Slashdot Mirror
Hackers Demand Automakers Get Serious About Security
wiredmikey writes: In an open letter to Automotive CEOs, a group of security researchers has called on automobile industry executives to implement five security programs to improve car safety and build cyber-security safeguards inside the software systems powering various features in modern cars. As car automation systems become more sophisticated, they need to be locked down to prevent tampering or unauthorized access. The Five Star Automotive Cyber Safety Program outlined in the letter asked industry executives for safety by design, third-party collaboration, evidence capture, security updates, and segmentation and isolation. Vehicles are "computers on wheels," said Josh Corman, CTO of Sonatype and a co-founder of I am the Cavalry, the group who penned the letter (PDF). The group aims to bring security researchers together with representatives from non-security fields, such as home automation and consumer electronics, medical devices, transportation, and critical infrastructure, to improve security.
Nothing is going to happen until they get sued.
Getting the automakers to make any kind of substantive change requires either legislation or expensive PR disasters like a Pinto or Firestone/Explorer event.
You're looking for quotes? See my journal.
it won't be long before we are forced to install antivirus in our cars : /
So is it "Hackers" demanding better security or is it "a group of security researchers"? Because the inflammatory headline surely conjures the modern, media definition of Hacker and not "A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary". And the headline certainly doesn't make me think of security experts at all!
Come on /. , you can do better than that...
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
People are going to be murdered like Diana, only it won't be MI6, it's going to be script kiddies and highway griefers.
We can't even get automakers to admit they put faulty ignition switches in for decades... A solid "good luck" to these hackers raising the issue to them.
it won't be long before we are forced to install antivirus in our cars : /
Lets hope it doesn't make them run significantly slower ;-)
It's kinda terrifying that the people making fast, heavy lumps of metal with computerised control systems don't already routinely isolate those control systems from any other computerised technologies in the vehicle, particularly any that can interact remotely. They shouldn't need to be publicly admonished about the dangers of these situations. Don't these organisations employ actual engineers any more?
But given that it does seem to be necessary to make a public display of this -- which presumably removes any plausible deniability if the auto makers do get sued after an accident later, so I can believe it will at least get their attention -- I'm glad it seems to be a responsible group with the right motivations who are starting the ball rolling. If it were just a bunch of lawyers or insurers, the general public could write the campaign off as the signatories just looking out for their own interests.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
I'm all for this *provided* these 'researchers' don't cause the prevention of access to diagnostic data so that users can continue to have the right to repair their own vehicles.
Otherwise the next headline will be a repeat of old ones where vehicle owners can't repair their vehicles because the automakers have locked things down *far* too much so you can only use their dealerships to reset computers, etc, etc.
Don't put this crap in cars in the first place.
I know, I know, simplicity is such an ugly word. It would be truly horrible if people had to concentrate on their driving rather than the six-channel, streaming video playing on their dashboard while they blend margaritas.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Hackers Demand Automakers Get Serious About Security
I misread the subject line as being about automake systems, like Maven, PIP, and easy_install, and was very excited. All of those are vulnerable to DNS cache poisoning attacks, allowing injection of arbitrary code into software builds.
An enormous first step in improving security is the incorporation of PGP signature checks, but at least in Maven, many of the most popular libraries aren't signed.
Given how many of the people here use these tools on a daily basis, perhaps pointing fingers at the automakers is not warranted until the automakes are not glass houses.
Stop-Prism.org: Opt Out of Surveillance
One of the simplest ways to lock down a computer is to physically lock it away from access. Originally car-makers did that --you needed physical access to the computer (usually inside locked hood compartment) to do anything to it. Now they have connected it to radio waves. That is the main security hole. Go back to a solid wired-only connection, with the connection point(s) behind locked doors, and a significant chunk of the security problems goes away.
If environmentalists were running things, cars would be slow and efficient. We'd probably have 55mph speed limits again (I get 54mpg in my car at 55mph, but only 42mpg at 75mph), and CAFE standards/gas taxes would be raised significantly. Your mock-conspiracy theory ignores the logic used by environmentalists. At no point would environmentalists argue for inefficient automobiles.
Since people are now talking about car computer security, now is the time to start thinking about including a secure keyed police shutdown mode.
When we get to autonomous vehicles, the nay-sayers are are already worrying about how this would permit alleged felons to drive off form robberies all the while taking pot-shots at the police (not having to drive, and all).
If we're building a Star-Trek ® flavor of car, start thinking about including Command Authorization Codes on a per-car basis.
Don't take life too seriously; it isn't permanent.
Damn those hackers!
Every stolen car, and every damaged car = $$ for the automakers for a new car, as the cost of parts is so high that a small amount of true damage = writeoff. or for the repair network for damaged parts.
Better security has been easy to implement for decades, but has not been implemented due to this conflict of interest.
Secure handshake key fobs are the way. Hard wired into the computer so they can not be bypassed or copied.
1). Not needed since it will add to the cost of the car.
2). The Computer is not accessible via wireless to change the program (stand still or not) - no issue
3). How to eleiminate insurance company access to impact data
4). The whole hobby market would be eliminated i.e. tuner groups, and the DIY since besides just encrypting or isoalting the internal computer, it would be taken to the next step to encrypt the communications such that 3rd party tools couldn't access the data or they would have to pay a license
5) The people who are suggesting this are just trying to create business for themselves to milk the car industry of an un-needed thing. Since they would be the self-proclaimed standards body and that all testing by the car manufacturers would have to come through them for a high price per car to get their seal of approval, let alone any recerts.
