Fiat Chrysler recalls 1.4M cars after Jeep hack

http://www.bbc.com/news/technology-33650491

by vvanders • 11 years ago

251 268 11 years ago

bbc.com

gandalfu2• 11 years ago

From the press release: http://www.media.chrysler.com/newsrelease.do?id=16849&mid=1

"No defect has been found. FCA US is conducting this campaign out of an abundance of caution."

What the hell?

freehunter2• 11 years ago

That's probably the wording their lawyers asked them to use so they would not be liable for damages. If they admit fault, they're legally to blame for any accidents or damage.

beambot• 11 years ago

Preemptively admitting fault probably creates issues if there is future litigation.

maxerickson10• 11 years ago

Defect appears to have a particular meaning in relation to vehicle safety. I'm just basing that on the way it is used here:

http://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm

I guess it isn't that big a stretch to use such defensive language, there are a lot of things that can be tampered with on a vehicle that arise out of engineering trade offs.

I don't mean to dismiss the problem at hand, but it is only an issue if someone makes an effort to tamper with a vehicle, which is different than a critical part failing prematurely or whatever.

gandalfu2• 11 years ago

Unfortunately your argument makes sense.

rhino3692• 11 years ago

Legally a defect in a product means you are stictly liable for all damage it causes.

But also the hackers haven't demo'd the exploit in an untampered with car. I still wonder if you need physical access to do this.

fnordfnordfnord10• 11 years ago

If my understanding is correct, Uconnect/Bluetooth security is the weakest link, which isn't much comfort.

skimmas• 11 years ago

One got to love bright minds who ever thought connecting any relevant part of a cars control mechanisms to the internet was a good idea.

hueving2• 11 years ago

The issue is the stupid media center. People want that to have Internet. Then at the same time they want it to display all of the climate details and other system info that comes off the CAN.

jasimq3• 11 years ago

But surely they can be isolated systems

djrogers2• 11 years ago

People want

Yeah, no. Auto mfr.'s want to reduce the display count to make cars cheaper to make and the interiors simpler to build. I've never ever spoken to or heard form anyone who 'wants' or even kinda likes having their climate controls on the same screen as their maps, pandora, etc. It's confusing, usually cluttered, and complicates things unnecessarily.

raverbashing• 11 years ago

Then it should only read the CAN, or have a limited write capability

Customers want things, it's not their responsibility, it's the manufacturer's responsibility to not ship something unsafe

netrus• 11 years ago

Doesn't Tesla send over-the-air updates for critical systems to its cars? From my understanding, that means there is a way for a similar attack with a fake-firmware. Am I wrong?

vvanders• 11 years ago

Pretty sure Tesla signs their OTA updates.

tinco3• 11 years ago

Yes, but I don't think skimmas is fully right. Updating firmware over the internet is not a terrible idea. Public key decryption is well established technology and simple enough for even big corporations to get right.

Of course.. there's some room for them to screw up, but I would argue that that's set off by the risk of having buggy vehicle control firmware killing people. Especially with a new vehicle like the Tesla.

djrogers2• 11 years ago

The ability to send OTA updates is a much better option than having to physically touch every single vehicle with a recall...

I'd prefer it if my car didn't have any connection between a public network and it's control systems, but if it does I want it to be able to automatically install patches ;)

higherpurpose4• 11 years ago

Indeed, and I remember the vast majority of the people getting super excited at the possibility of "getting an OTA update that can improve your acceleration by 0.1s" - without realizing what exactly that means in terms of security. In particular, that others could also control your engine and car the same way through updates.

The car manufacturers who do OTA updates for their cars are sitting on time-bombs. The clock is ticking for them until people get killed this way (regardless of them using HTTPS or signed updates - which some manufacturers don't even use now).

rasz_pl2• 11 years ago

like open(not unlock, open) doors while you drive?

http://www.theregister.co.uk/2014/07/21/chinese_uni_students...

imglorp3• 11 years ago

It's not just internet. There's also a vector that uses Digital Audio Broadcast (radio).

source: http://www.bbc.com/news/technology-33622298

imglorp3• 11 years ago

It's not just internet. There's also a vector that uses Digital Audio Broadcast (radio).

source: http://www.bbc.com/news/technology-33622298

chippy• 11 years ago

The Internet of Things has lots of bright minds working on it...

joesmo3• 11 years ago

Seriously. That's the real criminal action here.

justizin6• 11 years ago

With self-driving cars, this is definitely going to be the norm, and this really draws attention to how dangerous they could be, although human-driven cars are also pretty dangerous.

Jasper_• 11 years ago

It's all on the CAN bus anyway. That's how modern cars are built. And hey, if you don't like that, you can always fly on a plane... those surely aren't internet-connected, right? ... Right?

http://www.gpo.gov/fdsys/pkg/FR-2014-06-06/pdf/2014-13245.pd...

http://www.gao.gov/assets/670/669627.pdf#page=23

jasimq3• 11 years ago

If you missed it, this is related: http://www.wired.com/2015/07/hackers-remotely-kill-jeep-high...

maxerickson10• 11 years ago

Discussed here:

https://news.ycombinator.com/item?id=9921557

jacquesm7• 11 years ago

The company added that hacking its vehicles was a "criminal action".

