The reason you hear about security flaws in newer cars with OTA updates is because research on unpatchable cars is regularly silenced. Multiple friends of mine who thought it would be fun to look into bluetooth security in cars have had their work shut down by law enforcement and teams of lawyers, and told to back off.
I'd estimate that at least 90% of cars on the road without OTA updates are vulnerable to some sort of Bluetooth based attack that will never get fixed. Your "write enable" trick does more harm than good in these scenarios.
Steering wheels made of cardboard would be easier to manufacture, yet they'd fail safety inspection.
If car makers are actually hooking the bluetooth chip up to anything except the sound system, that's the problem. Although, assuming a class 2 device, it only has a 10 meter range. If an attacker is that close and wants to shut down your car, they can use a nail strip.
The real problem here is hooking up WWAN to control software.
These connections could be physically 'one-way' but in practice most modules are simply wired in parallel on a CAN bus and something like the radio would be set up to send data to the car's CAN bus (for diagnostic purposes at least).
The stereo is way too tightly coupled with the rest of the vehicle.
Not to mention that updates can obviously brick things. Imagine waking up one day and finding out that your car is bricked due to some update.
But car owners are not given a choice, and most systems are then gradually engineered to depend on online access to function.
The conspiracy theorists might say "so they can slowly degrade the performance, in the name of environmental protection"...
I bought a Honda once that was never brought in for a service recall and thus had an issue I had to pay the dealer to fix because it was outside of the recall window.
Tesla was able to push an OTA update to the Model 3 to improve performance after a CR article criticizing it's braking distance.
I think OTA or remote updates should be possible, and I think it should be something the owner of the vehicle has control over.
https://mall.industry.siemens.com/mall/en/us/Catalog/Product...
The more secure means would be to require the car be taken to a dealership -- but that's costly to the auto maker (they have to pay the dealers for updates they apply), and is deemed an inconvenience to the customer. They worry about the friction on the customer, and the cost.
With OTA updates, much of the security relies on using signed images. The SoCs in IVI systems are fused with the auto maker's key.
Unfortunately, it's somewhat unfair to always blame the non-engineering folks. Many times is other engineering domains that run counter to good security. In my experience, cost or schedule are the leading factors but sometimes engineers want to push for certain features that are not compatible with good safety or security practices.
I kept pleading that we don't have the marketing that Tesla has, our customers don't want to think about updates. Not to mention OTA costs money. Tesla can do it because they are sinking money and only have a few hundred thousand cars. My company sells millions of cars per year, OTA is significantly more expensive.
I'm not saying my company does OTA often, but the word Tesla cones up more often than it should.
I've done several OTAs on a Tesla. Most were about 1 month apart, and my longest update took 28 minutes. The average is closer to 15.
> Tesla can do it because they are sinking money and only have a few hundred thousand cars.
I won't get into whether they are sinking money, but they have about 1.6 million cars.
How does it work? Is it automatic during the night when the car is parked and you're asleep (that would be ideal) or does it updates when you start the car and would be ready to go (that would be a nightmare)? Maybe something in between.
When an update is triggered (manually or on a timer) you get a 2-minute countdown to restart and then it will install.
Interesting. My Model X always estimates 25 but it's usually closer to an hour.
Also make sure I can use my older thumbdrives to "downgrade" to a previous version.
That would be perfect. Thanks.
The thing is, thumb drives cost money, and mailing things cost money. Mass hack attacks rely on not costing the attacker any money.
That is the problem and that is the reason why every OEM will support OTA in the near future.
I honestly don't know what I'm going to do in the future, there's no chance I'm ever going to buy a modern "car", it's going to get tougher and tougher to keep a real vehicle running after enough decades have passed. Of course a non-modern car is infinitely easier for the average individual person to maintain and keep running so I'll be able to keep going for a long time.
For the same reason you never get malware USB sticks in the mail to stick into your computer. It costs money.
I'd be curious on the HN perspective. Are we less willing to accept this from software because it's taken as a given that when "it's just software" changes are easy? Does it imply that the software process (particularly requirements and testing) are not as robust as with hardware processes, leading to more frequent updates? Does it imply we are overly reliant on software to mitigate hardware issues because "it's easier"? (I'm thinking, in part, of the 737-Max issue for the last one).
Unfortunately, "the lawsuits get filed" is comfortably beyond the planning horizon of any entity out there right now, even though we're talking about lawsuits with the reasonable chance of driving the affected companies right out of business.
An automobile is the last thing on Earth I want suddenly working differently on Tuesday than it did on Monday.
Actually, scratch that: a plane is the last thing. An automobile is the second to last (because I'm not an amputee with a prosthesis).
Tesla "we remote SSH'd into as many vehicles as we still could to patch up a crash/bootloop that existed because our on-board JSON handler couldn't handle a certain json blob coming from our backend" Tesla?
