11 ms·

> This is a terrible decision. It's the only one available to them. They can't just refit all existing cars with a new design on a short timeline. Hardware has

by Xorlev 11y ago

> This is a terrible decision. It's the only one available to them. They can't just refit all existing cars with a new design on a short timeline. Hardware has permanence. With that in mind, how would you fix the issue for existing vehicles?

SEJeff 11y ago
The infotainment system should never have access to the CAN[1] network in the first place... ever. At most, they could have a very simple listener on the can network that could send data (one way only) to the infotainment device via a different channel of sorts. Mixing the two is asking for issues such as just this to happen. [1] https://en.wikipedia.org/wiki/CAN_bus https://en.wikipedia.org/wiki/CAN_bus
- fnordfnordfnord 11y ago
  I've done some CAN stuff (not on cars though), and that is the way that everyone I talked to advised to build your system, if suitable. However, we still pushed firmware from the master, so if the master were ever compromised, then all of the nodes would be potentially compromised as well. There is only sending and receiving data. All nodes receive any data from anything else on the bus. A node typically ignores data not addressed to itself but not always, that is up to the programmer. Any node can potentially impersonate the master, or another node. There is no way to prevent this, other than through the firmware.
  - semi-extrinsic 11y ago
    One thing I've not seen addressed in this context: If someone wants to create mayhem on a highway, why would they not go low-tech / low effort? There's a number of mechanical and electrical attacks that I can think of just off the top of my head. Analogy: is it worth the time making a pick-proof lock for the front door when someone can just break a window? (I'm not saying we should let car manufacturers off the hook, just offering a perspective on the realism of the threat.)
    - romaniv 11y ago
      why would they not go low-tech / low effort? Attribution. Mechanical attacks are easier to attribute than something that can be done from across the world over the Internet.
    - mattdeboard 11y ago
      There's also inhibitions to talk about. It's one thing to go lay a spike strip down in the middle of the road and it's another to do something over the internet.
    - fnordfnordfnord 11y ago
      I'm sure there are some who might want to "create mayhem on a highway" and who would not choose this route. But when your potential attackers are [everyone with an internet connection] this kind of exploit has huge potential. Imagine if the vulnerability were bundled with a popular mobile website or if someone else cracked how to mass-distribute it. Countries that are at war could use it against their enemy. Al-Abu-ISIS-HAMAS-Nidal-Haram-Boko could use it against anyone/everyone. >Analogy: is it worth the time making a pick-proof lock for the front door when someone can just break a window? Yes, because not everyone can throw a rock from their house to yours, be nearly everyone can be connected to the internet.
- wvenable 11y ago
  > The infotainment system should never have access to the CAN[1] network in the first place... ever. The problem is access to the CAN bus is necessary to change various vehicle settings from the infotainment system. I know for a fact that changing the door lock settings in my car requires the infotainment system to access the CAN bus to apply settings to that system. This is not an unsolvable problem; this is basic software engineering. Processes should be isolated from each other. I imagine everything in the infotainment system effectively runs as "root" because they consider the whole thing a singular black box.
  - UnoriginalGuy 11y ago
    I agree with both you and the person above. I think the missing word we're looking for is: "unrestricted" (as in unrestricted access should not be permitted). Yes, the info system needs SOME access to the CAN network. But it shouldn't be unrestricted access. Instead the info system should be treated as "untrusted" and only specific things should be permissible over a well documented set of APIs. I'd almost be tempted to say that while the car is moving, ALL access to the CAN network should be disabled. Since let's name some things the info system needs on the CAN network: - Reconfigure car (e.g. daylight running lights, auto-locking door, etc). - Start car remotely. - Set AC remotely. - Diagnostics. The only one on that list which MIGHT be useful to have while the car is in motion is diagnostics. And that could be delivered via a read only interface.
    - SEJeff 11y ago
