Fiat Chrysler Recalls 1.4 Million Autos To Fix Remote Hack

swinferno writes: Fiat Chrysler announced today that it's recalling 1.4 million automobiles just days after researchers demonstrated a terrifying hack of a Jeep that was driving down the highway at 70 miles per hour. They are offering a software patch for some of their internet-connected vehicles. Cybersecurity experts Chris Valasek and Charlie Miller have publicly exposed a serious vulnerability that would allow hackers to take remote control of Fiat Chrysler Automobile (FCA) cars that run its Uconnect internet-accessing software for connected car features. Despite this, the researchers say automakers are being slow to address security concerns, and are often approaching security in the wrong way.

Comments

Too bad

[hcs_$reboot]

So good to have a relaxing time while someone drives the car on your behalf.

Approach security the wrong way? No shit!

[Anonymous Coward]

This type of bugs should not even be possible. There should be no data connection between the entertainment crap and the actual, important things, like engine control.

And now we hear that they even pull this crap on airplanes - entertainment sections, connected to internet, are connected to same switches like engine control - "firewall will stop things!". Fucking idiots.

Re:Approach security the wrong way? No shit!

[TWX]

I've made this argument on and off for a decade. Connections between the ECM and the BCM should be one-way, with the ECM notifying the BCM of status only, no response, not even a reply, going back. The ECM doesn't need to know anything from the car's entertainment system. Unfortunately I think that some aspects of the operator's interface funnel through the BCM before ending up at the ECM now, so drive-by-wire might be at least partially to blame for this.

This is only going to get worse with the advent of cars that are capable of driving themselves while still allowing a human to override and take control unless automakers and their suppliers figure out how to sanely allow disparate computer systems to work together without compromising security.

Obvious Solution!

[fuzzyfuzzyfungus]

If you already have a devastating remote hack, why not make a virtue of necessity and just distribute the patch by mass-p0wning all your units in the field and rewriting the affected software? Nothing could go wrong!

Re:Obvious Solution!

[pixelpusher220]

It only works from the Sprint network. Not enough coverage or reliability ;-)

Where's the hardwired switch?

[kheldan]

Where's the hardwired switch that kills power to the transceiver(s) in the car? We've had these on laptops for a long time now, why doesn't your car have one? You can't hack what you can't access, and if the wireless access to the vehicle is literally powered off, you can't hack it.

Also could you people please just drive your cars and stop making them a lifestyle?

Re:Where's the hardwired switch?

[FranTaylor]

The car is technically always on because you can start it using a phone app.

me, you, the guy down the street, we can all start your car with a phone app, apparently.

Re:Where's the hardwired switch?

[andyring]

Sheesh. EVERY car needs cup holders! Where else are you supposed to put your beer?

tip of the iceburg

[The-Ixian]

It is becoming increasingly obvious to me that we have no idea how to secure information systems.

It's this kind of stuff that scares the crap out of people and there is no end in sight. As a matter of fact, this is only going to get worse as we migrate to an IoT.

I sometimes wonder if the technology bubble will someday be crushed under the weight of exploitation. A victim of its own complexity and insecurity.

Re:tip of the iceburg

[ckatko]

We have absolutely every idea of how to secure IT systems. Nobody wants to freaking listen.

I know of a college's root password stored in plain text file on a PUBLICLY accessible url so "new computers can install ghost copies quicker." I know of companies actually using "password" for their password. I know companies that deny access to copy-and-paste on remote desktop, refuse to use e-mail because it's insecure, but are fine with me using a domain administrator account to do my work.

The reason businesses don't care about security is two reasons. 1) They're not afraid and people and the laws should make them afraid so it becomes cost-effective to care. 2) The IT field is full of bullshitters so even when people do hire IT, they assume the guy they hire understands security. When most companies only need one IT guy, they have no experienced guy on hand to tell them if the guy if full of crap. I'm a software developer and I had to teach one admin how Kerberos authentication works and how to resolve issues with it, and another thought that intranet ip addresses were somehow accessible from the web.

However, with the IoT, the situation is mark darker. The IoT is a movement. If it cannot get good market penetration fast, it dies out. So people know that IoT is inherently dangerous but they don't have the time and resources to make them secure and solve those problems so they bank on, and hope for, that nobody ever notices so they can sell enough of their products to keep the market going. People buy features, but security only matters if someone finds out.

The IoT is the NSA's wet dream. Why spy on Americans when you can willingly get them to sign a EULA that lets their Smart TV keep the microphone on 24/7? (This has already happened.) And worse still, if the NSA can do it, so can any government. And people are so stupid they're willingly giving up their privacy just so they can "keep up with the tech Joneses" for a gadget that doesn't even improve their lives in any significant way.

Re:Get rid of the computer controls...

[FranTaylor]

Dare I suggest that we build cars without computers controlling things the driver should have been taught to properly manage anyway, and then actually teach people how to drive?

sure, if you want lots more death on the highway

this technology that you hate has saved many hundreds of thousands of lives

https://en.wikipedia.org/wiki/List_of_motor_vehicle_deaths_in_U.S._by_year

see how the death rate drops dramatically when these features you hate are implemented

Cruise control

[justthinkit]

I installed cruise control on my otherwise primitive '65 Chevy station wagon. Loved it. I'm hard pressed to think of a drawback of cruise control.

But then I would say exactly the same thing about ABS.

The rest...I agree with you. Oh, except for electronic ignition -- my car starting problems disappeared when I started owning cars with electronic ignitions.

And I'm kinda fond of those lights that come on automatically. Not the ones that are always on, but the ones that can tell when it is a little too dark. Like when you go in a tunnel. I positively love that.

Oh, and automatic overdrive, "torque lockout" and the 3-way catalytic converters.

But yeah, old cars, that weigh twice as much as new cars, are the best! Trucks that ride like trucks? Man I miss those. My crap 2002 GMC Sierra, with that high strength steel? Too car-like for me. Who needs comfort? I want the smell of oil and the bounce of a bench seat.

Oh, and the rear-view mirror that shows the outside temperature and the letters I-C-E when it is near freezing? I hardly ever use that. Mind you, when it does get near freezing I kind of appreciate knowing there might be black ice.

But the compass direction indicator is a bit much. Except when I'm driving on an unfamiliar road, at night, in the rain.

So, yeah, you're right. Who needs anything better than a model T? Well, except for the time that hand crank broke my wrist...