Hacker News Reader

Comment by myself248 | Hacker News Reader

"sent image files" is an HD Radio function, and HD Radio is also known as NRSC-5, the standards document that describes it.

There's an NRSC-5 encoder floating around on Github, if you want to try your hand at it. Notably, it was implemented by an infosec firm, presumably because more garbage code like this is lurking everywhere, and it never gets proper testing because HD Radio is proprietary and its creators never intended an open-source encoder to exist. (To the point of hiding all sorts of details about the codec, but some educated guesses and comparison to similar codecs seem to have paid off.)

So, in this case it just crashes the radios so they boot-loop, but how long until someone figures out a payload that can do more damage?

View on HN

At some point, I think we have to start asking if the addition of non-critical features like having a favicon for each radio station is worth the increased attack surface.

Mixing the car radio and actual critical systems (backup camera) doesn't seem like a great idea. Especially when the car manufacturer doesn't control the entire system. I know nothing about the supply chain for car radios, but I wouldn't be surprised if it was all made by some secondary supplier, so Mazda doesn't even necessarily have the code to the section they need to patch.

But, I'm honestly more surprised that it's a Mazda specific issue. I would have expected for the same bug to hit multiple infotainment systems.

This may be pedantic but I wouldn't call a backup camera critical, people need to learn how to drive and parallel park without those aides.

I sure would be pissed if I had a car with a backup camera and something like this bricked the big center screen in my car, however.

A backup camera is required safety equipment (at time of sale) on new cars.

Great, another unneeded feature forced down our throats at additional cost to who? You guessed it, consumers!

Yeah, drives me nuts. Some cars have really great rear visibility and should be exempt from the requirement. I understand it on SUVs and stuff though.

Do they still sell any cars with good rear visibility?

My hatchback has about the best you could get (and they don't sell it here anymore) and I still added a backup camera, it's very useful.

I used to pride myself on my ability to fit into small parking spaces and parallel park even big vans pretty precisely, and a backup camera blew all that out of the water because I can fit anywhere now.

My little GTI with a backup camera made me an invincible parking machine.

Why? You have a screen, the cameras are so small as to be undetectable, they add safety and they provide much better coverage than mirrors do.

It also enables auto-parking and other enhancements while not inhibiting anyone that wants to perform those functions manually.

Wouldn't the entire rear of the car and the rear seats have to be glass to exempt a car from having the camera?

A bigger rear window wouldn't have let me see the toddler who'd wandered a short distance off from his parents in a car park and was standing right behind my car.

Look at the split rear window on the Prius; it does exactly that. If the driver is tall and turning their neck, or short and using the center mirror, the sight-line from the driver's seat extends below the rear seats and down into what would ordinarily be the tailgate.

You can't see the pavement under the bumper, but you can see a kid on a tricycle right behind the car.

Personally I find rear view cameras to be quite disorienting. The view is quite distorted by the wide-angle lens and it's not clear where it can see and where it can't. Do I still have blind spots if I look at only the screen? Where are they? With a mirror I get an intuitive sense of what it can and can't see. Also, I expect the view to move when I move my head like in a mirror, which is part of what makes it so easy to get a sense of where the mirror can see. I suppose someday I'll get used to cameras, but today is not that day.

Well, you could also say the same about seat belts and ABS. I very much prefer cars with cameras at this point.

I think parents who have lost their children to cars backing out of driveways while children are playing on the sidewalk would disagree with your description of 'unneeded'

It wouldn't be an issue if we went back to making cars small enough you could see out of them. Legally requiring a certain level of rear visibility would be a good thing (and, sure, in some cases a camera might be the best way to achieve that) - and throw in some pedestrian collision safety requirements while you're at it. Legally mandating the expensive gadget-based way of doing things seems horribly shortsighted.

You'll never come close to getting the visibility that you can with a backup camera. With a decent backup camera the only blind spots are actually underneath the car itself. You can't possibly match that without a camera on anything other than a motorcycle. Setting the legal requirement of visibility without mandating a camera would either make it completely impractical to avoid a camera or you'd be sacrificing visibility by making the mandate achievable with only mirrors and windows.