      Perhaps a small proxy application that is fully vetted and tested code. This doesn't seem too dissimilar from the "I need a small suid root app to do $root_thing for an unprivileged user". As you said, unrestricted access is the problem. This just is typical "principle of least privilege" kind of stuff. Totally doable, but it is unbelievable to me the lack of forethought in things like this.
      - fnordfnordfnord 11y ago
        CAN has been around for a long time. I don't think we can blame Bosch that they didn't see from 1985 the pitfalls of someone possibly adding global internet connectivity, nor can we assume they would have advised interconnecting CAN systems with the internet.
- mzs 11y ago
  A lot of cars have audio controls on the steering wheel. It used to be on separate wires but now that's on CAN, save money. So that's one reason infotainment is on CAN. It could be it's own CAN bus completely separated but you probably also have the CC on the wheel too. So do you put the CC on the same one? But wait, there's the SRS there too, oh man that plays ball with the self diagnostics. Hmm looks like we need a high priority CAN in the wheel, might as well use it for everything. That's how it goes...
  - fineman 11y ago
    It's perfectly reasonable to use the same bus to carry driving and infotainment commands from the wheel - those are simply physical switches. Also, the steering wheel isn't connected to the cellular network. It's the infosystem that shouldn't be able to broadcast on that bus. There should be a very limited set of messages that will be accepted from it and there should be a dedicated circuit that drops everything else.
    - mzs 11y ago
      I'm not disagreeing with you, it's just the realities. For example CAN does not have a notion of source, it's really in the abstract a whole lot like a bus, just with cables. So one reason the infotainment might want to send commands is to that station/song information appears in the instrument cluster. Now I agree it would be really smart if there was another module sitting between the the radio and the IPC with two sides and it filters both ways. Also that gateway has logic like, I have power but it's been less than a minute, this packet has the right code, sure I will let this reflash happen. In fact such devices exist (except they are more trusting). The thing is though that the radio tends to have the most impressive CPU of all in the car, so there is pressure to add that in there (I mean there was one manufacturer that had tried to merge BCM, TCM, telematics, and DIC all into the head unit with a roughly 400MHz cpu, so that gives oyu an idea), logic like 'yeah maybe, we won't be sending that in fact.' But once it is hacked, all bets are off, it can even DOS the bus. The other aspect is you just want they crap from Delco to work with the stuff from TRW and the gateway is getting in the way and yo don't want to expend the resources to figure-out why. When it was all a wired network, it did not really matter so much.
- ChuckMcM 11y ago
  Easy to say, hard to do. Really cars now need TWO CAN bus networks, the RED network and the BLUE network. All critical car functions on the RED isolated network, vanity functions on the BLUE network. So often though a designer will say "We really want to help people who call in for roadside assistance, we just want to read the CAN bus, we don't need to write it." And some complex function will be created that only "reads" but then a overflow attack or some other exploit lets arbitrary code get run and since its possible to write code with a write function your security is toast. So what actually will happen (I hope) is that a bunch of things will no longer be possible from the infotainment system because that system doesn't have access to the CAN bus at all. And any UI that does have access to the CAN bus won't have any wireless access to it at all. Which will make some car features, less featurefull.
  - simcop2387 11y ago
    They've largely had something like this already in most cars, a low speed bus that's got the non-critical things (seat position controls, window controls, etc.) and a high speed one that has all the things like engine data, speedometer updates, etc. I definitely agree though they need to take this to the level that's usually seen in avionics with a read only gap between the third entertainment system bus. Without that you really can't hope to secure it. The only real problem I can see is how would you let the roadside assistance stuff unlock the doors? Maybe an authenticated write only to the low speed bus that you don't get to control the message, just "unlock all doors".
    - paulmd 11y ago
