Slashdot Mirror
US Wants Cybersecurity Protection Plan For Cars
coondoggie writes "As cars and other forms of transportation increasingly rely on online systems for everything from safety to onboard entertainment, the cybersecurity threat from those who would exploit such electronic control packages has also increased. That's why the US Department of Transportation (DOT) today issued a Request For Information to the security industry to help it build a roadmap to build 'motor vehicle safeguards against cybersecurity threats and assure the reliability and safety of automotive electronic control systems.'"
Though I would guess that the automotive industry will effectively bribe, oops I mean lobby, any stiff requirements that DOT would require of them based on the roadmap.
How come the first thing that came to mind was "they want to put a kill switch in my car?" They won't call it that, of course.
dont include networking in automobile computer systems at all, just enough to run the car things like air/fuel mixture (the basics) you cant hack what does not exist..
Politics is Treachery, Religion is Brainwashing
Call me a tinfoil'd mad hatter, but com'on. This is atrocious! one more thing for the gov to get their meddling hands into... I'm buying engines from now on; old, lackluster diesel autos without the obd* inside.
Let's stop cramming all this electronic shit into our cars. The wireless capabilities of the newer cars these days is really starting to get scary. The tech is awesome, but the potential for wrong-doing (government, vandals, or otherwise) is just too great. Only so much of the new stuff they're coming out with is actually useful; the rest of it is just junk meant to distract from the actual act of driving, or to add to the billfold of whoever builds the replacements for these in-car computers.
cybersecurity - the product of market creation and fear-mongering.
I demand that our government immediately convene a blue-ribbon commission to survey and understand the cyber-security of Owls. It is long-past time for our government to recognize this clear and present attack vector. Imagine the carnage: Terrorists take control of owls and deafen us with incessant daytime hooting. Or disrupt our sleep with all-night hooting. Or just crap all over our cars and cost us millions in extra car-washes.
Who did what now?
At least for autonomous vehicles.
Read my Very Short "Stories"
Brings to mind Roger Zelazny's "Last of the Wild Ones".
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Somehow I'm guessing that somebody at the DOT just discovered the "new" Battlestar Galactica is on "play instantly" on Netflix...
its bound to be as equally effective to protect your dumbass web cars
If I cyber-see the cyber word in one more cyber-news article I am going to cyber-kick the people who cyber-pen each one of these fucking cyber-articles and cyber-laws. Its about damn cyber-time that we accept that cyber-things that happen in the cyber-world are no more disconnected from cyber-reality than the communication medium we cyber-interact with.
I am electronically typing this on my electronic keyboard and viewing this cyber-page with my electronic monitor. Thankfully, after a real-day of complete cyber-bullshit, I relax with my dead-tree-books on my physical-leather couch in my real-house in the real-world.
The real cyber-question is whether or not this cyber-rant is virtual pontification or just more cyber chat. I'll get on my AOL and go AskJeeves it and see if I can find a GeoCities page that describes proper usage of 90's buzzwords that are used way to cyber-much.
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
There's really no sense in worrying about anything in a car that's not responsible for the actual driving of the car. If the computers that control engine timing, or braking, or airbag deployment get hacked, that's a problem. If the entertainment system gets hacked, and somebody maliciously transfers some Michael Bolton mp3s to your sound system, it's much less of a problem. You simply need to isolate the systems. Cars already have multiple internal computers, so it's not like this requires splitting one on-board computer into two.
Military aircraft have had this concept for a long time. The computing systems that actually fly the plane, like the fly-by-wire controls, are completely separate from the stuff that a pilot uses to do other tasks, like mission planning. Depending on whether your software is "mission critical" or "flight critical" or neither, there are different systems that run it, and different quality standards that apply.
I'd just hate to see a massive freak-out about "hackers" disabling your brakes remotely, when there's no reason for that to ever be even technically feasible.
The simple solution would be to keep the cars control systems and networked systems physically separate from each other. But how do you build massive, wasteful, self defeating government bureaucracies doing that?
Drive by Rickroll in 5..4..3..2..1
Microsoft Sync = LOLs
As with so many other systems, when it doesn't need to be connected to a network to do what it does and when connecting it to said network opens up the chance for attacks over the network, THEN LEAVE IT OF THE FSCKING NETWORK! Regardless of if it is airplane systems, nuclear centerfuges, general industrial control systems, medical equipment, cars or whatever else, if you leave it completely unconnected from a network then you have removed a very real vector of attack. And that doesn't mean you have to stop paying attention, but it does mean you are off to a good start.
> there's no reason for that to ever be even technically feasible.
Google "OnStar remote kill switch"
On the other hand, there are things that are big, fat, juicy targets for blackhats.
Take OnStar for instance. Hurricane coming in? Disable cars selectively to ensure nobody is able to evacuate. Same if there is a bong threat.
Or if the OnStar breaking tech gets sold to thieves, it would be trivial to have some gangbangers armed with 12 gauge shotguns on I-10. Disable cars going by, blow the head off the occupants, and gain another car.
Even though hackers may not be able to screw with brakes or the engine timing, remote engine disabling can be a major threat to national security if it falls into the wrong hands.
