Auto Industry Teams Up With Military To Stop Car Hacking

An anonymous reader writes: A team of hackers is collaborating with military and industry groups to develop cyber security defenses for commercially available cars, in response to a growing threat from criminals and terrorists. In the U.K., hackers are now responsible for a third of car thefts in London and there are fears that while technology is progressing, older models will remain vulnerable to attack. Although there have been no reported instances of a car being completely commandeered outside of controlled conditions, during tests hackers come out on top every time – unlocking car boots, setting off windscreen wipers, locking brakes, and cutting the engine.

Comments

should have teamed up with a famous guitar company

[Anonymous Coward]

Just saying brah...hack the Gibson

First rule of computer security!!!

[Karmashock]

1. Physical security.

If you let the machine get into the hands of hackers... they will break it the controls. And that is doubly certain if the device is mostly functional regardless. It will interact and that will let people either exploit flaws in the security or just decrypt it.

If you want to stop hackers from getting into the system then the first thing you have to do is make it pretty much impossible for a hacker to physically access the system. As in steel. And beyond that, the wireless connections are a serious vulnerability. Scale them back or secure systems from the wireless radios.

If you can't do that, then at the very least don't let a hacker turn my engine off while I'm driving down the free way. Some features are simply not worth that vulnerability.

Re:First rule of computer security!!!

[drinkypoo]

If you can't do that, then at the very least don't let a hacker turn my engine off while I'm driving down the free way. Some features are simply not worth that vulnerability.

The sad part is that preventing this is really easy by following some basic principles of networking and security like properly sanitizing your inputs. But they're just not used to even having to think about that at all at the companies which build the PCMs. Some vehicles are clever enough to have a communications gateway in between systems but who trusts the gateways?

Re:First rule of computer security!!!

[geekmux]

1. Physical security.

If you let the machine get into the hands of hackers... they will break it the controls. And that is doubly certain if the device is mostly functional regardless. It will interact and that will let people either exploit flaws in the security or just decrypt it.

If you want to stop hackers from getting into the system then the first thing you have to do is make it pretty much impossible for a hacker to physically access the system. As in steel. And beyond that, the wireless connections are a serious vulnerability. Scale them back or secure systems from the wireless radios.

If you can't do that, then at the very least don't let a hacker turn my engine off while I'm driving down the free way. Some features are simply not worth that vulnerability.

First rule of Capitalism: Make money.

Second rule of Capitalism: Actually give a shit how you make it.

Good luck getting anyone to pay attention to any other rule but the one that counts.

In other words, fuck your risks. The vendor is going to massively profit from those insecure features you never asked for, and won't stop installing them until enough people die to make it illegal (key word there being enough, that threshold is a lot higher than you think thanks to political gaming.)

Re:First rule of computer security!!!

[Anonymous Coward]

Bingo. This, and separation of items. For example, why does the radio need to be on the same CANBus as the ECM/TCM?

Thinks like vehicle upgrades need to be at least as well thought out as the BIOS of a computer I had from 1995 where to upgrade it, it took pressing a button to enable that functionality, and when done, the BIOS would re-lock, preventing alterations unless that button was pressed again.

Yes, it might be cool that one can start up a car from an app with a car using a 3G connection and the phone using its cellular connection... but lets be real here. Is that functionality worth it, as opposed to "just" a well built rolling code keyfob or a BlueTooth pairing? Automakers might want to throw the brakes on adding new features without considering the security aspects.

Even the remote disable functionality of cars can be easily abused. This happened in Austin when a car dealer installed aftermarket devices to ensure payments. A disgruntled ex-employee logged onto the system with a valid account of another employee, and disabled every single car (paid for or no) that the system was managing. Now, scale this up. A criminal organization would get a ton of street cred by hacking a system like this and disabling cars by the tens of thousands in a city evacuating from a hurricane.

This doesn't say that a vehicle is impossible to secure, but there are very basic things that can help immensely, from not having anything accessible by remote [1], separating different subsystems and having them on different CANs, having an offline, physical method of upgrading firmware, and maybe, just maybe, supporting vehicles that are older than the latest model year. If Tesla can support and upgrade with new features vehicles made a few years back, why can't other auto makers?

[1]: The only exception to this might be a 3G chip that would call for help and transmit position via E911 if air bags deploy, but otherwise be powered off otherwise.

Re:First rule of computer security!!!

[drinkypoo]

The radio is not a radio any more, it's a control unit (in many cases) and it changes powertrain and suspension settings. it legitimately needs to be able to communicate with stuff that's on that bus. But it should be doing it through a gateway which only permits the necessary signals...

I want remote features, but nobody should be able to drive away with the vehicle without actually having the key, and nobody should be able to reflash the vehicle without actually physically accessing it. Once they are in, though, there's very little you can do to prevent them. For cars which cost multiple thousands of dollars, it's not difficult to imagine someone spending a few hundred on a PCM and a couple hundred per model they want to steal making up a harness ahead of time which will operate any vehicle but the very fanciest without discussing starting the engine with the immobilizer at all. Preventing them from accessing it is also preventing a tech from doing so...

Re:First rule of computer security!!!

[kilodelta]

Think about it for a moment, cars were never designed with computer security in mind.

Your mention of why does the radio need to be on the CAN bus? Like those controls on the steering wheel? Wouldn't be possible without the CAN bus.

Re:First rule of computer security!!!

[Anonymous Coward]

Hmm... you could make a law that in addition to crash tests, cars have to undergo security tests. Say, an attacker familiar with the model but not the specific car should not be able to (unlock doors | start/stop the engine | ... ) given 1 (5? 10?) minute. Very unlikely to get passed, but it would be an interesting regulation.

Re:First rule of computer security!!!