      There are very few "non-critical" systems in a 2+ ton vehicle moving at highway-to-expressway speeds. For an example of what a "minor" system like seat position can do, consider the following: http://www.lakecountrynow.com/opinion/blogs/communityblogs/130253333.html http://www.lakecountrynow.com/opinion/blogs/communityblogs/1... After more investigation they ended up suspecting a different failure mode, but it speaks to the danger of even pedestrian functionality. Most people are shit drivers who are unsafe to be around in the best of times, "minor" things like stereo control, windshield washing, etc are certainly enough to distract them let alone being physically moved out of the reach of the controls. Particularly in combination, let alone in rush hour traffic or bad weather.
- mattdeboard 11y ago
  I thought about this too, but they're replacing the firmware with their own custom firmware OTA. How do you know that your hypothetical "very simple listener" won't be bypassed or re-appropriated for other means?
  - delinka 11y ago
    This sounds like the equivalent of sending UDP over the Internet. If you're receiving UDP from a server, you're not going to get access to the server just because it spouts UDP. If that's the _only_ thing the server does, you're just not going to gain access to it.
- bmir-alum-007 11y ago
  It's unfortunate but the reality is that manufacturers are too cheap/lazy to segregate devices on to separate L2 segments, deploy fw or keyed A3E until forced to by exposure of hack demos. In cars (and IoT), standards make everything cheaper but easier to hack without sensible security measures.
maxerickson 11y ago
Assuming the network fixes are effective, the recall is just a PR campaign.
- acdha 11y ago
  Perfect network security is a rather big assumption, though, isn't it? We recommend layered security to protect people's cat pictures – doesn't it seem like a good idea for something which could literally result in casualties?
  - maxerickson 11y ago
    Sure. My point is more that a fix that eliminates the ability for people to just use the internet to manipulate the vehicles removes a great deal of the urgency for corrections on the vehicle side.
    - acdha 11y ago
      It does make it less of an emergency but it also means that anyone with malicious intent has a huge incentive to look for a way around the network block because there's a known win if they find one.
    - fineman 11y ago
      What does it mean to you to "eliminate the ability for ..."? To patch the known bug? Or do an audit and fix all the bugs they find? Or unplug the system? If they were yanking the cellular connection that'd be pretty good... If they're just patching one or two obvious holes it'll likely be broken again by Blackhat.
      - maxerickson 11y ago
        It means I should have used fuzzier language (so as to not imply that I have a solid understanding of the bugs). But: https://twitter.com/0xcharlie/status/624608184485851136 https://twitter.com/0xcharlie/status/624608184485851136 So the vehicle connection is not as visible as it used to be.
bendykstra 11y ago
I think that disabling the entertainment center's access to the internet would be the responsible thing to do. Given Toyota's recent $1.2B settlement over the unintended acceleration defect, leaving this door open to hackers could be very costly for Chrysler.
- mratzloff 11y ago
  Hell, I'm driving a 2015 Jeep Cherokee as a rental right now and I don't even want it connected to the Internet. But you've gotta have car apps, right? How else would car manufacturers be priming you to accept in-car advertising than an Internet-connected screen that you can't turn off completely?
fineman 11y ago
>> This is a terrible decision. > It's the only one available to them. No, it's the only easy option they have. Take all the vulnerable vehicles off the road. That's another option they have. > How would you fix the issue for existing vehicles? Have dealers yank the cellular connection in every vehicle and refund the customers something for removing a feature the product sold with. Nothing else will fix it in a short timeline.
- imglorp 11y ago
  It's not just cellular. They also found it was the digital radio, and presumably anything else on that bus. Bluetooth? Key fobs? In-car wifi hotspot? Who knows what other entry vectors there are.
MichaelCrawford 11y ago
"Hardware has permanance" That automobiles are recalled for reasons other than hardware replacement is a recent phenomenon. However a software patch would keep Def Con busy while replacement hardware is developed.
- Xorlev 11y ago
  > That automobiles are recalled for reasons other than hardware replacement is a recent phenomenon. Sure, but how often are they doing major surgery vs. replacing a part / doing a patch? It sounds to me like properly fixing this issue would be a fairly sizable undertaking.
laacz 11y ago
Would it be really hard to fix this OTA for all vehicles, reusing (and patching) their own bug? This is a technical question, law might forbid doing this.
laacz 11y ago
Would it be really hard to fix this OTA for all vehicles, reusing (and patching) their own bug? This is a technical question, law might forbid doing this.

