Slashdot Mirror
Hackers Demand Automakers Get Serious About Security
wiredmikey writes: In an open letter to Automotive CEOs, a group of security researchers has called on automobile industry executives to implement five security programs to improve car safety and build cyber-security safeguards inside the software systems powering various features in modern cars. As car automation systems become more sophisticated, they need to be locked down to prevent tampering or unauthorized access. The Five Star Automotive Cyber Safety Program outlined in the letter asked industry executives for safety by design, third-party collaboration, evidence capture, security updates, and segmentation and isolation. Vehicles are "computers on wheels," said Josh Corman, CTO of Sonatype and a co-founder of I am the Cavalry, the group who penned the letter (PDF). The group aims to bring security researchers together with representatives from non-security fields, such as home automation and consumer electronics, medical devices, transportation, and critical infrastructure, to improve security.
Nothing is going to happen until they get sued.
Getting the automakers to make any kind of substantive change requires either legislation or expensive PR disasters like a Pinto or Firestone/Explorer event.
You're looking for quotes? See my journal.
it won't be long before we are forced to install antivirus in our cars : /
So is it "Hackers" demanding better security or is it "a group of security researchers"? Because the inflammatory headline surely conjures the modern, media definition of Hacker and not "A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary". And the headline certainly doesn't make me think of security experts at all!
Come on /. , you can do better than that...
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
it won't be long before we are forced to install antivirus in our cars : /
Lets hope it doesn't make them run significantly slower ;-)
It's kinda terrifying that the people making fast, heavy lumps of metal with computerised control systems don't already routinely isolate those control systems from any other computerised technologies in the vehicle, particularly any that can interact remotely. They shouldn't need to be publicly admonished about the dangers of these situations. Don't these organisations employ actual engineers any more?
But given that it does seem to be necessary to make a public display of this -- which presumably removes any plausible deniability if the auto makers do get sued after an accident later, so I can believe it will at least get their attention -- I'm glad it seems to be a responsible group with the right motivations who are starting the ball rolling. If it were just a bunch of lawyers or insurers, the general public could write the campaign off as the signatories just looking out for their own interests.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Don't put this crap in cars in the first place.
I know, I know, simplicity is such an ugly word. It would be truly horrible if people had to concentrate on their driving rather than the six-channel, streaming video playing on their dashboard while they blend margaritas.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
One of the simplest ways to lock down a computer is to physically lock it away from access. Originally car-makers did that --you needed physical access to the computer (usually inside locked hood compartment) to do anything to it. Now they have connected it to radio waves. That is the main security hole. Go back to a solid wired-only connection, with the connection point(s) behind locked doors, and a significant chunk of the security problems goes away.
1). Not needed since it will add to the cost of the car.
2). The Computer is not accessible via wireless to change the program (stand still or not) - no issue
3). How to eleiminate insurance company access to impact data
4). The whole hobby market would be eliminated i.e. tuner groups, and the DIY since besides just encrypting or isoalting the internal computer, it would be taken to the next step to encrypt the communications such that 3rd party tools couldn't access the data or they would have to pay a license
5) The people who are suggesting this are just trying to create business for themselves to milk the car industry of an un-needed thing. Since they would be the self-proclaimed standards body and that all testing by the car manufacturers would have to come through them for a high price per car to get their seal of approval, let alone any recerts.
6). I'd prefer to to be more open sourced and transparent so that I could figure out how to make a 3rd party tool to diagnose the car.