10 ms·

I agree with both you and the person above. I think the missing word we're looking for is: "unrestricted" (as in unrestricted access should not be permitted).

I agree with both you and the person above. I think the missing word we're looking for is: "unrestricted" (as in unrestricted access should not be permitted). Yes, the info system needs SOME access to the CAN network. But it shouldn't be unrestricted access. Instead the info system should be treated as "untrusted" and only specific things should be permissible over a well documented set of APIs. I'd almost be tempted to say that while the car is moving, ALL access to the CAN network should be disabled. Since let's name some things the info system needs on the CAN network: - Reconfigure car (e.g. daylight running lights, auto-locking door, etc). - Start car remotely. - Set AC remotely. - Diagnostics. The only one on that list which MIGHT be useful to have while the car is in motion is diagnostics. And that could be delivered via a read only interface.

SEJeff 11y ago
Perhaps a small proxy application that is fully vetted and tested code. This doesn't seem too dissimilar from the "I need a small suid root app to do $root_thing for an unprivileged user". As you said, unrestricted access is the problem. This just is typical "principle of least privilege" kind of stuff. Totally doable, but it is unbelievable to me the lack of forethought in things like this.
- fnordfnordfnord 11y ago
  CAN has been around for a long time. I don't think we can blame Bosch that they didn't see from 1985 the pitfalls of someone possibly adding global internet connectivity, nor can we assume they would have advised interconnecting CAN systems with the internet.
- gherkin0 11y ago
  > Perhaps a small proxy application that is fully vetted and tested code. I think that's a good idea, but I think it would be better if it was a small hardware firewall than a program in the infotainment system. I would think something like that could even be entirely formally verified.
  - SEJeff 11y ago
    I was referring to an application/hardware that sat directly on the CAN bus, not a part of the infotainment system whatsoever. Something totally separate that had only 1 small function, to authorize access to CAN communications for "unprivileged" things such as the infotainment system. So we're in complete agreement.
wvenable 11y ago
Interestingly enough, when my car is moving I cannot reconfigure the car. Those functions are disabled. However, I fully expect if that if my car was hacked, they could easily by-pass that restriction.
sokoloff 11y ago
Porsche and Audi (and likely others) have secondary nav displays [upcoming turn and distance] that originates in the info unit and is displayed somewhere on the dash. Other cars have climate controls built into the info unit. Then, there are cars like Tesla where nearly everything comes from the info unit...
MBCook 11y ago
The original 'researcher' (because they did something so horrendously unsafe on public roads) mentioned that there are at least 2 car manufacturers who have devices on the CAN bus to watch traffic and detect when a device is issuing commands that it shouldn't be so the tampering can be detected (and assumedly shut the infotainment system off).
- fineman 11y ago
  Oh give it up. That's just ridiculous SJW nonsense and you sound like anti-vaxers who say "If there's even a one in a billion chance of that vaccine hurting a child, you're a murderer!" Cars stall all the time on the highway. Lanes merge and traffic continues. It's not like they caused the car to swerve, or accelerate - it slowed in a controllable manner.
  - biot 11y ago
    And a stalled/wrecked/slowed vehicle on a highway sometimes results in death: http://i.imgur.com/dgHm3E9.gifv http://i.imgur.com/dgHm3E9.gifv [redundant warning: death] http://i.imgur.com/V6aySGy.gifv http://i.imgur.com/V6aySGy.gifv You can't control for other bad drivers' reactions to your vehicle becoming an obstacle on the highway. Swerve and change lanes? Sure, in an ideal world that always happens. In the real world, accidents can happen instead.
    - fineman 11y ago
      Yes, it could. A vaccine could kill a child. A meteor could crush the HN server as I post this. But is it even remotely likely? No. Of course not. Discussing it is pointless and counterproductive. It's not like you've been down the list of likely harms-sorted-by-danger and reached this one.
      - Retric 11y ago
        Let's say there is a low chance of death from doing this: 1:10:000. Arguably that's about the same as sending someone to jail for 1:10,000th their life. Which is about 2 and 1/2 days which is not ‘horrific’. Still, I would hope sending a random person to prison for a few days to stage a story seems unacceptable. On the other hand vaccinations are both lower risks and a higher benefit so it’s not really comparable.
mzs 11y ago
Steering wheel audio controls are common and useful in motion. It's not really about RO v RW, CAN is about sending commands. The head unit could say, it's the brakes, so that has to be protected against. When there is not a physical layer doing that protection (separate bus, a filter, and so on) there are two other layers. One is the thing sending can reject it from going out, but that takes resources that might not be there. The other the receiver does some sanity checking on it, like "you want me to go in P but I'm going at 65, yeah I don't think so" to even it's gotten common place for messages involving the brakes include a shared code back and forth. Really I think this boils down to there are untrusted channels (wifi, cellular, DAB) that should be locked down better. I mean the DAB thing, likely it's a buffer over flow in the head unit. Even if that has a cpu that is running FW that is making sure the CAN messages it is sending are sane, the exploit just makes it stop doing that. There's such a pressure to save cost and so many OEMs involved that ease of integration motivates the rest. Yeah it sucks, but it is what it is.
- gherkin0 11y ago
  > Steering wheel audio controls are common and useful in motion. But wouldn't those likely be one-way commands TO the infotainment system? They would still work even if it was receive only.
  - mzs 11y ago
    My goodness this is really not going well for me. Basically there is no notion of to or from really. When you push the vol+ button on the steering wheel there is a controller that sends a message trying over and over again until there is no collision. That message has an ID in it early on. In this case it will be like I dunno $412 okay. That means audio controls or something. A bit later is some length and then the data, say the data is $C. The infotainment unit is listening to everything just as the controller for the steering wheel controls is and everything else on the bus (it has to, because of how collision detection works). When the controller in the steering wheel sees that $412 ... $C it goes, well isn't that nice, me or someone else sent the vol+ message out finally, cool, I'll stop sending that now. When the radio sees that message with an ID of $412 it goes, oh that's an audio control message command, I should pay attention to that. Then it looks at the length and data and sees $C. It goes oh that means someone pressed vol+, I'll make it louder. But here's the thing, there might be a knob too for volume and there really is just one board doing the infotainment. It's not like the old days where it's a potentiometer, it's not even wired directly into the board that handles infotainment. All the IO pins that board has are already used-up handling the screen, CAN bus, and other things. When you twist it, it also sends the same $412 ... $C over CAN from it's controller! The radio did not know what sent it, and that's by design in CAN bus. There might be mobile phone integration, it can do CAN too, say also a $412 with with a different payload (and possibly length) that might mute on call. Also there may be a touch screen, but that will not do a thing over CAN if you press the vol+ there, just do it's normal IO from screen to SoC on the board. Am I doing a better job of explaining? The take away is lots of things can send the same message and lots of things might be interested in that message and that is how it is intended. To some extent you can mitigate this in hardware. You can make long runs or some shorter star shaped topologies as long as you get the termination right. For the star shaped topologies you can stick gateways in there. The controllers can be setup to filter on certain conditions and the bus is the limit for filtering if you are using a programmable part. What I mean by bus is the limit is things like there is no notion of to and from. That's what you get in CAN bus cause that's how it works. You can thank Bosch for that.

