Modern cars run on CANbus. Everything is linked. No, seriously, everything: steering (at low speeds, the park assist can be exploited), brakes, lights, radio, a/c.
You'd have to go back at least ten years to find cars without it.
Then "modern cars" can never be considered safe, and whomever the professional engineers are that signed off on that design have some explaining to do. "market forces" or "following my boss's orders" are not valid excuses; a professional engineer has a duty to ignore such things when considering safety.
I suspect whole auto industry needs to re-learn (if they ever learned in the first place) the lesson of the Therac-25 and what "fail safe" means. Some dangerous situations should not be possible.
Unfortunately, I suspect the auto industry will choose to learn those lessons the hard way. When people die from someone messing with their steering or brakes remotely, I hope whomever signed off the idea of mixing remote signalling with critical systems is found personally liable for manslaughter.
Does the software industry even have a requirement for professional licensure? If not, then there is no "professional engineer" that signed off on the design and there is no regulatory liability and hence no questions to answer by the engineer.
This is one of big problems with the software industry nowadays. It has a role to play in nearly every major industry but does not have the same regulatory hoops to jump through to get into that industry. In this case, I am sure multiple mechanical and electrical licensed professional engineers had to stamp all of the physical components that make up the vehicle but I would be very surprised if any software was ever signed off on by a licensed professional engineer explicitly (there is a case to be made for implied acceptance by the engineer of record for the system that the software runs on but I think it is weak).
At least in the US, it is entirely plausible that many of the electrical engineers working in a large company on such a product are not licensed professional engineers.
If the class action goes forward there will be a legal examination of whether a security flaw that allows remote tampering is a safety defect or not (of course it is, but I mean in the context of liability).
I'm pointing out that shipping imperfect software has not yet been determined to be negligence.
I pretty much expect that automakers will quickly start shipping systems with effective segregation (the cost pretty clearly doesn't outweigh the PR downside), so the interesting question really is whether the cars on the road today represent negligence or not.
That's really the problem...just like feds wanting backdoors that "only they" can access, Onstar thought it was clever and could grant itself powers in software that no one would be able to exploit. Too bad the people who are best at exploiting software aren't likely to work for companies like Onstar (I'm not saying Onstar is disreputable, just probably boring and with a low skill ceiling).
> 50 bitcoin in 20 minutes or your car takes a drive off the pier
I would NOT like to think about what would happen to someone who tried this sort of thing. I expect within seconds of the first accident (or worse, injury, even fatality) causing malware being discovered, the resources of the entire NSA would be being used to track down the author. Then, when found, 'bad day' would not begin to describe the rest of their life. In fact, I can see this sort of thing being validly placed under 'terrorism' and dealt with appropriately.
People who randomly attack vehicles being driven around today (brick thrown off bridge over a busy road into windscreen et al) are not the smartest, or have poor self control or other issues, but they are actually quite rare. To pull off an automated hack would require enough intelligence that they can surely understand the consequences. Therefore, this will be done by a genuine psychopath (or sociopath? never quite sure of the terminology) or terrorist group.
I think we should be as worried about vehicular-malware-based-death as we are about dying from other terrorist attacks. So yes, I know that means the risk is small, but the general public will over estimate it, and worry inappropriately. That seems to be a matter of education, not technology, though...
It's true, and it's the whole basis for CAN networks. The whole car runs without a central computer, but rather, a set of microcontrollers for all of the different functions of the car. Every single microcontroller, more or less, broadcasts messages to all of the other ones along the bus. I'd say you'd probably have to go back even further than 10 years as the latest CAN spec, 2.0, was published in 1991.
But every microcontroller on the network doesn't have to listen to messages from the others.
The real problem is that the designers of CANBUS never dreamed of a day when rogue nodes could show up on the network and start broadcasting messages they should not be broadcasting. Automotive embedded systems were closed loops and, aside from perhaps a diagnostic tool in the garage while parked, not susceptible to spoofing messages.
I wouldn't even blame the designers of CAN-bus. The crazy thing is that GM/Chrysler allow media devices and general computers on the CAN-bus without a firewall.
It's easy to say that the architecture is flawed, but that's no excuse at all. The CAN-bus allows control of the car, so non-control devices should not be allowed to send control messages on the CAN-bus.
It's the same as blaming the insecure architecture of the internet when your password gets snooped, when you should have just used a secure tunnel.
The CAN-bus allows control of the car, so non-control devices should not be allowed to send control messages on the CAN-bus.
Unfortunately CAN is not as complex as an IP packet. It's essentially a one-wire serial bus with collision detection. Even RS-232 lets you clip the TX line so that a device could listen but not send. You would need to clip the TX before the CAN transceiver, and that's something nobody typically does.
