Slashdot Mirror
Why Your Phone Gets OTA Updates But Your Car Doesn't
New submitter kjbullis writes with this snippet from Technology Review: "When Toyota recalled over two million cars last week because of flaws with antilock braking systems and other problems, the fix was simple — a few software updates .The implementation of that fix is far from simple. Every one of those cars has to be taken into a dealership to have the new software installed, an expensive process that can take months. Cars that haven't been fixed could, in some cases, suddenly stall and crash. There is an alternative — the same sort of remote software updates used for PCs and smart phones. Indeed, one automaker, Tesla Motors, already provides what it calls 'over-the-air updates,' which allowed it to execute a recent software fix without requiring anybody to bring in their cars. But other automakers are dragging their feet, both because they're worried about security and because they might face resistance from dealers."
Because a bad update on the phone won't cause a high speed fiery wreck.
...but I'd rather not add any more attack vectors than absolutely essential.
Although it doesn't happen as often these days, I do remember OTA updates bricking my phone in the past, and PCs under my care are still occasionally screwed up by "drive-by updates" in the middle of the night. For something like a car with the potential for property damage or stranding me and mine far from civilization, I'm pretty sure I don't want automatic OTA updates, even if they could arrange that the car not be moving during the time. I want to know exactly what problem the update is solving, the likelihood I will experience that problem, whether the update and backout procedures have been vetted, and the post-update test procedure. I make a living with my camera, and I don't blindly install firmware updates for it either.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
I'd rather not have a car manufacturer get into the mindset of assuming problems like that are cheap and easy to fix (so they can scrimp on testing)
That would be if the Windows Update team designed it, yes.
It would also idle for half an hour while the update installed.
I was assume the same thing that happens when anything else loses connection during an update... it will either hold the download until it can complete or else will cancel it. I don't know of any device that patches itself while it's still downloading the update... storage is cheap enough that nothing should be doing that in this day and age... cache first, then install.
Having OTA capability encourages vendors to push out incomplete/buggy firmware ("we can always fix it later") and to push out updates without properly testing them ("if it breaks something, we'll just fix it and re-send"). Suffice to say we definitely do not need these kind of perverse incentives on cars.
And that's without even getting into the trouble that a malicious user could potentially cause if they managed to hack the OTA process and sent out spoofed updates to vehicles...
When you're running late for work, you don't want to wait for your car to reboot to install a software update.
You never expect irony, do you?
Want to be a professional wrestler? Visit www.iyfwrestling.com
@iyfwrestling
How about firmware updates that a user can just download off the manufacturer's website, save on a USB stick, and insert it into a USB port somewhere on the dash? A little less convenient than OTA, but with lesser risks, and still a whole lot more convenient than going to the dealer's service department.
No, I don't see *any* possible ways to hack that update path. Not one thing comes to mind.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
There are way too many issues that this can cause for me to ever want a car that can do this. Here's a few:
Hacking. What's to keep a system like this secure? What happens if some criminal organization for bribing owner to pay them to "unlock" your car? Or a crazy person or group from changing the firmware to lock the brakes when the car hits 50 mph? Or just some 9 year old kid from doing this for the hell of it. And any number of other possibilities.
What happens if the process is interrupted in the middle of re-flashing? Does the car need to be towed in and the ECU replaced?
If there's a bad update, it's a hell of a lot better for it to be discovered quickly in the first few cars that receive it. It kinda sucks if the update is bad and suddenly a million+ cars all fail at the same time.
Perhaps I don't want the update. Granted, this doesn't happen often. But there have been cars that were recalled because they had more torque than they should have. Perhaps I want to keep this feature.
How many times have programs or video cards been released sooner than the software or drivers were ready. Being able to push out updates makes it possible to release a car that is not really ready. I would like to think it wouldn't happen. But as soon as someone's bonus is dependent on making a deadline, it will. Actually this would become pretty common I think. It's not done now because it costs the manufacturer a lot of money. Pushing updates would be very cheap by automotive company standards.
What's the added cost for this going to be?
I don't drive very much as it is. How much of a drain will this type of system put on my battery?
I don't want to have to pay to fix the update system when it breaks. A car is one of the harshest environments electronics can be in.
There was an article on /. not too long ago about the automotive industry charging monthly fees for functionality. I don't want a system like this in my car that would allow for fees of any kind.
I could go on. Perhaps I'm old and set in my ways. But I don't see any real benefit to this that would outweigh the potential issues.
Oh no, I need to get the hospital quick. "please wait while your car is being update... installing update 1 of 35... time remaing 1 h 16"
That's not my primary concern. My primary concern is bricking.
Dealer bricks my car, they already have it and can install a new ECU. I brick my car and it's a costly tow truck trip to the dealer.
Non impediti ratione cogitationus.
The *manufacturer* has a vested interest in making sure your car has a safety update--it's a bit different than just the neighbor's concern. Think about it. If you make a product that *will* kill a few hundred people over its lifetime unless you fix it, and only half of the owners will bring it in for an upgrade, wouldn't you rather be able to push the upgrade out?
An auto-upgrade is a major safety feature. Is there a security issue? Yes. But not an unsolvable one.
Every manufacturer will switch to auto-upgrades when the first one loses a massive tort case over failure to auto-upgrade.
It's not a question of the security on the OBD2 port. In most modern cars all the computers internally are networked together; so, the center console computer can actually talk to the PCM. It's theoretically possible to have any one of the computers push an update. My suspicion is that they're not allowing OTA updates to reduce risk.
Yes, I know anyone can buy an OBDII interface, I have one. Requiring a piece of "special" hardware to connect to the computer for updates both limits who can do it and requires physical access. Making OTA updates possible means anyone who can hack the update encryption and attach a proper digital signature (because, we all know that's impossible) can push anything they want.
Many of those infotainment centers are running Microsoft Windows Embedded.