Whoops. I screwed up the numbers (note to self: preview). Let me try again...
1) Almost all new cars have an infotainment system that has both Bluetooth and connections to a CAN bus.
2) Some cars even have devices that connect the cell phone network to the CAN bus.
3) Linux, and open-source software in general, has a lot of eyeballs looking at it. Anybody can download the source code and review it. Despite this, some bugs are still found, and some have been there for years without being found.
4) Given #3, it is reasonable to say that security is hard.
5) Given #3, it is POSSIBLE for there to be bugs in the infotainment or cell system that would allow an attacker to remotely control a car
6) It is possible that firmware in cars have not been well reviewed. Small development teams make it easier to have bugs.
7) It is generally IMPOSSIBLE to say that a particular system is invulnerable to attacks. The most that we can say is that no security problems have been found in a particular product SO FAR.
8) If an attacker DOES manage to compromise a system, the attacker could do great damage to the proper operation of the vehicle, and there is not really any good "easy" way to stop this damage.
Let me make this easy for you. I will list my assertions, in numerical order, and you can tell me which ones you disagree with..
1) Almost all new cars have an infotainment system that has both Bluetooth and connections to a CAN bus.
2) Some cars even have devices that connect the cell phone network to the CAN bus.
3) Linux, and open-source software in general, has a lot of eyeballs looking at it. Anybody can download the source code and review it. Despite this, some bugs are still found, and some have been there for years without being found.
3) Given #2, it is reasonable to say that security is hard.
5) Given #3, it is POSSIBLE for there to be bugs in the infotainment or cell system that would allow an attacker to remotely control a car
6) It is possible that firmware in cars have not been well reviewed. Small development teams make it easier to have bugs.
7) It is generally IMPOSSIBLE to say that a particular system is invulnerable to attacks. The most that we can say is that no security problems have been found in a particular product SO FAR.
Yeah, these are my assertions. Which ones do you disagree with?
Right, you're conflating "somebody somewhere can remotely hack a particular car" with "all news cars have a remote hacking risk."
Yup, your words. I never said any such thing. My point was that it is pretty much standard these days to have the "infotainment" system be attached to both some sort of wireless (say Bluetooth) and the CAN bus at the same time. I PROVED this point. A lot of cars are also connecting cell phone transceivers to the CAN bus, which provides yet another attack route.
I do not know WHICH cars might have vulnerabilities. I just know that, given enough cars with enough systems, some vulnerabilities will be found, and we cannot predict which ones will be found, and where they will be found. A *LOT* more people look at the Linux OS, and vulnerabilities are still found there on a regular basis. Proper security is hard.
Yeah, some do, and some don't. That still does not change the FACT that entertainment centers with both Bluetooth and CAN bus connections are becoming more and more common every year.
Some might. Some might not. Your car's airbags might shoot fatal fragments, some might not, so you want us all to just assume that our airbag is OK without even bothering to check.
Besides, lots of new cars do not have Chilton or Haynes manuals readily available, so how is the consumer supposed to know? Do they just assume their car is OK until their brakes stop working in traffic?
Most new cars have the POTENTIAL. Not all can be remotely hacked, but know knows WHICH cars determined researchers will be able to crack next.
Do you know WHICH Linux libraries or packages will be hacked next? Remember Heartbleed? If you could accurately predict where the next hack or bug will be found, you could patch them before they became a problem. The real problem is that security researchers have tried tarot cards, ouija boards, and crystal balls. They have all failed, and we still have random problems popping up.
Entertainment systems are NOT connected to the CAN bus at all. That is why THIS page must be a pure fantasy. Some fool must have an active imagination to thing that the stereo control buttons on the steering wheel send CAN messages intended to be intercepted by the stereo system.
The funny thins is that his imagination is VERY strong, since it somehow worked.
OK. Fine. Your are right. I don't know anything, and I clearly did NOT see Bluetooth in even the cheapest cars. I guess that Ford and Mitsubishi must clearly not be informed about the features of their own cars.
Here is a challenge for you the. Go to a dealer and TRY to buy a new car without Bluetooth. Let me know how successful you are.