[plover]

The military is good at physical security. That's their mandate, after all. It seems logical to put them together.

However, they seem to suck at this aspect of it. There is no reason that an American vehicle (or weapons system) left in the hands of an Iraqi army battalion should ever be able to be commandeered by troops who switched allegiance to ISIL. There should be an American satellite link required for occasional checking-in, and the vehicle should be disabling itself if it's failing to check in, or if it's been added to the "captured vehicle list", or whatever. High-risk auto leasing operations are already doing something like this today, with a kind of inverted Lo-jack system.

And from a maintenance standpoint, this shouldn't be an issue. The machines already require sophisticated computer control to turn on and run. All it has to do is wipe out its program when the "blacklist" threshold is hit, whatever that may be. It's not like ISIL would be able to order a replacement aftermarket electronic control system for these from Alibaba. For that matter, the engines could include embedded charges (think exploding bolts) that would physically disable the machine on receipt of a suitably authenticated "hostile takeover" signal. Or they could simply continuously report their ID and coordinates, and a J-DAM could sort them out right quick.

Yes, I'd raise holy hell if my car's computer shut me down because the manufacturer added me to their blacklist. But this is like a commercial operation, where the assets don't belong to the drivers, they belong to the Army. And they never, ever belong to ISIL.

Until they get this right, why do we think they are going to get consumer car security right?

Re:First rule of computer security!!!

[Karmashock]

You're expecting the government to understand computer security?

All I know is that there will be mods on the market to cripple these systems and I'll be using them.

Re:First rule of computer security!!!

[Pope]

Most cars cost multiple thousands of dollars

Re:First rule of computer security!!!

[Karmashock]

cars worked just fine without this nonsense. They can clearly work just fine without it again.

The easiest way to make sure the tech is not insecure is to not have it. It think the tech should be optional.

Those that want it for whatever reason can have it. Those that don't can omit it.

Re:First rule of computer security!!!

[plover]

The radio generally isn't on the same CAN bus as the ECM. The ECM is on the high speed bus which usually is reserved for engine and safety systems, like airbags and ABS. But as you noted, there are places where messages have to cross over: airbags need to be able to tell the entertainment system to have the connected cell phone dial 911. There are commercial CAN bus bridges available that provide this function, and they can be configured like a firewall to isolate all messages except those identified as needing to pass through.

Whether or not these bridges are actual security appliances is a different question. Who has the authority to alter those routing tables? Where is the password kept? How are they secured? CAN is a low level protocol that was never designed to be secured.

Re:First rule of computer security!!!

[dkman]

At the very least:
Separate the networks. Have essential processes (engine, breaking, steering) on a secure network
Have infotainment, radio, bluetooth phone, gps, wipers, rain sensor, etc on a separate network
Have anything wifi (door unlock) heavily vetted before you allow it into one of your other networks.

Personally I feel that windows even belong on the infotainment network, as they aren't vital to the safety of the vehicle.
Keep chatter between networks to a minimum. I figure secure (engine) would need to talk to wifi (keyfob) when you hit the start button, although I'm not even sure if that qualifies as wifi - it's more like a proximity sensor.

That way maybe you can open the doors. Some fobs let you open the windows too. But once inside the car you'd still have to do some serious hacking to go anywhere. And nobody's messing with your essential functions while in motion. I know that some fobs do let you start the car, and I don't trust that functionality since it certainly could be exploited - if not now, in the future.

Re:First rule of computer security!!!

[Opportunist]

In general they are not. Or rather, they were not designed as such.

CANbus is a prime example of a bus system that was designed with pretty much anything but security in mind. The whole deal is like 30 years old, and as one can imagine the core ideas in its conception were simplicity and resilience against noise. Both not quite lending themselves well to the idea of ensuring security on a bus.

Also there was really not a huge need to consider security an issue. Mostly because you needed physical access to the vehicle to even get close to accessing the bus. And by then, you HAD already broken in, so what's the gain?

Re:First rule of computer security!!!

[Anonymous Coward]

The difficulty with this is the ever present mandatory feature creep. In next year's model, a backup camera to prevent people from backing over a toddler or other being behind the car will be mandatory. This means that a video display will now be a mandatory default feature on every vehicle sold. Said display will be implemented using digital networking hardware to communicate with the rear view camera. So there's a digital controller in the dashboard whether the buyer wants it or not.

Re:First rule of computer security!!!

[Karmashock]

I'm going to have to side with the Colonial Fleet on this one and say the systems should not be networked at all.

Each of these systems has their own internal sensor package and programming. My fuel air sensors do not need to be coordinated with my anti lock breaks. The two operate just fine isolated.

What is more, some systems should be dumb. Toaster simple. Simplicity means not just more secure but more robust. Simple systems tend to be less prone to failure and error.

Re:First rule of computer security!!!

[Anonymous Coward]

My heavily-used 1984 Mitsubishi Starion sure did.

Re:First rule of computer security!!!

[bws111]

Your traction/stability control operates the throttle and brakes, so they need to be connected at some point.

Re:First rule of computer security!!!

[Karmashock]

No, the military's physical security is a soldier with a loaded rifle trained to kill you if you touch things you're not supposed to touch

Lets say I took any bit of modern military hardware and just dump it in the middle of a hacker convention. What exactly are the odds that someone there won't be able to break the lockouts?

Military gear is not designed to be hack proof. It is designed to be deadly and robust. How long did it take the Iranians to reverse engineer the drone we lost in their territory? They had pretty comprehensive access to its systems almost immediately.

Physical security is the first rule. If the hacker can TOUCH the computer then you're basically fucked.

Re:First rule of computer security!!!

[Anonymous Coward]

Second rule? Where do you live, I want to move there.

