Slashdot Mirror
Auto Industry Publishes Its First Set of Cybersecurity Best Practices (securityledger.com)
chicksdaddy quotes a report from Security Ledger: The Automotive industry's main group for coordinating policy on information security and "cyber" threats has published a "Best Practices" document, giving individual automakers guidance on implementing cybersecurity in their vehicles for the first time. The Automotive Information Sharing and Analysis Center (ISAC) released the Automotive Cybersecurity Best Practices document on July 21st, saying the guidelines are for auto manufacturers as well as their suppliers. The Best Practices cover organizational and technical aspects of vehicle cybersecurity, including governance, risk management, security by design, threat detection, incident response, training, and collaboration with appropriate third parties. Taken together, they move the auto industry closer to standards pioneered decades ago and embraced by companies like Microsoft. They call on automakers to design software to be secure from the ground up and to take a sober look at risks to connected vehicles as part of the design process. Automakers are urged to test for and respond to software vulnerabilities, to develop methods for assessing and fixing security vulnerabilities, to create training programs, promote cybersecurity awareness for both information technology and vehicle specific risks, and educate employees about security awareness. The document comes after a Kelly Blue Book survey that found that 62% of drivers think "connected cars will be hacked," and that 42% say they "want cars to be more connected."
Rotsofruk Fuckers.
Pity they didn't think of it before now.
They sentenced me to twenty years of boredom
... 62% of drivers think "connected cars will be hacked," and that 42% say they "want cars to be more connected."
Numbers may not lie, but they are occasionally insightful. If these two statements are true, and they represent the survey results of a similar control group, there is a minority report on an overlap that evidently admit cars will be hacked... but they like it, they love it, they want some more of it.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
... given the "guidance" available from the "computer security industry" s'kiddies.
Anyhow, given the myriad topics you have to "best practice" and you'll still end up with something trivially pwnable, you're better off sticking to what you're good at and produce cars that aren't connected to world+dog. Connectivity implies complexity implies security problems no matter what you do. Better make sure the connectivity serves a clear useful purpose other than "convenience" or "because we can", something that's actually worth the complexity trade-off.
I'd rather just not have networked anything in my car. There, problem solved.
Yet's see dealer only sevice and forced ecu swaps. Say your can't run car os 2018 so for only $500 + labor we can upgrade it to a new one and wave the $150 software update fee or you can get a good deal on a NEW CAR. If you say no your car may enter limb mode and will be locked out of some auto drive roads.
Needs to be free software updates for 7-12 years and no BS like after 1-2 years want that bug fix BUY A NEW CAR!
Is rule #1 along the lines of "thou shalt not allow traffic between the entertainment system and the actual driving the car system to occur"? Cuz if not, it's a fail from the beginning.
Exception being car system saying "oh holy fuck, slam on the brakes, this could be bad, turn off the music".
Needs to be free software updates for 7-12 years and no BS like after 1-2 years want that bug fix BUY A NEW CAR!
It needs to be free software updates for the life of the vehicle. Get these dickheads thinking about standardizing their interfaces now so they can upgrade your PCM if they want to abandon it.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
GM can shut down any Onstar-equipped vehicle anywhere. Currently, it's being heralded as a good thing http://www.autobytel.com/auto-...
But, as Aldredge Ames and Jonathon Pollard proved, there will always be turncoats willing to sell extremely sensitive info. So you're Al Qaeda or ISIS, with connections to Saudi oil money. Or China or Russia or whoever. You need to buy, or blackmail, the info on how it's done. Here's a doomsday scenario...
The date is a December or January in the next few years. The forecast calls for major snowstorm in the US Northeast, followed by a brutal cold front. 6-to-10 hours before the storm is due to hit, the bad guys throw the switch in the middle of afternoon rush hour. The roads are clogged with stalled cars. There are so many stalled cars, that any "immune" vehicles wouldn't be able to get anywhere anyways. The smart drivers get out and try to find shelter in stores/hotels/wherever. The slower thinkers freeze to death in their cars.
Because the roads are clogged with dead cars, and the US is heavily into JIT (Just-In-Time) supply chains, grocery stores, supermarkets, convenience stores, etc, are soon running out of goods. Minor issues in the power grid go unfixed, because utility workers can't get from home to the dispatch site to the problem area. More and more of the US Northeast loses electricity, and people start freezing and starving to death. The president declares martial law, but thousands, if not millions, of people die in the ensuing chaos before order is restored.
Similar scenarios apply to anything that can be shut down "from the cloud". Imagine if Microsoft's authentication systems suddenly decided that your copy of Windows, and everybody else's, was bogus. The US shuts down. Taking over Nest thermostats durning a cold spell or a heat wave could also cause many thousands of casualties, and major chaos. It's eff-ing stupid to allow any one authority that much power, because they *WILL* get hacked, and the power *WILL* be used for evil. It's only a matter of time.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
If this Automotive industry's main group for coordinating policy on information security and "cyber" threats has published anything, where is it? All the website has is an "Executive Summary". All this seems to be is a single consultancy company, whose sole revenue is government consulting, launching a marketing website to gather automotive execs' contact details so they can widen their customer base.
Between malware, ransomware, bad or false updates, targeted advertising trackers and every three-letter-acronym-agency trying to weasel their way in for reasons no less sinister...
I have a hard time believing the advantages to we consumers outweigh the loss of security and liberty that cheap "IoT" additions will bring our cars, most especially when the security we give up is then used as a reason for why we need to give up something else for more security...
I mean, sure you could have entirely separate closed systems where the onboard computer and engine controls are entirely separate, and that would be perfectly fine...
But they won't do that, will they.
standards pioneered decades ago and embraced by companies like Microsoft. They call on automakers to design software to be secure from the ground up
I believe there is a conflict between the statement and the call.
But as further networking of cars seems unavoidable I wish them success.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
The document comes after a Kelly Blue Book survey that found that 62% of drivers think "connected cars will be hacked," and that 42% say they "want cars to be more connected."
the real concern should be the percentage of people that despite thinking "connected cars will be hacked," still "want cars to be more connected," and then laughed maniacally. ;)
Anons need not reply. Questions end with a question mark.
That is pretty much in line with my expectations for the car trade. Fortunately, it is also my experience that with a bit of effort it is always possible to find someone to do the same work for next to nothing.
That is pretty much in line with my expectations for the car trade. Fortunately, it is also my experience that with a bit of effort it is always possible to find someone to do the same work for next to nothing.
Not if they ever get security correct. Correct security means that they *will* effectively lock out everyone that is not them. After all, any exploit used by a aftermarket tech can also be used by a thief/hacker.
I'm a minority race. Save your vitriol for white people.
...and Toyota settled with utmost haste after they were found guilty. http://www.safetyresearch.net/... Software like this CANNOT be connected to larger networks safely.
Wut?
This is not the first. SAE J3061: Cybersecurity Guidebook for Cyber-Physical Vehicle Systems was published in January!
and they want their hands on the ability to turn off your car. justified of course by "it's for your safety".
Isaac Asimov Three Laws of Robotics must be MANDATORY! Anything less and your'e just asking for trouble! The documentation for the device resides IN the device and is EASILY accessible to the user. I've seen way too many devices that require intricate complicated instructions that are no where to be found when something needs fixing or modifying. IE wrist watch time setting.