I don't think that's the case, but I still commend them for doing a recall this quick.

Shooting the messenger seems to still be quite a strong reflex for corporations faced with bad news. The way to look at it should be that these guys did Fiat-Chrysler a service. After all, it's not only security researchers that have the ability to write code and that have prolonged access to a vehicle to test.

They seem to be mistaken about the time to write the code, after all, you can write the code and test it on a different vehicle than the one you intend to crash.

Law enforcement typically won't analyze the firmware of all the computers in a car after a single vehicle accident (and it would probably be quite possible to erase the evidence once the car has been given a command sufficient to kill the occupants).

maxerickson10• 11 years ago

The language in the FCA press release (linked in another thread) is softer:

The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action.

So through the process of extensive journalism, unauthorized remote manipulation got turned into hacking vehicles.

MBCook9• 11 years ago

It was hacking. They clearly proved they had control over dangerous parts of random vehicles.

The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation[...]

Assuming that's not a lie, were they working on that because the 'researcher' (quotes due irresponsible 'testing') had been sending FCA what they found instead of their own internal decision to improve things and they knew this (specifically) was coming at some point?

joesmo3• 11 years ago

I assume there was security, no matter how weak, that was bypassed. That's criminal in the US under the DMCA. Hell, even bypassing ROT13 "encryption" is criminal under the DMCA. Furthermore, even if the system was wide open, I have no doubt Chrysler can claim criminal action under the CFAA.

Ain't America's laws wonderful?

quonn• 11 years ago

even bypassing ROT13 "encryption" is criminal under the DMCA.

Is it? I thought the encryption has to be "effective", which would not be the case for ROT13. I would even argue that ROT13 is merely an encoding.

new_hackers• 11 years ago

If we outlaw hacking then it will only be the criminals that have the hacks!

jameshart11• 11 years ago

I don't think they're necessarily asserting that the security researchers carried out a criminal act in demonstrating that the vehicle could be hacked (they almost certainly didn't). But they would be correct to assert that anybody who hacks someone's Jeep without their permission certainly WOULD be carrying out a criminal act. As such, I think they're reasonable in pointing out that this is not a safety issue but rather a protecting-their-customers-from-assholes issue.

MBCook9• 11 years ago

As such, I think they're reasonable in pointing out that this is not a safety

If your system ALLOWS other assholes to take over my car, it's DEFINITELY a safety issue.

nickysielicki2• 11 years ago

Something I'm big on in life is that the worst thing you can say to someone is that you don't understand them. To not understand someone is to deliberately not give the issue thought because you're so deeply embedded in the idea that you have enough background on an issue to decidedly say that you are right and that the reasoning behind your stance is flawless, and thus that they are wrong. I believe that everyone's beliefs and actions are understandable. They might used flawed logic, or they might value things differently than you, but I believe 100% that everyone on this earth uses reasoning for every action and opinion we have.

But when it comes to politicians trying to ban encryption and automakers trying to ban me from editing bits on a memory chip that I got as a part of purchasing one of their cars, I really am unapologetic when I say I really don't understand them. I completely and utterly lack an ability to get into their heads. It would be fascinating to lose my knowledge of everything I know about computers for a day and give these issues thought. To have computers be mystical voodoo magic would be an amazingly different world.

If I had to give it a guess, that's probably what I'd say. Politicians and automakers and middle aged Edward Snowden haters all lack an idea of what is possible and what is unpractical when it comes to computers. They lack an appreciation for just how much commonality there is between the computer running a McDonald's register and the one making sure their car doesn't kill them.

Politicians think we can just "ban" encryption, as if this isn't some mathematical concept with freely-available professionally made implementations. They think Apple has gone to great lengths just to implement their end-to-end iMessage encryption... when in reality they almost certainly took the path of least resistance and merely stand on the shoulders of giants that collectively implemented encryption for them. PR reps for automakers think of code in such an abstract way that they think modifying it must be terribly difficult and thus inherently malicious, when in reality their programmers stood on the shoulders of giants and used the same common interfaces that every programmer uses. Hacking their car was probably done by a curious man decompiling the firmware which they pulled off via JTAG or a test clip. They think Edward Snowden must have been sneaking around in underground tunnels with a ski mask and plugging his laptop into servers, when in reality this was just a drive that was mounted on a machine he used.

Tl;dr: Programmers all pretty much follow the path of least resistance. The general populations lack of background makes them think that things are much more difficult and thus deliberate than they really are.

jacquesm7• 11 years ago

Politicians and automakers and middle aged Edward Snowden haters all lack an idea of what is possible and what is unpractical when it comes to computers.

Plenty of the Edward Snowden haters are <= 30 and plenty of the people that applaud him are > 40 so let's not add age into that discussion.