by Xorlev 11y ago

SEJeff 11y ago

The infotainment system should never have access to the CAN[1] network in the first place... ever. At most, they could have a very simple listener on the can network that could send data (one way only) to the infotainment device via a different channel of sorts. Mixing the two is asking for issues such as just this to happen. [1] https://en.wikipedia.org/wiki/CAN_bus https://en.wikipedia.org/wiki/CAN_bus

fnordfnordfnord 11y ago
I've done some CAN stuff (not on cars though), and that is the way that everyone I talked to advised to build your system, if suitable. However, we still pushed firmware from the master, so if the master were ever compromised, then all of the nodes would be potentially compromised as well. There is only sending and receiving data. All nodes receive any data from anything else on the bus. A node typically ignores data not addressed to itself but not always, that is up to the programmer. Any node can potentially impersonate the master, or another node. There is no way to prevent this, other than through the firmware.
- semi-extrinsic 11y ago
  One thing I've not seen addressed in this context: If someone wants to create mayhem on a highway, why would they not go low-tech / low effort? There's a number of mechanical and electrical attacks that I can think of just off the top of my head. Analogy: is it worth the time making a pick-proof lock for the front door when someone can just break a window? (I'm not saying we should let car manufacturers off the hook, just offering a perspective on the realism of the threat.)
  - romaniv 11y ago
    why would they not go low-tech / low effort? Attribution. Mechanical attacks are easier to attribute than something that can be done from across the world over the Internet.
  - mattdeboard 11y ago
    There's also inhibitions to talk about. It's one thing to go lay a spike strip down in the middle of the road and it's another to do something over the internet.
  - fnordfnordfnord 11y ago
    I'm sure there are some who might want to "create mayhem on a highway" and who would not choose this route. But when your potential attackers are [everyone with an internet connection] this kind of exploit has huge potential. Imagine if the vulnerability were bundled with a popular mobile website or if someone else cracked how to mass-distribute it. Countries that are at war could use it against their enemy. Al-Abu-ISIS-HAMAS-Nidal-Haram-Boko could use it against anyone/everyone. >Analogy: is it worth the time making a pick-proof lock for the front door when someone can just break a window? Yes, because not everyone can throw a rock from their house to yours, be nearly everyone can be connected to the internet.
wvenable 11y ago
> The infotainment system should never have access to the CAN[1] network in the first place... ever. The problem is access to the CAN bus is necessary to change various vehicle settings from the infotainment system. I know for a fact that changing the door lock settings in my car requires the infotainment system to access the CAN bus to apply settings to that system. This is not an unsolvable problem; this is basic software engineering. Processes should be isolated from each other. I imagine everything in the infotainment system effectively runs as "root" because they consider the whole thing a singular black box.
- UnoriginalGuy 11y ago
  I agree with both you and the person above. I think the missing word we're looking for is: "unrestricted" (as in unrestricted access should not be permitted). Yes, the info system needs SOME access to the CAN network. But it shouldn't be unrestricted access. Instead the info system should be treated as "untrusted" and only specific things should be permissible over a well documented set of APIs. I'd almost be tempted to say that while the car is moving, ALL access to the CAN network should be disabled. Since let's name some things the info system needs on the CAN network: - Reconfigure car (e.g. daylight running lights, auto-locking door, etc). - Start car remotely. - Set AC remotely. - Diagnostics. The only one on that list which MIGHT be useful to have while the car is in motion is diagnostics. And that could be delivered via a read only interface.
  - SEJeff 11y ago
    Perhaps a small proxy application that is fully vetted and tested code. This doesn't seem too dissimilar from the "I need a small suid root app to do $root_thing for an unprivileged user". As you said, unrestricted access is the problem. This just is typical "principle of least privilege" kind of stuff. Totally doable, but it is unbelievable to me the lack of forethought in things like this.
    - fnordfnordfnord 11y ago
      CAN has been around for a long time. I don't think we can blame Bosch that they didn't see from 1985 the pitfalls of someone possibly adding global internet connectivity, nor can we assume they would have advised interconnecting CAN systems with the internet.
mzs 11y ago
A lot of cars have audio controls on the steering wheel. It used to be on separate wires but now that's on CAN, save money. So that's one reason infotainment is on CAN. It could be it's own CAN bus completely separated but you probably also have the CC on the wheel too. So do you put the CC on the same one? But wait, there's the SRS there too, oh man that plays ball with the self diagnostics. Hmm looks like we need a high priority CAN in the wheel, might as well use it for everything. That's how it goes...