I would've said:

First rule - make money for executives
Second rule - make money for shareholders
Third rule - gain power (political or otherwise)
Fourth rule - ...

Somewhere near the bottom - caring about how money is made (ethics, customer first, etc)

Re:First rule of computer security!!!

[drinkypoo]

Most cars cost multiple thousands of dollars

This does not appear to be a reply to my comment, but that's where you left it. Care to expound, or are you simply schizophrenic? The fact that cars cost multiple thousands of dollars is the reason why it's worth it to spend a grand or more on tools for stealing them. Get some easy scores from cars without good security, work your way up, like any other job.

Re:First rule of computer security!!!

[mjwx]

If you want to stop hackers from getting into the system then the first thing you have to do is make it pretty much impossible for a hacker to physically access the system. As in steel. And beyond that, the wireless connections are a serious vulnerability. Scale them back or secure systems from the wireless radios.

If you want to stop 99% of malicious vehicle hacks you need to remove any wireless components from the system as well as physically securing it. This means not giving the infotainment system access to the CANBUS or anything else.

The answer to vehicle hacking is stupidly simple... but this means they cant sell the new Craptiva with remote start technology so guess which one they're going to do.

Re:First rule of computer security!!!

[Karmashock]

Assuming that is correct, does that system need to be connected to anything else?

If the traction control system is connected to the brake servos and throttle servo, does that system need to be linked to the wireless ignition system or my bluetooth stereo? What is more, I do want manual over rides for all these things.

I have an older car and it is profoundly simple in the way that everything works. I don't see why I can't have all the relevant modern features without compromising the underlying robustness of the system.

Re:First rule of computer security!!!

[Karmashock]

You can still buy a dead simple new car.

Re:First rule of computer security!!!

[bws111]

Well, it is kind of hard to have wireless ignition (remote start) without having access to the engine controller, so they do need to be connected. And the remote start probably has connections to the body controller so it can do things like lock the doors, flash lights (for feedback) and monitor to brake pedal so it can kill the engine if the brake is touched (in order to shift into gear) without the key being present.

As for the radio, starting next year all new cars in the US must have backup cameras. The screen that shows the camera image is probably the same one that controls the radio. And the backup camera must know the gear selector position so it can change the display. And the gear position selector also must talk with transmission (obviously), which in turn talks to the engine.

Now, obviously you could do all that with separate switches and wiring, but that drives cost and complexity way up, and of course with each additional part comes an additional opportunity for failure. So no, you can't really have all those modern features with old style simple systems.

Re:First rule of computer security!!!

[dkman]

The rear view mirror has a small section that can display the rear view camera (it just acts as a mirror when an image isn't being displayed). They do it this way in cars that don't have an LCD display, for cars with a standard stereo face.

I do feel that the backup camera is just fine being on the infotainment network. If side camera go away I feel the same about them. Engine, steering, breaking - things where one might lose control of the vehicle if they don't function correctly belong on their own secure network.

Re:First rule of computer security!!!

[bouldin]

Product liability for software is in a weird limbo where vendors effectively have no liability. So they don't have much reason to care, beyond damage to their brand.

If you read the EULA that comes with software you purchase, it disclaims ALL warranty, and the vendor is not guaranteeing the software will do anything, not even what it says on the box.

I wonder if automotive software might be on different legal ground, since nobody accepts a software license when they buy a car.

Re:First rule of computer security!!!

[bouldin]

Product liability law says that manufacturers should be aware of the most current science related to manufacture of their product. They are on the hook for all manufacturing defects. Congress doesn't have to codify the state of the art.

The problem is that the law hasn't decided how software fits in to product liability law, so vendors can argue security defects are not manufacturing defects, but *design* flaws, and they have much less liability for design flaws.

Congress could fix this easily, but legislators are almost entirely hillbillies, low-tech businessmen, amd low-tech lawyers. This is why the USA has one foot firmly in the 20th century.

Re:First rule of computer security!!!

[drinkypoo]

You can still buy a dead simple new car.

Only if you buy a Morgan. Otherwise you're getting ABS, traction control, yaw control, driver and passenger airbags, and the aforementioned backup camera. All that stuff has been mandatory on new production vehicles sold in the USA since 2010, and the camera is coming next year. It doesn't have to be digital, though. If they're not putting any other screen in the car, or if it's not doing anything high-res, it could well be analog.

Re:First rule of computer security!!!

[Karmashock]

I don't have to buy that feature. Most cars in fact don't have a remote starter. Remote door locks are pretty common but the starter is unusual.

Re:First rule of computer security!!!

[Karmashock]

Depends on how complicated the system is actually.

If all you want is remote starting, then have a simple radio/computer system that interfaces with another very simple non-programmable bit of hardware. All the radio/computer unit can do is send a "GO" command to the ignition unit. The ignition unit should have a hardware fail safe that prevents it from operating if the alternator is producing power. In this way, the remote start will only start a car that is off and will have zero impact on a car that is on. Furthermore, compromising the system will not give one access to anything else since the remote start doesn't have to be interfaced with anything but the secure hardware failsafe ignition system.

Re:First rule of computer security!!!

[Karmashock]

Lawsuits seem to only be useful for catching defects rather then actual design flaws.

As to congress, you're talking about people that went into politics young in many cases. Most of them aspired to office from a fairly early point in their career. And therefore they tend to have very specialized skills which have little utility outside of strong arming other politicians.

Re:First rule of computer security!!!

[Karmashock]

ABS and Traction control do not need to be networked to a larger system that is wireless accessible or even programmable.

Ideally, these systems should hardwared. By all means, give them some updatable firmware but have that be something that requires a per chip hardware connection to facilitate.