I'm suggesting there would be a hardware device that sits between any device and the CAN-bus. It would simply decode incoming messages, and filter not allowed messages, recode the rest and put them on the bus. I bet you could program an Arduino Nano to do this (as an illustration that it's a fix that shouldn't require more than a few dollars, obviously it'd have to be rugged, robust and reliable for GM/Chrysler to do it).
The simplest method is to encode an authentication scheme using digital signatures for each device in the bus, and burn an approved transmitter list into each device such that specific messages have to be signed by a specific MCUs authentication key or it is ignored. Then simply don't add internet-connected hardware to the approved senders list for any high-risk messages. You can then compromise the car at will but none of the other CAN devices will process acceleration messages unless you happen to own an internet-connected accelerator.
Digital signatures are (a) not simple --- the cost and complexity of implementing and verifying them might be as bad as that of switching to a different phy/mac and (b) particularly tricky to do in microcontroller parts.
Some controllers already do some similar things, more like shared secrets though. It's common in the brakes. There is some sequence of commands that have to be sent first otherwise later commands will be ignored. The problem is that 1) you can wire in a scope and watch 2) just try every possibility or 3) use the diagnostic/test messages instead that accomplish the same without all of that.
There are devices like this in use, i worked with automotive and we used a device like this to attach certified third party factory installed add-ons, they also translated vendor specific quirks in the protocol so that both sides would understand each other better. In essence the third party was kindof trusted but to be on the safe side we firewalled them to only allow a list of white listed commands, more like an API. Not having this kind of barrier for internet attached devices is inexcusable.
Maybe I don't understand the difficulty. This is a standard services problem that standard software architecture practices would solve. You just need a gateway sitting in front of the CAN bus and any externally exposed services must go through the gateway. Only "safe" services or commands are exposed in this case. Maybe an entire service here, maybe a specific info command to an essential driving service there. The gateway inspects all incoming requests from these external services. All internal commands continue talking through the bus directly. Problem solved.
Yes, a gateway is a common solution. Or having two busses (one for engine control and the second for aux functions like HVAC, radio, lighting etc) with a system to pass critical messages between the two.
But it's cheaper to use a single bus and just slap everything on there. Or in the case of something like OnStar, realize you can add extra capabilities through firmware and not fully think about the impact when your radio can send unfiltered messages to your ECM.
You do have that gateway, it's likely the radio too. That thing has the most complicated and feature-full code of anything in the car and humans make mistakes when writing even simple software.
The worst thing is, people can hack your car through your 'entertainment system' on your car. I don't even want to know how such a system exists, why my radio has access to brakes?
Because people cry communism or incompetency every time the government tries to write forward-looking rules in matters affecting commercial interests. So politicians can only act retrospectively, once shit has hit the fan.
Who exactly would write these forward-looking regulations? Who is competent enough to foresee years in the future what car manufacturers might want to do, and then imagine how that might go wrong, and then regulate it? Any why would (indeed, should) these people not work for the auto industry, applying these competences in actually developing these new technologies?
And who checks these people's work? How do we make sure they don't risk outlawing ABS and ESP before they're invented?
For a relevant case study, compare and contrast with how heavy regulation, also plenty of forward-looking stuff, totally failed to predict or prevent the financial crash.
The, there's the issue of how the industry would actually adhere to these speculative regulations. You'd have plausibly millions of pages of regulation to evaluate every new development against. In practise, this means the lawyers are running the show. Just like in the banks.
Also, before your righteous anger gets the better of you, let's remember that nobody has actually been hurt due to these problems yet, except of course the manufacturer who must issue extreme expensive recalls. In the meantime, Toyota built cars with a gas pedal that stuck - this issue actually killed people. It was a purely mechanical problem - would these hypothetical forward-looking regulators have caught that issue?
Finally, I'm not one to throw around words like "communism" where they don't apply, and communists certainly didn't and don't care one bit for consumer safety or comfort - but severe overconfidence in the ability of government to plan, predict and prevent things is a central problem with communism.
I would suggest someone else should keep his own righteous anger in check, considering he replied to a simple quip with a comment that is eight times as long.
I won't even bother to fight your strawmen (the financial crash could not be helped by better laws, really?), tbh it's just boring. You are right, why have laws at all? Car manufacturers are so enlightened, they obviously work for the greater good rather than simple profit, I apologize for my stupid remark.