Next you will be telling me that fancy extras on cars like "interval wipers" and "anti-lock brakes" are also rare.
I have no time to waste on people who will try to tell me that water is not wet.
Also, please ignore that video PROVING that somebody can remotely hack a vehicle.
Also, please ignore web sites like this that show you how to use an Arduino to contol the air conditioning of your car...
Also, I urge you to pretend that this did not happen, and ignore the word "infotainment" in the text:
A few years later, in 2015, security researchers Charlie Miller and Chris Valasek demonstrated a remote exploitation of an unaltered passenger vehicle via the vehicleâ(TM)s cellular interface. This attack took advantage of a vulnerability in the Sprint cellular network and the onboard Uconnect infotainment system of a 2014 Jeep Cherokee (Miller & Valasek, 2015). The attack allowed Miller and Valasek to remotely take over the Jeepâ(TM)s steering, transmission, and brakes, the aftermath of which is shown in Figure 1:
No, not all entertainment systems have Bluetooth. I guess some stripped-down models can't afford the extra $5. Oh, wait. Never mind. The Mistubishi Mirage, the cheapest new car in America, has Bluetooth standard in its LOWEST equipment package. Oh, look. The Ford Fiesta's base model (Fords cheapest car) comes with "SYNC" which works with... wait for it... Bluetooth. I guess there might be one manufacturer that might have a model without Bluetooth -- maybe. Let me check my local Best Buy for their car receivers. Wait.. I did actually find TWO whole models without Bluetooth, so I guess SOMEBODY might have one
Yes, this is not true for ALL cars, but it pretty much IS true for NEW cars.
That "remote unlock" command that you mentioned? Yeah, that command is likely CAUSING the unlock. It is likely that the solenoid that controls the lock has a CAN listener on there.
So, yeah, this cannot totally happen, except here if video proof that, at least on some vehicles, it can happen... Here is a video of guys remote-controlling a Jeep -- from miles away -- while the Jeep is being driven... What should I believe: your opinion, or video proof. Hmmm, let me think about it for a while...
Your Bluetooth is built into your entertainment system, and your entertainment system is connected to your car's network.. Yes, bluetooth transmits audio. It also allows phone calls, exchanges phone book entries, and more. Who knows what a crafty hacker could do with a detailed analysis.
I also know how a car door unlocker works. There is a radio receiver. When it receives the right code, it sends a CAN bus message to unlock the doors. Simple. However, there is still the POSSIBILITY of a flaw in the system. Maybe send a malformed radio message that overflows a buffer and allows code injection. Can you honestly say that this is not possible? Worse things have happened.
You don't have to plug anything into it. All of that stuff is already built-in. GM cars already have On-Star built-in. Every car has a remote door unlocker (and maybe engine starter) built in. Many entertainment systems also include Bluetooth. These are all potential intrusion points, and there even before you drive the car off of the lot.
Yes, a PHY could detect continuous transmission by simply having a time-out.
Or clever software could keep on turning transmission on and off to fool the timer.
How would you prevent a device from sending packet of a higher priority or sending packets from a different address to spoof the data? While it might be possible, it would mean putting a LOT more smarts into the PHY -- such as the ability to actually partially decode packets, and all of the configuration that goes with it.
Think of a bank vault -- do they put great security around each and every dollar bill, or do they just build great security between the money and the outside world. Same thing here: you don't change the network, you make the interface between the network and other sources of data more secure, so nobody can use that to get into the network.
If somebody has physical access, it is already game over. They could screw up your CAN bus, cut your brake lines, pull wires, or just pee in the gas tank. What is more worrying are attacks over wireless networks.
Well, you have found the problem: "not accessible from the outside."
Car makers have jumped on the "smart everything" revolution, so they built devices into the cars that can bridge CAN with cell phone networks (On-Star, for example). If you own the On-Star, you can do pretty much whatever you want.
The problem is not with CAN, however. The problem is with the typical crappy security between things that bridge CAN to other data sources.
