Slashdot Mirror
Report: Automakers Fail To Fully Protect Against Hacking
An anonymous reader writes with news about a report by Senator Edward Markey on the security of new vehicles. "Automakers are cramming cars with wireless technology, but they have failed to adequately protect those features against the real possibility that hackers could take control of vehicles or steal personal data, a member of the U.S. Senate is asserting. Basing his argument on information provided by manufacturer, Sen. Edward Markey has concluded that "many in the automotive industry really don't understand what the implications are of moving to this new computer-based era" of the automobile. The Massachusetts Democrat has asked automakers a series of questions about the technologies — and any safeguards against hackers — that may or may not have been built into the latest models of their vehicles. He also asked what protections have been provided to ensure that information computers gather and often transmit wirelessly isn't used in a harmful or invasive manner."
...with regard to IT security. What a shocker. This really is not surprise at all. Hopefully their customers will react a bit less forgiving that the mindless masses that cheer for insecure OSes and applications. But I somehow doubt it.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I love my old car. No 3G connection, no wifi. Runs fine.
We have armies of security specialist working on securing systems across the globe, and still we get issues where data is broken in.
If there is a lock, that can be unlocked, someone will find a way to unlock it without their permission.
Automotive advantage to security is the fact that the access point is always moving, so it would be difficult to maintain a consistent connection. However its disadvantage is there is such a large lage in automotive design that the computers are already out of date by the time the car is released, and updates are not current.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
And until there are legal penalties for companies who fail to implement proper security, or to keep personal information safe ... this will continue to happen.
When a company can sell your private data (because they embedded something in an EULA), or has no consequences for being incompetent, they'll just say "oops, bummer" and keep doing it.
So until there are real data protection laws, with real consequences ... just assume these companies are incompetent, indifferent, and not accountable.
Because, let's face it, they are.
But for some reason people seem to think it's unnatural to make companies accountable. Because we couldn't possibly impose conditions on corporations ... they have to be free to make a profit without any accountability.
All products which have marketing driving features probably have ZERO security. Because marketing all need a kick to the head and don't understand security, and explicitly don't WANT security or constraints, because that limits how they can make money with and would mean they need to do a better job of engineering.
Most modern tech is rushed out the door, with zero thought of security and privacy. And since it doesn't matter if they suck at both, they'll continue to do it.
Lost at C:>. Found at C.
Exactly... as has been opined about dozens of times before... you can never fully protect against hacking, so automakers are always going to fail at it.
Which has more power: the hammer, or the anvil?
- Senator from the party that controlled the Senate for 8 years announces he's concerned about [issue] now that his party is out of control.
- President whose party had 100% control of congress announces a huge new new tax plan with "help" for the middle class as soon his party loses control and can't be blamed when it never passes.
We've had computers in cars for quite awhile. You are correct that these newer systems are more vulnerable to hacking and identity theft. The biggest question you should ask is why do we allow our information systems whether they be in cars, financial institutions or healthcare systems to be this vulnerable. The federal government is also slipshod when it comes to protecting information and it's time that was stop pointing fingers and produce legislation and a constitutional amendment that protects privacy.. The only way we'll change the behavior is to include penalties for not thinking about security and putting our PII and lives at risk.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
seriously. i hope security is increased or connectivity decreased.
Maybe this is a sign of politicians waking up to tech. Hopefully someone will start to ask these questions about medical devices, too. https://www.youtube.com/watch?...
Do you really need reason for beer? Wingman Brewers
The good Senator can begin by introducing legislation, that bans from public roads any and all electronic payment systems, that do not offer the anonymous option.
One can buy a prepaid cell-phone anonymously, but not a prepaid "EZ-Pass", for some reason. One can add money to a payment card (such as phone- or tranist- one), but can not simply add value (cash) to an "EZ-Pass" account. Heck, you can't even take your EZ-Pass with you from one car to another — it is registered to a particular license-plate (the concept, that itself is a gross violation of privacy, but that's another story).
And, unlike car-makers, EZ-Pass and the like systems have government-backed monopoly — because our overlords haven't though about allowing multiple companies to compete in toll-collection.
In Soviet Washington the swamp drains you.
... Roboticar 5.0 "Suckerpop" has all those security fixes, they're not backporting them to older releases.
Oh, whats that, you have a *2013* model car? Sorry, we're not coming out with an update for that, you're stuck on Roboticar 4.2 "Coffee Bean", unless some 3rd party group of hackers comes out with an update for your older model car.