> Legally mandating the expensive gadget-based way of doing things seems horribly shortsighted.

Your perspective is biased. If the backup camera had been invented before you were born and the automobile after you had been born than you would consider it only logical and familiar to see backup cameras on the wagons and horse drawn carts that you were used to but you would consider automobiles to be 'the expensive gadget-based way of doing things [that] seems horribly shortsighted.'

If backup cameras weren't expensive gadgets then I wouldn't consider them expensive gadgets, sure. But they are, so I do. When the facts change, I change my mind; what do you do?

Don't get me started on turn signals! Who's paying for these features? That's right, Joe Consumer. People just need to learn how to use hand signals.

Turn signals are not what makes a car expensive. Look at BMWs.

You could tell me BMW's ship without turn signals and I'd believe you.

I know BMW turn signals are a meme (with good reason...), but I've noticed the exact same behavioral trend with Lexus drivers as well. It's really just those two makes in particular.

It’s not unneeded, it’s there to prevent you from killing someone, just like every other required safety system.

Great, another feature that will save dozens to hundreds of lives (disproportionately of young children) every year, while adding only a few bucks to the bill of materials for cars that already have a display screen.

I do wish parents would stop teaching kids to take the short route over the carpark on the way to school. They save a couple of meters but walk behind cars backing out of the car garages... The back camera is handy but you won't see them if they walk on your side of the lane, too close to the 90 degree edge of the car.

And to make it more fun, our car has an overlay on the left edge with a top down view of the sensors around the car. That one blocks the view completely in that edge. And has a black background window that slowly fades away.

Also demanded by customers. A well implemented backup camera is much better than trying to use a small rear view mirror or twisting around to look out a small rear window. The backup camera can give you a wider field of view including low down where a small child might be. It is also much brighter in the dark than your eyes normally see.

This doesn’t mean that I am not also checking the surroundings but the backup camera is such a big improvement that I would not buy any car without one.

Backup cameras are going to become critical beyond "learn to drive properly" very soon. My college aged son has literally never driven a car without a backup camera. I taught him to use his mirrors after checking the camera for obstacles the mirrors can't see but I'm sure he's already developed the habit of simply relying on the camera. I'm pretty much there and have 30+ years of driving without them.

Where I live you could fail your driver's test if you look at the rearview camera while reversing. You can glance at it before you start the manoeuvre but if you take your eyes off the road while the vehicle is in motion, you get the silent note taking.

I usually look at the mirrors rather than the road?

you're getting a ton of criticism, but I have two cars, and only one has a backup camera. I reverse more safely in the car with no backup camera.

I've caught myself just backing up without thinking about it in the car with the backup camera. never done that in the old-school mirrors car.

I don't know if there are any studies that back up backup cameras.

I've read that people ride more dangerously, and are tested by car drivers less carefully, when wearing a cycle helmet. Perhaps there's a similar effect here -- I think we do tend to rely on safety equipment and ignore due diligence.

Some cars are designed around having that camera in exchange for rear visibility. Generally for better aerodynamics. It likely pays for itself in fuel pretty quickly.

My understanding is that it's partly motivated by rollover crash safety -- with smaller windows in the back, they can make those pillars sturdier.

That said, I'd much rather have a backup display in my rear-view mirror than a giant touch screen

Yeahbut, they both need access to the same screen. And yes, it's all made by suppliers, and therein lies most of the trouble with cars today.

Electronic KVM switches are pretty ancient tech. So getting access to the screen/input between different hardware modules shouldn't be that complicated. They just don't want to pay for the parts and additional complexity.

> I know nothing about the supply chain for car radios, but I wouldn't be surprised if it was all made by some secondary supplier, so Mazda doesn't even necessarily have the code to the section they need to patch.

You are correct that in general the automotive OEM's farm out the various components of the vehicle to suppliers. In that case, they probably also have some sort of support contract in place that ensures the supplier will address issues like this in a timely manner for the duration of the warranty period for the vehicles it is included in.

