https://news.ycombinator.com/item?id=9929177
jacquesm 11y ago
> The company added that hacking its vehicles was a "criminal action". I don't think that's the case, but I still commend them for doing a recall this quick. Shooting the messenger seems to still be quite a strong reflex for corporations faced with bad news. The way to look at it should be that these guys did Fiat-Chrysler a service. After all, it's not only security researchers that have the ability to write code and that have prolonged access to a vehicle to test. They seem to be mistaken about the time to write the code, after all, you can write the code and test it on a different vehicle than the one you intend to crash. Law enforcement typically won't analyze the firmware of all the computers in a car after a single vehicle accident (and it would probably be quite possible to erase the evidence once the car has been given a command sufficient to kill the occupants).
- maxerickson 11y ago
  The language in the FCA press release (linked in another thread) is softer: The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action. So through the process of extensive journalism, unauthorized remote manipulation got turned into hacking vehicles.
  - MBCook 11y ago
    It was hacking. They clearly proved they had control over dangerous parts of random vehicles. > The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation[...] Assuming that's not a lie, were they working on that because the 'researcher' (quotes due irresponsible 'testing') had been sending FCA what they found instead of their own internal decision to improve things and they knew this (specifically) was coming at some point?
    - maxerickson 11y ago
      It was hacking. I'm not quibbling about that. I replied to this statement: > The company added that hacking its vehicles was a "criminal action". I don't think that's the case, but I still commend them for doing a recall this quick. Which characterizes the statement in the article to be about hacking the vehicle at all. So my reply points out that the manufacturer was probably not putting forth that characterization when they talked about criminal action, they were likely talking about unauthorized remote manipulation (which should be and quite likely is criminal). So my argument is that the manufacturer statement about criminality is narrower in scope than the BBC translation of it. The software update release is obviously in response to the research: https://twitter.com/0xcharlie/status/623492229714313216 https://twitter.com/0xcharlie/status/623492229714313216 Upgrading it to a recall is probably in response to bad press.
tinco 11y ago
This is a terrible decision. On such a short timescale, they'll only be able to fix the particular bug in their infotainment system. The real problem as everyone has pointed out is that the car control and infotainment should not share channels. There should be a physical gap between them and if really necessary a very tightly controlled message bridge. The real fix will require much more intervention than just a firmware flash at the garage. We'll see at Def Con how much Chrysler really screwed up.
- Xorlev 11y ago
  > This is a terrible decision. It's the only one available to them. They can't just refit all existing cars with a new design on a short timeline. Hardware has permanence. With that in mind, how would you fix the issue for existing vehicles?
  - SEJeff 11y ago
    The infotainment system should never have access to the CAN[1] network in the first place... ever. At most, they could have a very simple listener on the can network that could send data (one way only) to the infotainment device via a different channel of sorts. Mixing the two is asking for issues such as just this to happen. [1] https://en.wikipedia.org/wiki/CAN_bus https://en.wikipedia.org/wiki/CAN_bus
    - fnordfnordfnord 11y ago
      I've done some CAN stuff (not on cars though), and that is the way that everyone I talked to advised to build your system, if suitable. However, we still pushed firmware from the master, so if the master were ever compromised, then all of the nodes would be potentially compromised as well. There is only sending and receiving data. All nodes receive any data from anything else on the bus. A node typically ignores data not addressed to itself but not always, that is up to the programmer. Any node can potentially impersonate the master, or another node. There is no way to prevent this, other than through the firmware.
curiousjorge 11y ago
Why does Jeep in particular have so much issue with quality assurance? The most memorable is the SUV rolling over in a simple test a couple years ago which have been fixed but it's quite worrying. https://www.youtube.com/watch?v=zaYFLb8WMGM https://www.youtube.com/watch?v=zaYFLb8WMGM
- sp332 11y ago
  A lot of SUVs were prone to rolling over before they got the traction control system right.
- justizin 11y ago
  This is not particular to Jeep, the Jeep Cherokee is simply the particular car they hacked. This basically affects all Fiat Chrysler vehicles.
- dsfyu404ed 11y ago
  First off that test is somewhat of a joke for SUVs since it basically rewards car-ish handling which is at odds with the truck-ish performance that is demanded of larger SUVs In terms of comparing two different vehicles... If the $year base model $carA has a suspension system closer in performance to the sport model of $year $carB but for $year+1 they put a much softer suspension in the base model of $carA in response to customer feedback then the results go out the window. Alternatively, if the OE tires are particularly expensive then you can bet that most owners will replace them with cheaper one. Additionally, particular trims are often incredibly rare or almost always have a particular option added. So testing a $trim without $package will be of little meaning when the vast majority of $trim that make it to dealer lots will have $package. In either case the results go out the window because there's a handful of large variables that are uncontrolled for. It's little better than the comparisons you see in car commercials. If you actually want to grill Jeep over something I suggest you read up on 90s XJ gas tank fires.
tantalor 11y ago
The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action. The WIRED story's hackers presumably were authorized by the vehicle's owner or operator, so the demo did not "constitute criminal action."
- latortuga 11y ago
  If there are protection measures in place it could be a violation of DMCA, whether or not they had the owner's permission.
- privong 11y ago
  > The WIRED story's hackers presumably were authorized by the vehicle's owner or operator, so the demo did not "constitute criminal action." They were probably authorized by the driver, but car companies have argued that the driver does not "own" the software in the car, so I assume their claim of unauthorized access is predicated on the assumption that the car company still owns the software and that the car company did not authorize the access. I do not agree with the car company's stance on ownership, but that may be the origin of their claim.
  - maxerickson 11y ago
    The car company isn't claiming that the Wired hack was unauthorized. That paragraph is there to make it clear that the tampering is a significant action to take.
  - tantalor 11y ago
    WIRED has another story about this question, http://www.wired.com/2015/04/dmca-ownership-john-deere/ http://www.wired.com/2015/04/dmca-ownership-john-deere/ Supposedly the US Copyright Office will decide this month.
- justizin 11y ago
  I'm pretty sure it was /their/ Jeep.
- 11y ago
ryandrake 11y ago
Auto companies' lax attitudes towards systems security will change when insurance companies start considering such security vulnerabilities as safety issues and adjust their existing safety ratings appropriately.