Whether you are pro/against Snowden probably has more to do with your life experience to date and your general views on what a government should be able to get away with.

surge• 11 years ago

The messenger did some stunt hacking on a highway to promote their talk, and didn't follow any guidelines of responsible disclosure to the company so they could less drastic steps to fix the problem or have some time and perhaps do it in a way that isn't quite so expensive or rushed.

Should they be criminally charged, no, not for the hack itself, perhaps for the highway theatrics. But they deserve to sweat and hire some lawyers, and perhaps face a civil case for the irresponsible way they disclosed it.

The surest way to get legislative pressure put forward to regulate the info sec industry and put red tape that hampers or outright outlaws security research and activity is to have guys like this being so irresponsible with research that affects people's lives as to give them cause to.

glass-• 11 years ago

The messenger reported the problem privately 9 months ago[0] and it was only fixed as they were preparing to go to the press. The day before the "stunt hacking" Jeep were claiming it was not a problem[1].

[0] https://twitter.com/0xcharlie/status/623492229714313216

[1] https://twitter.com/daviottenheimer/status/62351634451271270...

fineman16• 11 years ago

responsible disclosure to the company

When are you going to start discussing the criminal implications of the company in ignoring that disclosure?

a way that isn't quite so expensive or rushed.

Since when is the company's expense our problem?

The fix is trivial. Yank the cellular connection. The company is refusing to do the simple, easy, and quick fix. They're the ones making it a painful process. They're the ones choosing to leave everyone vulnerable while they hide the problem with a bandaid.

legislative pressure put forward to regulate the info sec industry

Your country's laws are your problem. That would be disastrously dumb, but it's your responsibility to forbid your politicians from shooting the country in the foot.

If you blame this on hackers you'll only ensure that a foreign hacker will start a campaign of trying to get you to pass broken laws.

protomyth7• 11 years ago

> The company added that hacking its vehicles was a "criminal action".
I don't think that's the case, but I still commend them for doing a recall this quick.

It is illegal under existing laws. Basically, it falls under the same set of laws as cutting someone break line. You are, at a minimum, in the "Reckless endangerment" category.

It doesn't take new laws, the old ones have seen enough people doing stupid things to other people's cars.

facetube• 11 years ago

It's not illegal to hack your own belongings. It may be illegal if you trespass on someone else's network to do so, or if you manage to provably put the public in danger, but merely discovering a security vulnerability and exploiting it in something you own outright is not illegal. Chrysler's statement is overly broad IMO.

TallGuyShort3• 11 years ago

I would add that shipping cars with such vulnerabilities should be a criminal action, if it isn't. It's certainly negligent (however unintentionally) and unsafe for consumers.

hellbanner• 11 years ago

Are there other areas where shipping with known vulnerabilities that can endanger lives is criminal? EG in medicine?

jacquesm7• 11 years ago

Given the complexity of the software components in a modern car I think it would be a safe assumption that all of them are shipping with such vulnerabilities. If there is one area where we could benefit from some openness it is the embedded world, these are life critical systems in every sense of the world and what I've seen of such code bases does not inspire confidence at all (rather the opposite).

codingdave• 11 years ago

Not to go all law school on you, but criminal actions are defined by statues. There are many actions that are ethically wrong, but perfectly legal.

Now, for a civil action, it is always fuzzy. Whether or not it is negligent is going to be based on many things, a big one being whether it was "reasonable". Shipping cars before this event may have been reasonable, but continuing to do so many be negligent. But at least in the US, that needs to be decided in court, not on the internet.

I'm pointing all this out because you said "Certainly". That word really has no place in the US legal system.

Digit-Al• 11 years ago

Yeah, good luck with that. Law enforcers find it incredibly useful to be able to remotely take over a (suspected) criminals vehicle and force it to stop, so they're hardly going to support a law that makes that impossible. And let's face it, the only way to truly make sure a hacker can't take over a vehicle remotely is to make it impossible.

beat• 11 years ago

Shooting the messenger isn't just bad PR for corporations. It's deeply ingrained in most enterprise culture, and it's why problems like this occur in the first place.

You know that engineers on the ground were well aware of this vulnerability. You know they tried to warn. But what happened to the warnings? They didn't make it up to the executive levels necessary, because several layers in between feared for their jobs and careers if they said something like "This new feature you're demanding could be used to brick every single Fiat-Chrysler vehicle we make, or even murder people". So the executives were asking for features but flying blind on danger.

And ultimately, this is a failure of the executive structure and the corporate structure (and it's an inherent antipattern in large organizations). Since the nature of hierarchy is for subordinates to hide unpleasant truths from superiors, they should have been actively asking about the hazards. They could have hired outside security reviewers. But they didn't.

cmurf2• 11 years ago

There should be push back against the idea it's inherently a crime to either R&D the operation of your own property, or modify it. There is a long standing tradition of car modification in the U.S. especially, I think it's unacceptable for this to be proscribed by making it a crime or even subject to civil action. Obviously any modification I make, is my liability, but that's a totally different thing that saying it's disallowed.

mark-r• 11 years ago

That "criminal action" statement was repeated multiple times; obviously they're trying to send a message. We need whistle-blower protection laws so that the auto companies can't try to eliminate this research by sending the researchers to jail.