You can't hack a VCR from 1995 with a bluetooth radio even though the VCR has some sort of computer in it.

Re:First rule of computer security!!!

[Jane Q. Public]

The sad part is that preventing this is really easy

Yes. I think it is pretty clear that the auto makers got themselves into this mess -- as they have often done -- by doing stupid shit they did not understand.

Re:First rule of computer security!!!

[Anonymous Coward]

I, agree with Scotty on this one: "The more they over-think the plumbing, the easier it is to stop up the drain." Hackers are also familiar with this concept. Vulnerabilities that compromise vehicle safety is one thing, but there are pranksters out there that would be just as happy to set your car horn on an infinite loop of 'La Cuca Racha' while your door locks cycle between states to provide the percussion.

Re:First rule of computer security!!!

[mjwx]

I don't have to buy that feature. Most cars in fact don't have a remote starter. Remote door locks are pretty common but the starter is unusual.

Like remote locks were in the early 90, remote start is uncommon now but it will become more common later. Its more common in Europe than the US because of the weather, most people would rather have breakfast than sit in their car waiting for it to warm up enough to drive.

Re:First rule of computer security!!!

[Karmashock]

Trust me, it gets every bit as cold in the US. US is a big place. Parts of it get a great deal colder then anything you'll see in western europe. Just saying.

As to remote start, there are ways to do it that don't present a security risk.

1. Isolate the system.
2. Make it so it does nothing if the car is already on.
3. Make a distinction between starting the engine with the remote start and authorizing driving. If what you want is to warm the car up then you don't need to unlock the steering wheel.
4. Consider multi factor authentication such as a password or pin code to do certain things.

The more you computerize the car the more this sort of thing will be important.

Re:First rule of computer security!!!

[beastofburdon]

"The radio is not a radio any more, it's a control unit (in many cases) and it changes powertrain and suspension settings."

Which it should never be!
A car stereo should be a car stereo and nothing more. It should have absolutely no communication to the rest of the car. Passive receive only connections would be fine in order to display some statistics about the car, but allowing the stereo to transmit data to the control bus is pure idiocy.

The idea of having wireless connections is not really a bad one, as long as it is implemented correctly.
You can't have the communication directly between the cellular chip and the control bus, there must be an intermediary which is only capable of passing the implemented commands, confirmations, and nothing else. It should have no networking ability whatsoever.

Overkill!

[Anonymous Coward]

Nothing, and I mean nothing the security guys ever come up with will have anywhere near the effect of the six inch square piece of plywood with 25 six inch nails hammered through that i place under the driver seat of my car. The second a would be thief jumps into my car seat is the second they begin to understand just how bad their life choices have been. I also have a conventional car alarm that serves to let me know that i should call an ambulance for the 'tard, should but wont, baseball bat feels better in my hands than phone.

Re:Overkill!

[NeutronCowboy]

I'm wondering: is your car a 1960 VW Beetle or 2CV? Because those are the only cars I can think of where the seats can sag enough to make this a worthwhile proposition.

Or, much more likely, you actually don't do any of this.

Re:Overkill!

[Anonymous Coward]

You, sir, are a hero.

Re:Overkill!

[Anonymous Coward]

Nothing, and I mean nothing the security guys ever come up with will have anywhere near the effect of the six inch square piece of plywood with 25 six inch nails hammered through that i place under the driver seat of my car. The second a would be thief jumps into my car seat is the second they begin to understand just how bad their life choices have been. I also have a conventional car alarm that serves to let me know that i should call an ambulance for the 'tard, should but wont, baseball bat feels better in my hands than phone.

I'm glad you think a baseball bat is the answer to car theft. The rest of us actually enjoy our freedom and don't look forward to finding out what feels better in Bubbas "hands" while serving a felony assault charge. Hell of a life choice there, buddy.

Re:Overkill!

[Anonymous Coward]

Yeah, a hero in his mind.

Re:Overkill!

[Anonymous Coward]

Yes it is actuall a '68 air cooled beetle 1300cc. runs like a dream to this day. As for Bubba, ever consider that being a loney crank and queer i might actally look forward to Bubba's hands? Would certainly eliminate all this dating shit that i seem to be terrible at.

Re:Overkill!

[Anonymous Coward]

25 might be too many nails. Remember, a bed-of-nails is reasonable to lie down on because your body weight is averaged over the many nail points such that there is not much penetrating force on any one nail. You might only want a matrix of nine nails or so.

Re:Overkill!

[drinkypoo]

Or, much more likely, you actually don't do any of this.

Probably not. But the springs break in lots of Mercedes seats, and so they're candidates too. A lot of people shore them up with a pool noodle. If you can find a fairly compatible spring, you can splice it into the broken section from below after removing the seat without even having to pull the upholstery, which you don't want to do.

Re:Overkill!

[Anonymous Coward]

Yes and have you ever seen how carefully a fakir will lay themselves on a bed of nails, slowly and tentatively are just two of the words i'd use to describe their actions. Car thieves on the other hand are usually in quite a rush and not gently lowering themselves into your car seat. Just as a kicker, i didn't drive the nails through in a uniform manner, some of them will dovetail into the flesh and make any hope of immediate escape painfully unfeasable.

Is this 2001?

[number17]

Didn't they say they solved this in 2001? /s

The best defense against car thieves is a beater.

Terrorists.

[Anonymous Coward]

They just had to throw that in there. It's become like Franks Red Hot. They put that shit on everything.

Re:Terrorists.

[Anonymous Coward]

What he said.