- brudgers 11y ago
  Insurance companies already do. Insurance rates are actuarily based on actual accident frequency. Outlier risks are covered by reinsurance. Not only are insurance companies well funded, they employ smart people and work in an information network with a lot of depth.
  - aianus 11y ago
    Yeah, right. The only way insurance companies are competitive and pricing risk correctly is if there's a magic responsibility fairy that bestows wisdom and driving ability upon all at midnight on their 25th birthday.
    - brudgers 11y ago
      If the band is 20-25, they charge everyone based on age 20, otherwise they would be subsidizing high risk drivers instead of generating more profit on 21-24 year olds. Actuaries are applied mathematicians, and typically of above average intelligence compared to the general populace.
      - aianus 11y ago
        Why would the band have to be 20-25 for every insurance company in the country? Why not be innovative and create an accurately priced 24-25 band and undercut your competition? I'll tell you why: because insurance companies are a rent-seeking oligopoly with an enormous barrier to entry. They just sit there and make a fortune doing jack shit.
    - deleted 11y ago
      [deleted]
bradgessler 11y ago
The good that comes out if this is that somewhere in the management chain people will feel justified to increase security investment by saying, "remember the Fiat Chrysler recall?"
fauigerzigerk 11y ago
Auto makers will have to make sure that they can update their software remotely or this going to become really expensive very soon.
- ytdht 11y ago
  They probably already can, if the use the right exploit.
- mzs 11y ago
  What's to say this wasn't precisely that? Maybe at the talk we will learn that accidentally uconnect was listening to the update FW messages from the sprint network. Often the board that handles the radio acts like a bridge in modern cars. It tends to be the beefiest computer hardware in the vehicle. So it is on the high speed CAN bus and a node on the more star shaped low speed bus. When they updated the FW, they removed the bit of code that prevented dangerous messages IDs from leaving the controllers on the radio board and possibly added code that could put arbitrary CAN bus messages on the buses as relay from the sprint network. I am very eagerly awaiting the talk.
  - deleted 11y ago
    [deleted]
discardorama 11y ago
If researchers really want to underscore a point: hang out outside the IIHS testing facility, and when they're testing the vehicle in question, then mess with the systems. Maybe IIHS needs to include "remote hackability" as a criterion in their testing?
- BinaryIdiot 11y ago
  > Maybe IIHS needs to include "remote hackability" as a criterion in their testing? I think so but just include hacking in general. Remote hacking is the worst but if someone can get physical access to some part of your car for a brief period of time (maybe the door's are unlocked and they plug something in or maybe they get under the hood and mess with the car's computer) you still have a major problem on your hands. Granted it's far harder to secure a device when someone has physical access to it but they need to test and harder for this the best they can as well. In my opinion anyway.
- dsfyu404ed 11y ago
  IIHS uses cars that aren't running and don't have fluids in them. They don't want to clean up that mess (or have the car destroyed by fire). They do test fuel system integrity though. I'm not sure if they use some other fluid (water + dye) or something like pressurized air or leakdown test after the fact. I guess you could engage in other antics but none of them would be all that effective since the car is towed by a cable until it's a few feet from whatever it's hitting.
  - discardorama 11y ago
    Actually, you are right. I was thinking of NHTSA, which does braking tests on an actual track.
dsfyu404ed 11y ago
Just an FYI for everyone on the "segregated systems" bandwagon: If a compromised device can talk on the CAN bus it's game over since (pretty much) everything listens on that bus so you can't (without a lot of time and effort, implement a way to) pick and choose systems to segregate while maintaining wireless connectivity to those critical system. Vehicle manufactures get a huge data set sent back to them by vehicles. They use this for stuff like correlating part failures to operational conditions, determining which intermittent wiper setting people use as well as improving the logic for the operation of critical systems (e.g. if my last inputs were $stuff then don't upshift). I wouldn't be surprised if they sold the data as well. McDonalds would love to know where and when people start looking for food. insurance companies would love to have more variables to correlate to risk trivial (e.g. $color cars with $trivial_feature get in accident that cost $really_small_percent $more_or_less than $other_color To segregate systems you need to be able to pitch to the bean-counters that the cost/benefit of whatever degree of segregation you're proposing beats the cost/benefit of whatever plan the next guy is proposing. These data sets are incredibly valuable to many different parts of the company. The people doing marketing and customer facing stuff would be at a severe competitive disadvantage if they had to wait months (first oil change) o get real world data on feature usage after a re-design. Sure you could download it at service time..."but we already have a system that does it in near real time, can't we just secure that?"... TL;DR: Segregating systems involves more than having the engineers wait a few months to figure out if their new tune solved the problem.
- krapp 11y ago
  Which costs less in the long run, a potential class action lawsuit and loss of consumer confidence, or better system security? If necessary, consider that security is a feature you can sell, when your competitors are following the path of least resistance and paying out their settlements.
  - dsfyu404ed 11y ago
    Depends on the lawsuit. How much effort would you go through to secure software that runs on a decade old vehicle with a very particular set of options if the exploit requires a very particular set of conditions? You might fix it just to have a similarly obscure zero day be discovered (unknown to you) and exploited in a different place. Then not only were all those resources spent in vain, but you've got to deal with the opportunity cost of not having thrown those resources behind current of future safety and security tech. People accept the risk of driving vehicles with legacy safety equipment, why should software be any different from hardware or legacy software in non-embedded applications. At some point you have to let stuff go. Just ask Microsoft.
nissehulth 11y ago
They claim that only US cars are affected. Is this because liability costs are much higher in the US or is there really a different software used in the rest of the world?
- maxerickson 11y ago
  It could also be related to the cell network used.
  - nissehulth 11y ago
    Good point. I guess there could also be some other service involved that's US only, something like OnStar.
  - takeda 11y ago
    Makes me wonder if that doesn't have something to do with IPv4 address exhaustion and perhaps cars in Europe are behind CGNAT.
jameshart 11y ago
I see a lot of people thoughtlessly applying computer-security mindset here to vehicle-safety. They're really not the same thing, because they are handling very different risk models. Vehicle safety is about "how will this system perform under typical conditions when something goes wrong?". Computer security is about "how will this system perform if a smart asshole tries to abuse it?". Vehicle safety generally doesn't concern itself with deliberate sabotage. You won't see a product recall for a car because "under some circumstances, a criminal might cut the brake cables". What Chrysler are doing here is, though, effectively that, and why they have to do that for a computer security issue is interesting. We're all used to the idea that if you put a computer on the internet, it will come under attack. People will try to snoop on the data it handles, or subvert it to use it for their own purposes. So why do we then move on to assume that, if such a system is attached to something safety critical, that those same people who will attack the computer to get at its data or processing power will now move on to attacking the brakes, or the engine, and try to kill people? Most vehicular crime isn't homicide, it's acquisitive - people will attack vehicle security systems to steal the car, or get access to valuable contents. Sabotaging the vehicle to kill the driver is way down the list. As a society we tend to assume that physical security is not the only thing that stops random strangers from trying to kill us. We do not all drive around in armored cars in case someone decides to shoot at us from an overpass. We don't all sweep under our car with a mirror for bombs before we get in and start the engine. And it's certainly not a failing of Chrysler's engineers to adequately consider customer safety that they sell Jeeps which are not bulletproof and which have exposed frameworks on the underside where bombs can be attached. So why is it that we're so quick to assume that because a safety-critical computer system is exposed to the internet, that this is the worst thing ever? Is it that as far as physical security of your Jeep goes you only have to trust the people in your neighborhood, but for internet security we have to trust the whole world?
- higherpurpose 11y ago
  So you're okay with spy agencies (from all over the world) as well as drug cartels and other criminal organizations having the power to kill you in an almost untraceable way while you're on the highway? Also, the US gov has been using these entertainment systems to spy on people for more than a decade...it's already been happening. Unfortunately, I can't find the link now, but it was a post from 2001 or 2003 on NYT and I think they were using Ford Sync to do it.
blahblah3 11y ago
Wow connecting cars to the internet? Sounds insanely dangerous. Not everything should be connected to the internet or "smart".
cmurf 11y ago
At RSA I was at a car hacking session, and the big take away I got is how some of these systems have none upgradable firmware, and today's designs sent for manufacturing now aren't due for 2017-2018 model year cars. So some of these vulns could be baked in, in a way that have expensive work arounds because the car manufacturers have been so feature driven rather than security conscious. It's the car equivalent of bloat/crap ware on phones. Features that drive up selling the customer. The cars that have OTA firmware updates (BMW was one example) are able to push out fixes faster, and with more complete coverage than recalls so it seems sane to me to make it mandatory such "smart cars" can be OTA updated.
LoSboccacc 11y ago
> The company added that hacking its vehicles was a "criminal action". screw that attitude. I hope government will make the equivalent of whistleblower protection for security researchers that report exploitable flaws, because it's the only way to increase security over time. i.e. I'm scared as hell that planes are allegedly hackable but researchers aren't really talking about it nor testing it properly because fear of lawsuits.
mizzao 11y ago
So despite the huge uproar at https://news.ycombinator.com/item?id=9921557 https://news.ycombinator.com/item?id=9921557, it turns out the end did justify the means.
- JeremyBanks 11y ago
  That only holds if there were no better means that could have achieved the same ends.
  - mizzao 11y ago
    It's possible, but can you cite another example of when a news article caused a recall to be issued a couple days later? It seems unlikely - usually takes months if anything happens at all.
    - rhino369 11y ago
      Do you really think this article would be less successful if the driver was on a test track?
      - jessaustin 11y ago
        Yes I think that. This was on local news early in the morning, just to cite one source from which I rarely get hacking stories. Normally they just talk about weather and how the elderly are getting scammed. This test occurring on a public road created an effective visual, that pushed the story into many more media channels.
        MBCook 11y ago
        I think 'hackers turned off the breaks on a car with a reporter in it at 70mph' would have made headlines even if it took place on a test track. It's a juicy story with plenty of 'it could happen to you' scare factor built in.
- oh_sigh 11y ago
pasbesoin 11y ago
Based upon my own experience (in another industry), I have no doubt that there were knowledgeable people internally who warned them of this -- if they were not fully cowed by the bureaucracy. I have zero sympathy for the manufacturers. I only hope that, if they decide to go on a witch hunt, they actually seek and punish the morons in power who, most likely for self-serving purposes, let this slide. This also should raise a ringing cry to rein in DMCA et al. uses that seek to outlaw such research. In this case, the manufacturer has obviated their authority in the matter.
deleted 11y ago
[deleted]
JustSomeNobody 11y ago
Do we really need our vehicles to have so much technology? I know I'll get down voted, but it has to be asked.
- csours 11y ago
  Short answer, no. But, consumers expect a infotainment user experience at least as good as hanging an iPad in the car, and if your car doesn't provide that, they will rate it poorly in surveys. Source / Disclaimer - I work for GM.
rasz_pl 11y ago
In other news Apple just hired Doug Betts, former FCA 'quality' boss http://blog.caranddriver.com/fiat-chrysler-quality-chief-resigns-one-day-after-terrible-consumer-reports-rankings/ http://blog.caranddriver.com/fiat-chrysler-quality-chief-res... http://www.autonews.com/article/20141028/OEM02/141029851/betts-leaves-chrysler-after-another-poor-quality-showing http://www.autonews.com/article/20141028/OEM02/141029851/bet... http://www.techtimes.com/articles/70582/20150721/apple-hires-fiat-chrysler-executive-doug-betts-beep-beep-beep-icar-coming.htm http://www.techtimes.com/articles/70582/20150721/apple-hires... because nothing screams quality like a 'decided to leave one day after yet another drop in Consumer Report rankings' and 1.4m car recall!
deleted 11y ago
[deleted]
bithead 11y ago
>"I wonder what is cheaper, designing secure cars or doing recalls?" Ever the enduring question
satyajeet23 11y ago
If you have to update software in person, you shouldn't be in the software business.
bborud 11y ago
I've been spending a bit of time over the last couple of months reading up on CAN, OBD2, system architectures for automotive systems, attack vectors, various forms of CAN-attacks, building stuff that interfaces with CAN buses, writing software, figuring out how things work etc. And I have to say that many of the comments in this thread are frighteningly uninformed. I know this is supposed to be The Magic Kingdom where people are only supposed to say positive things and eat happy pills all day, but would it kill people to at least try to read up about the things they so willingly share their "insights" on before posting here? At the very least, try to understand how CAN works before spouting nonsense grounded in uninformed assumption. Uninformed opinions are not helpful. They just pollute the discussion.

