Slashdot Mirror
Car Computer Systems at Risk to Viruses
datemenatalie writes "According to CNN, car computers are now at risk for potentially system-crippling viruses. According to the article, "The first mobile phone virus, Cabir, has spread to over 20 countries, ranging from the United States to Japan and from Finland to South Africa, using only Bluetooth." Though the problem isn't anything too serious yet, expect a slew of car anti-virus products to be lining the shelves before you know it."
Too lazy to go looking, but this feels like old news.
The force that blew the Big Bang continues to accelerate.
Yet another reason not to drive. Wake me when they have bicycle virusues!
I drive a 2004 Saab 9-3. Since buying it a year ago, it has been back to the dealership three times. In all three of those cases, there has been nothing physically wrong with the car; the software on various parts of the car was just buggy and needed to be patched. That being said, I'm not sure how that sort of virus would spread. Maybe a car could infect the diagnostic computer at the dealership which would then infect other cars? Just a thought...
caritj.org
Unlike software companies that have cutsie little "if it hoses you up beyond all hope that's just tough noogies for you" license agreements, car companies will be held liable for anything that goes wrong with a car due to hacking.
Which is why, in the final analysis, this "vulnerability" is bullshit. Microsoft can get away scott free with releasing a shoddy product that's compromised 12 minutes after starting, General Motors can't.
I was under the impression that cars typically had at least two computer systems. One for the in-cabin niceities like A/C and Audio, and another totally separate system for the engine. Has there been some sort of merging of these two systems recently?
The "comfort" system may need Bluetooth to talk to personal devices to download music, among other tasks. But what possible reason could there be to have the engine system talking to the comfort system? They would seem to be two totally different areas without any relation to each other.
The article is pretty vague about the consequences, but it does include a quote from a Symantec engineer who thinks it is possible that the engine system could be infected. I just don't see that happening.
Jesus saved me from my past. He can save you as well.
It's not that simple, though. Microsoft isn't liable for peoples' lost property, time, financial status, jobs, etc, but car companies have always been liable for defects. Is a vulnerability a defect? Is it the infector's fault if they inadvertently infect the vehicle? And furthermore, what kind of true hacker would put people's LIVES in harm's way. That's just sick. As far as car anti-viral solutions, opening up the car to third party software like that would only make the problem worse; allowing third party apps that can control other systems is only ADVANCING the threat of viruses.
And for the reasons that the parent talks about, though I am assuming out of my ass, I would guess that the car companies and their suppliers have much more rigerous code testing than the average (or in Microsoft's case, below average) software house.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
A quote from the article:
... sooner or later the hackers will find the vulnerability in the operating systems of on-board computers and ... will definitely use it," he added."
""If the smartphones and on-board computers have the same channel to transfer the data
Although that quote was a guy from Kaspersky, an anti-virus company which I've heard fearmongering on another subject.
However, below that is this juicy bit:
"Bluetooth is used in car electronics interfaces for monitoring and service.
Carmakers say they use the most sophisticated protection for safety equipment such as airbags or motor controls, whereas infotainment systems so far have less stringent safeguards."
I really really want the vehicle's automotive computer systems to stay stand-alone. I don't think there's any reason for, let's say, engine control to have a wireless interface to the outside world. Maybe only tire pressure sensors need wireless. I want the steering, accelleration and braking to be completely cut off from the outside world except for a physical port which is behind a panel with a lock.
There's going to be more and more "drive by wire" in future cars and there'll come a day when braking isn't hydraulic and in direct connection to your foot anymore. I think some electric or hybrid cars already "brake" by using the electric engine as a dynamo. Great cover for an assasination hehe!
Of course you'll want the minimum of feedback from the core systems for diagnostics or in case of an emergency, but the interface to those functions should be physical, like a button and a wired-up screen. Not a data connection like Bluetooth!
Reminds me of this story about a very computerized car like a Prius or something going berserk and gunning the accelarator on it's own. The driver claimed that he burned out the brakes and after that could only weave to avoid traffic LOL. Later the story turned might have proven a hoax. I guess he was joyriding (after thinking up a good excuse), a negative-pr puppet hired to discredit the manufacturer or bought off to retract his story or whatever (forgive me, I've just read an episode of "Ghost in the Shell 2" hehe).
So stand-alone automotive systems please. And none of this: "we'll just use the data cables for both the core- and the entertainment system" just to save on wiring (money) and don't even go near wireless!