Not a lot to say

[Thyamine]

Technology can be hacked. Cars were 'hackable' when they were just mechanical: shims or tools to unlock doors, bypassing the ignition, random fun things I've seen on TopGear. There was one care where if you pulled out a fuse or something, put it in backwards, it started the car. Now there is more tech in cars, and tech is hackable, so cars are more hackable in 'elegant' ways as opposed to using a rock or screwdriver. Not really breaking news, but good to know and keep an eye on.

Re:Not a lot to say

[Anonymous Coward]

In the UK in the nineties a very popular hatchback (Vauxhal Nova/Opel Corsa early models) had a large rectangular hazzard light switch which could be pulled out of the dash on a long stalk. The switch could then be rotated through 180 degrees and popped back into the dash with the effect that the cars electrics were now on, all a car thief then had to do was break the steering lock and bump start the car. This was corrected in later models but was bloody hillarious.

Captcha: extracts

Helpful bogeymen

[Anonymous Coward]

What does it mean to be a "hacker" these days? Apparently the ability to type "nmap" and some PR wherewithal. Actual skills are entirely optional. So what does that mean for these people? As far as I can see, only the fact they're employed by the government, defence branch, as a nice gimmick to add that bit of zest to the usual scary words. "We're the good guys, honest!" Well no you aren't, or you wouldn't call yourselves "hacker" in relation to security anything.

Re:Helpful bogeymen

[Anonymous Coward]

These hackers (really security consultants) are very competent, there just isn't shit for detail in the articles.

Who knows about the military people, though. I've never met any vets who specialize in secure software development.

Ants

[Anonymous Coward]

What will they do? Burn us like ants with their spy satellites from space?

Now that I think about it, it may be entirely possible to do that.

Re:Ants

[PPH]

Popcorn in the airbag?

It's easy!

[grumpyman]

https://www.youtube.com/watch?...

Re:First rule of DICEDOT

[Anonymous Coward]

BRING BACK THE FUCKING TAGLINE: NEWS FOR NERDS, STUFF THAT MATTERS.

Also, FUCK BETA.

Filter error: Don't use so many caps. It's like YELLING.

AND FUCK FILTER ERRORS.

OT: I have a small feature request for car-makers

[mi]

unlocking car boots, setting off windscreen wipers, locking brakes, and cutting the engine.

If a hacker can do all that, why can't the car itself open the windows slightly if the temperature inside gets high and there is no rain outside? All the hardware is already there — the sensors know both the inside temperature and whether anything is hitting the windshield (so wipers can turn automatically in rain).

Would've made returning to your car in the sunny lot more comfortable and even saved some lives.

morons

[slashmydots]

If they're going to team up with people who pretend to know about cyber security, they might as well team up with Valve and put Valve Anti Cheat on the cars. That system works peeeeerfectly.

Laff

[koan]

Auto Industry Teams Up With Military To Stop Car Hacking

Yeah only good things can come from this.

Re:Laff

[roc97007]

Auto Industry Teams Up With Military To Stop Car Hacking

Yeah only good things can come from this.

Yeah.... it'd be like Monsanto and the IRS teaming up to make children's lunches healthier.

Re:Laff

[weilawei]

I'm sorry, they just don't have the broad expertise in mass food preparation. Sure, they can grow crops and tax stuff, but can they make billions upon billions of Happy Meals? I think not. We clearly need to outsource this to McDonalds and Coca-Cola.

Re:Laff

[roc97007]

I'm sorry, they just don't have the broad expertise in mass food preparation. Sure, they can grow crops and tax stuff, but can they make billions upon billions of Happy Meals? I think not. We clearly need to outsource this to McDonalds and Coca-Cola.

When I went to high school, (mid-seventies) CocaCola already had the drinks contract, (probably why I can't stand the stuff today) and the food was worse than anything McD's had ever produced up to that time. Recognizable bone meal in the hamburger. Looking back, I realize now that the food would be considered bargain dog food today.

Re:Laff

[gweihir]

Especially if you consider that many military vehicles do not even have lockable doors...

Re:Laff

[koan]

Did you ever get the weird lumps in the milk, that was the last time I ate cafeteria food and always brought my lunch after that.

Re:Laff

[roc97007]

Did you ever get the weird lumps in the milk, that was the last time I ate cafeteria food and always brought my lunch after that.

Only once, and never ordered the milk again. (Maybe they were trying to drive us to the corporate sponsor, Coca Cola?) The cafeteria was a huge multipurpose room, and kids would buy the milk cartons to use as "hand grenades", throwing them high in the air across the room and learning important lessons about splash damage.

Similarly, had the hamburger once, didn't do that ever again. The burrito was... ok. The pizza was ghastly. (How can you ruin pizza??) The hot dog... I don't want to talk about it.

There was a McDonald's a few blocks away (original design, with the building between two giant yellow arches) and kids (including me) would break the prohibition against going off-campus during school hours to have lunch there. Not only was the food quality better, the prices were also. A regular hamburger made fresh with onion pickle ketchup and mustard was (in 1973) 20 cents, and the bone meal filler hamburger made hours earlier on a bun with nothing else at school was 25 cents.

Re:OT: I have a small feature request for car-make

[koan]

You want a machine to decide that for you...

so waitaminute...

[roc97007]

I know we've talked about it in Slashdot, in the context of more and more electronics taking responsibility for control of the car, mesh car networks, Windows controlling and potentially driving your car, but really -- hyperbole aside, is car hacking a real thing? And if so, is it really an effective tool for terrorists? (Or is that -- "terrorist" -- what we're calling experimenters and hackers these days?)

I mean, if someone is being proactive about what might be a terrorist vector, I guess that's ok, but there's a feeling in the back of my head that this might be a solution looking for a problem.

Re:so waitaminute...

[weilawei]

To answer your question: yes, car hacking is a real thing. It's widespread among higher-end cars, especially luxury models. However, it's usually limited to stealing the vehicles to be parted out and resold.

