Slashdot Mirror
Lawsuit Claims Major Automakers Have Failed To Guard Against Hackers
Lucas123 writes: A Dallas-based law firm has filed a class-action lawsuit in the U.S. District Court for the Northern District of California claiming Ford, GM and Toyota all ignored basic electronic security measures that leave vehicles open to hackers who can take control of critical functions and endanger the safety of the driver and passengers. The suit, filed on behalf of three vehicle owners and "all others similarly situated" is seeking unspecified damages and an injunction that would force automakers to install proper firewalls or encryption in vehicle computer bus systems, which connect dozens of electronic control units. "Toyota, Ford and GM have deliberately hidden the dangers associated with car computer systems, misleading consumers," attorney Marc Stanley said. The lawsuit cites several studies revealing security flaws in vehicle electronics. A 2013 study by the Defense Advanced Research Projects Agency found researchers could make vehicles "suddenly accelerate, turn, [and] kill the brakes." A study released last month by Sen. Edward Markey (D-Mass.) also claims automakers have fallen far short in their responsibility to secure their vehicles' electronics.
when the robots vote.
(Little girl jacks into your car's ecm) .... (Hack)....
This is a Unix system.... I know this....
(Next Driver)
Hang on to your butts!!!!
Clever girl....
Yay, more class action lawsuits. Car owners prepare to get your 30 cent rebate forms ready! Lawyers, buy a new vacation home!
They're suing because, theoretically, some third party could make them the victim of a crime? Good luck with that.
In a 2013 study that was funded by the Defense Advanced Research Projects Agency (DARPA), two researchers demonstrated their ability to connect a laptop to two different vehiclesâ(TM) computer systems using a cable, send commands to different ECUs through the CAN, and thereby control the engine, brakes, steering and other critical vehicle components
So you're telling me that if you have direct physical access to a car's ECU, you can issue commands to it? No shit sherlock. That is THE WHOLE POINT of the CAN bus. The only alternative would be to close down the bus and only allow "authorized" accessories to be connected to it - hello sky-high diagnostic fees and goodbye to useful bluetooth OBD connectors.
Call me when this can be done wirelessly. Oh and yes I did read the "What the companies failed to note is that the DARPA study built on prior research that demonstrated that one could remotely and wirelessly access a vehicleâ(TM)s CAN bus through Bluetooth connections, OnStar systems, malware in a synced Android smartphone, or a malicious file on a CD in the stereo" blurb - which still failed to materialize an actual working example of exploiting a CAN wirelessly.
Hard to have a remote starter if you can't wireless control the engine. Hard to have traction control if you can't control the engine and brakes from the same point. Hard to have stability control if you can't control the steering, brakes, and engine.
Can those things be done some other way? Probably. But the other ways are more likely more complex, and you would have to show that the more complex ways actually increase safety, which may not be the case.
Yet you don't see people demanding bomb sniffing technology to be added to all cars. If someone can get enough access to your vehicle to hook a cable into it, it's pretty much game over.
and I'll show you another wireless exploit.
People would still want to know how it all works so they aren't stuck going to the dealer for service. So how do you reconcile the two?
If automakers built cars that were as easily hijacked as Windows, everyone would be driving with body guards.
*** Don't be dull.***
That's how it generally works already. Important stuff is on one CAN bus (ECU, ABS pump, auto trans controller if it has auto trans, airbags, etc). All the secondary stuff like door modules (controls locks, windows, etc), cabin illumination, the radio/navi and whatnot are on a secondary CAN bus (or LIN, or..).
This way if your rear door module dies and manages to take down the (secondary) bus, the car still runs.
I don't see much point in securing it, as you need physical access anyway. I'd rather see it go the other direction, standard, open interface, instead of each manufacturer using a proprietary communication scheme. (CAN only defines lower layers).
This is like suing computer makers for people being able to hack a computer they have physical access to. It's not possible to prevent.
Sent from my PDP-11
1. Segregate the parts of the computer with networked access from the portions of the car that actually involve driving. Brakes, acceleration, engine timing firmware, etc. All of that should be airgapped from the GPS OnStar stuff.
2. Make the storage media that those systems use both physically accessible from the inside of the car AND compatible with conventional computer technology. The internal storage of these systems should be on an SD card or a USB 3.0 Flash drive or a little SSD hard drive. The point is that if something goes wrong with my on board computer, I want to be able to pull its drive and re flash it with factory defaults. There is no reason for on chip storage the same way cell phones do it in a car. The reason you do that in a cell phone is to save space. In a car, you're not that hard up for space so you can make the storage media a little more bulky,
3. Install a firewall. Nothing fancy and let people configure it.
4. "What about people that want to start their car engine with a smart phone app?" Well, first I think this is a stupid feature. But assuming you want to keep it, you can have one way conditional communication across the airgap so long as that communication cannot pass executable code OR endanger the safety of the driver. So certain commands under specific circumstances should be fine. For example, if the engine is off, and the onstar system sends a "start engine command" that doesn't endanger the driver. If the engine is already on then the command will be ignored and so far as I know there are no other commands people want to issue to cars through their smartphones. If you want to mess with the headlights etc... perhaps have the condition that the transmission be in "park" or that the emergency brake is activated. If you put these conditions on very specific commands and only permit those commands to be passed. Then a hacker with total control of your onstar system won't be able to endanger you while you drive.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
If companies can be sued for selling an insecure product, I need to dump my Microsoft stock ASAP.
It would probably be rather easy to disablr input from unapproved ports or devices once the vehicle reaches a certain speed or is in gear for a specific length of time. This would allow for diagnostics, remote starters and so on. They could even employ a diagnostic override that requires pluging a resistor chiped dongle in under the hood or somewhere allowing user modifications and whatever at the owner's direction.
The fear doesn't seem to be you and your car. Its some hacker issuing commands at 5:30 causing toyotas to accelerate out of control, fords to brake rapidly, and gm vehicled to lose sterring controls because of an infected app on a synced phone or a device placed along side a stretch of road somewhere.
They ded.
Don't fight for your country, if your country does not fight for you.
Clearly some lawyer has some teenaged kids he's looking to put through school. But food for thought here. Having just gotten into analysing the ECMs in my car and figuring out how to analyse the performance characteristics of my car, I appreciate the ability to figure out what's going on with the vehicle without paying $1000's to the mechanic. That being said, I have serious doubts that a public/private key cryptographic authentication mechanism on the vehicle ECM would be shared with the consumer that purchased said vehicle and would ultimately eliminate the ability of people to work on their vehicles.
Select from tblFriends where interesting >= 4;
Seriously, I would rather see them sue the stores that continue to be cracked because they are running windows and outsourcing. Target; Home Depot; etc.
If class actions were taken against these companies, then quickly, companies would spend the money and secure themselves. So would companies like these car makers.
I prefer the "u" in honour as it seems to be missing these days.
I always suspected that automakers were amateurs. Real engineers use CMake.