1. A car is a necessity that cost a ton to replace. An internet-connected camera or TV isnt. They could just as easily not buy an Internet-enabled appliance.
2. These devices are being used as weapons when people leave them around insecure. Leaving loaded guns lying around is a bit closer but minus the lethality.
3. With cars, we have efforts on safety and security at user side, manufacturer side, and the law. There's no effort to buy secure IoT by these users, to do even minimum protections at manufacturing, or pass laws putting liability on users or manufacturers where it should be. Now, it's more like a car with defective parts that make it hit other cars. A city's worth are affected with nobody taking action but people are told armored cars are available for a fortune.
So, these comparisons to highly damaging thefts of legit goods on innocent people are nonsense. There's defective products damaging innocent people. Nobody with power to prevent or punish it legitimately is doing anything. Im happy that a vigilante is reducing risk to Internet hosts plus putti g cost on those responsible for that risk.
You used to have what was essentially airgapped and self contained.
But then feature x needed an ongoing net connection, and it happens to run on the same soc as feature y that talk to the can bus, and boom.
Neither of the teams responsible for the features considers that something can jump from x to y, almost like an illness jumps between species.
Damn it, the other day HN linked to an article on how VMs sharing hardware could talk to each other using the CPU cache.
That sounds similar to a paper I read ~20 years ago that described a way to move data from a high privilege process, bypassing mandatory access control (>= TCSEC B), using page faults as a covert channel.
> it happens to run on the same soc as feature y that talk to the can bus
I wonder how many people will have to die to teach car manufacturers the lesson that there shouldn't be any electrical connection at all from the internet to the breaks.
So then the question becomes: How are we going to educate engineers about this class of problems?
Feelings are irrelevant.
Some vigilantes hack that said "Turn the car off at 10mph or less" is a far better outcome than the attackers option of "Press the gas and turn the wheel left as hard as you can at 100mph".
Thank you. I am tired of these so-called arguments that start with "how would you feel if". If we're going by my feelings, you're all in deep trouble.