The one thing to remember about CAN is that it is a SHARED BUS. There is no hub; the same wires go to all devices. This means that a compromised device can jabber and jam all traffic, continually send higher-priority traffic to eat up bandwidth, or even pretend to be any device that it wants to send false data. No protocol can stop this without going to a hub-style arrangement, which increases the amount of wiring. Decreasing wiring (and its cost and weight) was one of the prime reasons for inventing CAN -- to allow multiple devices to share the same wires, so if you want to use a hub, you might as well get rid of CAN and just go back to point-to-point wiring.
I can imagine changes to the PHY to stop the "jabbering idiot" problem, but nothing that would prevent the other attacks.
There is another approach. CAN traffic happens over a differential pair. I have a specially-constructed device that can jam CAN traffic. I call it a "paperclip." I bend it and plug it into both data lines on the OBD port and the network is dead.
We need to ban these dangerous hacking paperclips.
I have two recent experiences in the theatres that just left a bad taste in my mouth.
The first was seeing a blockbuster movie on a week night (Tuesday or Wednesday, as I recall). Well, the ticket prices were as normal, but there was an extra $5 charge for a "nicer" seat made of leather. Who cares? When I got into the theater, the seats were not $5 worth of extra nice.
Also, a week ago, I tried to see "Valerian" on a Friday night. Yeah, popular night, but an old movie with mediocre rating. This move had even been pulled out of other theaters already. Well, I was told that this was another "premium" extra-expensive seat, and the only seats available were in the front row, and my wife and I would have to sit separately. We said "no" and walked away. My wife then found through Fandango that we could buy two seats together a couple of rows back for the same showing. Seriously, an app gives you better seats than walking to the box office?
So, yeah, paying $12 to $15 for one movie is not the end of the world, but being forced to pay an extra $5 for almost nothing, and then being lied to about the seating? Way to treat your customers.
Not necessarily. I have kids, so I have seen the differences between males and females. There are structural differences, including differences in the corups collosum (part of the brain). Perhaps such changes just mean that boys and girls find different sorts of things interesting.
I have four daughters. If one of them wanted to enter the tech field, I would support them 100%. However, I am not going to try to force them to enter the field just just because somebody thinks that we need more women coders and sysadmins. I will let them decide what interests them.
When it comes to sex, you are somewhat incorrect. I work more in the hardware side, but the female engineers that I have known have been every bit as good as the men (some better than most men).
However, take your example, and have the two groups be the SAME in terms of skill, but group A is much more numerous than group B. In order to hire the same numbers of A and B, you need to lower the standards for B.
That is possibly what we have here. If you want equal numbers of males and females, but the males in the workforce outnumber the females 4 to 1, you will have to let the standards slide to get the numbers of women up.
A quick Google search turned this up, which shows that women tend to be around 20% of the graduates in I.T. fields.
Yeah, I was just making a point. That is just one of her many scandals. If you don't pay attention and don't know about the others, that is not my fault. You have only yourself to blame for ignorance.
New facts are coming up about Hillary even today, and people are in jail right now for doing less than what she had.
Trump's biggest flaw is that he is an egotistical blowhard.
Or, fly a drone towards an boat. Hang a mirrored ball off of the bottom, and blind any sailors looking towards the drone who are not wearing eye protection.
It is kind of hard to bounce a bullet back towards an attacker. Lasers? Yeah, much easier.
Well, they are still not quite safe. If the target has a reflective surface, there is the possibility of witnesses being blinded. This thing does use light outside the visible spectrum, so you would not even get any warning of being blinded.
Slashdot Mirror
Whoops. I screwed up the numbers (note to self: preview). Let me try again...
1) Almost all new cars have an infotainment system that has both Bluetooth and connections to a CAN bus.
2) Some cars even have devices that connect the cell phone network to the CAN bus.
3) Linux, and open-source software in general, has a lot of eyeballs looking at it. Anybody can download the source code and review it. Despite this, some bugs are still found, and some have been there for years without being found.
4) Given #3, it is reasonable to say that security is hard.