251 points by vvanders 11y ago

From the press release: http://www.media.chrysler.com/newsrelease.do?id=16849&mid=1 http://www.media.chrysler.com/newsrelease.do?id=16849&mid=1 "No defect has been found. FCA US is conducting this campaign out of an abundance of caution." What the hell?

freehunter 11y ago
That's probably the wording their lawyers asked them to use so they would not be liable for damages. If they admit fault, they're legally to blame for any accidents or damage.
beambot 11y ago
Preemptively admitting fault probably creates issues if there is future litigation.
maxerickson 11y ago
Defect appears to have a particular meaning in relation to vehicle safety. I'm just basing that on the way it is used here: http://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm http://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm I guess it isn't that big a stretch to use such defensive language, there are a lot of things that can be tampered with on a vehicle that arise out of engineering trade offs. I don't mean to dismiss the problem at hand, but it is only an issue if someone makes an effort to tamper with a vehicle, which is different than a critical part failing prematurely or whatever.
- gandalfu 11y ago
  Unfortunately your argument makes sense.
rhino369 11y ago
Legally a defect in a product means you are stictly liable for all damage it causes. But also the hackers haven't demo'd the exploit in an untampered with car. I still wonder if you need physical access to do this.
- fnordfnordfnord 11y ago
  If my understanding is correct, Uconnect/Bluetooth security is the weakest link, which isn't much comfort.