CLEARLY, the fix for all these problems is a good HOSTS FILE MANAGER
Think this is scary now, just wait 'til we have self-driving cars which will also be built by purely profit-driven organizations who want do anymore than pay lip service to security until they get sued for it.
Not true, they're not as incompetent as the slashdot editors -- this is the third article about this topic in less than seven days.
This is fixed pretty easily:
Don't put the fscking radio, XM satellite stuff, BlueTooth toys and other garbage on the same CAN as the ECM/TCM.
One CAN for the basic stuff that is vital to life safety. As for wanting to turn the climate control system on and off via an app? How about no. Automobiles are dangerous, and there is a point where you just can't let the entire Internet have access to a vehicle, in the name of security.
Even things like OnStar are disasters waiting to happen. If/when it gets breached an attacker can turn an evacuation into an epic disaster by disabling all GM cars trying to get out of an area that is about to get nailed by a hurricane. A microcosm of this happened in Austin when a car dealer's immobilization system (the buyers of cars had to type in a code each week or else their vehicle was disabled) got "hacked" (by an ex-employee who knew the manager's user info), and all cars that were in that dealer's system shut off and made to honk until their batteries died.
I hope car makers have sense, and don't take the IoT bait. It will mean certain loss of life in the future, when some intruder disables the power brakes on vehicles at random (for example.) Or for cars that are totally drive by wire, just disable the steering wheel, or have it turn randomly. Nobody could prove that it was anyone's fault but the driver's in that condition.
Here I found out 2 days ago my car is dying and have been looking online at other vehicles. Granted I love computers and all, when it comes to cars I'm more of a minimalist - less shit that can break and go wrong. The last thing I want is for my CAR to get hacked!
Conspiracy theorists, discuss amongst yourselves...
</ tinfoil>
Never confuse movement with action. --Hemingway
What have you done?!
He also asked what protections have been provided to ensure that information computers gather and often transmit wirelessly isn't used in a harmful or invasive manner."
Same as in the tech industry - somewhere between "absolutely none" and "we intentionally use it in a harmful or invasive manner, that's our business model...and the NSA demands access too."
"When information is power, privacy is freedom" - Jah-Wren Ryel
and you trip to Canada or just near the border can cost you $15-$20 a meg just hope that there is no update at the time and a 500 MB update is 7.5K to 10K in data fees.
DARPA has a car-hacking app. The 60 Minutes correspondant was driving a new car in an empty parking lot. The DARPA rep turned the brakes off, the accelerator off, the wipers on at various times from a Wifi enabled laptop. The driver was flustered.
As long as we keep on refusing to name the problem, preferring to use words meticulously stripped of any meaning save sensationalist claptrap, we certainly won't be able to talk meaningfully about improving the situation. But the hat-wearing bunch will be happy to "consult", prolonging the problem. So, keep talking, suckers.
Welcome to the next generation of theft, rape, murder, and kidnapping done by cyber assaliants hijacking self-driving cars.
... because I'll never choose a vehicle that sends a single byte of data about itself or me to the Cloud.
Exactly... as has been opined about dozens of times before... you can never fully protect against hacking, so automakers are always going to fail at it.
Yeah, but...
Though TFA is pretty short on details, it's a safe bet that the auto makers have made only a half-assed attempt at security, at best. Time will tell, of course, but I've got money to wager that within the next few years, we're going to see just how little those companies knew and/or cared about security.
Lord, I'm really about to start upping my efforts to buy a restored 70's muscle car. No excess computers, nothing connecting to anything, basically a nice beefy engine, a drivetrain, possibly no catalytic converter (depends on the year)...simple and fun to drive.
Ok, I will update the suspension, and swap out the 8-track for a bit more modern stereo, but seriously, I would rather have a simpler car that just MOVES and is fun. I don't need it to be a connected device that likely transmits far too much information about me and my driving habits for my comfort, and is a target for hackers.
What customers are actually ASKING for all this shit in cars today? Seriously?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
The sad thing is, the obvious answer the car industry is going to come up with is to encrypt the canbus and use DRM to control access to the bus. This will provide a (false) sense of security, while locking out those pesky people that want to mod their vehicles and add all those cheaper after market parts like remote starts. And in the end this is bad thing for all of us.
Why do we need wireless services in our cars? GPS I can understand (although I don't use it myself). Wireless? Internet? Why?
