Comment by jve | Hacker News Reader

Comment by jve | Hacker News Reader

Parent Full thread

Source?

There is this ex-employee, telling some interesting stories. And regarding the downgrade... he was the one who did it for reasons he explains. I want to see if you are talking about different case or what.

> Question: There's the story online of that hacker who was pulling software images off through the door Ethernet port and found that his car's firmware was remotely downgraded after he uncovered and posted the first references to the P100 models.

> Answer: yup, i'm the guy that installed the older versions. this was a marketing mistake really. if i recall correctly, he ended up getting a marketing car or his car got tagged in the update system as a trusted car and he ended up getting pre-release stuff. this happened from time to time - sometimes marketing would sell off a car and the poo poo erp system wouldn't record the change. that car would then get prerelease and sometimes very broken firmware. i seem to recall another case where we just forgot to remove the prerelease materials from the official build, so all you had to do was look around.

https://forums.somethingawful.com/showthread.php?threadid=38...

Uh, that still doesn't paint Tesla in a good light, so this guy bought a car running special experimental firmware by mistake? What if there was a bug and he crashed?

then the firmware is downgraded again before anyone gets sued/fired or the hackers who hacked the manufacturer cover their tracks. duh.

one big reason why i'm not particularly thrilled at the prospect of one day owning a car that is actively managed/controllable by the manufacturer.

in the days of the audi 5000 sudden acceleration syndrome, they could take a production car and study it.

how would a third party/government agency trustlessly investigate "brake lose control" when the manufacturer has root and remote access on the vehicle?

> not particularly thrilled at the prospect of one day owning a car that is actively managed/controllable by the manufacturer

Ditto.

So many examples of companies shoving half-baked software updates down our throats... and worse... companies with half-baked security that are compromised with no consequences/little liability and effect the consumer.

An audit system? Presumably, regulators will require software and system and component behavior change logs.

Is this not already the case?

i'd love to see any computer system that can provide a crytographically tamper proof log that comes with cryptographic proofs that:

a) a specific set of source code was used to generate the logs... so cryptographic security from source text files through compilation to execution on the hardware.

b) that specific set of software was run on a specific machine at a specific time.

it's hard... but beyond that, pretty much all audit logs are just security theater anyhow. sometimes can be mitigated by sending them to multiple places, but they're still meaningless unless you have a proof of what exactly generated them.

I don’t think they need to be tamper proof, but I do think they need to be held criminally liable if they are tampered with.

Volkswagen tampered with regulated measurements and got away with it for a while. But it was discovered and they paid a huge price for it.

With that precedent, it should create incentive to deal with mistakes transparently.

It does also mean transportation authorities will need to create some amount of leeway for mistakes. But I think there has been plenty of that given to traditional auto manufacturers.

that sort of inches at my point. how exactly would this criminal liability work? it would be comprised of two classes of evidence:

1) unassured/untrusted digital evidence that can be fabricated to say anything, leaving no trace of its previous state. (unless digital forensics has advanced well beyond what i know to be possible)

2) personal testimony that can also be fabricated.

i suppose what's new here is that in a digital world, bits can be set however one likes with no trace of their previous state, where physical evidence left behind physical manifestations of itself.

imagine rootkits that seek not to steal or hide their existence, but rather exist to plant fabricated evidence or hide actual evidence. in today's untrusted computer systems, this is all possible, and terrifying.

If you thought Mirai was bad, just wait for the first "IoT" car worm that gets people killed. I hope it never happens, but if it does...

But you know eventually someone will do a big over the air firmware update and brick a couple of hundred cars. This is almost certain to happen eventually.

...by SIM jacking the legacy baseband models. This is all too prescient.

It’s weird, and almost a bit funny. For a brief moment.

The first smashing can be felt more than heard, a subsonic strike something like a vast drumhead being struck with a metre-wide mallet, but so quick, you barely even notice it until it’s over. The second one, however, isn’t far behind, and it’s a bit louder. That second thump gives away its location — whatever it was seems to be happening quite close by — in the direction of the parking structure.

At just this moment a car cruises through the pick-up zone at full speed, barreling along at least 100 kmh. It’s only because of some very fast reactions that no one gets hurt as it passes by. As it zooms past, you notice there’s no one behind the wheel.

Before you have any time to process that, another huge thump nearby causes a section of the barrier wall of an upper floor of the concrete parking structure to shear off. A pile of rubble falls to the ground not very far away from you.

-- Mark Pesce, Oct 2015, https://medium.com/@mpesce/the-great-hack-part-one-attack-70...

Relevant sci-fi: Daemon, by Daniel Suarez.

(AI-controlled cars feature prominently as weapons.)

I was momentarily confused when I parsed that sentence as referring to the Toyota Mirai: https://en.wikipedia.org/wiki/Toyota_Mirai

There has already been a proof-of-concept hack of a vehicle: Hackers Remotely Attack a Jeep on the Highway. [0]

(Incidentally, I applaud the top comment at [0]. Everyone involved in recklessly demonstrating the hack on public roads, should have faced serious consequences. As far as I can tell though, nothing came from the police report.)

[0] https://news.ycombinator.com/item?id=9921557

Minor note for the unaware: "poo poo" in this post is a forum word filter for "shit".

how were you able to say shit?

on something awful, not hn. here you can say whatever the heck you please.

except most emoji

On MySQL utf8 encoding, ? is the word filter for emoji.

HN specifically filter out emojis but pass other utf8s and zalgos(which is a well balanced decision IMO)

¯\_(ツ)_/¯

ฅʕ; •ﻌ• ʔฅ

Strange how emojis don’t work.

You can swear on SA as well.

It's only if you aren't logged in to an account that word filters are applied (and some other things e.g. there are a bunch of subforums not visible to outsiders).

Reply on news.ycombinator.com