5) Given #3, it is POSSIBLE for there to be bugs in the infotainment or cell system that would allow an attacker to remotely control a car
6) It is possible that firmware in cars have not been well reviewed. Small development teams make it easier to have bugs.
7) It is generally IMPOSSIBLE to say that a particular system is invulnerable to attacks. The most that we can say is that no security problems have been found in a particular product SO FAR.
8) If an attacker DOES manage to compromise a system, the attacker could do great damage to the proper operation of the vehicle, and there is not really any good "easy" way to stop this damage.
Let me make this easy for you. I will list my assertions, in numerical order, and you can tell me which ones you disagree with..
1) Almost all new cars have an infotainment system that has both Bluetooth and connections to a CAN bus.
2) Some cars even have devices that connect the cell phone network to the CAN bus.
3) Linux, and open-source software in general, has a lot of eyeballs looking at it. Anybody can download the source code and review it. Despite this, some bugs are still found, and some have been there for years without being found.
3) Given #2, it is reasonable to say that security is hard.
5) Given #3, it is POSSIBLE for there to be bugs in the infotainment or cell system that would allow an attacker to remotely control a car
6) It is possible that firmware in cars have not been well reviewed. Small development teams make it easier to have bugs.
7) It is generally IMPOSSIBLE to say that a particular system is invulnerable to attacks. The most that we can say is that no security problems have been found in a particular product SO FAR.
Yeah, these are my assertions. Which ones do you disagree with?
Please allow me to quote you:
Yup, your words. I never said any such thing. My point was that it is pretty much standard these days to have the "infotainment" system be attached to both some sort of wireless (say Bluetooth) and the CAN bus at the same time. I PROVED this point. A lot of cars are also connecting cell phone transceivers to the CAN bus, which provides yet another attack route.
I do not know WHICH cars might have vulnerabilities. I just know that, given enough cars with enough systems, some vulnerabilities will be found, and we cannot predict which ones will be found, and where they will be found. A *LOT* more people look at the Linux OS, and vulnerabilities are still found there on a regular basis. Proper security is hard.
You just argue against facts.
Says the person who is arguing that cars are secure, despite video evidence to the contrary.
Yeah, some do, and some don't. That still does not change the FACT that entertainment centers with both Bluetooth and CAN bus connections are becoming more and more common every year.
Some might. Some might not. Your car's airbags might shoot fatal fragments, some might not, so you want us all to just assume that our airbag is OK without even bothering to check.
Besides, lots of new cars do not have Chilton or Haynes manuals readily available, so how is the consumer supposed to know? Do they just assume their car is OK until their brakes stop working in traffic?
Most new cars have the POTENTIAL. Not all can be remotely hacked, but know knows WHICH cars determined researchers will be able to crack next.
Do you know WHICH Linux libraries or packages will be hacked next? Remember Heartbleed? If you could accurately predict where the next hack or bug will be found, you could patch them before they became a problem. The real problem is that security researchers have tried tarot cards, ouija boards, and crystal balls. They have all failed, and we still have random problems popping up.
You just completely misunderstood what I said.
Entertainment systems are NOT connected to the CAN bus at all. That is why THIS page must be a pure fantasy. Some fool must have an active imagination to thing that the stereo control buttons on the steering wheel send CAN messages intended to be intercepted by the stereo system.
The funny thins is that his imagination is VERY strong, since it somehow worked.
https://theksmith.com/software...
OK. Fine. Your are right. I don't know anything, and I clearly did NOT see Bluetooth in even the cheapest cars. I guess that Ford and Mitsubishi must clearly not be informed about the features of their own cars.
Here is a challenge for you the. Go to a dealer and TRY to buy a new car without Bluetooth. Let me know how successful you are.
Next you will be telling me that fancy extras on cars like "interval wipers" and "anti-lock brakes" are also rare.
I have no time to waste on people who will try to tell me that water is not wet.
Also, please ignore that video PROVING that somebody can remotely hack a vehicle.
Also, please ignore web sites like this that show you how to use an Arduino to contol the air conditioning of your car...
https://news.voyage.auto/an-in...