SEJeff 11y ago

Perhaps a small proxy application that is fully vetted and tested code. This doesn't seem too dissimilar from the "I need a small suid root app to do $root_thing for an unprivileged user". As you said, unrestricted access is the problem. This just is typical "principle of least privilege" kind of stuff. Totally doable, but it is unbelievable to me the lack of forethought in things like this.

fnordfnordfnord 11y ago
CAN has been around for a long time. I don't think we can blame Bosch that they didn't see from 1985 the pitfalls of someone possibly adding global internet connectivity, nor can we assume they would have advised interconnecting CAN systems with the internet.
gherkin0 11y ago
> Perhaps a small proxy application that is fully vetted and tested code. I think that's a good idea, but I think it would be better if it was a small hardware firewall than a program in the infotainment system. I would think something like that could even be entirely formally verified.
- SEJeff 11y ago
  I was referring to an application/hardware that sat directly on the CAN bus, not a part of the infotainment system whatsoever. Something totally separate that had only 1 small function, to authorize access to CAN communications for "unprivileged" things such as the infotainment system. So we're in complete agreement.

wvenable 11y ago

Interestingly enough, when my car is moving I cannot reconfigure the car. Those functions are disabled. However, I fully expect if that if my car was hacked, they could easily by-pass that restriction.

sokoloff 11y ago

Porsche and Audi (and likely others) have secondary nav displays [upcoming turn and distance] that originates in the info unit and is displayed somewhere on the dash. Other cars have climate controls built into the info unit. Then, there are cars like Tesla where nearly everything comes from the info unit...