To answer your second question: Terrorists? WTF are you smoking? It's probably more likely to be abused by law enforcement.

Re:so waitaminute...

[roc97007]

> To answer your second question: Terrorists? WTF are you smoking?

Whatever I'm smoking, it doesn't appear to be working. I was referring to this line in the article:

> in response to a growing threat from criminals and terrorists

Criminals, that's a given. You had a great example. Terrorists? I'm having a hard time seeing the connection.

Re:so waitaminute...

[ahaweb]

Car hacking is real, they can make a journalist's Mercedes in Los Angeles accelerate so it crashes into a tree and explodes. Hypothetically.

Re:so waitaminute...

[Anonymous Coward]

Yes there is car hacking, and car companies and the government want to stop it. They do not want the consumer to be in control of the electronics that they purchased. They do not want the customer to turn on software-only paid upgrades. Car companies want to preserve remote root and disable (OnStar), the lock-in to prevent non-dealer markup accessories from being made compatible, and to continue to record data against the interests of the owner (crash sensor, telemetry, and much more used to deny your insurance claims and prosecute you.)

The more locked down a car is, the less of it the consumer owns.

Re:so waitaminute...

[roc97007]

Ok. I think I'm going to hang onto my old truck, thanks.

Re:so waitaminute...

[Anonymous Coward]

I'd say that bringing a city to a halt by blocking most roads (by shutting off a significant number of vehicles) would be a reasonable plot.

If it takes more than a few days to get the roads clear, food might get a bit scarce in that city.

Re:OT: I have a small feature request for car-make

[sinij]

A number of reasons this isn't a simple feature request:
 
* continuous monitoring will drain your battery, so you will come to a dead battery every time you go on vacation;
 
* the system will also have to monitor for precipitation, so additional sensors are needed (you wouldn't want to come back to wet seats now, would you?);
 
* there are better ways to spend ~100$ in parts and 5lb of weight.

Re:OT: I have a small feature request for car-make

[Anonymous Coward]

You could work out an integrated climate control system that uses low power fans when off and maybe opens a top vent instead of a window.
Opening windows is a security risk.

Re:OT: I have a small feature request for car-make

[mi]

You want a machine to decide that for you...

No, I want it to decide for itself — when I am not there.

No reason to network cars

[sinij]

Car manufacturers want to double-dip by tracking you using your car. When you pair your phone with infotainment system, they can sell real-time location data (your car's GPS) strongly tied to your identity. Even if you opt out of OnStar and such system, they are still active.

You also get your car pwned remotely, because not only they track you, they failed to secure the interface, ether out of ignorance or "in the interest of national security".

Re:No reason to network cars

[geekmux]

Car manufacturers want to double-dip by tracking you using your car. When you pair your phone with infotainment system, they can sell real-time location data (your car's GPS) strongly tied to your identity. Even if you opt out of OnStar and such system, they are still active.

Let's be realistic here for a moment. When is your cellular GPS data not your real-time location?

There is no opting out of being tracked if you own a cell phone, whether you own a car equipped with OnStar or not.

And you signed away that GPS data about 17 EULAs ago.

Re:No reason to network cars

[sinij]

Yes, correct to the above. Only now car manufacturers also can do what telecoms have been doing for some time.
 
Also, some phone manufacturers allow you to turn GPS off. I am not aware of a car manufacturer letting you do the same.

Re:No reason to network cars

[drinkypoo]

Also, some phone manufacturers allow you to turn GPS off.

That's irrelevant. Read up on DTOA, differential time of arrival. TL;DR: It's like GPS in reverse, with multiple cell sites used to triangulate your position based on your cellular radio emissions.

Re:No reason to network cars

[Anonymous Coward]

You are correct, technically speaking, but AFAIK the cell provider industry does not have software to implement that tracking en masse and do anything with the location data.

I worked at a medium-sized carrier for a couple years. The complexity of all the systems that had to work together to provide voice, data, SMS, etc. was.. staggering!

Software to implement that tracking would be very complex and expensive, and deploying it would be a huge PiTA.

Not to say it won't happen. But I don't think that kind of tracking is worth the cost to carriers (yet). And carriers are probably worried about a PR backlash when such a program was made public.>/p>

Re:No reason to network cars

[drinkypoo]

Software to implement that tracking would be very complex and expensive, and deploying it would be a huge PiTA.

DTOA is how the USA GSM providers decided to implement the mandatory E911 position services. In fact, they were allowed to slip the deadline so that they could get it implemented. It's what they use right now. Consequently, GSM phones remained cheaper on average than CDMA phones when E911 was made mandatory because they did not have to include a GPS chip even when it was not made available to the user.

Re:OT: I have a small feature request for car-make

[mi]

* continuous monitoring will drain your battery, so you will come to a dead battery every time you go on vacation;

I have an outside temperature sensor, that radios figures to the display unit inside. Its puny little battery lasts a year... You too can get one at Home Depot.

the system will also have to monitor for precipitation

As I said, such sensors are already built into my car. The wipers start automatically, when the rain or snow hits the windshield.

there are better ways to spend ~100$ in parts and 5lb of weight.

All the hardware is already in the car. Just need to teach the existing software a new trick.

"technology is progressing"

[Anonymous Coward]

Yes, we have progressed from cars that could NOT remotely have the boot opened, windshield wipers set off, brakes locked, and engine cut, to cars that can. Well done.

But hey, I'm sure that security will be taken seriously now and these issues will be gone any minute. And only the "older models" will be vulnerable...

It's always the same claim from software developers. "Oops, we fucked up horribly last time... Buy our NEW version!!!"

