Luckily it is a very well-tested system, it was one the first commercial use cases for QuickCheck [1], but still...
One of the bugs that John Hughes found was an integer overflow that transformed a lowest-priority message into a highest-priority message. [1] https://www.cs.tufts.edu/~nr/cs257/archive/john-hughes/quviq...
On the Stanford Solar Car Project -- a mostly-undergrad student group -- we always built our cars with two physically separate CAN buses, one for nonessential features and one for the motor controller.
That way, we limited our surface area for catastrophic bugs: the only things connected to the safety-critical CAN bus were the motor controller itself and the throttle board.
This for a one-off experimental vehicle.
CAN is a very simple, unauthenticated bus. Any device can send a message that every other device on the bus will receive. Messages are typically just a few bytes long, binary encoded.
The idea of attaching an internet-connected infotainment computer to the same CAN bus as the brakes is absurd. Doing so on a production car, even more so.
--
The Ford story is disappointing but not totally new.
A few years ago, Jeep committed similar design malpractice, resulting in a bug where Jeeps could be crashed remotely. https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...
I'm surprised that regulators still allow these kinds of designs.
True, but in practice messages that are deemed important are secured at higher OSI levels, and the identity of important bus participants is cryptographically checked during vehicle startup.
> The idea of attaching an internet-connected infotainment computer to the same CAN bus as the brakes is absurd. Doing so on a production car, even more so.
Which is why all vehicle architectures I'm familiar with have a bunch of CAN (and other) buses. Maybe it used to be different, and I certainly know only a few bus architectures, but they make a honest attempt at securing the important bits at least.
Industry engineers may not get everything right, but they're not that stupid. Cut them some slack.
I understand software engineers pulling stunts like this, because there isn't actually a regulated engineering license, but I'd honestly have expected automotive engineers to be vehemently opposed to putting the stereo on the same system as the brakes.
This means more weight and more power required to operate the electrics and in turn means lower MPG, higher fuel consumption and a more expensive car to design and manufacture.
The net outcome is a less competitive car in a competitive market.
[1]: https://www.autozone.com/electrical-and-lighting/can-bus-hub...
I think customers might know how messed up their car is.
[0]https://wheels.blogs.nytimes.com/2011/06/23/aggravating-myfo...
So I suppose weight could be a factor, but space seems to be the big one.
The DOT should have standards for this stuff. Infotainment system shouldn't have control authority or share critical buses with the engine and braking/traction control system.
http://www.ordemengenheiros.pt/pt/a-ordem/colegios-e-especia...
[1] https://www.blackhat.com/docs/us-17/thursday/us-17-Nie-Free-... (page 19), https://blog.lookout.com/hacking-a-tesla
It's hard to find an appropriate segmentation for an air gap without sacrificing features, and most customers won't trade features for "security".
Then again, this exact scenario actually happened and having an intermediary didn't help. https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-e...
I understand that it a little wasteful to not use that big touch screen in the center console to do configuration of the driving experience, but there's no safe way to do so.
No idea how it was one or two decades ago, but modern architectures certainly have one.
I can't remember the specifics, but the one I looked at was actually pretty beefy hardware-wise, it had three reasonably powerful cores, 1GB RAM, etc.
> There is no reason for everything to be on the same bus.
It isn't. They would run into bandwidth or (more likely) latency issues anyway.
There are. IIRC BMW uses seven (anyway, several) different CAN buses, plus other bus systems for entertainment (MOST bus)
Not true.
The automotive bus architectures I know first hand (admittedly far from all of them of course) have multiple CAN buses, plus other bus technologies as well (MOST/LIN/Ethernet).
I don't think it would even be possible from a bandwidth/latency standpoint to push everything across a single CAN bus.
Critical (e.g. brakes, steering, engine control) important (AC, heat, dashboard) and then everything non-essential.
The people that design cars need to be software engineers but instead they're behaving like mechanical engineers.