10 ms·

> The infotainment system should never have access to the CAN[1] network in the first place... ever. The problem is access to the CAN bus is necessary to chang

> The infotainment system should never have access to the CAN[1] network in the first place... ever. The problem is access to the CAN bus is necessary to change various vehicle settings from the infotainment system. I know for a fact that changing the door lock settings in my car requires the infotainment system to access the CAN bus to apply settings to that system. This is not an unsolvable problem; this is basic software engineering. Processes should be isolated from each other. I imagine everything in the infotainment system effectively runs as "root" because they consider the whole thing a singular black box.

UnoriginalGuy 11y ago
I agree with both you and the person above. I think the missing word we're looking for is: "unrestricted" (as in unrestricted access should not be permitted). Yes, the info system needs SOME access to the CAN network. But it shouldn't be unrestricted access. Instead the info system should be treated as "untrusted" and only specific things should be permissible over a well documented set of APIs. I'd almost be tempted to say that while the car is moving, ALL access to the CAN network should be disabled. Since let's name some things the info system needs on the CAN network: - Reconfigure car (e.g. daylight running lights, auto-locking door, etc). - Start car remotely. - Set AC remotely. - Diagnostics. The only one on that list which MIGHT be useful to have while the car is in motion is diagnostics. And that could be delivered via a read only interface.
- SEJeff 11y ago
  Perhaps a small proxy application that is fully vetted and tested code. This doesn't seem too dissimilar from the "I need a small suid root app to do $root_thing for an unprivileged user". As you said, unrestricted access is the problem. This just is typical "principle of least privilege" kind of stuff. Totally doable, but it is unbelievable to me the lack of forethought in things like this.
  - fnordfnordfnord 11y ago
    CAN has been around for a long time. I don't think we can blame Bosch that they didn't see from 1985 the pitfalls of someone possibly adding global internet connectivity, nor can we assume they would have advised interconnecting CAN systems with the internet.
  - gherkin0 11y ago
    > Perhaps a small proxy application that is fully vetted and tested code. I think that's a good idea, but I think it would be better if it was a small hardware firewall than a program in the infotainment system. I would think something like that could even be entirely formally verified.
    - SEJeff 11y ago
      I was referring to an application/hardware that sat directly on the CAN bus, not a part of the infotainment system whatsoever. Something totally separate that had only 1 small function, to authorize access to CAN communications for "unprivileged" things such as the infotainment system. So we're in complete agreement.
- wvenable 11y ago
  Interestingly enough, when my car is moving I cannot reconfigure the car. Those functions are disabled. However, I fully expect if that if my car was hacked, they could easily by-pass that restriction.
- sokoloff 11y ago
  Porsche and Audi (and likely others) have secondary nav displays [upcoming turn and distance] that originates in the info unit and is displayed somewhere on the dash. Other cars have climate controls built into the info unit. Then, there are cars like Tesla where nearly everything comes from the info unit...
- MBCook 11y ago
  The original 'researcher' (because they did something so horrendously unsafe on public roads) mentioned that there are at least 2 car manufacturers who have devices on the CAN bus to watch traffic and detect when a device is issuing commands that it shouldn't be so the tampering can be detected (and assumedly shut the infotainment system off).
  - fineman 11y ago
    Oh give it up. That's just ridiculous SJW nonsense and you sound like anti-vaxers who say "If there's even a one in a billion chance of that vaccine hurting a child, you're a murderer!" Cars stall all the time on the highway. Lanes merge and traffic continues. It's not like they caused the car to swerve, or accelerate - it slowed in a controllable manner.
    - biot 11y ago
      And a stalled/wrecked/slowed vehicle on a highway sometimes results in death: http://i.imgur.com/dgHm3E9.gifv http://i.imgur.com/dgHm3E9.gifv [redundant warning: death] http://i.imgur.com/V6aySGy.gifv http://i.imgur.com/V6aySGy.gifv You can't control for other bad drivers' reactions to your vehicle becoming an obstacle on the highway. Swerve and change lanes? Sure, in an ideal world that always happens. In the real world, accidents can happen instead.
      - fineman 11y ago
        Yes, it could. A vaccine could kill a child. A meteor could crush the HN server as I post this. But is it even remotely likely? No. Of course not. Discussing it is pointless and counterproductive. It's not like you've been down the list of likely harms-sorted-by-danger and reached this one.
        Retric 11y ago
        Let's say there is a low chance of death from doing this: 1:10:000. Arguably that's about the same as sending someone to jail for 1:10,000th their life. Which is about 2 and 1/2 days which is not ‘horrific’. Still, I would hope sending a random person to prison for a few days to stage a story seems unacceptable. On the other hand vaccinations are both lower risks and a higher benefit so it’s not really comparable.
- mzs 11y ago
  Steering wheel audio controls are common and useful in motion. It's not really about RO v RW, CAN is about sending commands. The head unit could say, it's the brakes, so that has to be protected against. When there is not a physical layer doing that protection (separate bus, a filter, and so on) there are two other layers. One is the thing sending can reject it from going out, but that takes resources that might not be there. The other the receiver does some sanity checking on it, like "you want me to go in P but I'm going at 65, yeah I don't think so" to even it's gotten common place for messages involving the brakes include a shared code back and forth. Really I think this boils down to there are untrusted channels (wifi, cellular, DAB) that should be locked down better. I mean the DAB thing, likely it's a buffer over flow in the head unit. Even if that has a cpu that is running FW that is making sure the CAN messages it is sending are sane, the exploit just makes it stop doing that. There's such a pressure to save cost and so many OEMs involved that ease of integration motivates the rest. Yeah it sucks, but it is what it is.
  - gherkin0 11y ago
    > Steering wheel audio controls are common and useful in motion. But wouldn't those likely be one-way commands TO the infotainment system? They would still work even if it was receive only.
    - mzs 11y ago
      My goodness this is really not going well for me. Basically there is no notion of to or from really. When you push the vol+ button on the steering wheel there is a controller that sends a message trying over and over again until there is no collision. That message has an ID in it early on. In this case it will be like I dunno $412 okay. That means audio controls or something. A bit later is some length and then the data, say the data is $C. The infotainment unit is listening to everything just as the controller for the steering wheel controls is and everything else on the bus (it has to, because of how collision detection works). When the controller in the steering wheel sees that $412 ... $C it goes, well isn't that nice, me or someone else sent the vol+ message out finally, cool, I'll stop sending that now. When the radio sees that message with an ID of $412 it goes, oh that's an audio control message command, I should pay attention to that. Then it looks at the length and data and sees $C. It goes oh that means someone pressed vol+, I'll make it louder. But here's the thing, there might be a knob too for volume and there really is just one board doing the infotainment. It's not like the old days where it's a potentiometer, it's not even wired directly into the board that handles infotainment. All the IO pins that board has are already used-up handling the screen, CAN bus, and other things. When you twist it, it also sends the same $412 ... $C over CAN from it's controller! The radio did not know what sent it, and that's by design in CAN bus. There might be mobile phone integration, it can do CAN too, say also a $412 with with a different payload (and possibly length) that might mute on call. Also there may be a touch screen, but that will not do a thing over CAN if you press the vol+ there, just do it's normal IO from screen to SoC on the board. Am I doing a better job of explaining? The take away is lots of things can send the same message and lots of things might be interested in that message and that is how it is intended. To some extent you can mitigate this in hardware. You can make long runs or some shorter star shaped topologies as long as you get the termination right. For the star shaped topologies you can stick gateways in there. The controllers can be setup to filter on certain conditions and the bus is the limit for filtering if you are using a programmable part. What I mean by bus is the limit is things like there is no notion of to and from. That's what you get in CAN bus cause that's how it works. You can thank Bosch for that.
fineman 11y ago
Changing your door lock setting doesn't require the infotainment system, the GUI for it currently does. That's vitally important to understand. The systems are mingled but they don't have to be and in fact shouldn't be. Also, not all isolation is the same. Consider the scope of isolation between multiple sandboxed apps (some accessing the raw internet) on a single computer and two separate computers connected via a specialized protocol-aware data diode.
- wvenable 11y ago
  Managing all my car settings requires a touchscreen -- should I really have two touch screens for this? No. One screen, one computer, but two processes that are isolated from each other.
romaniv 11y ago
Cars can have three separate networks for infotainment (radio, navigation, etc), body controls (seats, lighting, locks) and mission-critical stuff (steering, breaks, engine). Some of them actually do. There is little genuine need to send commands from low-importance networks to high-importance networks. Yes, you would have to live without single uber-control touchscreen, but it's not really that big of a limitation: you simply need separate controls for low-importance and high-importance things.
- rodgerd 11y ago
  Then HN would be full of people sneering at the terrible car UI and demanding the Apple of cars come along and disrupt cars.
  - mattwad 11y ago
    I rent cars often, I really dislike the ones w/a giant touch-screen on the front and nothing else. To me it's a gimmick and totally unsafe, since I have to look at the screen to do anything on it, sometimes repeatedly if it didn't recognize my touches. So they often end up duplicating all controls on the steering wheel, how is that 'good design'? Last car I had (Kia Forte) was actually very pleasurable... they had a very helpful digital display but all the adjustment could be done w/real buttons.
  - Silhouette 11y ago
    The parts of car UIs we're talking about are mostly awful anyway, and on several different levels. They have basic design flaws like using naff graphics, which neither look good nor supply information more effectively than simpler alternatives, and using non-tactile controls like touchscreens or fully circular rotating dials. Hopefully by now everyone knows the dangers introduced by most of the mobile communications systems in modern cars. The direct control interfaces in a car that tend to be very well designed and implemented are the basic movement controls like the steering wheel and pedals. These are distinctive and immediately recognisable. They work predictably and after proper driver training they become very intuitive. Drivers in an emergency can often still manage to swerve or brake to avoid a collision, and that is the level of user friendliness you want when you're in control of multiple tonnes of fast-moving death machine. Other parts of the interface that modern cars tend to do very well are all the subtle behaviours behind those controls: the power steering that adjusts so it "feels right" at any speed, the independent driving and braking of different wheels so the simple pedal controls don't unnecessarily spin the wheels if you try to move off with too much gas but do retain control without skidding unnecessarily if you brake and steer at the same time in an emergency. And of course there are a raft of safety systems in modern cars, some fully automatic, but some giving subtle cues to the driver to help them predict and hopefully avoid dangerous situations earlier. But these so-called infotainment systems, and radios, and communications systems, and satnavs, and fancy environmental controls... Most of these are just awful, and sneering at them is entirely fair and justified right now, so separating them from the essential controls that keep the vehicle operating properly and safely should really be no problem at all.
rpcope1 11y ago
I guess my question would be, why on earth do we need to change vehicle settings through the infotainment system? If you have systems that need to talk to the ECM, you either need to just hook up a tool through the OBD2 port, or have a dedicated interface. I also find the built in cellular link, at best, mildly insane, but under no circumstances should there be any real interconnect between a device that can send and receive with the internet, and the increasingly controlling and complex ECM, as the risks are enormous.
WalterBright 11y ago
Airframe manufacturers have solved this problem. The car makers need to simply hire some aircraft electronics systems engineers for consultation. It's not just security - you can't have bugs in one system causing other systems to go down. You can't tolerate a bug in the radio causing the car to crash (didn't anyone learn anything from the demise of the Death Star?) The Fukushima disaster and the Deepwater Horizon disaster, from what I read about them, all suffered from easily preventable "zipper effect" of cascading failures. Every industry apparently has to relearn the hard way what the aviation industry learned decades ago (and what the Navy learned even earlier).
kwhitefoot 11y ago
In my Rover the K-bus devices do all the stuff that doesn't affect the integrity of the engine management system. It is definitely not connected to the CAN-bus. Why should the locks be connected to the CAN-bus? That's a stupid decision. Locks are the responsibility of the body controller. The K in K-bus means body, in German.
extc 11y ago
Since you seem to know what you're talking about - can you explain: if the system can be accessed and controlled remotely, why it can't be patched remotely?