Also, I urge you to pretend that this did not happen, and ignore the word "infotainment" in the text:
https://www.sans.org/reading-room/whitepapers/awareness/hacking-bus-basic-manipulation-modern-automobile-through-bus-reverse-engineering-37825
No, not all entertainment systems have Bluetooth. I guess some stripped-down models can't afford the extra $5. Oh, wait. Never mind. The Mistubishi Mirage, the cheapest new car in America, has Bluetooth standard in its LOWEST equipment package. Oh, look. The Ford Fiesta's base model (Fords cheapest car) comes with "SYNC" which works with ... wait for it... Bluetooth. I guess there might be one manufacturer that might have a model without Bluetooth -- maybe. Let me check my local Best Buy for their car receivers. Wait.. I did actually find TWO whole models without Bluetooth, so I guess SOMEBODY might have one
Yes, this is not true for ALL cars, but it pretty much IS true for NEW cars.
That "remote unlock" command that you mentioned? Yeah, that command is likely CAUSING the unlock. It is likely that the solenoid that controls the lock has a CAN listener on there.
So, yeah, this cannot totally happen, except here if video proof that, at least on some vehicles, it can happen... Here is a video of guys remote-controlling a Jeep -- from miles away -- while the Jeep is being driven... What should I believe: your opinion, or video proof. Hmmm, let me think about it for a while...
https://www.youtube.com/watch?...
Your Bluetooth is built into your entertainment system, and your entertainment system is connected to your car's network.. Yes, bluetooth transmits audio. It also allows phone calls, exchanges phone book entries, and more. Who knows what a crafty hacker could do with a detailed analysis.
I also know how a car door unlocker works. There is a radio receiver. When it receives the right code, it sends a CAN bus message to unlock the doors. Simple. However, there is still the POSSIBILITY of a flaw in the system. Maybe send a malformed radio message that overflows a buffer and allows code injection. Can you honestly say that this is not possible? Worse things have happened.
You don't have to plug anything into it. All of that stuff is already built-in. GM cars already have On-Star built-in. Every car has a remote door unlocker (and maybe engine starter) built in. Many entertainment systems also include Bluetooth. These are all potential intrusion points, and there even before you drive the car off of the lot.
Yes, a PHY could detect continuous transmission by simply having a time-out.
Or clever software could keep on turning transmission on and off to fool the timer.
How would you prevent a device from sending packet of a higher priority or sending packets from a different address to spoof the data? While it might be possible, it would mean putting a LOT more smarts into the PHY -- such as the ability to actually partially decode packets, and all of the configuration that goes with it.
Think of a bank vault -- do they put great security around each and every dollar bill, or do they just build great security between the money and the outside world. Same thing here: you don't change the network, you make the interface between the network and other sources of data more secure, so nobody can use that to get into the network.
If somebody has physical access, it is already game over. They could screw up your CAN bus, cut your brake lines, pull wires, or just pee in the gas tank. What is more worrying are attacks over wireless networks.
Well, you have found the problem: "not accessible from the outside."
Car makers have jumped on the "smart everything" revolution, so they built devices into the cars that can bridge CAN with cell phone networks (On-Star, for example). If you own the On-Star, you can do pretty much whatever you want.
The problem is not with CAN, however. The problem is with the typical crappy security between things that bridge CAN to other data sources.
The one thing to remember about CAN is that it is a SHARED BUS. There is no hub; the same wires go to all devices. This means that a compromised device can jabber and jam all traffic, continually send higher-priority traffic to eat up bandwidth, or even pretend to be any device that it wants to send false data. No protocol can stop this without going to a hub-style arrangement, which increases the amount of wiring. Decreasing wiring (and its cost and weight) was one of the prime reasons for inventing CAN -- to allow multiple devices to share the same wires, so if you want to use a hub, you might as well get rid of CAN and just go back to point-to-point wiring.
I can imagine changes to the PHY to stop the "jabbering idiot" problem, but nothing that would prevent the other attacks.
There is another approach. CAN traffic happens over a differential pair. I have a specially-constructed device that can jam CAN traffic. I call it a "paperclip." I bend it and plug it into both data lines on the OBD port and the network is dead.
