Slashdot Mirror
Many Lexus Navigation Systems Bricked By Over-The-Air Software Update (theverge.com)
An anonymous reader quotes a report from The Verge: An unknown number of Lexus automobiles have seen their infotainment and navigation head units broken by a bug in an over-the-air software update from Lexus. The glitch, which was confirmed by a Lexus spokesperson, was delivered in a routine software update. In affected cars, it can cause the dashboard screen to spontaneously reset itself and, as a result, both the radio and navigation system can be unusable. It affects cars equipped with Lexus' Enform system with navigation. Lexus social media channels have been flooded by frustrated owners, but the company has been unable to give any estimates for when the problem will be resolved. The company also couldn't say whether customers will see the problem fix itself with another software update or if they will need to head into dealers to get it fixed. Some users on Twitter have reported success with disconnecting their battery for a few moments to force a reset of the system.
The company also couldn't say whether customers will see the problem fix itself with another software update or if they will need to head into dealers to get it fixed. Some users on Twitter have reported success with disconnecting their battery for a few moments to force a reset of the system.
If a reset of the system can fix the problem, it's not bricked. If a software update can fix it, it's also not bricked.
"Bricked" means it is completely unrepairable and useless as anything other than a brick.
Karma: Terrifying (mostly affected by atrocities you've committed)
Car manufacturers do not understand InfoSec and should not be networking cars. It is only matter of short time until someone reverse-engineers update mechanism, inevitably discovering that they did not implement code signing and integrity checking, craft malicious update and bricks (or worse) cars equipped with such functionality.
More so, in 15 years your networked car could still be on the road. Even if 2015 best-practices are followed, by 2030 how resistant do you think such over-the-air update functionality going to be to, for example, quantum-capable attackers?
underneath the buzzwords and the snobby sales experience it's still a Toyota for a $10,000 premium over a regular Toyota but that is how they make your money, their money
Yes.
as a lexus driver im accustomed to certain quirks but this is unreal. First the car comes with "turning signals" which honestly I dont see any reason to use, and now the GPS, my only means of figuring out how to make a left turn against 5 lanes of traffic at 90 miles per hour is broken?! Whats next?? youll tell me the little L on the front of my car hasnt doesnt give me godlike powers over traffic?
Good people go to bed earlier.
the delaer can fix it and do other updates for $150 + labor.
What about data roaming where a 1-2 GB update can cost as much as an new car in data roaming fees?
...who video their displays WHILE THEY'RE DRIVING.
What about cars auto staring in the garage to run updates / re change battery's (hybrids).
Let's some acts like the laptop bios updates and says must have engine on to reduce risk of a battery failing / some systems are only on with key on mode and there is some kind of anti battery drain system that may kick in with out the engine on?
It depends on the make, and model. Some asshole manufacturers have the CANBUS running through the head unit (radio) so that if you remove it, things like the power windows stop working. I saw a Dodge truck like this once, and there was enough room in the dash that the owner just shoved the unit back in far enough that he could plug the speaker wires into a new unit that he mounted in the dash - that was the only way to get it done without buying some $300 aftermarket unit that could replicate the CANBUS functions in the radio.
Other manufacturers play nice and don't do stupid shit like that, so YMMV.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
I pointed out this very flaw in a comment not too long ago:
https://slashdot.org/comments....
Why anyone would let an unknown person send random software to a vehicle I bought and own any time they want without me knowing it is simply begging for this type of situation.
People are upset about Microsoft forcing updates on them, they should be equally upset at car manufacturers or anyone else who does the same thing.
But I'm sure there will be hypocritical excuses for why this is acceptable despite large portions of the /. community who would go on a rampage if this were done to their home machines.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Get ready for it people, and buy AV software for your cars.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
What they need to do, is open the right door while holding the brake pedal down as they re-apply power to the vehicle.
Once it powers on, they open the trunk to enter recovery mode where they can flash the infotainment system back to it's stock kernel! Fixed!
"Service Department, have you tried disconnecting and reconnecting the battery?"
Automatic Updates on any sort of mission critical system is a bad idea. Over the Air automatic updates are even worse.
How bad does the situation have to get before people will start to build in proper security starting from the design stage. Every industry using electronics in their products needs to hire a bunch of paranoid security engineers and give them veto power over everyone else.
"Grab them by the pussy" -- President of the United States of America
They cant autostart AFAIK. Starting them still requires you to push the power button. The keyfob is required to be within 15-20 feet (from my experiance with a 2010 Prius rental) and unless you want the care stolen no one leaves it in the car lose.
Well I've wrestled with reality for thirty five years doctor, and I'm happy to say I finally won out over it.
What about in your home with the keys in a cup near the car but inside?
Or don't buy in to Lexus Enform.
Actually, it can. In later models, it's part of the Lexus Enform system. That "power button" is just a simple momentary contact that tells the computer to "go". The computer (part of it) is always running to see that button press. You aren't turning a large, high current racecar kill switch. That said, they won't autostart to "charge the batteries", mostly because the charge monitors are on when the car is "off".
(If that were the case, my totalled HS would've been starting itself every few hours to recharge the partially shorted 12V battery. The high voltage traction batteries don't run the ECU. Also, that's the only time in 5 years I've seen that car "boot". And no, the clips in the fuse box for "jump starting" aren't enough to start the car; you need to get to the actual battery.)