UnoriginalGuy 11y ago

I agree with both you and the person above. I think the missing word we're looking for is: "unrestricted" (as in unrestricted access should not be permitted). Yes, the info system needs SOME access to the CAN network. But it shouldn't be unrestricted access. Instead the info system should be treated as "untrusted" and only specific things should be permissible over a well documented set of APIs. I'd almost be tempted to say that while the car is moving, ALL access to the CAN network should be disabled. Since let's name some things the info system needs on the CAN network: - Reconfigure car (e.g. daylight running lights, auto-locking door, etc). - Start car remotely. - Set AC remotely. - Diagnostics. The only one on that list which MIGHT be useful to have while the car is in motion is diagnostics. And that could be delivered via a read only interface.

SEJeff 11y ago
Perhaps a small proxy application that is fully vetted and tested code. This doesn't seem too dissimilar from the "I need a small suid root app to do $root_thing for an unprivileged user". As you said, unrestricted access is the problem. This just is typical "principle of least privilege" kind of stuff. Totally doable, but it is unbelievable to me the lack of forethought in things like this.
- fnordfnordfnord 11y ago
  CAN has been around for a long time. I don't think we can blame Bosch that they didn't see from 1985 the pitfalls of someone possibly adding global internet connectivity, nor can we assume they would have advised interconnecting CAN systems with the internet.
- gherkin0 11y ago
  > Perhaps a small proxy application that is fully vetted and tested code. I think that's a good idea, but I think it would be better if it was a small hardware firewall than a program in the infotainment system. I would think something like that could even be entirely formally verified.
  - SEJeff 11y ago
    I was referring to an application/hardware that sat directly on the CAN bus, not a part of the infotainment system whatsoever. Something totally separate that had only 1 small function, to authorize access to CAN communications for "unprivileged" things such as the infotainment system. So we're in complete agreement.
wvenable 11y ago
Interestingly enough, when my car is moving I cannot reconfigure the car. Those functions are disabled. However, I fully expect if that if my car was hacked, they could easily by-pass that restriction.
sokoloff 11y ago
Porsche and Audi (and likely others) have secondary nav displays [upcoming turn and distance] that originates in the info unit and is displayed somewhere on the dash. Other cars have climate controls built into the info unit. Then, there are cars like Tesla where nearly everything comes from the info unit...
MBCook 11y ago
The original 'researcher' (because they did something so horrendously unsafe on public roads) mentioned that there are at least 2 car manufacturers who have devices on the CAN bus to watch traffic and detect when a device is issuing commands that it shouldn't be so the tampering can be detected (and assumedly shut the infotainment system off).
- fineman 11y ago
  Oh give it up. That's just ridiculous SJW nonsense and you sound like anti-vaxers who say "If there's even a one in a billion chance of that vaccine hurting a child, you're a murderer!" Cars stall all the time on the highway. Lanes merge and traffic continues. It's not like they caused the car to swerve, or accelerate - it slowed in a controllable manner.
  - biot 11y ago
    And a stalled/wrecked/slowed vehicle on a highway sometimes results in death: http://i.imgur.com/dgHm3E9.gifv http://i.imgur.com/dgHm3E9.gifv [redundant warning: death] http://i.imgur.com/V6aySGy.gifv http://i.imgur.com/V6aySGy.gifv You can't control for other bad drivers' reactions to your vehicle becoming an obstacle on the highway. Swerve and change lanes? Sure, in an ideal world that always happens. In the real world, accidents can happen instead.
    - fineman 11y ago
      Yes, it could. A vaccine could kill a child. A meteor could crush the HN server as I post this. But is it even remotely likely? No. Of course not. Discussing it is pointless and counterproductive. It's not like you've been down the list of likely harms-sorted-by-danger and reached this one.
      - Retric 11y ago
        Let's say there is a low chance of death from doing this: 1:10:000. Arguably that's about the same as sending someone to jail for 1:10,000th their life. Which is about 2 and 1/2 days which is not ‘horrific’. Still, I would hope sending a random person to prison for a few days to stage a story seems unacceptable. On the other hand vaccinations are both lower risks and a higher benefit so it’s not really comparable.
mzs 11y ago
Steering wheel audio controls are common and useful in motion. It's not really about RO v RW, CAN is about sending commands. The head unit could say, it's the brakes, so that has to be protected against. When there is not a physical layer doing that protection (separate bus, a filter, and so on) there are two other layers. One is the thing sending can reject it from going out, but that takes resources that might not be there. The other the receiver does some sanity checking on it, like "you want me to go in P but I'm going at 65, yeah I don't think so" to even it's gotten common place for messages involving the brakes include a shared code back and forth. Really I think this boils down to there are untrusted channels (wifi, cellular, DAB) that should be locked down better. I mean the DAB thing, likely it's a buffer over flow in the head unit. Even if that has a cpu that is running FW that is making sure the CAN messages it is sending are sane, the exploit just makes it stop doing that. There's such a pressure to save cost and so many OEMs involved that ease of integration motivates the rest. Yeah it sucks, but it is what it is.
- gherkin0 11y ago
  > Steering wheel audio controls are common and useful in motion. But wouldn't those likely be one-way commands TO the infotainment system? They would still work even if it was receive only.
  - mzs 11y ago
    My goodness this is really not going well for me. Basically there is no notion of to or from really. When you push the vol+ button on the steering wheel there is a controller that sends a message trying over and over again until there is no collision. That message has an ID in it early on. In this case it will be like I dunno $412 okay. That means audio controls or something. A bit later is some length and then the data, say the data is $C. The infotainment unit is listening to everything just as the controller for the steering wheel controls is and everything else on the bus (it has to, because of how collision detection works). When the controller in the steering wheel sees that $412 ... $C it goes, well isn't that nice, me or someone else sent the vol+ message out finally, cool, I'll stop sending that now. When the radio sees that message with an ID of $412 it goes, oh that's an audio control message command, I should pay attention to that. Then it looks at the length and data and sees $C. It goes oh that means someone pressed vol+, I'll make it louder. But here's the thing, there might be a knob too for volume and there really is just one board doing the infotainment. It's not like the old days where it's a potentiometer, it's not even wired directly into the board that handles infotainment. All the IO pins that board has are already used-up handling the screen, CAN bus, and other things. When you twist it, it also sends the same $412 ... $C over CAN from it's controller! The radio did not know what sent it, and that's by design in CAN bus. There might be mobile phone integration, it can do CAN too, say also a $412 with with a different payload (and possibly length) that might mute on call. Also there may be a touch screen, but that will not do a thing over CAN if you press the vol+ there, just do it's normal IO from screen to SoC on the board. Am I doing a better job of explaining? The take away is lots of things can send the same message and lots of things might be interested in that message and that is how it is intended. To some extent you can mitigate this in hardware. You can make long runs or some shorter star shaped topologies as long as you get the termination right. For the star shaped topologies you can stick gateways in there. The controllers can be setup to filter on certain conditions and the bus is the limit for filtering if you are using a programmable part. What I mean by bus is the limit is things like there is no notion of to and from. That's what you get in CAN bus cause that's how it works. You can thank Bosch for that.

fineman 11y ago

Changing your door lock setting doesn't require the infotainment system, the GUI for it currently does. That's vitally important to understand. The systems are mingled but they don't have to be and in fact shouldn't be. Also, not all isolation is the same. Consider the scope of isolation between multiple sandboxed apps (some accessing the raw internet) on a single computer and two separate computers connected via a specialized protocol-aware data diode.