Law enforcement won't try to analyze the firmware, but class-action lawyers certainly could. Won't do any good if the bad actors have erased their tracks of course.

tinco3• 11 years ago

This is a terrible decision. On such a short timescale, they'll only be able to fix the particular bug in their infotainment system. The real problem as everyone has pointed out is that the car control and infotainment should not share channels. There should be a physical gap between them and if really necessary a very tightly controlled message bridge.

The real fix will require much more intervention than just a firmware flash at the garage.

We'll see at Def Con how much Chrysler really screwed up.

Xorlev2• 11 years ago

This is a terrible decision.

It's the only one available to them. They can't just refit all existing cars with a new design on a short timeline. Hardware has permanence.

With that in mind, how would you fix the issue for existing vehicles?

maxerickson10• 11 years ago

Assuming the network fixes are effective, the recall is just a PR campaign.

bendykstra• 11 years ago

I think that disabling the entertainment center's access to the internet would be the responsible thing to do. Given Toyota's recent $1.2B settlement over the unintended acceleration defect, leaving this door open to hackers could be very costly for Chrysler.

SEJeff3• 11 years ago

The infotainment system should never have access to the CAN[1] network in the first place... ever. At most, they could have a very simple listener on the can network that could send data (one way only) to the infotainment device via a different channel of sorts. Mixing the two is asking for issues such as just this to happen.

[1] https://en.wikipedia.org/wiki/CAN_bus

fineman16• 11 years ago

> This is a terrible decision. It's the only one available to them.

No, it's the only easy option they have.

Take all the vulnerable vehicles off the road. That's another option they have.

How would you fix the issue for existing vehicles?

Have dealers yank the cellular connection in every vehicle and refund the customers something for removing a feature the product sold with.

Nothing else will fix it in a short timeline.

MichaelCrawford• 11 years ago

"Hardware has permanance"

That automobiles are recalled for reasons other than hardware replacement is a recent phenomenon.

However a software patch would keep Def Con busy while replacement hardware is developed.

laacz• 11 years ago

Would it be really hard to fix this OTA for all vehicles, reusing (and patching) their own bug? This is a technical question, law might forbid doing this.

chinathrow• 11 years ago

There is simply no alternative at this point. The press coverage was so big (which I prefer) that they can't hope that 100% of users will do the fw upgrade themselves.

That thing here is a big fucking warning to all other car manufactures for the future.

higherpurpose4• 11 years ago

The recall doesn’t actually require Chrysler owners to bring their cars, trucks and SUVs to a dealer. Instead, they’ll be sent a USB drive with a software update they can install through the port on their vehicle’s dashboard.

http://www.wired.com/2015/07/jeep-hack-chrysler-recalls-1-4m...

Chrysler says it’s also taken steps to block the digital attack Miller and Valasek demonstrated with “network-level security measures”—presumably security tools that detect and block the attack on Sprint’s network, the cellular carrier that connect Chrysler’s vehicles to the Internet.

Oh great, they'll install an antivirus and think they've fixed the problem.

jacquesm7• 11 years ago

No, it's a stopgap. They have to be seen to do something to counter all the bad press. You can be sure they'll be looking at a more definitive and more robust solution in the longer term but in the shorter term they need to be able to say 'this particular hole was plugged'. That's just damage control on their part, nothing more or less.

fineman16• 11 years ago

The problem is that a fix for this particular problem doesn't actually make anyone secure, it only blocks the one specific attack the hacker told them about. (Hopefully the hackers kept another bug in reserve so they can trigger another recall/patch cycle as soon as this is over.)

We need to communicate that this isn't a decent half-measure, this is specifically a worthless measure intended to keep vulnerable cars on the street where they can kill people because a real fix is seen as being too expensive.

msane• 11 years ago

I think it's a great decision. Vulnerabilities should involve this much pain for the auto companies.

We all acknowledged the issue is architecture, and that can't be fixed by flashing firmware.

murbard2• 11 years ago

That's a good use for formal software proving. While proving the safety of the entire codebase might be currently out of bridge, it would be quite feasible to prove the safety of a message bridge.

Animats• 11 years ago

Chrysler doesn't have much of a choice. They have to do a "voluntary" recall for a safety issue, or the NTSB orders an involuntary recall. Since this has terrorism implications, they need to get this done.

MichaelGG2• 11 years ago

Terrorism implications? Sure, but so does pretty much everything. If terrorists inside the US wanted to mess things up they just need to blow up a small targets in BFE, Iowa and the like. Worse, kidnap a few people and behead them. The US would be utterly paralyzed with fear.

Ignoring direct violence? DoS PSAPs so small things like reporting burglaries or helping heart-attack patients fails. Or shit, have you seen the cabling at many datacentres? Take a few of those out and the US Internet would be off for what, weeks? (And that one you can even do remotely.)

