News for hackers. Stuff that matters.

A comment on Black Hat USA 2015: The full story of how that Jeep was hacked. Parent comment

Re:Black Hat USA 2015: The full story of how that Jeep was h... by forgottenpass on Friday August 14, 2015 @12:00AM (#10058558)
Tesla takes their security pretty seriously. There were at DEF CON, both in the contest area and the front row of the talk where someone dumped their firmware. The presenter was overall pleased with their design. Expect to see something on 60 Minutes in the coming months.
[ Parent | on HN ]
Re:Black Hat USA 2015: The full story of how that Jeep was h... by Animats on Friday August 14, 2015 @03:01AM (#10058970)
If they allow over the air updates, even encrypted, there's a big potential risk. Exactly how are the crypto keys generated and protected? An attack on the download signing server, rather than the car, offers an entry point.
[ Parent | on HN ]
Re:Black Hat USA 2015: The full story of how that Jeep was h... by brohee on Friday August 14, 2015 @10:12AM (#10060174)
From what I've seen, in multiple industries (but not automotive), pretty much anyone serious about signing firmware holds the keys in a HSM.

When you factor the total impact of firmware signing on the product lifecycle, a HSM is a drop in a bucket...

[ Parent | on HN ]