skimmas 11y ago

One got to love bright minds who ever thought connecting any relevant part of a cars control mechanisms to the internet was a good idea.

hueving 11y ago
The issue is the stupid media center. People want that to have Internet. Then at the same time they want it to display all of the climate details and other system info that comes off the CAN.
- jasimq 11y ago
  But surely they can be isolated systems
  - jacquesm 11y ago
    They can be but they're not. Once you share a wire all bets are off.
    - UnoriginalGuy 11y ago
      By that logic there's no security on the internet at all. Everything "shares a wire" after all. Security is about degrees and nuances. These kind of black & white statements are unhelpful and unrealistic.
      - justizin 11y ago
        > By that logic there's no security on the internet at all. Have you /been/ on the internet, lately? ;)
  - brudgers 11y ago
    Two systems that accept input from the same touchscreen can't be isolated in hardware. From the software side, any portion of each system's interface that overlaps at the touchscreen cannot be isolated. On top of that, if the touchscreen is reprogrammable, then it can be attacked directly and touchscreens are commodity devices not normally considered part of the security infrastructure.

jasimq 11y ago

If you missed it, this is related: http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ http://www.wired.com/2015/07/hackers-remotely-kill-jeep-high...

maxerickson 11y ago
Discussed here: https://news.ycombinator.com/item?id=9921557 https://news.ycombinator.com/item?id=9921557 Also related: https://news.ycombinator.com/item?id=9929177 https://news.ycombinator.com/item?id=9929177

jacquesm 11y ago

> The company added that hacking its vehicles was a "criminal action". I don't think that's the case, but I still commend them for doing a recall this quick. Shooting the messenger seems to still be quite a strong reflex for corporations faced with bad news. The way to look at it should be that these guys did Fiat-Chrysler a service. After all, it's not only security researchers that have the ability to write code and that have prolonged access to a vehicle to test. They seem to be mistaken about the time to write the code, after all, you can write the code and test it on a different vehicle than the one you intend to crash. Law enforcement typically won't analyze the firmware of all the computers in a car after a single vehicle accident (and it would probably be quite possible to erase the evidence once the car has been given a command sufficient to kill the occupants).

maxerickson 11y ago
The language in the FCA press release (linked in another thread) is softer: The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action. So through the process of extensive journalism, unauthorized remote manipulation got turned into hacking vehicles.
- MBCook 11y ago
  It was hacking. They clearly proved they had control over dangerous parts of random vehicles. > The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation[...] Assuming that's not a lie, were they working on that because the 'researcher' (quotes due irresponsible 'testing') had been sending FCA what they found instead of their own internal decision to improve things and they knew this (specifically) was coming at some point?
  - maxerickson 11y ago
    It was hacking. I'm not quibbling about that. I replied to this statement: > The company added that hacking its vehicles was a "criminal action". I don't think that's the case, but I still commend them for doing a recall this quick. Which characterizes the statement in the article to be about hacking the vehicle at all. So my reply points out that the manufacturer was probably not putting forth that characterization when they talked about criminal action, they were likely talking about unauthorized remote manipulation (which should be and quite likely is criminal). So my argument is that the manufacturer statement about criminality is narrower in scope than the BBC translation of it. The software update release is obviously in response to the research: https://twitter.com/0xcharlie/status/623492229714313216 https://twitter.com/0xcharlie/status/623492229714313216 Upgrading it to a recall is probably in response to bad press.

tinco 11y ago

This is a terrible decision. On such a short timescale, they'll only be able to fix the particular bug in their infotainment system. The real problem as everyone has pointed out is that the car control and infotainment should not share channels. There should be a physical gap between them and if really necessary a very tightly controlled message bridge. The real fix will require much more intervention than just a firmware flash at the garage. We'll see at Def Con how much Chrysler really screwed up.

Xorlev 11y ago
> This is a terrible decision. It's the only one available to them. They can't just refit all existing cars with a new design on a short timeline. Hardware has permanence. With that in mind, how would you fix the issue for existing vehicles?
- SEJeff 11y ago
  The infotainment system should never have access to the CAN[1] network in the first place... ever. At most, they could have a very simple listener on the can network that could send data (one way only) to the infotainment device via a different channel of sorts. Mixing the two is asking for issues such as just this to happen. [1] https://en.wikipedia.org/wiki/CAN_bus https://en.wikipedia.org/wiki/CAN_bus
  - fnordfnordfnord 11y ago
    I've done some CAN stuff (not on cars though), and that is the way that everyone I talked to advised to build your system, if suitable. However, we still pushed firmware from the master, so if the master were ever compromised, then all of the nodes would be potentially compromised as well. There is only sending and receiving data. All nodes receive any data from anything else on the bus. A node typically ignores data not addressed to itself but not always, that is up to the programmer. Any node can potentially impersonate the master, or another node. There is no way to prevent this, other than through the firmware.

