Slashdot Mirror
How To Take Control of a Car's Electronics, Cheap
mspohr writes with this excerpt from The Register: "Spanish hackers have been showing off their latest car-hacking creation; a circuit board using untraceable, off-the-shelf parts worth $20 that can give wireless access to the car's controls while it's on the road. The device, which will be shown off at next month's Black Hat Asia hacking conference, uses the Controller Area Network (CAN) ports car manufacturers build into their engines for computer-system checks. Once assembled, the smartphone-sized device can be plugged in under some vehicles, or inside the bonnet of other models, and give the hackers remote access to control systems. 'A car is a mini network,' security researcher Alberto Garcia Illera told Forbes. 'And right now there's no security implemented.'"
The hacker has to physically install a dongle in the port, or plug the hard ware somewhere under the hood of the car. Once that is done, it would be possible to control the cars electronics remotely.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
And how does this differ from the Bluetooth ODB-II connector I use to stream car data to my cell phone? That is wireless and also requires being plugged into the diagnostic port on the car.
I can pull all sorts of data from that. If I spend a little more, I can get a full CAN-bus connection and actually *send* information and control things.
This isn't hacking. It is a product demo for VW.
Learning HOW to think is more important than learning WHAT to think.
If you need physical access then it's not a hack and doesn't show lack of security.
This issue surrounds physical access to the vehicle, at which point no amount of security is going to be able to protect it (it will only make it more difficult to do). Adding security would make it significantly more difficult for mechanics and enthusiasts to work with their vehicles. My vote is towards adding a notification light on the dash board for when a device is connected to the vehicle's computer (that cannot be turned off by the computer [e.g. controlled by an auxiliary system]), which would notify the user that something is not right (if they did not connect something).
Taken from the wise wjwln
http://slashdot.org/comments.pl?sid=4761849&cid=46192975
You're obviously not paying attention then. Plenty of people have posted *exactly* what's wrong with the comment system in beta. Maybe you haven't seen them because you're actually using beta?
Look, you have to understand something: Slashdot discussions generate interesting content by allowing tons of garbage to be posted, mixed around, and evolved. Part of the evolution comes from the interactive nature of community discussion, and part of it comes from the moderation process. For this evolution process to work properly, you have to be able to see a lot of posts at once, all in one shot. You need to be able to see some contextual information about the people posting comments. When you post your own comments, you need to be able to quote or link to other posts easily. When you want to moderate, you need to be able to do it in place, at the comment you intend to moderate.
Beta breaks all of these vital features; without them, the nature of Slashdot discussion changes completely. People will read fewer comments because the new layout hinders rapid seeking, scanning, and comprehension of potentially valuable posts... all while making it much more difficult to skim past the stuff that doesn't interest you. When people read fewer comments, they post fewer comments. When the total number of comments starts to drop, the exploration of the discussion space becomes much less thorough. Potentially valuable or interesting discussion paths will be missed. Those rare, but highly sought after gems of insight and wisdom borne from the cesspool of chaos will become much more scarce.
You want to know why people hate the beta so much? It's because it kills the evolutionary discussion dynamic that makes this community what it is. There's nothing else like it, and many of us do not want to lose it.
It's only use is as a gadget in CSI for the gang to figure out to determine it was the husband that sabotaged the wife's car and drove her off a cliff, after all, the husband would need physical access, and he'd have it, as he has a set of keys.
Learn to love Alaska
It's reasonable to assume that no hacker will have physical access to your computer. For your car, that's a much less reasonable assumption. Cars sit unattended in public places for long periods, so someone intent on messing with you will probably have little trouble gaining access to your car and installing this box.
A simple way to improve security somewhat would be to require CAN devices to be paired with the car's computer. IIRC Volvo used to do this; installing a CD player on the CAN bus required a trip to the dealer to pair it, but they've since disabled this security as it was "too troublesome".
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
What company directs 25% of its users to a partially-working, not-ready-for-production website? Please realize that Beta will not have the features that we want, because it goes against Dice's plans for Slashdot. To their advertisers, Dice presents Slashdot as a "Social Media for B2B Technology" platform. B2B - that's the reason Beta looks like a generic wordpress-based news site. A large precentage of the current userbase might be in IT, but /. is most certainly not a B2B site.
Nevertheless, Dice is desperate to make money off of Slashdot, since it has not lived up to their financial expectations, a fact that they have revealed in a press release detailing their performance in 2013:
Slashdot Media was acquired to provide content and services that are important to technology professionals in their everyday work lives and to leverage that reach into the global technology community benefiting user engagement on the Dice.com site. The expected benefits have started to be realized at Dice.com. However, advertising revenue has declined over the past year and there is no improvement expected in the future financial performance of Slashdot Media's underlying advertising business. Therefore, $7.2 million of intangible assets and $6.3 million of goodwill related to Slashdot Media were reduced to zero.
Beta is not a cosmetic change. It is a new design that deliberately ruins the one thing that makes /. what it is today -- the commenting system. There is nothing wrong with Slashdot, from the users' perspective, that demands breaking its foundations. As others have commented, this is an attempt to monetize /. at any any cost, and its users be damned. Dice views its users, the ones who create the site, as a passive audience. As such, it is interchangeable with its intended B2B crowd. We, the current users of Slashdot, are an obstacle in Dice's way.
That is why they ignore the detailed feedback they have received in the months since they first revealed Beta. That is also why they now disregard our grievances. Their claims of hearing us are a deliberate snow job. It is only pretense, since at the same time they openly admit that Classic will be cancelled soon:
"Most importantly, we want you to know that Classic Slashdot isn't going away until we're confident that the new site is ready.
Don't hold your breath waiting for Dice to fix Beta. Their vision of Slashdot is a crippled shadow of the site as it is today. Don't let them pull the wool over your eyes. Dice doesn't need us, and it wants us out.
Slashdice delenda est!
Most cars have a high speed CAN, for all functions needing messages at a rate of about 10 or 20 ms like Abs, engine, etc. There is also a low speed CAN, which is used for things like heating, and low rate signals of about 100 and 200 ms. The advantage of low speed CAN is that it can be put into low power and use it to wake up devices, like a wake up on LAN. I Then there is the LIN bus. This is a low speed, single wire cheap bus. It is used for things like wipers. These are the basic three buses.
Cars like BMW and Mercedes have two or three high speed CAN, a MOST bus for entertainment, and a flexray for safety critical applications. Other manufacturers use TTP instead of flexray, but the safety and timing is in both cases the main reason for not using CAN throughout.
Cars are also slowly rolling out Ethernet, mostly due to the high speed and low cost.
All buses are connected to each other in one way or the other via dedicated gateways. These gateways are usually not pure network gateways, but standard ECUs used for vehicle functions, also serving as gateways.
Then there are internal buses. For example some controllers include multiple ECUs connected via SPI or similar. The engine ECU is almost always connected to the CAN bus because it requires a lot of information from other systems, such as speed, gas pedal input, etc. The actual firing of the sparks is very time critical, and this is after done via a dedicated TPU controller, integrated as a sub core in the engine ECU (take a look at the MPC555 documentation), connected to the main ECU via an internal bus.
The point is that no one gives a Shit if you Fuck up your car by plugging something to one of the vehicle buses. From the OEM perspective, the car must be non hackable from the outside, but once you are in, it's your problem.