Slashdot Mirror
Luxury Car Hacker To Speak At USENIX Despite Injunction
alphadogg writes "The lead author of a controversial research paper about flaws in luxury car lock systems will deliver a presentation at this month's USENIX Security Symposium even though a UK court ruling (inspired by a Volkswagen complaint) has forced the paper to be pulled from the event's proceedings. USENIX has announced that 'in keeping with its commitment to academic freedom and open access to research,' researcher Roel Verdult will speak at the Aug. 14-16 conference, to be held in Washington, D.C. Verdult and 2 co-authors were recently prohibited by the High Court of Justice in the U.K. from publishing certain portions of their paper, 'Dismantling Megamos Crypto: Wireless Lockpicking a Vehicle Immobilizer.' Among the most sensitive information: Codes for cracking the car security system in Porsches, Audis, etc."
Because if they block the documents, organized crime will never find out.
c++;
US law does not extend outside of the US other, but people have, for example, been arrested for going to places like Thailand and having sex with underage girls and boys. He's still going to be liable to the UK court's decision unless he's never planning to return to his home country.
Fuck the limey court.
Once scientists, even the dim-witted social scientists, get muzzled, the Western Civilization is finished.
Seriously, what's the difference between Ayatollah-mullah fatwas encouraging violence to cartoon drawers, and multinational industrial outfits threatening legal/financial ruins to those who tell truth to power?
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
See here's the deal: Just because one person discovers something, it doesn't magically mean that everyone else can figure it out right away. It might be the person who discovered it is pretty clever, and has done a lot of work in that field. So it may well take others quite some time to find it out. If you want to see some examples, look at various military technologies, in particular stealth technology. You might note that that US had working stealth systems long before anyone else.
Now as this relates to security, what it means is that disclosing right away may not be that useful. Perhaps if you give some time for a fix to be implemented, or at least a mitigation, then things could be a little better. Remember with cars it isn't like one can just post a bug fix on a website. All other things aside in terms of what has to be changed, there is pretty extensive testing and certification.
So one can well argue if you've found a flaw in a car you need to notify the manufacturers and give them time to fix it or mitigate it, which may be a good deal of time, rather than running out and telling the world so people know how clever you are.
Like say I discovered that if I pushed on a particular spot in your house, the whole thing would come crashing down on your head. Turns out, said spot is not easy to fix, you can't just go and spend $5 and an hour to do it. It will take a good bit of time and money to fix the problem. Would you like me to let you know, quietly, or would you like me to stick up a poster letting anyone who sees it know, and how that nobody does anything?
Indeed. And normally in cases like this, the researchers alert the people responsible for fixing the problem in good time before publication. In some (many?) cases, the people in charge of the problem doesn't take it seriously, downplaying the risks, or plays the never ending blame-the-contractor game. In that case the only way forward is to threaten to publish the information.
I don't know what happens here, the article never mentions either scenario, but seeing how the people behind the article are serious researchers, I don't think it's very far fetched to guess that they have at least taken some sort of responsible action before publishing the paper. It says that the source code for the crypto has been available since 2009, but hard to know what that means.
c++;
Which is the Netherlands. A German company is taking legal action against a Dutch hacker giving a presentation in the US using British law. This is like the poster child for jurisdictional WTFery. Do all laws of all EU member states now apply to every country in the EU? That doesn't sound quite right.
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
It's not necessary that convoluted. The legal action is taken by the UK-based court on this particular work of the UK-based researcher, working at the University of Birmingham. The original article reads as if the court almost initiated this themselves, due to an ongoing case involving Volkswagen Group. Not sure how that actually holds up.
c++;
See here's the deal: Just because one person discovers something, it doesn't magically mean that everyone else can figure it out right away. It might be the person who discovered it is pretty clever, and has done a lot of work in that field.
History proves you wrong. Usually all it takes is the notion something is possible and vague explanation, or merely advances in other fields that make new discovery feasible. Look up parallel invention.
http://www.kk.org/thetechnium/archives/2009/08/progression_of.php
Who logs in to gdm? Not I, said the duck.
From http://www.bbc.co.uk/news/technology-23487928 :
"The researchers informed the chipmaker nine months before the intended publication - November 2012 - so that measures could be taken. The Dutch government considers six months to be a reasonable notification period for responsible disclosure. The researchers have insisted from the start that the chipmaker inform its own clients."
So essentially they have followed the responsible disclosure protocol but are now being blocked anyway
The researchers informed the chipmaker
That's the key phrase here. Most likely the chips are not field-reprogrammable. There are no measures to take short of getting new silicon out and recalling the hardware. Knowing the corporate inertia, they'd probably need a year from the date the recall decision was made to implement it and push to the dealers, if they really worked on it like crazy. Fixing crypto where the cost of another mistake may be another recall isn't something you do casually. Presumably some people with suitable theoretical background would need to be contracted and check things out before it hits the fabs. How long would deciding on a recall take I wouldn't know, but presumably not overnight either.
A successful API design takes a mixture of software design and pedagogy.