MBCook 11y ago

The original 'researcher' (because they did something so horrendously unsafe on public roads) mentioned that there are at least 2 car manufacturers who have devices on the CAN bus to watch traffic and detect when a device is issuing commands that it shouldn't be so the tampering can be detected (and assumedly shut the infotainment system off).

fineman 11y ago
Oh give it up. That's just ridiculous SJW nonsense and you sound like anti-vaxers who say "If there's even a one in a billion chance of that vaccine hurting a child, you're a murderer!" Cars stall all the time on the highway. Lanes merge and traffic continues. It's not like they caused the car to swerve, or accelerate - it slowed in a controllable manner.
- biot 11y ago
  And a stalled/wrecked/slowed vehicle on a highway sometimes results in death: http://i.imgur.com/dgHm3E9.gifv http://i.imgur.com/dgHm3E9.gifv [redundant warning: death] http://i.imgur.com/V6aySGy.gifv http://i.imgur.com/V6aySGy.gifv You can't control for other bad drivers' reactions to your vehicle becoming an obstacle on the highway. Swerve and change lanes? Sure, in an ideal world that always happens. In the real world, accidents can happen instead.
  - fineman 11y ago
    Yes, it could. A vaccine could kill a child. A meteor could crush the HN server as I post this. But is it even remotely likely? No. Of course not. Discussing it is pointless and counterproductive. It's not like you've been down the list of likely harms-sorted-by-danger and reached this one.
    - Retric 11y ago
      Let's say there is a low chance of death from doing this: 1:10:000. Arguably that's about the same as sending someone to jail for 1:10,000th their life. Which is about 2 and 1/2 days which is not ‘horrific’. Still, I would hope sending a random person to prison for a few days to stage a story seems unacceptable. On the other hand vaccinations are both lower risks and a higher benefit so it’s not really comparable.

mzs 11y ago

Steering wheel audio controls are common and useful in motion. It's not really about RO v RW, CAN is about sending commands. The head unit could say, it's the brakes, so that has to be protected against. When there is not a physical layer doing that protection (separate bus, a filter, and so on) there are two other layers. One is the thing sending can reject it from going out, but that takes resources that might not be there. The other the receiver does some sanity checking on it, like "you want me to go in P but I'm going at 65, yeah I don't think so" to even it's gotten common place for messages involving the brakes include a shared code back and forth. Really I think this boils down to there are untrusted channels (wifi, cellular, DAB) that should be locked down better. I mean the DAB thing, likely it's a buffer over flow in the head unit. Even if that has a cpu that is running FW that is making sure the CAN messages it is sending are sane, the exploit just makes it stop doing that. There's such a pressure to save cost and so many OEMs involved that ease of integration motivates the rest. Yeah it sucks, but it is what it is.

gherkin0 11y ago
> Steering wheel audio controls are common and useful in motion. But wouldn't those likely be one-way commands TO the infotainment system? They would still work even if it was receive only.
- mzs 11y ago
  My goodness this is really not going well for me. Basically there is no notion of to or from really. When you push the vol+ button on the steering wheel there is a controller that sends a message trying over and over again until there is no collision. That message has an ID in it early on. In this case it will be like I dunno $412 okay. That means audio controls or something. A bit later is some length and then the data, say the data is $C. The infotainment unit is listening to everything just as the controller for the steering wheel controls is and everything else on the bus (it has to, because of how collision detection works). When the controller in the steering wheel sees that $412 ... $C it goes, well isn't that nice, me or someone else sent the vol+ message out finally, cool, I'll stop sending that now. When the radio sees that message with an ID of $412 it goes, oh that's an audio control message command, I should pay attention to that. Then it looks at the length and data and sees $C. It goes oh that means someone pressed vol+, I'll make it louder. But here's the thing, there might be a knob too for volume and there really is just one board doing the infotainment. It's not like the old days where it's a potentiometer, it's not even wired directly into the board that handles infotainment. All the IO pins that board has are already used-up handling the screen, CAN bus, and other things. When you twist it, it also sends the same $412 ... $C over CAN from it's controller! The radio did not know what sent it, and that's by design in CAN bus. There might be mobile phone integration, it can do CAN too, say also a $412 with with a different payload (and possibly length) that might mute on call. Also there may be a touch screen, but that will not do a thing over CAN if you press the vol+ there, just do it's normal IO from screen to SoC on the board. Am I doing a better job of explaining? The take away is lots of things can send the same message and lots of things might be interested in that message and that is how it is intended. To some extent you can mitigate this in hardware. You can make long runs or some shorter star shaped topologies as long as you get the termination right. For the star shaped topologies you can stick gateways in there. The controllers can be setup to filter on certain conditions and the bus is the limit for filtering if you are using a programmable part. What I mean by bus is the limit is things like there is no notion of to and from. That's what you get in CAN bus cause that's how it works. You can thank Bosch for that.