Tesla "we'll call you as soon as you connect anything to the onboard ethernet port to tell you to stop doing that" Tesla?
Tesla "it was demonstrably possible to 0-day your way to the Autopilot ECU" Tesla?
I'm sorry, my comment might come off as more hostile than I mean it to, but it seems you and I have radically different impressions of Tesla. Knowing their quality control process and build quality, I wouldn't even want to stick with the first version as released.
Although I do definitely agree with you on one thing. I think OTA is a very scary prospect for cars. And let me be clear: for any car manufacturer. From the type of software I've seen car manufacturers produce I'm not sure any of them should be capable of instantly updating their whole fleet.
Then again I also don't want touch screens in my car, so what do I know?
In any case, if it can't be built without GSM tracking, I won't be getting one.
Or maybe only the military version will have it.
I guess the military/police version will cost multiples of the civilian version too, if I were Musk I'd know I'd want to suck on that "virtually unlimited government budget" tit.
It's possible I could compromise on wi-fi or bluetooth, because those need to be paired to communicate. Hard no to cellular of any kind, if for no other reason than it means that the car's location is being continuously tracked and logged for all time by the carriers and national military.
I hate it for the fact alone that it enables location tracking via cellular connectivity as I assume that the SIM is connected all the time.
I'm willing to bet there are militaries and state intel agencies in the EU that have obtained brand new passenger cars that don't have transceivers in them. The module is also probably fairly easy to physically rip out, too, without disabling the whole vehicle, if creative methods with more finesse don't pan out.
Does nobody at all in governments see what an existential danger it is to a free society for anyone in that society to have access to a database containing the complete transportation logs of every single member of the society? I can't be the only person who sees this is an existential threat to a small-l liberal democracy; there are people alive in the EU today who suffered under the USSR and DDR.
I'd be worried even if it were a benevolent person with these logs; I'm positively terrified knowing it is the phone company and their pals in military intelligence.
Maybe. But does anybody in the governments think that the free society withering away is the danger to the government? Perhaps during the Cold War they thought so, but nowadays...
It's a legal requirement to have it. Sure, I can rip out the head-lights too, but then I am not allowed to use the car any longer on public roads. If emergency call is part of the cars registration I am probably not allowed to disable it without voiding the registration.
As well, no one does this. If you do it, you stand out like a sore thumb.
It's internal to the vehicle, so I doubt it would stand out visually. The ALPR stuff and mobile towers aren't (yet) integrated.
I can't do that for a GSM radio built into my car if my car has to be on to drive from A to B.
This was 15 years ago: https://en.wikipedia.org/wiki/Data_Retention_Directive
Sure, it eventually got struck down by the courts, but EU politicians still thought this was a terrific idea. And it's not like things have changed much since then.
(I was looking for my "smart" TV, I ended up disconnecting the wireless card from the TV. Thankfully the error message isn't as annoying as other models.)
There's no real standard for cellular antennas as there is for many other types of radios (as far as I know, not that I would / can find in some brief looking). Most stuff I'm familiar is 50ohm or 75ohm. E.g., wifi antennas are generally 50ohm. If you made me pick a resistor to put on there without being able to test anything first, I'd pick a 50ohm/5W. But you might burn your electronics up.
So your two main unknowns are the impedance and wattage.
Solving for wattage is probably best just done with Google. The power output should be fairly standardized. Assume the transmitter's going to go into its highest power mode when it realizes it can't find anyone to talk to and then leave yourself some headroom on top of that. On a very brief look, most sources put LTE at about a half a watt, but other techs at up to 3-4W. For the price of resistors and assuming these will end up mounted somewhere without great airflow, I'd probably just throw two 5W resistors at it.
Solving for impedance is going to be a bit more challenging. If you're lucky, an off-the-shelf antenna _may_ be marked with the frequency ranges and impedance. Otherwise, measuring impedance generally requires some more specialized tools. You could pick up something like the NanoVNA2 to do the measurements yourself (they're not the best, but likely close enough for what you're doing and cheap relative to the other options), or try getting in touch with your local ham radio group and ask if anyone has an antenna analyzer to analyze a cellular antenna (impedance is at a given frequency, so they need an analyzer that covers up to at least around the 1GHz range, which are less common than one for HF which is only covering up to a few dozen MHz) and could analyze an antenna for you.
Then just hop on Digikey/Mouser/etc, grab some resistors and a SMA or whatever other connector would plug in in place of the antenna and get to soldering.
Disclaimer: Amateur radio guy, not RF engineer. It's been years since I actually used any of this information in any significant way. This could all be entirely wrong.
There's the fundamental problem right there. Over the air software updates means malware can always be installed.
One day, security engineers may remember (or reinvent) critical technology from the 1970s. This was when, to write to the ROMs, there was a physical electrical switch called "write enable".
Now, if the car's embedded systems have a physical write-enable switch, then malware won't survive a reboot.
Next, have the system reboot every time the car is started.