It seems to me there's really no inherent danger in adding wireless networking and other new electronics technologies to our vehicles. A big part of the potential problem stems from the insistence of auto-makers to integrate everything into ONE common system. For example, my 2007 Jeep Patriot 4x4 uses a CANBUS interface as the central communications bus for practically all of the electronics in the vehicle. If you try to swap out something like the factory headlights with an aftermarket set of HID lamps? You're likely to run into problems, because the system senses less electrical resistance on the headlight circuit than it expects, so it makes lights blink on and off in an "error" pattern. You can't successfully change out the factory stereo with an aftermarket one either, without spending $150+ more for a CANBUS module to plug in behind it, so the computer system communicates with it as it expects to see it. Other factory accessories won't work properly either, until the Jeep is taken in to the dealer and the firmware re-flashed with a version that has those features "enabled" in it.
If things like wi-fi in the car are only interfaced with the stereo/media center, and that system is independent of the computer handling the engine, transmission, etc.? Hackers won't be able to do a single thing that directly affects the safety or performance of the vehicle. They'll only be able to mess up your in-dash entertainment system.
Keep driving the old clunker
> There's really no sense in worrying about anything in a
> car that's not responsible for the actual driving of the car.
We worry about our desktop PCs, laptops, smartphones - why should we worry less when the computer's embedded in the car?
After all, they already kill people with drug errors from databases.
The ability to track, monitor, bug & ultimately seize control of any passenger car in the "land of the free"!
Glad I drive a 66 Bel Air wagon, go ahead, make my day!
I killed da wabbit -Elmer Fudd
You want a cybersecurity plan? I'll give you one...
All manufacturers liable upon preponderance of the evidence for 1M in damages for any and all incidents of hacking of a car. In event of injury liability to extend to 10M per incident, with annual adjustment for inflation.
Laws passed to support third party discovery of source code, toolchain, compilers in event of such accusation with costs to be paid by loser.
Problem solved.
If the computers that control engine timing, or braking, or airbag deployment get hacked, that's a problem. If the entertainment system gets hacked, and somebody maliciously transfers some Michael Bolton mp3s to your sound system, it's much less of a problem.
I disagree. Dying inside a fireball due to a crash is much less of a problem than listening to a Michael Bolton mp3.
...this is not a way to get a government black box in all cars at all. Nothing to see here folks.
I'm pretty sure your Pontiac will be safe.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Spend your time on actual roads and rail lines. We can manage the cars and our loss of them just fine.
This can't be said often enough nor loud enough.
I bet they'll throw in some little extras for the auto industry. Like being required to buy wheels, tires, A/C compressors, etc. from the manufacture since anything else would be an illegal modification of the system. They'll put electronics in the valve stem caps at $250 each, and you won't be able to buy them elsewhere without being a national security risk.
Hey Dimwit DOT my car is not connected to the Internets and will never be. I don't want "cyber-security" in my car under any guise.
There is a model-T that still runs in my area. I've seen the guy a few times in the grocery store parking lot, and cruising about the retail district. I'm pretty sure cybersecurity is not a problem for him.
In other words, the solution is: Duh! Cars don't need to be on any stinkin' network.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
The smart / auto drive cars will need a very good plan as a hack then just hack them and trun a auto drive road in to a big pile up or cars or maybe just shut down the road system.
Damn right it will be! I don't have OnStar, power locks, or power windows!
I agree that vehicles are in need of greater security of their electronic systems, I don't know that I want the US Government in charge of such an initiative. I'll just keep driving my car from 1989 until I can't afford the gas anymore.
The US and friends have been pushing for Can-bus, drive by wire, odb and friends since the turn of the century. Last time I stepped into a rented Ford Focus you had to ask the ECU permission to unlock a door.
The regulations passed have been sideways and covert, by 2012 TCS and ABS need to be available. As a result you will be hard pressed to find a mass production car that does not have drive by wire throttle, regardless of the problems that have been experienced pushing these technologies to market.
Current immobilizer key tech has been thrust upon the people under the guise of anti-theft, but really means that someone with the right frequency jammer can stop your car in it's tracks.
The security implications, and the control of a vehicle that can be attained through just the ODB connecter is scary.
This is a case of the regulating bodies opening a security can of worms by forcing these technologies to market, then crying security hazard in an attempt to regulate freedoms.
I call for open source ECU's, less regulation and community control.
These technologies have already fallen into the wrong hands, and they are not yours.
Seems the paranoied rasists-homophiles at Homeland Security are up to no good, they never were.
Now they want to mandate remote detonation devices in all automobiles in the US and US Territories.
This will give Homeland Security its most chearished tool ... a KILL SWITCH .. in every automobile in the USA.
Want to save Uncle Sam some cash?
Answer: Kill Homeland Security!
--//++
http://www.tanfoot.com/
Nuff said.
Each time this rubric gets spouted, it's a sham trying to hide another attempt to control the public.
So while they're "protecting you from cyber criminals" they'll also be monitoring your driving, your destinations, etc. All the better to protect us from "terrerists or child molesters.
It's just accidental, you know - to verify you're not being hacked they'd need to know what you're doing, right? And you'll buy in and feel so much safer - until the insurance companies start subpoenaing this evidence and the law enforcement people use it to send you tickets in the mail.
This is the road to hell, folks - it's paved with good intentions but the destination remains the same
Some of the talk about the new OBD standard has been hinting at the possibility of mobile communication with your vehicles ECU in order to get the emissions information. This is a good idea on paper but execution could lead to some concerns.