We need to ban these dangerous hacking paperclips.
You are wrong about the ticket prices. They suck.
I have two recent experiences in the theatres that just left a bad taste in my mouth.
The first was seeing a blockbuster movie on a week night (Tuesday or Wednesday, as I recall). Well, the ticket prices were as normal, but there was an extra $5 charge for a "nicer" seat made of leather. Who cares? When I got into the theater, the seats were not $5 worth of extra nice.
Also, a week ago, I tried to see "Valerian" on a Friday night. Yeah, popular night, but an old movie with mediocre rating. This move had even been pulled out of other theaters already. Well, I was told that this was another "premium" extra-expensive seat, and the only seats available were in the front row, and my wife and I would have to sit separately. We said "no" and walked away. My wife then found through Fandango that we could buy two seats together a couple of rows back for the same showing. Seriously, an app gives you better seats than walking to the box office?
So, yeah, paying $12 to $15 for one movie is not the end of the world, but being forced to pay an extra $5 for almost nothing, and then being lied to about the seating? Way to treat your customers.
Not necessarily. I have kids, so I have seen the differences between males and females. There are structural differences, including differences in the corups collosum (part of the brain). Perhaps such changes just mean that boys and girls find different sorts of things interesting.
I have four daughters. If one of them wanted to enter the tech field, I would support them 100%. However, I am not going to try to force them to enter the field just just because somebody thinks that we need more women coders and sysadmins. I will let them decide what interests them.
I think that the bigger issue is that, generally, women are not as interested in tech jobs as guys are.
Women are 100% as capable as men in tech fields -- when they choose those fields. I have known some great women engineers.
However, women only make up approximately 20% of I.T. related degrees earned.
When it comes to sex, you are somewhat incorrect. I work more in the hardware side, but the female engineers that I have known have been every bit as good as the men (some better than most men).
However, take your example, and have the two groups be the SAME in terms of skill, but group A is much more numerous than group B. In order to hire the same numbers of A and B, you need to lower the standards for B.
That is possibly what we have here. If you want equal numbers of males and females, but the males in the workforce outnumber the females 4 to 1, you will have to let the standards slide to get the numbers of women up.
A quick Google search turned this up, which shows that women tend to be around 20% of the graduates in I.T. fields.
http://www.economicmodeling.co...
Yeah, I was just making a point. That is just one of her many scandals. If you don't pay attention and don't know about the others, that is not my fault. You have only yourself to blame for ignorance.
New facts are coming up about Hillary even today, and people are in jail right now for doing less than what she had.
Trump's biggest flaw is that he is an egotistical blowhard.
If Hillary isn't in jail, the Trump won't be either. Neither one of them are classy people, but Hillary broke more and bigger laws.
Then again, Hillary is clever, so maybe she is better at getting rid of the evidence (cough bit bleach cough).
If Trump breaks the law, he will likely tweet about it.
Wow, listening to you, a person would get this ideal that a can of silver spray paint costs a LOT more than $5.
Plus, if you make a weapon too annoying to use, you have just neutralized one weapon that the military spent millions of dollars developing.
Yes, avoid the disco ball. Great idea, unless the disco ball IS the body of the drone. Those things do not have to be big.
Drones can do surveillance, and do not need to be big. Standard quadcopters could be made very reflective to blind any viewers.
You have to start thinking like an attacker. Is there any way to turn the enemy's weapon against them? Then you try to neutralize that approach.
Unless you hang a mirror off of the drone, and the light bounces back and blinds people on the boat.
Of course you could order all people on the ship inside, or issue eye protection.
Or, fly a drone towards an boat. Hang a mirrored ball off of the bottom, and blind any sailors looking towards the drone who are not wearing eye protection.
It is kind of hard to bounce a bullet back towards an attacker. Lasers? Yeah, much easier.
Well, they are still not quite safe. If the target has a reflective surface, there is the possibility of witnesses being blinded. This thing does use light outside the visible spectrum, so you would not even get any warning of being blinded.
Do not look into laser with remaining eye.