News for hackers. Stuff that matters.

A comment on The Big Tesla Hack: A hacker gained control over the entire fleet. Parent comment

Re:The Big Tesla Hack: A hacker gained control over the enti... by jxurueydyys on Sunday August 30, 2020 @09:25PM (#24327612)
The difference is that the pc is exposed to everything it interacts with including the internet while the car would only be interacting with shops that were meeting their certification obligations. Tying updates to physical locations also reduces the severity of a successful bad actor since most people in a city don't all go to the same auto-shop. A problem like a nation-wide cyber attack on vehicles is only possible if we allow personal vehicles to support the attack vector.
[ Parent | on HN ]
Re:The Big Tesla Hack: A hacker gained control over the enti... by throwaway0a5e on Sunday August 30, 2020 @09:32PM (#24327641)
I don't see how certification solves anything that just not doing OTA updates doesn't also solve.
[ Parent | on HN ]
Re:The Big Tesla Hack: A hacker gained control over the enti... by jxurueydyys on Sunday August 30, 2020 @09:36PM (#24327661)
It reduces the attack surface to places that have been verified to be following security obligations. Otherwise a physical attack becomes much easier because you just need to work at an auto-shop that doesn't pay much attention to you. The same sort of attack is still possible with certs but it's more difficult because it would require compromising both the shop and the person who vets their practices.
[ Parent | on HN ]
Re:The Big Tesla Hack: A hacker gained control over the enti... by est31 on Sunday August 30, 2020 @09:50PM (#24327770)
People still want regular map updates, live updating traffic information, and play back stuff from their phone on the in-car entertainment system. All this exposes cars to data communication outside of the car repair shop. Yes, the entertainment system is different from the system that runs the car, but there is some level of communication between the two.
[ Parent | on HN ]
Re:The Big Tesla Hack: A hacker gained control over the enti... by Silhouette on Sunday August 30, 2020 @10:55PM (#24328113)
Yes, the entertainment system is different from the system that runs the car, but there is some level of communication between the two.

I think you've just identified the root cause of at least one set of problems. The essential control systems in a vehicle should ideally be separated from other vehicle functions to prevent interference, whether accidental or deliberate, from compromising vehicle safety. The approach now being taken by manufacturers with their always-online, increasingly automated cars may be undermining that separation, without necessarily having adequate safeguards in place to ensure safety and reliability are maintained.

[ Parent | on HN ]
Re:The Big Tesla Hack: A hacker gained control over the enti... by tsimionescu on Sunday August 30, 2020 @10:53PM (#24328101)
There is some level of communication, but there really shouldn't be.
[ Parent | on HN ]
Re:The Big Tesla Hack: A hacker gained control over the enti... by Silhouette on Sunday August 30, 2020 @10:58PM (#24328128)
The problem is that total separation is difficult to achieve with the requirements being placed on these vehicles. Sure, whatever is playing your favourite music tracks over the speakers probably doesn't need to know anything about steering and acceleration. However, your self-driving software is going to have a tough time getting your car to a location it doesn't know exists because its onboard navigation maps predate the existence of that building, or planning a route that avoids an accident it doesn't know about because it has no real-time information about road closures.
[ Parent | on HN ]
Re:The Big Tesla Hack: A hacker gained control over the enti... by tsimionescu on Sunday August 30, 2020 @11:03PM (#24328147)
As others have pointed out, self driving software is inherently unsafe at this moment - we don't know how to make safe network-connected software yet.

Anyway, this is moot in most cars, as they don't have sold driving software anyway.

[ Parent | on HN ]
Re:The Big Tesla Hack: A hacker gained control over the enti... by Silhouette on Monday August 31, 2020 @07:33AM (#24330364)
If you read my comments elsewhere in this discussion, you'll see that I've been one of those people.

In this thread, I'm simply observing that there can't be a clear separation between control systems and information systems if we're going to achieve these kinds of autonomous functionality. We need a more nuanced solution.

[ Parent | on HN ]