News for hackers. Stuff that matters.
Re:The Big Tesla Hack: A hacker gained control over the enti... by iRomain on Sunday August 30, 2020 @10:10PM (#24327875)
I think the key here, and unfortunately most companies don't give a sh*t, is to allow the user to gain control over his device and/or take it offline if it pleases him. For example, a Tesla car should come with an option to disable any remote control features, or a way to control it over short distance only when it's offline (I don't know if its already the case, I don't have a tesla).
Re:The Big Tesla Hack: A hacker gained control over the enti... by angry_octet on Sunday August 30, 2020 @11:11PM (#24328181)
If you look at adversarial machine learning you'll see it is shaping up as a bit of an evolutionary battle. It is quite likely that a years-offline Telsa (or similar) could be deceived into a fatal collision.

We need safe updates with transparent documentation as to all the changes, with hardware enforced feature switches. Forcing them to go through an approval process doesn't sound bad until you've met regulators like the FAA -- or Apple.

Re:The Big Tesla Hack: A hacker gained control over the enti... by adrianN on Monday August 31, 2020 @12:55AM (#24328615)
You have to weigh the risks of manipulating cars one at a time because they don't have the latest updates with the risk of manipulating all cars at once because they can be remote controlled. A more expensive alternative to over the air updates is requiring regular updates done by a mechanic, e.g. when the vehicle is due for an inspection.
Re:The Big Tesla Hack: A hacker gained control over the enti... by angry_octet on Monday August 31, 2020 @04:43AM (#24329543)
I don't really think OTA updates is the problem, so much as the automatic application of the updates without owner awareness (or consent to possibly significant feature changes). Preventing OTA is not the same as preventing remote control -- vehicles WILL be networked, if only for collision avoidance. OTA could be very useful if a bad exploit becomes widely available -- like a protocol bug in the V2X network that lets you crash the V2X module. Many bugs are discovered after being in production for years.

If you allow users to approve and roll back updates then there is some ability to recover after bad updates. Of course, you don't want theives to be able to roll back to a vulnerable release, but you can require the master owner key & code for rollback.

Re:The Big Tesla Hack: A hacker gained control over the enti... by Silhouette on Sunday August 30, 2020 @10:31PM (#24327997)
I think the key here...is to allow the user to gain control over his device and/or take it offline if it pleases him.

I wonder how long it will be before we start to see legal or regulatory interventions in this area. Mandatory self-updating and phone-home functionality is rapidly infecting technologies we rely on every day, from our cars to our home computers to our TV sets.

This always-connected, always-updated approach inevitably introduces some risks. It often causes intrusions into privacy or brings changes after purchase that users of these technologies don't necessarily want.

Competition in these markets is evidently insufficient to provide alternatives for those who don't want anything to do with this modern culture. I don't believe that is limited to a small group of eccentric tinfoil-hat fans any more.

Hopefully it won't take some sort of widespread disaster to wake the politicians up to the dangers here, though given the past performance of the political class around the world when it comes to technology issues, I'm not particularly optimistic.

Re:The Big Tesla Hack: A hacker gained control over the enti... by CamperBob2 on Monday August 31, 2020 @12:12AM (#24328434)
Rest assured, the 'regulatory interference' will be in the direction of forbidding the user to gain control over his device and/or take it offline.

Consumers don't have a voice here, and (given the Democrats' record) I don't see that changing regardless of who wins the upcoming election.

Re:The Big Tesla Hack: A hacker gained control over the enti... by Silhouette on Monday August 31, 2020 @07:30AM (#24330347)
Fortunately, there is a world outside the US, and much of it is more enlightened. If other large markets impose limitations on this kind of technology or create a penalty regime for failures that makes it worthwhile for the manufacturers to invest in more reliable systems, that will probably benefit everyone indirectly, even users in the US if a US government of whatever colour sells them out.
Re:The Big Tesla Hack: A hacker gained control over the enti... by donmcronald on Monday August 31, 2020 @01:09AM (#24328678)
> I wonder how long it will be before we start to see legal or regulatory interventions in this area.

Not long IMO. It'll be sold as a safety measure, but the real purpose will be to limit competition. I think it's similar to "warranty void if removed" stickers, but I'm worried we're not going to get the same pragmatic legislation that makes those ignorable.

Re:The Big Tesla Hack: A hacker gained control over the enti... by judge2020 on Sunday August 30, 2020 @10:19PM (#24327927)
It's not possible without rooting your car and losing the warranty. This is legal as long as you don't touch the odometer.
Re:The Big Tesla Hack: A hacker gained control over the enti... by Reelin on Monday August 31, 2020 @12:29AM (#24328502)
> rooting your car

Something has gone terribly wrong with modern technology.