My point is that you cannot harden the entire US infrastructure. Saying this car issue "has terrorism implications" is either a tautology or fearmongering.

urda• 11 years ago

This is a terrible decision.

Regardless it's the only and correct decision they can make at this time. It's honestly not terrible at all. What would be terrible, and valid of the comment "a terrible decision" would be doing nothing at all.

curiousjorge• 11 years ago

Why does Jeep in particular have so much issue with quality assurance? The most memorable is the SUV rolling over in a simple test a couple years ago which have been fixed but it's quite worrying.

https://www.youtube.com/watch?v=zaYFLb8WMGM

sp332• 11 years ago

A lot of SUVs were prone to rolling over before they got the traction control system right.

justizin6• 11 years ago

This is not particular to Jeep, the Jeep Cherokee is simply the particular car they hacked. This basically affects all Fiat Chrysler vehicles.

dsfyu404ed6• 11 years ago

First off that test is somewhat of a joke for SUVs since it basically rewards car-ish handling which is at odds with the truck-ish performance that is demanded of larger SUVs

In terms of comparing two different vehicles...

If the $year base model $carA has a suspension system closer in performance to the sport model of $year $carB but for $year+1 they put a much softer suspension in the base model of $carA in response to customer feedback then the results go out the window. Alternatively, if the OE tires are particularly expensive then you can bet that most owners will replace them with cheaper one. Additionally, particular trims are often incredibly rare or almost always have a particular option added. So testing a $trim without $package will be of little meaning when the vast majority of $trim that make it to dealer lots will have $package. In either case the results go out the window because there's a handful of large variables that are uncontrolled for. It's little better than the comparisons you see in car commercials.

If you actually want to grill Jeep over something I suggest you read up on 90s XJ gas tank fires.

tantalor2• 11 years ago

The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action.

The WIRED story's hackers presumably were authorized by the vehicle's owner or operator, so the demo did not "constitute criminal action."

latortuga• 11 years ago

If there are protection measures in place it could be a violation of DMCA, whether or not they had the owner's permission.

privong• 11 years ago

The WIRED story's hackers presumably were authorized by the vehicle's owner or operator, so the demo did not "constitute criminal action."

They were probably authorized by the driver, but car companies have argued that the driver does not "own" the software in the car, so I assume their claim of unauthorized access is predicated on the assumption that the car company still owns the software and that the car company did not authorize the access.

I do not agree with the car company's stance on ownership, but that may be the origin of their claim.

maxerickson10• 11 years ago

The car company isn't claiming that the Wired hack was unauthorized.

That paragraph is there to make it clear that the tampering is a significant action to take.

tantalor2• 11 years ago

WIRED has another story about this question,

http://www.wired.com/2015/04/dmca-ownership-john-deere/

Supposedly the US Copyright Office will decide this month.

justizin6• 11 years ago

I'm pretty sure it was /their/ Jeep.

protomyth7• 11 years ago

Did the WIRED story demonstration take place on a public road with other cars around?

[edit: viewing the video - yes they did - they should be charged with endangerment - someone could have been hurt rear ending the jeep]

ryandrake• 11 years ago

Auto companies' lax attitudes towards systems security will change when insurance companies start considering such security vulnerabilities as safety issues and adjust their existing safety ratings appropriately.

brudgers4• 11 years ago

Insurance companies already do. Insurance rates are actuarily based on actual accident frequency. Outlier risks are covered by reinsurance. Not only are insurance companies well funded, they employ smart people and work in an information network with a lot of depth.

aianus3• 11 years ago

Yeah, right. The only way insurance companies are competitive and pricing risk correctly is if there's a magic responsibility fairy that bestows wisdom and driving ability upon all at midnight on their 25th birthday.

bradgessler• 11 years ago

The good that comes out if this is that somewhere in the management chain people will feel justified to increase security investment by saying, "remember the Fiat Chrysler recall?"

fauigerzigerk• 11 years ago

Auto makers will have to make sure that they can update their software remotely or this going to become really expensive very soon.

ytdht• 11 years ago

They probably already can, if the use the right exploit.

mzs7• 11 years ago

What's to say this wasn't precisely that? Maybe at the talk we will learn that accidentally uconnect was listening to the update FW messages from the sprint network.

Often the board that handles the radio acts like a bridge in modern cars. It tends to be the beefiest computer hardware in the vehicle. So it is on the high speed CAN bus and a node on the more star shaped low speed bus.

When they updated the FW, they removed the bit of code that prevented dangerous messages IDs from leaving the controllers on the radio board and possibly added code that could put arbitrary CAN bus messages on the buses as relay from the sprint network.

I am very eagerly awaiting the talk.

discardorama2• 11 years ago

If researchers really want to underscore a point: hang out outside the IIHS testing facility, and when they're testing the vehicle in question, then mess with the systems.

Maybe IIHS needs to include "remote hackability" as a criterion in their testing?

