News for hackers. Stuff that matters.

A comment on Reboot Your Dreamliner Every 248 Days to Avoid Integer Overflow (2015). Parent comment

Re:Reboot Your Dreamliner Every 248 Days to Avoid Integer Ov... by jccooper on Tuesday September 04, 2018 @02:08PM (#17911372)
Most modules have some feature or other that needs to communicate with infotainment or another module that needs to communicate with infotainment. Error reporting is the big one, but there's lots of little ones too. The brake module, for example, may be involved in tire pressure sensing, and also takes configuration for traction control and reports activation.

It's hard to find an appropriate segmentation for an air gap without sacrificing features, and most customers won't trade features for "security".

[ Parent | on HN ]
Re:Reboot Your Dreamliner Every 248 Days to Avoid Integer Ov... by rthomas6 on Tuesday September 04, 2018 @03:03PM (#17911828)
You are right of course. But still. Once you can talk over the CAN bus you can spoof pretty much anything, if I recall correctly. You could at least have some intermediary module on both buses that acts as a proxy. Then if someone hacks your radio they can't pretend to be the ECM.

Then again, this exact scenario actually happened and having an intermediary didn't help. https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-e...

[ Parent | on HN ]
Re:Reboot Your Dreamliner Every 248 Days to Avoid Integer Ov... by mrweasel on Tuesday September 04, 2018 @03:46PM (#17912194)
The infotainment system should only be allowed to read values from the modules related to the actual driving. Configuring things like traction control will just have to be done via a system separate from the infotainment system.

I understand that it a little wasteful to not use that big touch screen in the center console to do configuration of the driving experience, but there's no safe way to do so.

[ Parent | on HN ]
Re:Reboot Your Dreamliner Every 248 Days to Avoid Integer Ov... by plttn on Tuesday September 04, 2018 @05:01PM (#17912768)
But the gauge cluster screen is connected to the infotainment system.
[ Parent | on HN ]
Re:Reboot Your Dreamliner Every 248 Days to Avoid Integer Ov... by marcosdumay on Tuesday September 04, 2018 @05:25PM (#17912951)
An air gap may not be viable, but you can place a firewall there. There is no reason for everything to be on the same bus.
[ Parent | on HN ]
Re:Reboot Your Dreamliner Every 248 Days to Avoid Integer Ov... by pipelineist on Wednesday September 05, 2018 @07:18AM (#17916872)
> An air gap may not be viable, but you can place a firewall there.

No idea how it was one or two decades ago, but modern architectures certainly have one.

I can't remember the specifics, but the one I looked at was actually pretty beefy hardware-wise, it had three reasonably powerful cores, 1GB RAM, etc.

> There is no reason for everything to be on the same bus.

It isn't. They would run into bandwidth or (more likely) latency issues anyway.

[ Parent | on HN ]