Re:"technology is progressing"

[geekmux]

Yes, we have progressed from cars that could NOT remotely have the boot opened, windshield wipers set off, brakes locked, and engine cut, to cars that can. Well done.

But hey, I'm sure that security will be taken seriously now and these issues will be gone any minute. And only the "older models" will be vulnerable...

It's always the same claim from software developers. "Oops, we fucked up horribly last time... Buy our NEW version!!!"

This problem will become much worse as insurance companies refuse to accept "insecure" car models, or simply charge a 4x fee for "obsolete hardware support."

Re:OT: I have a small feature request for car-make

[weilawei]

I have a heat gun/torch and I know how to use them!

Re:OT: I have a small feature request for car-make

[weilawei]

Just need to teach the existing software a new trick.

And I bet you the existing wetware will learn a new trick just as fast as you automate your car to crack the windows. Won't even need a wedge to slip in an opening tool.

Re:OT: I have a small feature request for car-make

[Anonymous Coward]

* continuous monitoring will drain your battery, so you will come to a dead battery every time you go on vacation;

Easy, a secondary battery. For this application, it can be a crazy small lightweight rechargeable that recharges off alternator. When battery low, roll window up. When battery dies, starter will still work. Also 'continuous' can mean a wake every 30 seconds to check, meaning trivial trivial load.

the system will also have to monitor for precipitation, so additional sensors are needed (you wouldn't want to come back to wet seats now, would you?);

They mentioned using the rain sensing sensors already in some cars.

* there are better ways to spend ~100$ in parts and 5lb of weight.

It would be cheaper than that given the condition of a model with rain sensing wipers already. We go through non-trivial engineering to save someone the hassle of flipping a wiper switch on, but not to dramatically increase comfort day to day and save lives in some particular cases?

Re:OT: I have a small feature request for car-make

[geekmux]

unlocking car boots, setting off windscreen wipers, locking brakes, and cutting the engine.

If a hacker can do all that, why can't the car itself open the windows slightly if the temperature inside gets high and there is no rain outside? All the hardware is already there — the sensors know both the inside temperature and whether anything is hitting the windshield (so wipers can turn automatically in rain).

Would've made returning to your car in the sunny lot more comfortable and even saved some lives.

Or perhaps you'll walk back to an empty parking spot where your car used to be.

All a thief really needs to steal a car (or the contents inside) is access, which you're suggesting to now provide in a automated and unattended fashion.

Manual door and ignition locks?

[davidwr]

If you MUST have a remote-control door lock, make it something that requires very close physical proximity that is very hard to override.

For example, have a receiver that is on the car-facing side of the door handle using a very-near-field communications setup. You swipe your "key" under the handle and the door locks or unlocks.

Yes, it might be possible for a thief to make a small "reflector" and tape it to your car door near the handle, but that's one more step he'll have to go through and one more opportunity for him to be caught or leave his fingerprints behind. Plus, unlike today, the thief can't just sit in a parking lot all day collecting "sample transmissions" for later analysis/reverse-engineering.

erm, I think you might have meant

[Anonymous Coward]

Did you mean to say "In the U.K., a third of car thefts in London are due to car related hacking"
rather than "In the U.K., hackers are now responsible for a third of car thefts in London"?

Because the latter is somewhat offensive, as well as undoubtedly incorrect.

cheers

Re:OT: I have a small feature request for car-make

[hawguy]

unlocking car boots, setting off windscreen wipers, locking brakes, and cutting the engine.

If a hacker can do all that, why can't the car itself open the windows slightly if the temperature inside gets high and there is no rain outside? All the hardware is already there — the sensors know both the inside temperature and whether anything is hitting the windshield (so wipers can turn automatically in rain).

Would've made returning to your car in the sunny lot more comfortable and even saved some lives.

Because opening the windows slightly only affects inside temperatures slightly? Yet it makes it much easier to thread in a wire to snag a door handle to open the door.

A forced air fan to vent in cooler air from below the car 30 minutes before you return to the car would be more effective. And the only thing stopping that is cost vs benefit - not enough people would find it useful enough to add $xx to the price of the car.

No useless technology, better security

[LessThanObvious]

If they want better security then stop with the unnecessary technology. I don't want a car that unlocks or locks every time I walk up to it or walk away. The GPS should be isolated, not integrated and should do it's best to maintain privacy. There should be no possible way in the world for a radio signal to control anything, but the door locks. Cars should not be as Ford says "A computer on wheels". I'm quite happy with my luxury car from the 90's and although some modern features are nice I really think it's a step in the wrong direction to train the public that a car should have a huge list of electronic gadgetry. How about simple reliable cars that people can actually afford to buy.

Re:No useless technology, better security

[drinkypoo]

Cars should not be as Ford says "A computer on wheels".

Ah yes, Ford. They went to 32-bit PCMs when Hitachi at least (and Bosch too, I think) was still using 6800-family chips. A computer on wheels, indeed.

How about simple reliable cars that people can actually afford to buy.

Like a Ford Fiesta?

What, car thieve are now "terrorists"?

[gweihir]

What is next? Shoplifters as terrorists? Or people that ride public transportation without a ticket?

Seriously, this is far beyond mere ridiculous. Possibly, this utter idiocy results from a deep desire to classify all hackers as "terrorists". After all, they can do things! That seems to scare the government badly.

Re:OT: I have a small feature request for car-make

[Pope]

unlocking car boots, setting off windscreen wipers, locking brakes, and cutting the engine.

If a hacker can do all that, why can't the car itself open the windows slightly if the temperature inside gets high and there is no rain outside? All the hardware is already there — the sensors know both the inside temperature and whether anything is hitting the windshield (so wipers can turn automatically in rain).

It'd be way safer to get a fan going to circulate the air than to crack the windows open. You really want car makers to open themselves up to having cars stolen easier?