BinaryIdiot• 11 years ago

Maybe IIHS needs to include "remote hackability" as a criterion in their testing?

I think so but just include hacking in general. Remote hacking is the worst but if someone can get physical access to some part of your car for a brief period of time (maybe the door's are unlocked and they plug something in or maybe they get under the hood and mess with the car's computer) you still have a major problem on your hands.

Granted it's far harder to secure a device when someone has physical access to it but they need to test and harder for this the best they can as well. In my opinion anyway.

dsfyu404ed6• 11 years ago

IIHS uses cars that aren't running and don't have fluids in them. They don't want to clean up that mess (or have the car destroyed by fire). They do test fuel system integrity though. I'm not sure if they use some other fluid (water + dye) or something like pressurized air or leakdown test after the fact.

I guess you could engage in other antics but none of them would be all that effective since the car is towed by a cable until it's a few feet from whatever it's hitting.

discardorama2• 11 years ago

Actually, you are right. I was thinking of NHTSA, which does braking tests on an actual track.

dsfyu404ed6• 11 years ago

Just an FYI for everyone on the "segregated systems" bandwagon:

If a compromised device can talk on the CAN bus it's game over since (pretty much) everything listens on that bus so you can't (without a lot of time and effort, implement a way to) pick and choose systems to segregate while maintaining wireless connectivity to those critical system.

Vehicle manufactures get a huge data set sent back to them by vehicles. They use this for stuff like correlating part failures to operational conditions, determining which intermittent wiper setting people use as well as improving the logic for the operation of critical systems (e.g. if my last inputs were $stuff then don't upshift). I wouldn't be surprised if they sold the data as well. McDonalds would love to know where and when people start looking for food. insurance companies would love to have more variables to correlate to risk trivial (e.g. $color cars with $trivial_feature get in accident that cost $really_small_percent $more_or_less than $other_color

To segregate systems you need to be able to pitch to the bean-counters that the cost/benefit of whatever degree of segregation you're proposing beats the cost/benefit of whatever plan the next guy is proposing. These data sets are incredibly valuable to many different parts of the company. The people doing marketing and customer facing stuff would be at a severe competitive disadvantage if they had to wait months (first oil change) o get real world data on feature usage after a re-design.

Sure you could download it at service time..."but we already have a system that does it in near real time, can't we just secure that?"...

TL;DR: Segregating systems involves more than having the engineers wait a few months to figure out if their new tune solved the problem.

krapp5• 11 years ago

Which costs less in the long run, a potential class action lawsuit and loss of consumer confidence, or better system security?

If necessary, consider that security is a feature you can sell, when your competitors are following the path of least resistance and paying out their settlements.

dsfyu404ed6• 11 years ago

Depends on the lawsuit. How much effort would you go through to secure software that runs on a decade old vehicle with a very particular set of options if the exploit requires a very particular set of conditions?

You might fix it just to have a similarly obscure zero day be discovered (unknown to you) and exploited in a different place. Then not only were all those resources spent in vain, but you've got to deal with the opportunity cost of not having thrown those resources behind current of future safety and security tech.

People accept the risk of driving vehicles with legacy safety equipment, why should software be any different from hardware or legacy software in non-embedded applications. At some point you have to let stuff go. Just ask Microsoft.

userbinator2• 11 years ago

Vehicle manufactures get a huge data set sent back to them by vehicles.

That is creepy. Is there a way to disable this phoning home (or know it even exists) if I ever buy a new vehicle? That's an unlikely situation for me, but maybe there are others who would like the new features but not the privacy aspects of it.

Even so, the manufacturers are only receiving data, so a one-way link from critical systems to others would be fine. That's how airplane avionics have been designed.

nissehulth2• 11 years ago

They claim that only US cars are affected. Is this because liability costs are much higher in the US or is there really a different software used in the rest of the world?

maxerickson10• 11 years ago

It could also be related to the cell network used.

nissehulth2• 11 years ago

Good point. I guess there could also be some other service involved that's US only, something like OnStar.

takeda3• 11 years ago

Makes me wonder if that doesn't have something to do with IPv4 address exhaustion and perhaps cars in Europe are behind CGNAT.

jameshart11• 11 years ago

I see a lot of people thoughtlessly applying computer-security mindset here to vehicle-safety. They're really not the same thing, because they are handling very different risk models. Vehicle safety is about "how will this system perform under typical conditions when something goes wrong?". Computer security is about "how will this system perform if a smart asshole tries to abuse it?". Vehicle safety generally doesn't concern itself with deliberate sabotage. You won't see a product recall for a car because "under some circumstances, a criminal might cut the brake cables". What Chrysler are doing here is, though, effectively that, and why they have to do that for a computer security issue is interesting.

We're all used to the idea that if you put a computer on the internet, it will come under attack. People will try to snoop on the data it handles, or subvert it to use it for their own purposes. So why do we then move on to assume that, if such a system is attached to something safety critical, that those same people who will attack the computer to get at its data or processing power will now move on to attacking the brakes, or the engine, and try to kill people?

