Hacker News Reader

Comment by ACS_Solver | Hacker News Reader

I've worked on autonomous driving / ADAS, and have read a few university lectures on related software engineering subjects. On one occasion, my presentation was followed by that of a military researcher whose job is basically to study new threats enabled by digital technology.

To my surprise, the military researcher wasn't particularly concerned about software vulnerabilities in cars and similar vectors. We discussed some specific instances of remote car software exploits. His point was, in essence, that all cars with advanced software can potentially be exploited, but that it's not a real threat because all such exploits require special knowledge, equipment and money. For someone looking to assassinate a specific individual, there are far cheaper and simpler methods that are also more reliable, including several methods that involve physically tampering with a car. For someone who wants to cause mass chaos, such as attacking many vehicles in an area, the researcher estimates it requires the capabilities of a state actor or at least a large organization, and they also have cheaper and simpler ways to plunge a city into chaos.

View on HN

> For someone looking to assassinate a specific individual, there are far cheaper and simpler methods that are also more reliable, including several methods that involve physically tampering with a car. For someone who wants to cause mass chaos…

Most of us tech people are good at imagining ways technology might be abused, but we’re not as good at thinking like actual criminals.

It’s a simile story with smart home gear: Tech people go to great lengths to imagine how their smart locks might be compromised by hackers who will break into their homes, but real burglars will just break a window and go around it. Tech people imagine how their wireless security cameras might be vulnerable to WiFi jamming, but criminals will just wear a face covering and park around the corner.

I’m sure high value targets have specialized vehicles where these systems are removed, replaced, or disconnected. For the rest of us, the biggest concern would be if a hack enabled vehicle theft, as that would be more likely to be abused than a movie-style assassination where someone locks up our brakes from a drone or something equally complicated.

> Most of us tech people are good at imagining ways technology might be abused, but we’re not as good at thinking like actual criminals.

I wouldn't limit it to tech people. I hear the same ideas from non-technical folks who are often even more adamant.

And you'd be shocked at how many people don't realize that home burglaries are primarily a daytime activity.

I'm not sure if the fact that most people can't think like a criminal makes me more or less comfortable. :)

Same for car thefts. People imagine it happens in the dead of night at their house and that they'll be around to hear their alarm, but chances are high it'll be in a carpark while you're at work and no-one will think twice about an alarm in a carpark.

As always, there's a relevant xkcd: https://xkcd.com/538/

It is trivial to secure windows with plastic foil, glass will literally become bullet proof.

Real problem is if attackers would activate ALL alarms in entire city, night after night. Or your "smart doors" would tip attackers that owner is away from home/

This seems to be a mild deterrent at best.

most doors can be kicked down fairly easily. A window with plastic foil is only as good as its framing.

I guess it depends on who is trying to break in and why.

I remember reading a reddit AMA from a former burglar and he said that these windows did stop him, because he would be looking to get in and out as quickly and inconspicuously as possible and these would slow him down enough that he would try elsewhere instead.

So, for a random opportunistic burglar, they may work quite well, but for somebody determined or someone with more time (eg if you live in a secluded area and they know you're away for long enough), there's always a way in. I've watched enough lockpicking videos to know its not that hard and enough defcon talks to know that lockpicking is rarely necessary. If someone determined wants to get into your home, they will.

Exactly - it’s the old joke about not having to run faster than a bear in the woods - just faster than the slowest membe of your party :)

Deviant Ollam has some great talks on physical pentesting and simple, affordable solutions to common attacks. You can find them on YouTube.

Even the walls of most houses are fairly easy to get through.

> It is trivial to secure windows with plastic foil, glass will literally become bullet proof.

Here's some $50k windows that Nordstrom in Seattle was using that used that film. The windows couldn't stand up to Antifa with hammers, which makes me question the bulletproofness claim. It might not be the same exact stuff that you're claiming, but I'm guessing it is due to the description ("due to their thickness and a protective film that internally self-adheres after strikes or damage"), and that this has happened numerous times to them in the last year and I'm sure they're tired of replacing them and went for the best, strongest windows they could. $50k-70k EACH seems quite expensive for a single display window.

https://www.seattletimes.com/seattle-news/crime/downtown-nor...