curiousjorge 11y ago

Why does Jeep in particular have so much issue with quality assurance? The most memorable is the SUV rolling over in a simple test a couple years ago which have been fixed but it's quite worrying. https://www.youtube.com/watch?v=zaYFLb8WMGM https://www.youtube.com/watch?v=zaYFLb8WMGM

sp332 11y ago
A lot of SUVs were prone to rolling over before they got the traction control system right.
justizin 11y ago
This is not particular to Jeep, the Jeep Cherokee is simply the particular car they hacked. This basically affects all Fiat Chrysler vehicles.
dsfyu404ed 11y ago
First off that test is somewhat of a joke for SUVs since it basically rewards car-ish handling which is at odds with the truck-ish performance that is demanded of larger SUVs In terms of comparing two different vehicles... If the $year base model $carA has a suspension system closer in performance to the sport model of $year $carB but for $year+1 they put a much softer suspension in the base model of $carA in response to customer feedback then the results go out the window. Alternatively, if the OE tires are particularly expensive then you can bet that most owners will replace them with cheaper one. Additionally, particular trims are often incredibly rare or almost always have a particular option added. So testing a $trim without $package will be of little meaning when the vast majority of $trim that make it to dealer lots will have $package. In either case the results go out the window because there's a handful of large variables that are uncontrolled for. It's little better than the comparisons you see in car commercials. If you actually want to grill Jeep over something I suggest you read up on 90s XJ gas tank fires.

tantalor 11y ago

The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action. The WIRED story's hackers presumably were authorized by the vehicle's owner or operator, so the demo did not "constitute criminal action."

latortuga 11y ago
If there are protection measures in place it could be a violation of DMCA, whether or not they had the owner's permission.
privong 11y ago
> The WIRED story's hackers presumably were authorized by the vehicle's owner or operator, so the demo did not "constitute criminal action." They were probably authorized by the driver, but car companies have argued that the driver does not "own" the software in the car, so I assume their claim of unauthorized access is predicated on the assumption that the car company still owns the software and that the car company did not authorize the access. I do not agree with the car company's stance on ownership, but that may be the origin of their claim.
- maxerickson 11y ago
  The car company isn't claiming that the Wired hack was unauthorized. That paragraph is there to make it clear that the tampering is a significant action to take.
- tantalor 11y ago
  WIRED has another story about this question, http://www.wired.com/2015/04/dmca-ownership-john-deere/ http://www.wired.com/2015/04/dmca-ownership-john-deere/ Supposedly the US Copyright Office will decide this month.
justizin 11y ago
I'm pretty sure it was /their/ Jeep.
11y ago

ryandrake 11y ago

Auto companies' lax attitudes towards systems security will change when insurance companies start considering such security vulnerabilities as safety issues and adjust their existing safety ratings appropriately.

brudgers 11y ago
Insurance companies already do. Insurance rates are actuarily based on actual accident frequency. Outlier risks are covered by reinsurance. Not only are insurance companies well funded, they employ smart people and work in an information network with a lot of depth.
- aianus 11y ago
  Yeah, right. The only way insurance companies are competitive and pricing risk correctly is if there's a magic responsibility fairy that bestows wisdom and driving ability upon all at midnight on their 25th birthday.
  - brudgers 11y ago
    If the band is 20-25, they charge everyone based on age 20, otherwise they would be subsidizing high risk drivers instead of generating more profit on 21-24 year olds. Actuaries are applied mathematicians, and typically of above average intelligence compared to the general populace.
    - aianus 11y ago
      Why would the band have to be 20-25 for every insurance company in the country? Why not be innovative and create an accurately priced 24-25 band and undercut your competition? I'll tell you why: because insurance companies are a rent-seeking oligopoly with an enormous barrier to entry. They just sit there and make a fortune doing jack shit.
  - deleted 11y ago
    [deleted]

bradgessler 11y ago

The good that comes out if this is that somewhere in the management chain people will feel justified to increase security investment by saying, "remember the Fiat Chrysler recall?"

fauigerzigerk 11y ago

Auto makers will have to make sure that they can update their software remotely or this going to become really expensive very soon.

ytdht 11y ago
They probably already can, if the use the right exploit.
mzs 11y ago
What's to say this wasn't precisely that? Maybe at the talk we will learn that accidentally uconnect was listening to the update FW messages from the sprint network. Often the board that handles the radio acts like a bridge in modern cars. It tends to be the beefiest computer hardware in the vehicle. So it is on the high speed CAN bus and a node on the more star shaped low speed bus. When they updated the FW, they removed the bit of code that prevented dangerous messages IDs from leaving the controllers on the radio board and possibly added code that could put arbitrary CAN bus messages on the buses as relay from the sprint network. I am very eagerly awaiting the talk.
- deleted 11y ago
  [deleted]

discardorama 11y ago

If researchers really want to underscore a point: hang out outside the IIHS testing facility, and when they're testing the vehicle in question, then mess with the systems. Maybe IIHS needs to include "remote hackability" as a criterion in their testing?