- fineman 11y ago
  It's perfectly reasonable to use the same bus to carry driving and infotainment commands from the wheel - those are simply physical switches. Also, the steering wheel isn't connected to the cellular network. It's the infosystem that shouldn't be able to broadcast on that bus. There should be a very limited set of messages that will be accepted from it and there should be a dedicated circuit that drops everything else.
  - mzs 11y ago
    I'm not disagreeing with you, it's just the realities. For example CAN does not have a notion of source, it's really in the abstract a whole lot like a bus, just with cables. So one reason the infotainment might want to send commands is to that station/song information appears in the instrument cluster. Now I agree it would be really smart if there was another module sitting between the the radio and the IPC with two sides and it filters both ways. Also that gateway has logic like, I have power but it's been less than a minute, this packet has the right code, sure I will let this reflash happen. In fact such devices exist (except they are more trusting). The thing is though that the radio tends to have the most impressive CPU of all in the car, so there is pressure to add that in there (I mean there was one manufacturer that had tried to merge BCM, TCM, telematics, and DIC all into the head unit with a roughly 400MHz cpu, so that gives oyu an idea), logic like 'yeah maybe, we won't be sending that in fact.' But once it is hacked, all bets are off, it can even DOS the bus. The other aspect is you just want they crap from Delco to work with the stuff from TRW and the gateway is getting in the way and yo don't want to expend the resources to figure-out why. When it was all a wired network, it did not really matter so much.
ChuckMcM 11y ago
Easy to say, hard to do. Really cars now need TWO CAN bus networks, the RED network and the BLUE network. All critical car functions on the RED isolated network, vanity functions on the BLUE network. So often though a designer will say "We really want to help people who call in for roadside assistance, we just want to read the CAN bus, we don't need to write it." And some complex function will be created that only "reads" but then a overflow attack or some other exploit lets arbitrary code get run and since its possible to write code with a write function your security is toast. So what actually will happen (I hope) is that a bunch of things will no longer be possible from the infotainment system because that system doesn't have access to the CAN bus at all. And any UI that does have access to the CAN bus won't have any wireless access to it at all. Which will make some car features, less featurefull.
- simcop2387 11y ago
  They've largely had something like this already in most cars, a low speed bus that's got the non-critical things (seat position controls, window controls, etc.) and a high speed one that has all the things like engine data, speedometer updates, etc. I definitely agree though they need to take this to the level that's usually seen in avionics with a read only gap between the third entertainment system bus. Without that you really can't hope to secure it. The only real problem I can see is how would you let the roadside assistance stuff unlock the doors? Maybe an authenticated write only to the low speed bus that you don't get to control the message, just "unlock all doors".
  - paulmd 11y ago
    There are very few "non-critical" systems in a 2+ ton vehicle moving at highway-to-expressway speeds. For an example of what a "minor" system like seat position can do, consider the following: http://www.lakecountrynow.com/opinion/blogs/communityblogs/130253333.html http://www.lakecountrynow.com/opinion/blogs/communityblogs/1... After more investigation they ended up suspecting a different failure mode, but it speaks to the danger of even pedestrian functionality. Most people are shit drivers who are unsafe to be around in the best of times, "minor" things like stereo control, windshield washing, etc are certainly enough to distract them let alone being physically moved out of the reach of the controls. Particularly in combination, let alone in rush hour traffic or bad weather.
mattdeboard 11y ago
I thought about this too, but they're replacing the firmware with their own custom firmware OTA. How do you know that your hypothetical "very simple listener" won't be bypassed or re-appropriated for other means?
- delinka 11y ago
  This sounds like the equivalent of sending UDP over the Internet. If you're receiving UDP from a server, you're not going to get access to the server just because it spouts UDP. If that's the _only_ thing the server does, you're just not going to gain access to it.
bmir-alum-007 11y ago
It's unfortunate but the reality is that manufacturers are too cheap/lazy to segregate devices on to separate L2 segments, deploy fw or keyed A3E until forced to by exposure of hack demos. In cars (and IoT), standards make everything cheaper but easier to hack without sensible security measures.