6). I'd prefer to to be more open sourced and transparent so that I could figure out how to make a 3rd party tool to diagnose the car.
Automobile companies make a large number of vehicles - both GM and Toyota make around 10 million per year. Saving just one dollar on each vehicle adds millions to the company profits.
Something as simple as the extra wiring to create multiple data busses in the vehicle could add a couple of dollars to the vehicle cost. The auto makers will not do it unless it is mandated (either by law or their legal department fearing lawsuits) or they see some sort of a competitive advantage (somewhat unlikely) or there's a PR disaster.
It's easy to say "Just isolate the critical driving functions (brakes, accelerator, ignition) from the non-critical systems (radio, NAV, etc.). The problem is that for as many people are pushing to keep these two worlds isolated from one another, you have an entirely different set of constituents pushing for integration - customers, governments, law enforcement, OEMs, etc.
- Someone steals your car or car jacks it, groups want the ability for law enforcement to remotely track it (NAV) and disable it (turn off the engine, apply the brakes, etc.).
- Lock you keys in the car? Customer want the ability to call in and have the doors remotely unlocked.
- Air bags deployed? Many want that in-car event to automatically alert emergency response.
- Want monthly preventative diagnostics run by the car and emailed to you? Guess that requires...
- Some OEMs like Tesla are intentionally pushing the boundaries of 21st century automotive computing. Automatic remote firmware updates (a la Windows Update). Remote diagnostics. Sounds cool... until someone pwns you through that vector.
Cryptology and 2FA can help address some of these security concerns, but the manufacturers also need a workable support model that scales to the size of thousands of dealerships worldwide and their need to get stuff done too.
20 years minimum for any hacker who affects a car which is driving on a public road. Would that be enough of a security measure?
Well, obviously not. We also need 30 years minimum for anyone trying to pin fake evidence of such a crime on someone else, and 40 years for anyone who suggests doing this on slashdot.
I believe they mean 'automobiles which are inefficient at actually getting you anywhere', which is what environmentalists actually want, so we'll start using their beloved buses and bikes instead.
Of don't own a car with all those gadgets doesn't occur to anyone? On the other hand, laws are funny things. Everyone claims to want to end drunk driving no matter what but as soon as you suggest lifetime revocation of all licenses upon first conviction and mandatory long prison time for second offense, all of a sudden it's a 'societal problem'.
Oh well.
Things like ABS EBS and the many engine control computers that i have probably never heard of do not need to be connected to the car stereo or the internet, they should be physically separate from any other non crucial set of components that they have no need to communicate with...
As Andrew Tenenbaum would put it:
When you flush the toilets on an airplane; an error in the toilet flushing mechanism should not be able to possibly cause missile launch systems to go off or engines to shut down.
The same applies for security of a system as important as breaking on a car: Any convenience given by connecting an ABS to a networked computer will never outweigh the safety benefit of the physically isolated security of not having it connected. It's too important and you don't need to have access to it on the same network as your frickin iTunes device. The same goes for all the other critical systems in a car. At most it's central hub should be separated from a networked hub that is capable of connecting to the internet.
The latest in braking technology involves radars which detect obstacles, vehicles, pedestrians etc. That information is processed and then fed to the ABS/ASR/ESP brake, the motor, the clutch and an electric steering unit.
So,... being in a warfare mode I say you could potentially eliminate that rich guy in his S-class by means of a $500 laptop and a $50 USB microwave transmitter. You could also do this with a nice directional antenna from 50 kilometers distance from a Cessna. Or a Rivet Joint.
I am not privy to the Radar code, but I am privy to some inner working of an auto business and it does not look nice+secure, to be honest.
Land Of The Prison Inmates and Fatty Burgers !
I am yet to read anything even close to correct on how CAN works and how wireless for vehicles work. These articles all compare the vehicle network to a computer network. They are not the same. Wireless systems have existed in vehicles for years. Only recently have cell phone modems been included but the connection to the vehicle systems is hardware separated.
You can communicate with the modules,on the vehicle network but you need to know what bits to send. Also there are limits to what cannot change on each module in the network. Wifi communication is typically on a radio or hands-free module with a cell phone modem. Wireless communication is to that module and no others. Communication between the wifi and to external modules is limited by the radio/hands-free device and network. These cell phone modems are locked down quite drastically to prevent any such issue from occurring. Reducing technical details to manager speak on how CAN networks work is not easy. Having crackpot authors whom think they are experts like this does not help.
it won't be long before we are forced to install antivirus in our cars : /
Lets hope it doesn't make them run significantly slower ;-)
2015 Dodge Challenger SRT Hellcat (707 hp, capable of 10 second quarter mile times with the sole modification of using race tires. And if you can keep your foot off the gas pedal you can get about 20 MPG) + McAfee Antivirus 2016 Automotive Edition = Prius-like performance @ 10 MPG
Any insufficiently advanced magic is indistinguishable from technology.
...hackers demanding printer companies make more secure ink cartridges.
I'd worry about people hacking my car about the same time as I'd worry about people cutting my brake lines.
This is a boring sig
One of the approaches compartimentalization of embedded systems is MILS (wikipedia), it's e.g. followed by EURO-MILS and D-MILS. A use case in cars is given here (in German). Disclosure: I'm with EURO-MILS.