Most vehicular crime isn't homicide, it's acquisitive - people will attack vehicle security systems to steal the car, or get access to valuable contents. Sabotaging the vehicle to kill the driver is way down the list.

As a society we tend to assume that physical security is not the only thing that stops random strangers from trying to kill us. We do not all drive around in armored cars in case someone decides to shoot at us from an overpass. We don't all sweep under our car with a mirror for bombs before we get in and start the engine.

And it's certainly not a failing of Chrysler's engineers to adequately consider customer safety that they sell Jeeps which are not bulletproof and which have exposed frameworks on the underside where bombs can be attached.

So why is it that we're so quick to assume that because a safety-critical computer system is exposed to the internet, that this is the worst thing ever?

Is it that as far as physical security of your Jeep goes you only have to trust the people in your neighborhood, but for internet security we have to trust the whole world?

higherpurpose4• 11 years ago

So you're okay with spy agencies (from all over the world) as well as drug cartels and other criminal organizations having the power to kill you in an almost untraceable way while you're on the highway?

Also, the US gov has been using these entertainment systems to spy on people for more than a decade...it's already been happening. Unfortunately, I can't find the link now, but it was a post from 2001 or 2003 on NYT and I think they were using Ford Sync to do it.

jameshart11• 11 years ago

Don't think I said that I was okay with that, no.

But to be clear, drug cartels, spy agencies and criminal organizations have been able to do that for quite some time. They've just had to send a person to plant the bomb or the bug or the location tracker in person. And it's not generally regarded as the car manufacturer's problem to deal with that threat.

So yes, there's a question of scale, which makes a difference here. Traceability can maybe be handled at the network level - who knows what information Sprint captures about traffic to these car systems?

But the way most people are talking about this you'd think that as soon as the method for doing this hits the internet, script-kiddies are going to start randomly crashing Jeeps into bridge pylons.

krapp5• 11 years ago

Is it that as far as physical security of your Jeep goes you only have to trust the people in your neighborhood, but for internet security we have to trust the whole world?

Yes?

If you connect a system to the internet, you have to consider attempts to attack that system (automated and not) to be part of typical operating conditions.

jameshart11• 11 years ago

But why does the internet need to be considered a completely hostile environment? Because the internet differs from the real world in that... Actions are untraceable? Crime has no consequences? It crosses borders?

These are all true to a greater or lesser extent (often to a lesser extent than people think). But it makes for a pretty weird threat model, trying to protect your customers from high-tech murderers, anarchists, and three-letter-government agencies. This isn't like trying to stop someone steal a credit-card-number.

SilasX• 11 years ago

That doesn't sound like the same vulnerability at all. Cutting brake lines no longer results in someone's death [1], and they'd know at the time they first try to brake, when they'll probably be at low speed anyway.

The Chrysler exploit, by contrast, allows you to silently take control of the vehicle in ways that don't reveal your position until much later (if at all), due to the sound system not being firewalled from the brakes.

That seems fundamentally different from "hey, gangbangers might shoot at you while driving".

[1] http://www.quora.com/Is-cutting-someones-brake-line-prior-to...

jameshart11• 11 years ago

Why is it fundamental different? What is the fundamental difference?

I'm asking because I'm genuinely not sure. I agree it seems different. It does feel like chrysler should be responsible for securing the system from remote exploitation. But are they? And why?

threatofrain• 11 years ago

I think it's pretty clear that connecting a computer to the internet is a matter of trusting the whole world, which is a lot harder than trusting local circumstances.

Your assessment of risk has to change when the cost of scanning and attacking your machine from afar in a hard-to-trace manner is dirt cheap.

ScottBurson2• 11 years ago

Interesting questions. I think part of what's going on is that people don't like being exposed to new, unknown threats. Even if this turned out not to be a very big deal in practice -- and I am not sure it won't -- it's still a new risk that's being assumed.

Sabotaging the vehicle to kill the driver is way down the list.

But if it can be done remotely and untraceably...?

munificent• 11 years ago

So why is it that we're so quick to assume that because a safety-critical computer system is exposed to the internet, that this is the worst thing ever?

Because of the Greater Internet Fuckwad Theory (or, more nicely put, the "online disinhibition effect"[1]).

We don't worry as much about random strangers harming us in person because most people are generally well-behaved when they are face to face with someone in real physical space.

On the Internet, where all you see is a screen and all you do is click your mouse, "reality" gets a lot more tenuous. In that environment, people act worse.

If you were walking over an overpass and saw someone left a cinder block up there with a note attached saying "Throw me!" how likely would you be to lumber it up off the ground, carry it to the edge, and heave it over onto to a car you can see passing below, whose occupants are visible to you?

Now imagine you stumble onto a random web page with a button labeled "Click to drop cinder block off overpass". Tempting?

The way our behavior differs in these two circumstances is a big part of why Internet security is so different from physical security. (The other big difference is how data can be replicated for free. It takes 50x as much effort to steal 50 cars. It often takes no more effort to apply the same have 50, or a million times.)