BinaryIdiot 11y ago
> Maybe IIHS needs to include "remote hackability" as a criterion in their testing? I think so but just include hacking in general. Remote hacking is the worst but if someone can get physical access to some part of your car for a brief period of time (maybe the door's are unlocked and they plug something in or maybe they get under the hood and mess with the car's computer) you still have a major problem on your hands. Granted it's far harder to secure a device when someone has physical access to it but they need to test and harder for this the best they can as well. In my opinion anyway.
dsfyu404ed 11y ago
IIHS uses cars that aren't running and don't have fluids in them. They don't want to clean up that mess (or have the car destroyed by fire). They do test fuel system integrity though. I'm not sure if they use some other fluid (water + dye) or something like pressurized air or leakdown test after the fact. I guess you could engage in other antics but none of them would be all that effective since the car is towed by a cable until it's a few feet from whatever it's hitting.
- discardorama 11y ago
  Actually, you are right. I was thinking of NHTSA, which does braking tests on an actual track.

dsfyu404ed 11y ago

Just an FYI for everyone on the "segregated systems" bandwagon: If a compromised device can talk on the CAN bus it's game over since (pretty much) everything listens on that bus so you can't (without a lot of time and effort, implement a way to) pick and choose systems to segregate while maintaining wireless connectivity to those critical system. Vehicle manufactures get a huge data set sent back to them by vehicles. They use this for stuff like correlating part failures to operational conditions, determining which intermittent wiper setting people use as well as improving the logic for the operation of critical systems (e.g. if my last inputs were $stuff then don't upshift). I wouldn't be surprised if they sold the data as well. McDonalds would love to know where and when people start looking for food. insurance companies would love to have more variables to correlate to risk trivial (e.g. $color cars with $trivial_feature get in accident that cost $really_small_percent $more_or_less than $other_color To segregate systems you need to be able to pitch to the bean-counters that the cost/benefit of whatever degree of segregation you're proposing beats the cost/benefit of whatever plan the next guy is proposing. These data sets are incredibly valuable to many different parts of the company. The people doing marketing and customer facing stuff would be at a severe competitive disadvantage if they had to wait months (first oil change) o get real world data on feature usage after a re-design. Sure you could download it at service time..."but we already have a system that does it in near real time, can't we just secure that?"... TL;DR: Segregating systems involves more than having the engineers wait a few months to figure out if their new tune solved the problem.

krapp 11y ago
Which costs less in the long run, a potential class action lawsuit and loss of consumer confidence, or better system security? If necessary, consider that security is a feature you can sell, when your competitors are following the path of least resistance and paying out their settlements.
- dsfyu404ed 11y ago
  Depends on the lawsuit. How much effort would you go through to secure software that runs on a decade old vehicle with a very particular set of options if the exploit requires a very particular set of conditions? You might fix it just to have a similarly obscure zero day be discovered (unknown to you) and exploited in a different place. Then not only were all those resources spent in vain, but you've got to deal with the opportunity cost of not having thrown those resources behind current of future safety and security tech. People accept the risk of driving vehicles with legacy safety equipment, why should software be any different from hardware or legacy software in non-embedded applications. At some point you have to let stuff go. Just ask Microsoft.

nissehulth 11y ago

They claim that only US cars are affected. Is this because liability costs are much higher in the US or is there really a different software used in the rest of the world?

maxerickson 11y ago
It could also be related to the cell network used.
- nissehulth 11y ago
  Good point. I guess there could also be some other service involved that's US only, something like OnStar.
- takeda 11y ago
  Makes me wonder if that doesn't have something to do with IPv4 address exhaustion and perhaps cars in Europe are behind CGNAT.

jameshart 11y ago

I see a lot of people thoughtlessly applying computer-security mindset here to vehicle-safety. They're really not the same thing, because they are handling very different risk models. Vehicle safety is about "how will this system perform under typical conditions when something goes wrong?". Computer security is about "how will this system perform if a smart asshole tries to abuse it?". Vehicle safety generally doesn't concern itself with deliberate sabotage. You won't see a product recall for a car because "under some circumstances, a criminal might cut the brake cables". What Chrysler are doing here is, though, effectively that, and why they have to do that for a computer security issue is interesting. We're all used to the idea that if you put a computer on the internet, it will come under attack. People will try to snoop on the data it handles, or subvert it to use it for their own purposes. So why do we then move on to assume that, if such a system is attached to something safety critical, that those same people who will attack the computer to get at its data or processing power will now move on to attacking the brakes, or the engine, and try to kill people? Most vehicular crime isn't homicide, it's acquisitive - people will attack vehicle security systems to steal the car, or get access to valuable contents. Sabotaging the vehicle to kill the driver is way down the list. As a society we tend to assume that physical security is not the only thing that stops random strangers from trying to kill us. We do not all drive around in armored cars in case someone decides to shoot at us from an overpass. We don't all sweep under our car with a mirror for bombs before we get in and start the engine. And it's certainly not a failing of Chrysler's engineers to adequately consider customer safety that they sell Jeeps which are not bulletproof and which have exposed frameworks on the underside where bombs can be attached. So why is it that we're so quick to assume that because a safety-critical computer system is exposed to the internet, that this is the worst thing ever? Is it that as far as physical security of your Jeep goes you only have to trust the people in your neighborhood, but for internet security we have to trust the whole world?