Self driving, Internet-ready cars are a really bad idea, imho.
I can just see some 13-year old script kiddie 'hacking' into your car and controlling it with his racing wheel. Better yet, testing his script on your car in an effort to work out the real-world bugs...
No thanks.
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
My car doesnt need wifi or bluetooth.
I dont remember ever thinking "gee i wish my car had wifi & bluetooth, thatd be great!"
insurance is a fucking ripoff anyway.
How many of those vulnerabilities were deliberately left in by the NSA?
Between this story about the need to secure on board systems against hacking, and Friday's story about the NEED to hack farm equipment....
http://tech.slashdot.org/story...
Fish found to be good at swimming! News at 11!
@gstoddart: "The problem is there will be a whole bunch of people who will loudly proclaim that having penalties for corporations failing to protect this information is tantamount to socialism."
:)
It isn't down to the corporations that our computing infrastructure is so insecure, but our own Governments. As in order to protect us they need to keep us under constant surveillance. Some of us might still be able to recall when the NSA helped Microsoft secure Skype. See also where your Bitlocker keys are stored safely in the Cloud. The socialist East German Stasi could only dream of such technology
The government is hacking every router, server, and computerized device in the country. Yet they will lean "for our protection" on car manufacturers and vehicle computerization. I don't believe this is nearly as much concern. You want better security? Open the sources and especially open what the government is doing to subvert and work around security measures and end them. Otherwise? STFU.
It has been claimed that Michael Hastings might have been assassinated by hacking his car:
https://en.wikipedia.org/wiki/...
I'm not sure whether he actually died that way, but it's theoretically possible, if you've pissed sufficiently rich and powerful people off enough, and he may have done.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"What customers are actually ASKING for all this shit in cars today? Seriously?
Most of them.
Nowdays people expect connectivity from a base model Korean hatchback. Its more important to buyers than airbags and seatbelts. All you have to do is look at the ads for a Ford Fiesta to realise their marketed as fashion accessories for a chic lifestyle with their iwhotsits connectivity, bluetooth, satellite navigation. Having their phone play music through the speakers is more important than a car that actually works. It started with BMWs and Mercs in the early 00's, now its expected in a Kia.
People who shop for a car with decent performance or handling as priorities are in the extreme minority these days. Most people buy a BMW M3 or a WRX STI because of the reputation, not because they're exceptional cars.
I dont mind some computers in the car. Engine management systems, traction control, adjustable suspension and AWD systems are quite nice, especially when you can fettle with them yourself. However I expect that these systems will be disconnected from the "infotainment" unit. However a lot of manufacturers are integrating it into the infotainment system. In this case, I'd rather not have things like adjustable suspension because it means someone from outside my car could fiddle with it.
Eventually its going to backfire and manufacturers are going to have to backpedal connectivity as the cost of people making warranty claims and law suits for hacked cars increases.
Calling someone a "hater" only means you can not rationally rebut their argument.
Well they could go a LONG way in letting users secure their own cars, by allowing a SIMPLE method for de-activating all this un-needed wireless connectivity. I have a phone/gps I don't need my fscking car wired to the fscking internet.
Lord, I'm really about to start upping my efforts to buy a restored 70's muscle car. No excess computers, nothing connecting to anything, basically a nice beefy engine, a drivetrain, possibly no catalytic converter (depends on the year)...simple and fun to drive.
Ok, I will update the suspension, and swap out the 8-track for a bit more modern stereo, but seriously, I would rather have a simpler car that just MOVES and is fun. I don't need it to be a connected device that likely transmits far too much information about me and my driving habits for my comfort, and is a target for hackers.
What customers are actually ASKING for all this shit in cars today? Seriously?
Well, if you can afford it, maybe convert that gas tank to a lead acid battery. If for no other reason, you don't want to get a fine for outputting too much smog.
Report: Everyone fails to fully protect against hacking
Report: Matter fails to cease attracting other matter
Report: Slashdot...sucks?
That is exactly not what I am saying. What I am saying is that they went cheap and did not have independent outside evaluation. Of course that will almost always fail. You can make these things secure enough that nobody will hack them (because it is too much effort), but that costs money.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Half-assed, incompetent and on the cheap is probably the best way to describe it.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Not a problem.
Old cars are grandfathered in for pollution levels.
That and I live in a state where they don't do any "sniff" tests on inspections. Hell, not all states even require inspections at all.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........