Passive-aggressive much? Sometimes a simple quip requires a long response to accurately address multiple potential issues. In speaking about forward-looking government regulation, bringing up how forward-looking government regulation failed in other cases is pretty relevant. And never was the idea mentioned that these things should not be governed at all, which is you throwing out a strawman. Simply that the nature of modern regulation is to restrict possible outcomes, and that also has negative externalities. "Good" advancements can be just as restricted as "bad" advancements, and it's extremely difficult to tell the difference years or even decades before they happen.
> Sometimes a simple quip requires a long response to accurately address multiple potential issues.
Not sprayed with gratuitous ad-hominems, not really.
> bringing up how forward-looking government regulation failed in other cases is pretty relevant.
I struggled to consider it relevant, considering how it's widely accepted that reduction in regulation is one of the main causes of the recent financial crash. Forward-looking regulation was there and was removed. I think that particular example doesn't make the point he thinks it makes.
> And never was the idea mentioned that these things should not be governed at all
It was basically inferred. If you take his points to the logical conclusions, there is no point in regulating the car industry, they hire the best minds so they will know what to do.
> "Good" advancements can be just as restricted as "bad" advancements
Of course; but it's extremely difficult to prove whether the advantages of outlawing both outweigh the advantages of allowing both. So we came up with this rule that "we legislate only after shit happens". Is it crazy to think this arrangement could be sub-optimal, and there might be a better compromise?
I get that. But how much forward thinking does it take?
Back in the 80's or early 90's when "Drive by wire" was the buzzword and old timers were saying they'd never drive a car that didn't have physical linkages, how much forward thinking would it have taken for regulators to say controls system circuitry needs to be completely isolated from other systems in the car? Something like this would still apply today and maybe we wouldn't be seeing these issues.
a lot. You can start by looking up if any of these old timers raised anything remotely similar to that concern. Remember how insanely unprotected the Internet was in the beginning? How SMTP basically still is? That was build by some of the smartest people in the world, and they didn't have the foresight to predict that there might be adversaries, and thus build (in retrospect, quite simple) protections in.
Also, those old timers were wrong about drive by wire, there is zero evidence that it's any less safe than physical linkages.
One of the reasons it would have been extremely difficult to predict, is that the phenomenon of consumer devices having a general purpose computer (and that this might be connected to the rest of the car), much less one networked in any sense, as its interface is pretty new.
I guarantee you that engineers warned PM's about this kind of thing from the start.
>Also, those old timers were wrong about drive by wire, there is zero evidence that it's any less safe than physical linkages.
Let's distinguish drive-by-wire from FADEC (or what amounts to a poor-version of FADEC). An electronic throttle is fine. An electronic throttle that cannot be overridden by a casual user not. It's the implementation that's problematic.
> controls system circuitry needs to be completely isolated from other systems in the car
What would they define 'other systems' as? Back then carphones were pretty new, and the height of technology, and a car 'computer' was a trip mileage counter and mpg calculator. Amy definition would either be rooted in the technology of the time, and therefore not handle new breakthroughs and inventions, or be so vague as to be unenforceable, I suspect. They would have to be pretty far forward thinking to have envisaged high bandwidth Internet connections or wireless data links, as inputs to the car systems, let alone the amount of compute power that is now routine in vehicles.
The sorts of things that are going to enforce safety here are going to be produced by the car industry engineering standards bodies eventually, but it will take time. Many of the concepts, like CAN-bus firewalls, data diodes and filters are already present in high-assurance avionics networks and (post STUXNET) in process control systems. Note that it took STUXNET for people to realise that vulnerability, now the industry is working on solutions, but so far no power stations or chemical plants have exploded. We are in the same place with vehicle security now.
Why is canbus a bad design? As long as you don't allow untrusted data onto it there is nothing wrong. Physical access exploits are quite irrelevant imo.
These are security issues, it's not by design. We will see more issues like this one and they _are_ bad, but this would be the least of my worries. There is no money in exploiting these bugs and even so-called script kiddies will probably not want to risk killing anyone. There are real risks, like buggy software in your ECUs wich can be deadly without any Internet connection.
It is partly by design since the ECU is physically connected to the infotainment system for diagnostics / user configuration. If ever there was an example of when systems should be airgapped, this should be one of them.
ECU's have no business being integrated into infotainment systems. It's fine to have a physical wire that can be connected for diagnostics, but don't have then permanently connected by default. Just don't.
edit: just read the article (doh for commenting before reading) and this attack is different from the previous ones. This one uses a feature that was built into the cars purposely for unlocking the vehicle and controlling the engine. That feature seems monumentally dumb from the outset - and very much implemented by design.
I'm not afraid of being killed because someone hates me, I'm afraid of being killed because a 12 year old with a laptop may not have a fully developed moral sense of right and wrong.