higherpurpose 11y ago
So you're okay with spy agencies (from all over the world) as well as drug cartels and other criminal organizations having the power to kill you in an almost untraceable way while you're on the highway? Also, the US gov has been using these entertainment systems to spy on people for more than a decade...it's already been happening. Unfortunately, I can't find the link now, but it was a post from 2001 or 2003 on NYT and I think they were using Ford Sync to do it.

blahblah3 11y ago

Wow connecting cars to the internet? Sounds insanely dangerous. Not everything should be connected to the internet or "smart".

cmurf 11y ago

At RSA I was at a car hacking session, and the big take away I got is how some of these systems have none upgradable firmware, and today's designs sent for manufacturing now aren't due for 2017-2018 model year cars. So some of these vulns could be baked in, in a way that have expensive work arounds because the car manufacturers have been so feature driven rather than security conscious. It's the car equivalent of bloat/crap ware on phones. Features that drive up selling the customer. The cars that have OTA firmware updates (BMW was one example) are able to push out fixes faster, and with more complete coverage than recalls so it seems sane to me to make it mandatory such "smart cars" can be OTA updated.

LoSboccacc 11y ago

> The company added that hacking its vehicles was a "criminal action". screw that attitude. I hope government will make the equivalent of whistleblower protection for security researchers that report exploitable flaws, because it's the only way to increase security over time. i.e. I'm scared as hell that planes are allegedly hackable but researchers aren't really talking about it nor testing it properly because fear of lawsuits.

mizzao 11y ago

So despite the huge uproar at https://news.ycombinator.com/item?id=9921557 https://news.ycombinator.com/item?id=9921557, it turns out the end did justify the means.

JeremyBanks 11y ago
That only holds if there were no better means that could have achieved the same ends.
- mizzao 11y ago
  It's possible, but can you cite another example of when a news article caused a recall to be issued a couple days later? It seems unlikely - usually takes months if anything happens at all.
  - rhino369 11y ago
    Do you really think this article would be less successful if the driver was on a test track?
    - jessaustin 11y ago
      Yes I think that. This was on local news early in the morning, just to cite one source from which I rarely get hacking stories. Normally they just talk about weather and how the elderly are getting scammed. This test occurring on a public road created an effective visual, that pushed the story into many more media channels.
      - MBCook 11y ago
        I think 'hackers turned off the breaks on a car with a reporter in it at 70mph' would have made headlines even if it took place on a test track. It's a juicy story with plenty of 'it could happen to you' scare factor built in.
oh_sigh 11y ago

pasbesoin 11y ago

Based upon my own experience (in another industry), I have no doubt that there were knowledgeable people internally who warned them of this -- if they were not fully cowed by the bureaucracy. I have zero sympathy for the manufacturers. I only hope that, if they decide to go on a witch hunt, they actually seek and punish the morons in power who, most likely for self-serving purposes, let this slide. This also should raise a ringing cry to rein in DMCA et al. uses that seek to outlaw such research. In this case, the manufacturer has obviated their authority in the matter.

deleted 11y ago

[deleted]

JustSomeNobody 11y ago

Do we really need our vehicles to have so much technology? I know I'll get down voted, but it has to be asked.

csours 11y ago
Short answer, no. But, consumers expect a infotainment user experience at least as good as hanging an iPad in the car, and if your car doesn't provide that, they will rate it poorly in surveys. Source / Disclaimer - I work for GM.

rasz_pl 11y ago

In other news Apple just hired Doug Betts, former FCA 'quality' boss http://blog.caranddriver.com/fiat-chrysler-quality-chief-resigns-one-day-after-terrible-consumer-reports-rankings/ http://blog.caranddriver.com/fiat-chrysler-quality-chief-res... http://www.autonews.com/article/20141028/OEM02/141029851/betts-leaves-chrysler-after-another-poor-quality-showing http://www.autonews.com/article/20141028/OEM02/141029851/bet... http://www.techtimes.com/articles/70582/20150721/apple-hires-fiat-chrysler-executive-doug-betts-beep-beep-beep-icar-coming.htm http://www.techtimes.com/articles/70582/20150721/apple-hires... because nothing screams quality like a 'decided to leave one day after yet another drop in Consumer Report rankings' and 1.4m car recall!

deleted 11y ago

[deleted]

bithead 11y ago

>"I wonder what is cheaper, designing secure cars or doing recalls?" Ever the enduring question

satyajeet23 11y ago

If you have to update software in person, you shouldn't be in the software business.

bborud 11y ago

I've been spending a bit of time over the last couple of months reading up on CAN, OBD2, system architectures for automotive systems, attack vectors, various forms of CAN-attacks, building stuff that interfaces with CAN buses, writing software, figuring out how things work etc. And I have to say that many of the comments in this thread are frighteningly uninformed. I know this is supposed to be The Magic Kingdom where people are only supposed to say positive things and eat happy pills all day, but would it kill people to at least try to read up about the things they so willingly share their "insights" on before posting here? At the very least, try to understand how CAN works before spouting nonsense grounded in uninformed assumption. Uninformed opinions are not helpful. They just pollute the discussion.