The only way I can see this happening is when EVERYBODY will point and laugh at the first sucker and manufacturer who's car has been infected by a virus. In other words a hugely negative PR effect in that case. Otherwise they might just put the risk into a giant bean-counter equation and calculate the cost of a fatality lawsuit compared to the savings on car wiring. Reminds me of "Fight Club". Screaming your lungs out while trapped in a burning car **shudder**
- -- Truth addict for life.
Yeah, embedded Windows is playing with fire. Please put it in your car, please do all those stupid things. It doesn't matter if I would encourage Microsoft to make their crappy ill product that is so friendly to virusses, they will making it anyway. But when I know their would be a car that runs embedded GNU/Linux or GNU/FreeBSD (or in the future GNU's HURD) then I would buy a car. Now I simply and boldly refuse to do so.
We're running Linux on ours. I'm not being elitist here, I'm just wondering what OS'es are afflicted by this.
I assume it's not a flaw in Bluetooth, because it would be much more pervasive. AFAIK, BMW's flakey iDrive system runs Windows - and I'm not saying it's flakey because it runs Windows. I'm saying it's flakey because of telematics industry reports about it. Any correlation is probably/likely just a coincidence.
Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
I was worried this anti-Microsoft discussion was going to turn into one about how car computer systems are potentially vulnerable to viruses.
Thanks a ton for steering us back on track.
Here's a good Microsoft joke:
Q: How much does Microsoft suck?
A: Probably a lot!
The public simply won't buy a car if it can be infected by a virus. In the PC world, people don't have a choice, they have to buy Microsoft Windows if they want to buy cheap and compatible. In the automotive industry it's a totally different situation.
Ruby on Rails Screencast
Any number of leet brainy folks are willingly buying modern cars that can be remote controlled turned off and have the doors lock. The feds and cops really want that 'feature", and they sell it by calling it "security" for you. Pretty soon it will be mandatory for all new cars sold in the US. And other little gems like RFIDs in all the tires sold.
Bottom line is, people purchase what is on the shelves or at the dealers. And if you are always buying new, you are getting pwned.
The evidence will show that the plaintiff could not possibly have sustained such serious neck and back injuries in a mere 30 mile-per-hour rear-end collision. More importantly, the evidence will show that my client was not negligent and did not cause the accident. Instead, the evidence will show that my client's vehicle acquired the GM.DriveTrain.A virus by merely driving past the Alexis Park Hotel on July 31, and this caused the gas pedal to floor unexpectedly at the intersection in question. How is this possible? you ask.....
This is absured.
The first 9 stories on slashdot have 0 comments above a 3.
And the first story that has a non-zero value has over 700 comments, and it only has 5!
What comes first, finding a teacher or becoming a student?
I'm guessing car makers will be putting in all sorts of restrictions in their cars to prevent you installing any unauthorised (by them) code.
It will probably be something like today's consoles, where the code has to be signed by the manufacture, locking out any homebrew apps - and most likely enthusiasts will find ways to "mod" their cars to allow modifications & additions to the car's software that the manufacturer never intended.
So the possibilities of code "accidentially" being run on your car will be remote.
It can't do anything serious. It can only crash the system. Oh wait...
That's a pretty big 'if' there. There are alternatives: Macs are at pretty comparable prices, and can do the majority of things people use PCs for; Linux isn't too complex for a fair proportion of people to install and use, and again, it can do a fair proportion of the things people use PCs for.
Now, obviously, neither of those is a no-thought-needed drop-in replacement; either will need a minimum investment of time and brainpower learning how to drive the system and transfer data and tasks. But compared to their current userbase, a much greater number of people could manage to do so.
The fact that they don't do so means that people aren't troubled by viruses, crashes, &c enough to put in that minimum investment; either they don't believe that things are significantly better on those other platforms (maybe they've come to believe that viruses and crashes are just part of How Computers Work), or they believe that the effort needed to switch is too great. Or they just haven't thought about it. Of course, to us geeks, it seems as if those beliefs are both completely unfounded and misguided; but maybe we should be putting more effort into working out why people have them, and whether/how we might change them?
When it comes to cars, people value security and reliability, even over the latest, shiniest, fastest models. Why do they not apply the same values to computers?
Ceterum censeo subscriptionem esse delendam.
Cars were't dangerous enough otherwise.
Cut that out, or I will ship you to Norilsk in a box.
Yeah, I noticed that, too. Slashdot is broken...
"Not an actor, but he plays one on TV."
You know, the more I hear about stuff like this, the more I like my '71 Ford. Sure I had to spend a week replacing the timing gear, and another week fixing the oil pump after it sucked up parts of the old timing gear, but it least it doesn't get viruses.
Unknown host pong.