I'm not afraid of being killed either. I'm mostly worried about politicians and powers that be killing others to stay in power. It's much easier to keep your hands clean as a government hacker than as a government hit-man.
Even if the hardware is secure against a script kiddie hacker, it'll never be secure against a government backdoor.
Imagine the power that someone like Nixon would have as president today. It's scary.
I fully expect a new genre of prank videos to emerge. Self-driving cars with cameras make for perfect targets. Innocent people will be involuntary passengers for a Grand Theft Auto style rampage that is livestreamed for the world to see.
Really? Do you imagine the only thing stopping people from trying to kill random strangers is the fact they currently have to get up out of bed to do it? Because it can't be the fear of getting caught, since the perpetrators of any vehicular malware that kills people will be caught...
Exactly, so according to the people worried about killer malware, the only thing stopping our population of latent murdering sociopaths is the fact that it's currently too much physical effort to go and sabotage some sandom vehicle? As I said, this seems unlikely to me...
On the bright side, these cars can now be used as an open platform for developing open source driverless car software. You can even use the stereo to run the control software. (I'm only being slightly flippant)
You're right. Thankfully, I had a quote to give some context to what I was trying to rebut. It'd be great if a mod could change the location of the reply.
More like, there is this acceleration module and there is this pedal that must hook into it, and there is this handy bus going through the car that you can connect the two systems to in order to make them talk with each other.
And then you add a radio, and a knob under the steering wheel to control it, and think - hey, I have this handy bus I can reuse so that they talk with each other. And suddenly, your radio talks to your brakes.
I don't think it's malicious design. More likely stupid one, or just a result of people being used to treating car hardware as trusted environment - where obsessing over security is just a waste of resources. It's just that when you introduce an Internet-connected device to that environment, it's not trusted anymore.
I'd still argue that anyone who connects radio, travel computer or air condition systems (non-critical, not real time) with breaking, acceleration and external lightning systems (mission-critical, realtime, potentially lethal) is maliciously stupid.
In almost all cars there are in fact two CAN buses - a high speed, low security bus that connects the radio to the entertainment system and so on, and a low-speed, high security (in terms of components, not actual security) but that connects the brakes to the ECU and so forth.
The issue is that frequently systems like OnStar sit on both buses, because they are used for things like engine diagnostics. If you investigate you'll notice that every single one of these car hacking attacks starts somewhere, pivots to an OnStar like system, then can control the car.
Doesn't really make your point less true, but fits perfectly in the features over security mindset.
Two CAN buses is a quite low number. Last system i saw, which was pretty old, had at least half a dozen from what i could tell from my end of the system, probably even more internally inside or behind other components. Modern cars also use flexray, LIN, MOST and all other kinds of buses. The reason for this is safety, bandwidth and that the delay jitter on a highly loaded can bus can be relatively unpredictable for high frequency control requirements like suspension, traction and other engine related control.
Or there is always the chance of management overriding building a separate system due to higher costs. The gains in safety did not justify the costs to them.
Don't contribute to malice what could be explained by stupidity. Don't contribute to stupidity what could be explained by greed.
Add to that the fact that some cars, like a Mercedes C-Class I rented recently, allow you to change the 'agility' setting from the entertainment screen (changing throttle response, steering and suspension).
There is a common bus, and there are reasons for it existing, but the fault is with an internet-connected module being able to break out of its role. Fixing that is the traditional game of whac-a-mole that we have in IT every day, at least until a secure-by-design Bus 2 comes along.
> There is no money in exploiting these bugs and even so-called script kiddies will probably not want to risk killing anyone.
I'm sure plenty of international "agencies" would pay very good money to be able to exploit these bugs. Gotta take out somebody driving a GM car? No sweat!
There's such an obvious way to make money on them I'm surprised it isn't happening yet - if you have a zero-day for a car, just make a deal with your lawyer friend, that you'll crash some poor schmuck's car and your friend will help the victim sue car manufacturer for $shitton, which you'll split between the two of you.
There may be no money in exploiting these bugs, but it's bugs like these that make a police state even closer to possible... if these bugs aren't found and squashed, they can and will be exploited by anyone who decides they need to coerce and control whatever they need to. One more tool for to be used against... whoever.
If this kind of exploit could be exploited en masse it could wreak huge economic havoc in addition to the life safety issues. Even if the attackers were warm and fuzzy types and they only took control of cars that were stationary. Forgetting about the safety problems for a moment it's kind of amusing to imagine thousands of logo-turtle-cars ambling around parking lots, clogging up traffic, making unprotected left-turns, etc.