Re:OT: I have a small feature request for car-make

[Anonymous Coward]

The sensors are there, use them.

1st, they added sensors and logic on the engine. MPG, fuel injection, etc.

I want them to do things like adaptive cruise control, blind spot detection, stopping when there is something in the way. Some cars already have this and that's is driving my car search.

The navigation system gets info. How about telling me if I adjust my speed, I can turn those red lights into green as I'm driving?
Or my tires are below pressure, adding air can improve mileage?

There's lots of this kind of thing they can do.

Instead they're focusing on the entertainment system, voice commands and syncing with your phone.

Re:OT: I have a small feature request for car-make

[mi]

It'd be way safer to get a fan going to circulate the air than to crack the windows open. You really want car makers to open themselves up to having cars stolen easier?

Spinning fan will drain battery quickly. A slightly-open window will not make theft much easier — and the alarm will still go on, if the door is opened.

People do leave windows rolled-down a little on hot days as a matter of course. Would be nice, if the car could do it itself. And even close them back up, if rain starts.

its not about hacking

[Anonymous Coward]

its not about hacking but about locking out "non approved" mechanics, so you have to go to a main dealer, locking out small garages who dont have the budget for that $20000 special "tool" that main dealers have.

want to turn off that service light ? too bad sucka

Re:OT: I have a small feature request for car-make

[sinij]

Now, I know you don't have a cheap car if it is already has all these features. Most people won't have a car with automatic rain-sensing wipers. This is certainly an upscale feature. I also have no idea what kind of power draw the infrared light and sensor require.

On my car I can set fan to run for some time using residual core heat or cooling to maintain preset temperature. This feature good for about 30 minutes (but will run longer) and does not run if the battery charge drops past some threshold, but you have to manually activate it before exiting the car. I also never use this feature since it is too much bother to set.

Re:OT: I have a small feature request for car-make

[koan]

LOL that's even worse.

Re:OT: I have a small feature request for car-make

[Opportunist]

So... all I'd have to do to break into your car is to increase the inside temperature? Provided it doesn't rain, of course...

That's doable.

WRONG TITLE

[Anonymous Coward]

Should be: "Auto Industry Teams Up With Military To Make Sure Car Hacking Stays"

The military has already suicided people with this technology "onstar" and has been in use for at least 2008 in all vehicles:

http://cartech.about.com/od/Safety/a/Gms-Onstar-Service-How-Does-It-Work.htm

The global banking syndicate/military industrial complex also suicided Michael Hastings with this technology

http://rt.com/usa/michael-hastings-car-neighbor-853/

R.I.P Michael Hastings, and R.I.P slashdot the paid repeaters.

HuffPo picture

[Anonymous Coward]

Apart from being void of any information, the huffpo article is somewhat odd. I can't quite figure out the relevance of the second picture. It's a motherboard, HD, PSU and what looks like reclaimed laptop screen inside a suitcase.
What does that have to do with anything?!

We already knew; we just don't seem to care

[Falos]

>> during tests hackers come out on top every time
BUT BUT BUT INTERNET OF THINGS

Re:OT: I have a small feature request for car-make

[drinkypoo]

If a hacker can do all that, why can't the car itself open the windows slightly if the temperature inside gets high and there is no rain outside?

It's safer to just put a solar panel on the roof, my car has it integrated into the sunroof. When the interior temperature rises sufficiently and the panel is sunlit then it runs the blower motor to keep the car cool. Sadly, it ignores the ambient temperature sensor and has no concept of humidity, so in some conditions the sun can hit your car, heat it up before the surroundings, and suck damp cold air into the vehicle and humidify it. In the normal course of the day, though, it will blow warm air through after it, and the air at least comes through the cabin air filters.

Re:OT: I have a small feature request for car-make

[mi]

Seriously? We are about to have self-driving cars — and some say, human drivers should be banned — you are afraid to trust the car to automatically open windows, when the inside gets too hot?

This sort of logic was present and functioning on the first steam-engines! You have such a system in your toilet — it closes the water-valve, when the "sensor" detects, the tank is full...

Re:First rule of DICEDOT

[Anonymous Coward]

And FUCK AUTOREFRESH too while you are at it.

Becasue that helps

[Anonymous Coward]

The military has proven it's security works well enough to prevent leaks... That it can prevent break-ins... That it's tools cant be intercepted.... Okay, okay, they aren't good at any of these. Maybe. we should hire bankers.... *face-palm* Maybe we should hire someone who actually has a stake in insuring that the systems they work with remain secure. Like Tesla was attempting to do. They had a couple of reps at Defcon 22 for just this purpose, they went straight to the experts in security and dared to ask them for help. The very people who bet their reputation on ensuring that they have the best knowledge in pentesting and security. The if the military fails here or leaves a backdoor into your vehicle available then they can simply explain it away, or cover it up. If a security firm fails here it could be the end of that firm. I wonder who I should trust more.

Re:OT: I have a small feature request for car-make

[AmiMoJo]

Continuous monitoring isn't an issue with EVs. When you have a 24,000Wh or larger battery remaining connected to a cellular network for weeks is no issue. Remember when your Nokia could run for a week on one charge? That's what the modem in the car is like, only it has a giant car sized battery to power it.

This article and 'autonomous' cars:

[kheldan]

This is what we will be faced with in a world with 'autonomous' cars, but even worse if they have no manual controls and people don't know how to drive a car: Some script kiddie (or actual criminal/criminal organization) will take control of your vehicle with you in it, and you will have no way to take control back. So-called 'autonomous' vehicles must have full manual controls with an unimpeachable manual override and there must be a trained, certified, licensed driver at those controls at all times!