Having worked on those very windows. They are also expensive because of other films and treatments to that glass that filter certain light that damages the items displayed behind it. Also they are just really big pieces of thick glass.

> I've worked on autonomous driving / ADAS, and have read a few university lectures on related software engineering subjects.

For clarity: this exploit isn't to the autonomy or vehicle control system, it's to the infotainment system. It can command auxilliary systems like wipers and doors, and in theory it could do somewhat nefarious stuff like present incorrect data to the user or provide faked waypoints to the navigation system. But it can't actually drive the car.

Really the security model here is fairly reasonable: car control over the motion and autonomy systems is handled by distinct hardware that talks only to one system over a specified protocol, with audited capabilities. And that system then runs the bluetooth and wifi and USB and user interface where the attack surfaces lie.

> this exploit isn't to the autonomy or vehicle control system, it's to the infotainment system. It can command auxilliary systems like wipers and doors, and in theory it could do somewhat nefarious stuff like present incorrect data to the user or provide faked waypoints to the navigation system. But it can't actually drive the car.

Doesn't sound that reassuring, though. For a self-driving car it wouldn't matter, but as long as a human driver is in control, the infotainment system does affect motion of the car, by proxy of the driver. Could the infotainment system, or the wipers, make a driver crash their car? I find it highly likely. Imagine speeding down the highway - suddenly, your in-car speakers start blasting your ears with 80dB music, while the wipers start to dance and the car keeps spraying the cleaning fluid all over your windshield.

Obviously security bugs are bad and need to be fixed. But the point is that the security architecture seems to have made the right choices here. It's the same defense in depth strategy that puts reverse proxies in front of our web applications, or runs a database server behind a managed protocol such that SQL commands can never come from the front end boxes.

Or, for a glib answer: if you need to stop the car safely, engage autopilot and unbuckle your seatbelt. The car will turn the hazards on and pull over on its own.

Does anyone know if the glib answer works? Does the steering column selector stalk go through the ui (and therefore is interceptable by the supposedly compromised interface) or is it directly connected to the 'backend' below?

Calling the critical ui interface the 'infotainment' system for a tesla is slightly misleading.

>Does the steering column selector stalk go through the ui (and therefore is interceptable by the supposedly compromised interface) or is it directly connected to the 'backend' below?

It is directly connected to the 'backend' below and doesn't go through the infotainment system/UI.

You can manually kick off a reboot of the infotainment system on a Tesla while you are waiting at a traffic light, and still drive like usual just fine if the light goes green a second after. The only non-functional stuff will be the visuals on the screen and anything infotainment related (like playing music). All driving aspects are preserved even with the infotainment system being broken/in the middle of a reboot.

Unbuckling your seatbelt at speed when your car suddenly acts strangely is a very bad idea.

“My car suddenly accelerated to 110 mph, I know, I’ll unbuckle my seat belt” doesn’t seem like a plausible human reaction to me.

Imagine said drone hovering in front of your windshield and igniting a dozen flashbulbs in short succession STASI-style. Apparently they are still available for about a dozen bucks per dozen. I remember having much fun with them in my youth. Single use, blinding white light, small 9-volt battery sufficient to light them up.

ZAP!!!

(Now playing: "I wear my sunglasses at night.")

Every car that has an infotainment system that could potentially be hacked in this way. I have a recent Chevy ICE that gets OTA software updates.

That only makes this vector more of a threat, not less.

Not to mention what happens if the seat and/or steering wheel starts to move while you are driving…

Yeah wipers are kind of a security feature, imagine if they stopped working while under heavy rain.

> But it can't actually drive the car.

Hopefully. Remember this vulnerability:

https://www.csoonline.com/article/2951746/hackers-remotely-t...

The initial intrusion was through the infotainment system but from there they moved to the more critical systems.

Exactly! Because in the Jeep case there was an architectural failure where the attack surface (the radio controller) was connected directly to the vehicle control system via a CAN bus, speaking bare unauthenticated protocols that were designed before the idea of internet-accessible cars was conceived. So once your initial attack face was compromised, the game was up.

This is the writeup if you want details, certainly I'm no expert on this particular hack: http://illmatics.com/Remote%20Car%20Hacking.pdf

What I'm saying is that Tesla seems to have learned from that experience and gone with a very different architecture where vehicle commands simply aren't accessible to the public-facing computer, from which motor/brake/steering control systems only get general direction (e.g. waypoints).

That's not saying it can't have a hole. But they don't seem to have made the kind of messup that would permit an attack like the Jeep hack.

> What I'm saying is that Tesla seems to have learned from that experience

Maybe. From a few decades in the industry in and around security, I have no faith in assuming that a serious vulnerability triggers any kind of change in the culture that led to it.

Remember Cisco and curl? https://news.ycombinator.com/item?id=19507225

> Tesla seems to have learned from that experience and gone with a very different architecture

Have circuit diagrams?

"state actor or at least a large organization, and they also have cheaper and simpler ways to plunge a city into chaos."

I'm not sure that's true. If I were China or the US, I would totally be interested in an exploit that would allow me to hack even a single model across the entire country and set the accelerator to be unconditionally floored and the car no longer able to turn off. Heck, that second one is even optional, given how many people are going to panic. Getting multiple models would be an even bigger bonus.

As others in the thread point out, we have publicly-known instances of companies that collect vulnerabilities. It's hardly a stretch to imagine that state actors already have the vulnerabilities, or even already have this capability essentially turnkey for whenever they need it. I mean, fund a decent hacker group of ~10 people for a year and they could probably build "the button to crash every Tesla, Ford truck between 2018 and 2020, and all Volvos after 2015 on the road in the US"... our impression of how hard security work is is colored by civilian researchers who are incredibly poorly funded. How many of our reports of deeply broken things come from people working in their spare time? I wouldn't underestimate what someone systematically collecting vulnerabilities could do with not much funding, relatively speaking.

The problem is, it's not even that you can turn a whole city into chaos... you can turn a whole country into chaos for cheap enough that it's worth adding to your portfolio.

In my opinion, the only reason to be unworried about that is precisely that there are so many other things that can be done that this somehow doesn't even rate as "interesting" and that is far from good news!

Some may find 'unconditionally floored' unrealistic, but hackers have already been able to activate the parallel parking feature while a car is travelling forwards - jerking the steering wheel rapidly to the side.

If the hacker could detect speed and make the cars swerve when they've been at highway speed for X seconds, it would be pretty horrific.

I'm sure you're right and it is being added to a portfolio somewhere - it's also a valid point that for a state level actor, there are some inexpensive and effective ways to cause mass chaos that they've already got.

For instance. the Aquaducts that feed water to the city of LA go through some deserts north of there that are remote - and the giant pipes are exposed. There are no guards, nothing.

For a state level actor, a small explosive charge on one of those is probably trivial to do and would lock up LA in fear and panic for a long time - and essentially untraceable. Every major metropolis has some equivalent to this (contamination in a specific water supply, or damage to a specific bridge).

Being able to do similar things to vehicles of different types is also interesting, but the space is rapidly changing, and exploits would lose 'potency' rapidly compared to that small block of C4 and knowing someone who would place it for you. So more an R&D type interest than a practical operational capability one.

It's also easy for us to look at the trajectory, know the tech, and say 'this will change the world and we need to be prepared' - but most militaries and intelligence agencies tend to focus on what they already have experience with, or what happened last time. The old quote 'Generals always fight the last war' is very applicable. Part of the reason why is because until it has happened, you don't have any real data - just endless speculative paths, all of which are too divergent from each other to prepare for all at once, and too theoretical to justify funding because the projected costs of it happening are too divergent.

You saw it with COVID - we suspected something like this would happen soonish, we'd even had some scares recently like H1N1/swine flu - but even if you'd asked the most prepper types of us if they'd be willing to spend 100 billion to stop what happened - they'd go 'yeah right, that's not going to happen', or 'that would be a waste of money'

Now, I'm sure you'd get 75% or more of the popular vote on such a measure nation wide and everyone would consider it dirt cheap. Even if the odds of a repeat surprise event are quite low now.

"For instance. the Aquaducts that feed water to the city of LA go through some deserts north of there that are remote - and the giant pipes are exposed. There are no guards, nothing."

Which is still a body on the ground in one place. These hacks can go country-wide pretty easily. It still seems like something that would be worth digging into because that digital scale can't be replicated by any physical action.

Plus attack-in-depth is a thing. If you can cheaply add "mess up all civilian automotives", you might want to do it, even if you are also blowing up aqueducts and such.

War sucks.

100% agreed on all points. The cyberwar (hate the term, but it’s what’s used) equivalent of chemical warfare or a nuke is going to be..... incredibly nasty.

> For a state level actor, a small explosive charge on one of those is probably trivial to do

Remember Oklahoma city bombing. It's trivial to do for a couple guys, never mind anyone more organized.

For sure - what I was referring to is a state level actor can (and almost certainly does) afford to have thousands of those 'couple guys' already identified and in an action plan somewhere in their top secret list of dirty tricks, against pretty much anyone they think likely (or even not likely) to want that kind of ability against some day.

Someone COULD go to the store, grab a hammer, and smash my computer. It's a different type of situation however when someone has figured out what model of hammer they would want, from which store (and if it is in stock or not), how they would pay for it, and who they would call to do all these things in a way that I couldn't figure out who ordered or paid for it, to smash my particular workstation at my home on a specific desk tomorrow at 6am - if they wanted to.

It's important to keep in mind capabilities, inclinations, and consequences - when that person with that plan is playing against me in competitive gaming the next day, I need that workstation to win, and I just bet them $10k I could beat them in front of all of my friends.

Thankfully most of us don't have to deal with this in our daily lives, but we can still be collateral damage when someone else is playing these kinds of games. And nation states do on the regular.

This sounds like an extremely naive and optimistic outlook. Large scale command and control situations are getting increasingly close to reality. Anyone who has followed US foreign policy and the like won’t be too surprised that this guy worked for the military (which is sad, really).

That's not the US military by the way - despite persistent rumors to the contrary, other countries do exist.

I also find the outlook a bit optimistic admittedly, but there are definitely plenty of better targets than cars for a sophisticated actor. Car software is very different from model to model, and there's a large variety of models on the road - even if you can cause all cars of model X in an area to accelerate to dangerous speeds (something far beyond the capability of current exploits), that will only affect a small proportion of all cars in the area. It will undoubtedly cause chaos, but nothing on the scale you can get by attacking some weaker systems.

Even a coordinated attack against traffic lights is easier to pull off and has no less potential damage.

But it only takes one car (or truck) to cause chaos on a freeway.

As to versions, you may be familiar with Cellebrite? Their stock in trade is having a huge database of exploits for every popular phone. And cars frequently have common software and computing components. It's just a matter of time before script kiddies can pop an unpatched car -- as soon as their is an external wifi / 3g connection. At the moment most only have Bluetooth to the stereo.

I'm curious as to what weaker systems they were thinking about. Obviously the OT at various plants, but that can be air gapped. Most traffic light systems have in built low level safeguards to prevent conflicting states, and the high level system is centrally managed and patched. Attacking requires a multi-stage attack, maintaining access requires continual maintenance, so it just doesn't have the impact an unpatchable vuln in embedded devices does.

> But it only takes one car (or truck) to cause chaos on a freeway.

And that's back to the original point, if you are looking for such small scale problems, make a spike strip and deploy it on the highway. Same scale of destruction as taking one car over, orders of magnitude less skill and money required.

Cars have standard components, but even for cars that don't take digital security seriously (Tesla has that reputation), no driving functions should be on the same network as the external 3G/4G. Yeah you have the infotainment or door opener there, but any ECU running an ASIL-qualified function should be on a separate network, and treat anything connected to the external world as untrusted. That was definitely one of the core architecture assumptions in all car software I've seen. The infotainment system is considered to be compromised and possibly sending malicious data. All the important communication happens on a different network, where internal signing and authentication mechanisms are also used.

And at that level, the internals are too different for the same exploit to work everywhere. What you need to send on the network to make the car brake, or what data format represents the gearbox position, those are different.

I think the major overlooked point is that the modern digital world provides a means for people to commit crimes they otherwise would not have done, simply because they can and because they feel there is low risk of getting caught.

A spike strip, you have to be in the area. A remote attack, you don't have to particularly care about any specific area enough to physically travel to it.. someone can cause chaos simply because they are bored.

And immediately after, they can go do something else.

Tech vulnerabilities aren't yet accessible enough to these types of people, but soon enough they will be and it is not like security is in a temporary poor state. A lot of these systems will remain unchanged for a long time because they are part of an already working business model

Police are quite practiced in finding armed robbers and other people who might use a spike strip (which is pretty tricky to deploy IRL if you want to hit a specific car). But organised crime car theft (with access to key cutting/duplication, remote unlock repeaters, engine immobilizer bypass codes, etc) is a significant problem. I don't see any reason why OCGs wouldn't be enthusiastic users of hacks, the same way that card skimmer gangs operate.

> no less potential damage.

A centralised and timed attack against a tech stack that has significant dominance in the market in the future has one of the biggest potential ceilings out there. Cars are effectively kinetic weapons and if you could say, get 30% of vehicles to turn into on coming traffic on a Friday afternoon the outcome could be seriously ugly.

Weird... Spying on high profile individuals through GPS position and car microphone is probably worth more than assassinations and traffic jams.

I guess targeting their phones works better. Phones can provide a lot more data, and with iOS and Android you have just two platforms that cover the vast majority of phones. If you're a state-level actor, you have the NSA, GHCQ or equivalent with full-time teams working on compromising both platforms, so probably have quite a few options available.

Cars are sometimes easier to get data out of though, and if the person has linked their phone to their car then it can contain much of the same information. https://theintercept.com/2021/05/03/car-surveillance-berla-m...

> car microphone

What?

There's probably not a single new car that doesn't come with at least one microphone in the cabin. You need at least one for Bluetooth handsfree and for voice commands.

Cars sold in Europe since 2018 need to have a system to automatically call emergency services in the event of an accident. So, there's that microphone.

No wonder EU cars are so expensive.

All new cars sold in the United States of America must have a backup camera.

https://eu.usatoday.com/story/money/cars/2014/03/31/nhtsa-re...

European airbag regulations also allow for smaller airbags that explode with less force since US regulations require automotive manufacturers to assume an unbelted driver. ECE specifications are based on people wearing seatbelts.

Yes - love one size fits all regulations like this. It’s so rediculous seeing Mazda Miata’s with mandatory backup cameras :p

That's great. But mandating an embedded cell phone? Hopefully it is a fully independent system that only turns on after a collision, but it still has a spooky big brother aspect to it.

I don't know what your point is about airbags. Some sort of weird defence of European safety standards?

I’m shocked insurance companies aren’t demanding access to telemetry in order to get decent rates.

The airbag thing was a dig that Americans are too stupid to wear seatbelts :p

I looked at the insurance plans that give a safe driving / low km bonus, they use a device that plugs I to the car diagnostics port. But it's actually a sham -- you get a discount on the next year, not the past year, so it's just a trick to get you to renew.

I thought the seatbelt thing was a dig at Americans, who I never mentioned, and blatant whataboutism, but whatever.

For the countries with the highest death rates (~80/million), which are poorer former Eastern Block countries, they predominantly occur in urban areas. Making cars 0.1% safer for Germans/French/Swedish, who have >50% of fatalities in the countryside, makes cars more expensive for the whole block, delaying the changeover to cars with massive safety features, like monocoque passenger safety cells, ABS/ESC and airbags.

Incidentally,10% of US fatalities occured where no seat belt was worn.[1] In the UK this was 30%, but with a quarter of the fatality rate. All you can say is that people without seat belts on die.

[1] https://www.iihs.org/topics/fatality-statistics/detail/urban...

I have to admit I don't know if you're sarcastic or not, but it certainly exists in Europe. You can have reduced rates (by quite a bit) if you install some special hardware to record how you drive.

I had no idea, I don't use any of those features. I just checked my car and it does have phone features. I'm honestly shocked. I want to get rid of the microphone.

Any car with a bluetooth setup has a microphone. That's about any car since 2005ish?

The newest car that I've had without Bluetooth hands-free was actually a 2005 BMW. But it was basically the last year facelift model based on a 90s design. I think the completely new model came out in 2006 and had Bluetooth handsfree.

It's probably way later than 2005 when pretty much every car included Bluetooth handsfree.

We have a 2011 Toyota without Bluetooth, for what it’s worth. Base trim models can skip features which are otherwise common.

Lots of cars now have microphones in them for voice commands and so on, and not just luxury vehicles. Is that what you were asking?

In general the likelihood an exploit will be exploited can be thought of as a relationship between it's ease and payoff. Just because something is exploitable doesn't mean it's likely to be exploited unless it's easy to do so or there is a good reason to put in the effort required.

I guess if it was possible to remotely take over or disable the brakes on an entire fleet of self-driving cars then we could have problems. Likewise, if it was possible for school kids to "prank" their teacher by downloading some exploit software from the internet we could have problems. But in both cases you would hope security would at least be good enough that these types of events could not happen.

Remember someone with a bit of knowledge could easily tamper with your mechanical car today if they wanted to. Digital tech provides new attack vectors for someone seeking to do damage, but if designed correctly any new digital attack vector shouldn't present any greater risk than the existing mechanical attack vectors.

It's actually quite difficult to tamper with a car. You have to find the car in an unattended and out of sight place. That opportunity isn't available for high value targets, and doesn't scale to 100k cars.

In contrast, there are tens to hundreds of thousands of popular car models sold every year. Eg 55k Ford Focus sold in the UK in 2019. https://www.statista.com/statistics/463148/ford-focus-annual...

Just a DOS attack would require every car to be taken by tow truck to the garage or visited by a tech to patch it, and the resulting reputational damage would be huge. I'm sure Ford/Toyota/etc would pay a ransom to avoid that.

Everyone is focusing on the assassination angle but I stopped when it said that it could unlock the doors and trunks. Sure we exist in a world where people break into cars a lot, but generally it's at least somewhat destructive. No-one is 'picking' locks (because picking increases the time they are 'on target' and could get caught), they are smashing windows or are forcing locks with leverage. These actions look to an observer like what they are.

In this new scenario, someone could have a remote rootkit loaded on their phone. Trigger it from across a parking lot or approaching the target and then simply walk up to the car and pull anything valuable out of it. They would look like the owner to most observers.

In some parts of Europe, digital attacks on proximity unlock systems are becoming a common way to break into cars. Especially for a system based on Bluetooth, it's difficult to defend against an amplification attack.

The key here is that one person can make a tool and sell it to many common criminals, and even if the auto manufacturer notices that they are doing this, there isn't an easy way to patch the issue. For something like a Tesla, it's difficult to imagine a software vulnerability that cannot be fixed with an OTA update, but for a manufacturer that doesn't have OTA update capabilities, I could definitely see cyber hacking tools being distributed and used in a similar way.

Right, but direct physical access is a bit different from "can mess with your car from 100 m away". A security camera will effectively deter one but not the other.

This kind of assassination has a potential if you want to make it look like an accident. Especially when poisoning failed Russians so many times.

Yes, but isn't it more about the message? "We can get anyone, anywhere, and get away with it?" If nobody knows it was them, does it then work for making an example out of someone?

Can't you also make it look like an accident by physically tampering with the car?

Yes, though your assets may end up on camera tampering with the car and their physical modifications may be found. If you can do it from a drone or from the internet all digital evidence may be destroyed in the fire if you did not remotely wipe it already.

One thing that might change this is if V2V, where cars communicate to each other on the road, becomes more relevant. Then you'd only need to compromise one particular make and/or model of a car to start sending false information to a whole bunch of cars.

V2V and V2X serve as additional ways for a car to get data, to complement the car's own sensors. They're not command protocols. V2V shouldn't make your car do anything dangerous, as all the usual software logic still applies. E.g. your car may get info over V2V that an ambulance with sirens is coming up behind you, so your car slows down to make room, but that's an internal decision of the car, it's not a "slow down" command over V2V channels.

In that vein, rogue traffic signs or other objects designed to confuse a car's inputs are probably more of a threat.

False V2V inputs could cause a car satnav to divert to an alternative route. If the data fusion is done wrong, or if external visibility is very poor, it could rely on single source data (V2V without confirmation from an on-board sensor) and swerve or engage emergency braking. If an attacker has access to disable/deceive, e.g., the microwave sensors (via software attacks, or by jamming) then it becomes quite possible.

There is lots of research in the topic though, so I'm fairly confident most V2V systems will be robust, but it depends on regulation. If they froze capability at a specific 'approved' version then attacks could become serious. Especially for systems using lots of ML, at higher levels of autonomy. At the moment it seems like Looney Tunes attacks (draw a picture of a tunnel with the word TUNNEL on it, paint the road markers towards it) work amazingly well.

> but that it's not a real threat because all such exploits require special knowledge, equipment and money

In other words they (that military research lab) have the resources and you don't. Sounds like the ideal vulnerability from their perspective.

In any case, that overstates the difficulty. Plenty of examples of low budget research teams finding remote vulnerabilities in newer cars.

Also, remember that a vulnerability is laborious to find, once. After it's out every script kiddie can do it.

> physically tampering with a car

That doesn't scale. If you're after one single specific person it's done, but if you want widespread ability to cause mayhem, you'll take the remote vulnerability.

Oh wow.. So Fast & Furious series got it right?

https://www.youtube.com/watch?v=19zeMqh-zqY

Looks pretty funny that they have like a 2001 Volkswagen Passat, seemingly not even equipped with parking sensors, shift itself to D and drive off.

Did they seriously dub in a lion's roar when the Dodge Ram came out? Lol

> there are far cheaper and simpler methods that are also more reliable

Reminds me of crypto-nerd reality:

"His laptop's encrypted. Drug him and hit him with this $5 wrench until he tells us the password." https://xkcd.com/538/

This is a descendent of a 1990 Usenet post. "Problem #2: is that white noise, or is it a one-time pad ? I dunno. Awfully hard to prove, isn't it ? Unless, of course, I left my radioactive source and oscillators lying around. Big deal, you zap me for a misdemeanor. You still don't get The Master Plan, unless you resort to the rubber-hose technique of cryptanalysis. (in which a rubber hose is applied forcefully and frequently to the soles of the feet until the key to the cryptosystem is discovered, a process that can take a surprisingly short time and is quite computationally inexpensive)"

source: https://groups.google.com/g/sci.crypt/c/W1VUQlC99LM/m/ANkI5z... via wikipedia.

The good old rubber hose cryptanalysis.

Yes, I can totally see how a large organization can achieve its objectives in much simpler way - or without actually killing anyone.

But on the other hand, this was done only by two dudes (even if they did not yield drive control).

I find this attitude VERY disturbing. Cars are target comparable to industrial infrastructure, but with weak security. USA has many enemies, there is constantly some sort of hacking scandal.

Next time there is a mass scale hack: a few dozen people die, grid lock for couple of days, hardware worth of billions bricked.

And US government can bomb any country it marks as an attacker....

Good thing if that happened there would be outrage for a week and nothing actually done about it.

Think of the chaos if people didn’t feel safe driving their cars. You don’t need full control to achieve that.

That was a "move along citizen" move, the US already uses these techniques to assasinate targets.

Reply on news.ycombinator.com