[1] https://en.wikipedia.org/wiki/Online_disinhibition_effect

imh• 11 years ago

In addition to this, there are differing scales at work. In real life, by your analogy, you might find a cinder block with a "throw me" note. With the internet, you might find a button that says "throw 1.4M cinder blocks." One maniac can cause much more trouble that way.

amwang217• 11 years ago

Not too long ago, many decent hackers were no longer interested in causing damage and instead focused on stealing people's identities or credit card information for financial gain.

If Greedy Greg knew public CEO Huge McChecks was driving an exposed vehicle, Greedy Greg could short sale Huge McCheck's company and cause a multi-million dollar crash with Huge McChecks inside... all with a couple strokes on a keyboard from thousands of miles away.

superuser2• 11 years ago

applying computer-security mindset here to vehicle-safety

That might be a valid complaint if this attack required physical access, but it's a remote exploit. It is computer security, except the target is many times more interesting because it can kill people.

blahblah3• 11 years ago

Wow connecting cars to the internet? Sounds insanely dangerous. Not everything should be connected to the internet or "smart".

cmurf2• 11 years ago

At RSA I was at a car hacking session, and the big take away I got is how some of these systems have none upgradable firmware, and today's designs sent for manufacturing now aren't due for 2017-2018 model year cars. So some of these vulns could be baked in, in a way that have expensive work arounds because the car manufacturers have been so feature driven rather than security conscious. It's the car equivalent of bloat/crap ware on phones. Features that drive up selling the customer. The cars that have OTA firmware updates (BMW was one example) are able to push out fixes faster, and with more complete coverage than recalls so it seems sane to me to make it mandatory such "smart cars" can be OTA updated.

LoSboccacc• 11 years ago

The company added that hacking its vehicles was a "criminal action".

screw that attitude.

I hope government will make the equivalent of whistleblower protection for security researchers that report exploitable flaws, because it's the only way to increase security over time.

i.e. I'm scared as hell that planes are allegedly hackable but researchers aren't really talking about it nor testing it properly because fear of lawsuits.

mizzao2• 11 years ago

So despite the huge uproar at https://news.ycombinator.com/item?id=9921557, it turns out the end did justify the means.

JeremyBanks• 11 years ago

That only holds if there were no better means that could have achieved the same ends.

mizzao2• 11 years ago

It's possible, but can you cite another example of when a news article caused a recall to be issued a couple days later? It seems unlikely - usually takes months if anything happens at all.

oh_sigh• 11 years ago

Only if it can be shown that performing the test on a dangerous section of a public highway was instrumental in getting the recall to happen. I believe they could have performed the test on a closed auto track and it would have been just as effective.

pasbesoin• 11 years ago

Based upon my own experience (in another industry), I have no doubt that there were knowledgeable people internally who warned them of this -- if they were not fully cowed by the bureaucracy.

I have zero sympathy for the manufacturers. I only hope that, if they decide to go on a witch hunt, they actually seek and punish the morons in power who, most likely for self-serving purposes, let this slide.

This also should raise a ringing cry to rein in DMCA et al. uses that seek to outlaw such research. In this case, the manufacturer has obviated their authority in the matter.

JustSomeNobody• 11 years ago

Do we really need our vehicles to have so much technology?

I know I'll get down voted, but it has to be asked.

csours• 11 years ago

Short answer, no.

But, consumers expect a infotainment user experience at least as good as hanging an iPad in the car, and if your car doesn't provide that, they will rate it poorly in surveys.

Source / Disclaimer - I work for GM.

rasz_pl2• 11 years ago

In other news Apple just hired Doug Betts, former FCA 'quality' boss

http://blog.caranddriver.com/fiat-chrysler-quality-chief-res...

http://www.autonews.com/article/20141028/OEM02/141029851/bet...

http://www.techtimes.com/articles/70582/20150721/apple-hires...

because nothing screams quality like a 'decided to leave one day after yet another drop in Consumer Report rankings' and 1.4m car recall!

bithead• 11 years ago

"I wonder what is cheaper, designing secure cars or doing recalls?"

Ever the enduring question

satyajeet23• 11 years ago

If you have to update software in person, you shouldn't be in the software business.

bborud• 11 years ago

I've been spending a bit of time over the last couple of months reading up on CAN, OBD2, system architectures for automotive systems, attack vectors, various forms of CAN-attacks, building stuff that interfaces with CAN buses, writing software, figuring out how things work etc. And I have to say that many of the comments in this thread are frighteningly uninformed.

I know this is supposed to be The Magic Kingdom where people are only supposed to say positive things and eat happy pills all day, but would it kill people to at least try to read up about the things they so willingly share their "insights" on before posting here?

At the very least, try to understand how CAN works before spouting nonsense grounded in uninformed assumption. Uninformed opinions are not helpful. They just pollute the discussion.

Fiat Chrysler recalls 1.4M cars after Jeep hack

Related Stories