Slashdot Mirror
Why Car Info Tech Is So Thoroughly At Risk
Cory Doctorow reflects in a post at Boing Boing on the many ways in which modern cars' security infrastructure is a white-hot mess. And as to the reasons why, this seems to be the heart of the matter, and it applies to much more than cars: [M]anufacturers often view bugs that aren't publicly understood as unimportant, because it costs something to patch those bugs, and nothing to ignore them, even if those bugs are exploited by bad guys, because the bad guys are going to do everything they can to keep the exploit secret so they can milk it for as long as possible, meaning that even if your car is crashed (or bank account is drained) by someone exploiting a bug that the manufacturer has been informed about, you may never know about it. There is a sociopathic economic rationality to silencing researchers who come forward with bugs.
Someone in the car industry needs to stand up and say "There will be no networked computers in my vehicles."
-- Thou hast strayed far from the path of the Avatar.
A significant problem is that computer-related security lessons seem to have to be learned from the ground up, industry by industry. Contrary to this, the smartphone industry (especially Apple) has relatively sophisticated security in both hardware and software, and I think it was because they could learn a lot of valuable lessons from their experience with the PC. As a result, iOS users enjoy a relatively malware-free system.
The automobile industry on the other hand, is probably somewhere in the early 2000's mindset, comparatively speaking. You see the same mistakes being made with many early Internet of Things manufacturers with brain-dead security mistakes, such as storing hard-coded encryption keys right on the devices themselves. Router manufacturers, just as little as a few years ago were still leaving shipping with services open to the internet by default. They're STILL shipping devices with known, default passwords, mysterious backdoors, and all sorts of other vulnerabilities. You can probably point to any other industry and see the same lack of basic security knowledge and practices. It's not going to change until these issues are dragged, kicking and screaming, into the light of day... either by lawsuits, legislation, or simply too much bad press.
Irony: Agile development has too much intertia to be abandoned now.
Disagree. Proprietary software is just as buggy and sometimes extremely buggy. There may even be NDA agreements that forbid revealing any bugs to third parties.
Narrator:
A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one.
Business woman on plane:
Are there a lot of these kinds of accidents?
Narrator:
You wouldn't believe.
Business woman on plane:
Which car company do you work for?
Narrator:
A major one.
"If any question why we died, Tell them because our fathers lied."
> You should read the articles. Because CAN is a multi-master communications
> bus any device on the bus has write access at the hardware level - it's only
> software controls that limit whether a device can write to the bus or not. Which
> is why the government-mandated ODBC-II interface is such a bad idea,
> because anyone can plug in to the CAN bus with a standardized connector
> and get complete control of a vehicle.
Why is so much unnecessary, security-risky, stuff connected to that device? In a worst case, have separate buses...
* the "entertainment" bus for wifi for "teh interweb", streaming audio, etc.
* the "critical" bus that controls car operation. Have it only *PHYSICALLY* accessable, i.e. only via physically plugging a probe into a jack. And none of the devices connected to the "critical" bus are radio/wifi/bluetooth/whatever-else externally accessable.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Because the tech is invariably based on open Source and written by some unpaid intern.
Though it's probably not in the way that you intended, you do have a valid point. Far too many companies seem to piece together open source software then slap on some proprietary code, without adequately testing it. Since they are doing so to save development and licensing costs, it frequently ends up as a disaster.
That being said, many companies do spend some time in integrating open source software and do thorough testing. So the success or failure of open source software in such circumstances is more a product of the company's motivation and culture than an indicator of the quality of open source software.
even regulatory capture is better than no regulation. the big guys corrupting the government and writing rules that help them, is still better than no rules at all, where the big guys simply crush smaller guys and consumers any fucking way they want: no regulation, remember?
plenty of countries handle regulation with far less corruption than us. that's what we should aim for. but asking for less regulation, is far worse, on any measure you can think of. you should be asking for regulations to be cleaned up
it's like the bad guys robbed the bank by paying off the guard
and your solution is:
1. fire the guard. no guard. hey, that will work to prevent bank robberies (!?)
2. forget the bad guys, don't even go after them or punish them
just let them get away with robbing you and not even mentioning them as the fucking cause of your problem. all you do is whine "the problem is we have guards who can be corrupted, you can never get rid of that problem..." hello? what about the assholes doing the corrupting and robbing you? do you have anything to say about their behavior?
what you should do is:
1. fire the guard. hire a new guard. evaluate him better and more regularly
2. go after the bad guys. punish them. make them pay. they fucking robbed you asshole
why do corporations escape scrutiny when they corrupt our government and so many morons can only criticize the government?
what the hell is up with that?
FIX the government. if you WEAKEN the government, the bad guys who are the actual cause of your fucking problem laugh all the way to the bank: you made their job easier, and rewarded them for fucking up the only thing you have to protect yourself, your fucking government
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
NDAs in proprietary software is there for a reason - to protect the software vendor against revelations that they have done wrong, all the way from copyright infringement (like breaking an open source license condition in their solution), backdoors, security shortcuts etc. If it possibly can exist it will exist in the closed code.
As being involved in the car industry - I can agree upon the observation. Just look at the Autosar platform, it's a collection of bugs in tight formation that has been sold to the car industry as the greatest solution since the invention of the stone axe. But for everyone that have been working with internet solutions it's revealed to be a very clunky solution that doesn't really improve things, it just adds overhead.
Today the car industry starts to look at Ethernet as a replacement for CAN, but then there are complaints about it causing a higher power consumption and therefore there's a "need" to do quirky solutions like separating traffic on VLANs on the same physical bus, and that separation into VLANs is enough to offer sufficient security against intrusions and overload attacks (intentional through malware or unintentional through bugs).
In addition to this it's worth to realize that when you buy a car you only buy the hardware, you aren't permitted to know anything about the software. So essentially the manufacturer could say that you can keep the car but we have to erase the software in it - leaving you with a 2 ton shell of steel and plastics.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
It's all kind of baffling. We have decades of experience that tells us that writing secure software is very difficult and that patching insecure software is expensive, inefficient, and largely ineffective. So the response -- and not just in the auto industry -- is to constantly add more questionably necessary complex hardware and software (Why do I need digital air time pressure indicators that do not work properly to replace $2 mechanical pressure indicating Schraeder valve caps?) and then express surprise that the result is vulnerable to digital attack.
Folks. I don't know how to break this to you. The "solutions" that don't work on the internet, with financial stuff, with dating sites, etc probably aren't going to work in cars either..
What will work? Nothing most likely. But minimizing attack surfaces by air gapping systems that don't need to talk to one another, making ROMs read only with a physical programming switch, banishing anything that looks or works like javascript, abandoning the odd notion that over the air updates can't -- by accident or hijacking -- simultaneously brick millions of vehicles might help. The result would be clunky and sort of mid-20th centuryish. But it might be moderately secure.. And implementing it might free up resources to deal with the inevitable similar problems in the rest of the digital world.
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey