Hacker News Reader

Comment by TeMPOraL | Hacker News Reader

> this exploit isn't to the autonomy or vehicle control system, it's to the infotainment system. It can command auxilliary systems like wipers and doors, and in theory it could do somewhat nefarious stuff like present incorrect data to the user or provide faked waypoints to the navigation system. But it can't actually drive the car.

Doesn't sound that reassuring, though. For a self-driving car it wouldn't matter, but as long as a human driver is in control, the infotainment system does affect motion of the car, by proxy of the driver. Could the infotainment system, or the wipers, make a driver crash their car? I find it highly likely. Imagine speeding down the highway - suddenly, your in-car speakers start blasting your ears with 80dB music, while the wipers start to dance and the car keeps spraying the cleaning fluid all over your windshield.

View on HN

Obviously security bugs are bad and need to be fixed. But the point is that the security architecture seems to have made the right choices here. It's the same defense in depth strategy that puts reverse proxies in front of our web applications, or runs a database server behind a managed protocol such that SQL commands can never come from the front end boxes.

Or, for a glib answer: if you need to stop the car safely, engage autopilot and unbuckle your seatbelt. The car will turn the hazards on and pull over on its own.

Does anyone know if the glib answer works? Does the steering column selector stalk go through the ui (and therefore is interceptable by the supposedly compromised interface) or is it directly connected to the 'backend' below?

Calling the critical ui interface the 'infotainment' system for a tesla is slightly misleading.

>Does the steering column selector stalk go through the ui (and therefore is interceptable by the supposedly compromised interface) or is it directly connected to the 'backend' below?

It is directly connected to the 'backend' below and doesn't go through the infotainment system/UI.

You can manually kick off a reboot of the infotainment system on a Tesla while you are waiting at a traffic light, and still drive like usual just fine if the light goes green a second after. The only non-functional stuff will be the visuals on the screen and anything infotainment related (like playing music). All driving aspects are preserved even with the infotainment system being broken/in the middle of a reboot.

Unbuckling your seatbelt at speed when your car suddenly acts strangely is a very bad idea.

“My car suddenly accelerated to 110 mph, I know, I’ll unbuckle my seat belt” doesn’t seem like a plausible human reaction to me.

Imagine said drone hovering in front of your windshield and igniting a dozen flashbulbs in short succession STASI-style. Apparently they are still available for about a dozen bucks per dozen. I remember having much fun with them in my youth. Single use, blinding white light, small 9-volt battery sufficient to light them up.

ZAP!!!

(Now playing: "I wear my sunglasses at night.")

Every car that has an infotainment system that could potentially be hacked in this way. I have a recent Chevy ICE that gets OTA software updates.

That only makes this vector more of a threat, not less.

Not to mention what happens if the seat and/or steering wheel starts to move while you are driving…

Yeah wipers are kind of a security feature, imagine if they stopped working while under heavy rain.

Reply on news.ycombinator.com