wvenable 11y ago
Managing all my car settings requires a touchscreen -- should I really have two touch screens for this? No. One screen, one computer, but two processes that are isolated from each other.

romaniv 11y ago

Cars can have three separate networks for infotainment (radio, navigation, etc), body controls (seats, lighting, locks) and mission-critical stuff (steering, breaks, engine). Some of them actually do. There is little genuine need to send commands from low-importance networks to high-importance networks. Yes, you would have to live without single uber-control touchscreen, but it's not really that big of a limitation: you simply need separate controls for low-importance and high-importance things.

rodgerd 11y ago
Then HN would be full of people sneering at the terrible car UI and demanding the Apple of cars come along and disrupt cars.
- mattwad 11y ago
  I rent cars often, I really dislike the ones w/a giant touch-screen on the front and nothing else. To me it's a gimmick and totally unsafe, since I have to look at the screen to do anything on it, sometimes repeatedly if it didn't recognize my touches. So they often end up duplicating all controls on the steering wheel, how is that 'good design'? Last car I had (Kia Forte) was actually very pleasurable... they had a very helpful digital display but all the adjustment could be done w/real buttons.
- Silhouette 11y ago
  The parts of car UIs we're talking about are mostly awful anyway, and on several different levels. They have basic design flaws like using naff graphics, which neither look good nor supply information more effectively than simpler alternatives, and using non-tactile controls like touchscreens or fully circular rotating dials. Hopefully by now everyone knows the dangers introduced by most of the mobile communications systems in modern cars. The direct control interfaces in a car that tend to be very well designed and implemented are the basic movement controls like the steering wheel and pedals. These are distinctive and immediately recognisable. They work predictably and after proper driver training they become very intuitive. Drivers in an emergency can often still manage to swerve or brake to avoid a collision, and that is the level of user friendliness you want when you're in control of multiple tonnes of fast-moving death machine. Other parts of the interface that modern cars tend to do very well are all the subtle behaviours behind those controls: the power steering that adjusts so it "feels right" at any speed, the independent driving and braking of different wheels so the simple pedal controls don't unnecessarily spin the wheels if you try to move off with too much gas but do retain control without skidding unnecessarily if you brake and steer at the same time in an emergency. And of course there are a raft of safety systems in modern cars, some fully automatic, but some giving subtle cues to the driver to help them predict and hopefully avoid dangerous situations earlier. But these so-called infotainment systems, and radios, and communications systems, and satnavs, and fancy environmental controls... Most of these are just awful, and sneering at them is entirely fair and justified right now, so separating them from the essential controls that keep the vehicle operating properly and safely should really be no problem at all.

rpcope1 11y ago

I guess my question would be, why on earth do we need to change vehicle settings through the infotainment system? If you have systems that need to talk to the ECM, you either need to just hook up a tool through the OBD2 port, or have a dedicated interface. I also find the built in cellular link, at best, mildly insane, but under no circumstances should there be any real interconnect between a device that can send and receive with the internet, and the increasingly controlling and complex ECM, as the risks are enormous.

WalterBright 11y ago

Airframe manufacturers have solved this problem. The car makers need to simply hire some aircraft electronics systems engineers for consultation. It's not just security - you can't have bugs in one system causing other systems to go down. You can't tolerate a bug in the radio causing the car to crash (didn't anyone learn anything from the demise of the Death Star?) The Fukushima disaster and the Deepwater Horizon disaster, from what I read about them, all suffered from easily preventable "zipper effect" of cascading failures. Every industry apparently has to relearn the hard way what the aviation industry learned decades ago (and what the Navy learned even earlier).

kwhitefoot 11y ago

In my Rover the K-bus devices do all the stuff that doesn't affect the integrity of the engine management system. It is definitely not connected to the CAN-bus. Why should the locks be connected to the CAN-bus? That's a stupid decision. Locks are the responsibility of the body controller. The K in K-bus means body, in German.

extc 11y ago

Since you seem to know what you're talking about - can you explain: if the system can be accessed and controlled remotely, why it can't be patched remotely?