maxerickson 11y ago

Assuming the network fixes are effective, the recall is just a PR campaign.

acdha 11y ago
Perfect network security is a rather big assumption, though, isn't it? We recommend layered security to protect people's cat pictures – doesn't it seem like a good idea for something which could literally result in casualties?
- maxerickson 11y ago
  Sure. My point is more that a fix that eliminates the ability for people to just use the internet to manipulate the vehicles removes a great deal of the urgency for corrections on the vehicle side.
  - acdha 11y ago
    It does make it less of an emergency but it also means that anyone with malicious intent has a huge incentive to look for a way around the network block because there's a known win if they find one.
  - fineman 11y ago
    What does it mean to you to "eliminate the ability for ..."? To patch the known bug? Or do an audit and fix all the bugs they find? Or unplug the system? If they were yanking the cellular connection that'd be pretty good... If they're just patching one or two obvious holes it'll likely be broken again by Blackhat.
    - maxerickson 11y ago
      It means I should have used fuzzier language (so as to not imply that I have a solid understanding of the bugs). But: https://twitter.com/0xcharlie/status/624608184485851136 https://twitter.com/0xcharlie/status/624608184485851136 So the vehicle connection is not as visible as it used to be.

bendykstra 11y ago

I think that disabling the entertainment center's access to the internet would be the responsible thing to do. Given Toyota's recent $1.2B settlement over the unintended acceleration defect, leaving this door open to hackers could be very costly for Chrysler.

mratzloff 11y ago
Hell, I'm driving a 2015 Jeep Cherokee as a rental right now and I don't even want it connected to the Internet. But you've gotta have car apps, right? How else would car manufacturers be priming you to accept in-car advertising than an Internet-connected screen that you can't turn off completely?

fineman 11y ago

>> This is a terrible decision. > It's the only one available to them. No, it's the only easy option they have. Take all the vulnerable vehicles off the road. That's another option they have. > How would you fix the issue for existing vehicles? Have dealers yank the cellular connection in every vehicle and refund the customers something for removing a feature the product sold with. Nothing else will fix it in a short timeline.

imglorp 11y ago
It's not just cellular. They also found it was the digital radio, and presumably anything else on that bus. Bluetooth? Key fobs? In-car wifi hotspot? Who knows what other entry vectors there are.

MichaelCrawford 11y ago

"Hardware has permanance" That automobiles are recalled for reasons other than hardware replacement is a recent phenomenon. However a software patch would keep Def Con busy while replacement hardware is developed.

Xorlev 11y ago
> That automobiles are recalled for reasons other than hardware replacement is a recent phenomenon. Sure, but how often are they doing major surgery vs. replacing a part / doing a patch? It sounds to me like properly fixing this issue would be a fairly sizable undertaking.

laacz 11y ago

Would it be really hard to fix this OTA for all vehicles, reusing (and patching) their own bug? This is a technical question, law might forbid doing this.

laacz 11y ago

Would it be really hard to fix this OTA for all vehicles, reusing (and patching) their own bug? This is a technical question, law might forbid doing this.