Automakers Trying to Prevent Hackers from Commandeering Cars

http://www.nytimes.com/aponline/2015/08/05/us/ap-us-autos-hacking.html?_r=0

by shahryc • 11 years ago

20 27 11 years ago

jacquesm• 11 years ago

That shouldn't be too hard. Disconnect all radios from management computers with an airgap. And if that goes at the cost of some functionality then so be it but the downsides of interconnected systems are heavier than the upsides.

At a minimum stick an 'airgap' switch in the dash somewhere and default it to 'on', or label it 'insecure' when off so the users know the risks.

LoSboccacc2• 11 years ago

a proper separation model with a bridge controlling which message can go from each zone would work as well without reduced functionality - the problem for now is not even that they had some fault in their security but that there was no security to begin with, everything listen to every other thing and can send messages to (almost) anything over the common car bus.

robmcm3• 11 years ago

Any bridge between an air gap poses a risk.

I am not sure why you would need access to the system that controls the breaks/steering/engine. Perhaps to pre-heat the car, or the sat-nav may feed topology to suspension etc.

If they introduce over the air software updates I would be more worried :/

itsmillertime4u• 11 years ago

The problem is that doing so removes the ability to do the self parking, or doing something like the remote kill switch that they can invoke in case the vehicle is ever stolen.

Me personally, I know how to park and particularly care if my car is stolen..that's my insurance companies problem. So I could live without both of these features, but you can see how some would argue the opposite. I'm sure there are other tie ins, I'm just can't think of any other that as obvious.

kazinator2• 11 years ago

The insurance company could make it your problem, by charging you a higher premium for theft coverage than the next customer if your vehicle doesn't have the feature.

nsns• 11 years ago

But if these cars can be "commandeered", they (i.e. my movements) could also easily be tracked by the companies themselves (with the information then sold to "trusted partners"). For some reason, that frightens me more.

Lorento• 11 years ago

If you live in the US or UK, your movements are already being tracked by license plate reading cameras.

pdkl95• 11 years ago

While this is true, it only works where cameras are present, and adding a significant number of cameras costs time and money.

COTRAVELER[1] is much easier and costs almost nothing. Just having a cellphone in a car (either in the driver's pocket or "OnStar") - which only needs to be on and giving presence notifications to the local tower - is enough to get very accurate near-realtime tracking information. The only costs are read-only access to the tower logs and a few SQL JOINs.

[1] https://www.washingtonpost.com/apps/g/page/world/how-the-nsa...

ohitsdom• 11 years ago

This title should only be "news" early on in the design stage. Were they not trying to prevent hackers from commandeering cars before they released them?

Also as others have said, airgap the systems.

outworlder• 11 years ago

Can't we just stop using the (admittedly convenient) CAN bus for this sort of communication? It was never designed for what people are using it for these days.

S_A_P• 11 years ago

Part of the reason cars have gotten more reliable in recent decades is due to this sort of standardization and refinement. What would you replace it with? If you replaced CAN, you still would need an in car network of some sort. It would have its own layer of security issues to worry about. Mechanics/Service centers would need an entirely new suite of diagnostic tools, this isn't just something you can quit using.

datenwolf• 11 years ago

What would you replace it with?

Individual wires transmitting analogue signals; differential voltage or current loop, depending on application. Add a bunch of RC filter networks on either side to limit the bandwidth to the kind of signals going over the wire and you got a pretty tight, hardwired system.

dkx• 11 years ago

"But two Democratic senators, Edward Markey of Massachusetts and Richard Blumenthal of Connecticut, have introduced a bill that would force the industry to seal off critical computers and add technology to stop hackers in real time."

Why do governments feel the need to dictate the little details? Instead of forcing all car manufacturers to secure cars in the exact same way how about just holding them liable for the consequences if a car is hacked? Car makers can then decide how best to secure the car which would lead to a more diverse and hopefully innovative security measures.

iolothebard• 11 years ago

Because by the time it gets to Congress, the auto makers have clearly avoided fixing the issues themselves for pushing a half decade or more.

If they did things the right way, we wouldn't be at this point. Now they get the hammer.

tertius• 11 years ago

Holding them liable will kill the automotive industry quicker than competition can meet demand.

"Add technology to stop hackers in real tie." Because backdoors never backfire.

nfriedly• 11 years ago

Aren't the car manufacturers already liable?

spathi_fwiffo2• 11 years ago

There is at least one lawsuit over the hackability; so, I guess we will see.

jdc0589• 11 years ago

This is the easiest problem in the world to fix going forward... The entertainment system (usually the entry point for this kind of stuff) has no business being connected to any core systems (steering, throttle, brakes, ignition). Just keep the core systems separate, without any connectivity to ANYTHING that can be accessed remotely.

Boom. problem solved.

ams6110• 11 years ago

Except the cars are not wired that way, and design changes are expensive once cars are in production (kind of like software in that way, only moreso because they are physical things).

comrh• 11 years ago

I had this same thought but someone in another hn thread had a good point about how a lot of features still use the core systems. Remote starting your car (a common aftermarket feature for the last 20 years) from an app now obviously needs access to the engine. Even if you disconnect the "core systems" they're still probably going to be connected to the internet.

kazinator2• 11 years ago

My ideal car has no power-anything: no power windows, door locks, brakes or steering. Accessory-wise, just an AM/FM radio with a 1/8" AUX jack, a 12V outlet and some cup holders. 5 or 6 speed manual transmission, unless it's electric.

toufka• 11 years ago

Seriously, when can this happen? Is there a cad file on TPB yet? I'd download it.

spathi_fwiffo2• 11 years ago

Build yourself a kit car. I'm sure you could get this setup.

Automakers Trying to Prevent Hackers from Commandeering Cars

Related Stories