At least in my car (2013 Chevy Volt), the backup camera is on an internal KVM-type switch.

The moment I switch into reverse the camera forcibly takes over the infotainment screen. You can occasionally see the signal flicker when the switch happens.

But also… a backup camera is hardly critical equipment. It’s there for situational awareness (and a good idea), but doesn’t replace the mirror. And since nobody drives in reverse at high speed, stopping is always an option if it malfunctions.

On many newer cars, the backup camera is approaching critical equipment. With the rising safety standards, the visibility in cars, especially out the back, has gone down significantly. Incidentally, this is very apparent on the Mazdas that I've owned. My old old Protege had good visibility out the back, an early 10's 3 had passable visibility out the back, and the now handful-of-years-old 6 has atrocious visibility out the back, to the point where more than half the field of view is obscured.

That’s still not critical. The backup camera is not used as a rear view mirror replacement and the ability to back up, let lone back up safely, is not required for safe operation of the vehicle.

Brakes are critical, steering is critical. Reverse and everything that entails is not.

> Brakes are critical, steering is critical. Reverse and everything that entails is not.

The statistic is that every year, in the U.S. alone, over 2000 kids are run over by vehicles reversing. I had to read what you wrote a half-dozen times, but in hindsight the dissonance makes perfect sense.

> The statistic is that every year, in the U.S. alone, over 2000 kids are run over by vehicles reversing.

That’s nothing. 10k a year die from speeding.

Rear view mirrors aren't critical. Vans don't have them.

Federal law in the US considers backup cameras critical enough to mandate them in all new vehicles since 2018, with penalty for non-compliance.

I think that take precedence over your idiosyncratic definition of what is critical.

Federal law also requires manufacturers to use too little water in all your home appliances. That’s clearly not “critical.”

Edit: I really don’t understand why I’m getting downvotes on this. Is it because people are so glad the federal government is in their bathroom making these “critical” decisions for you?

My point is that the federal government makes all kinds of decisions that are obviously not “critical,” and that includes in the auto industry.

Because we have to agree on some authority, and almost everyone is going to prefer the government's authority to yours.

I’m not trying to get any authority nor questioning the government’s authority. You are saying that every law the federal government has passed is critical?

y'all are just arguing semantics.

The camera is "critical" to manufacturers by definition because it's the subject of regulatory compliance - it's a must have for the manufacturer to clear a gate.

We also know that people have been driving in all sorts of conditions and in all sizes of cars without backup cameras for decades upon decades and cameras are obviously not critical to the act of driving the vehicle. They undeniably help: the field of view is often wider than your mirrors, you can drive backwards at high speed while ducking to avoid bullets, You can see directly behind the bumper of your car to wedge yourself into tighter parking spots and avoid backing over tiny people, etc. I don't believe a functional backup camera is required to resell the vehicle.

If you never learned to drive without a backup camera, it may be more "critical" to you individually.

Emissions systems are a completely different story. Critical to manufacturer and required for resale of the vehicle (technically critical to owner), though who's going to check for that $400 bypass kit? ;)

That’s not critical ffs. Federal law requires all kinds of things that are not critical (I.e. does not even result in a fine for operating it on the road with it broken). Side curtain airbags, reverse, a rear view mirror, etc are all not critical nor legally required to operate a vehicle on the road.

Manufacturer mandates for general safety have only a small overlap with what is critical.

In the vast majority of the US, being able to safely back up _is_ required for the safe operation of a vehicle. I recall my drivers license test included a driving-in-reverse section. You will also frequently need to be able to back out of a parking spot, or a driveway. Even if its not critical, its as close to critical as can be. When your rear view mirror and your side mirrors combined cannot give you enough visibility to safely back up, a rear-view camera quickly becomes critical.

Backup cameras are great for avoiding things low to the ground but do give a false sense of security. I managed to back into a fan box at about head level in a parking garage because I became too reliant on the camera alone. If I had turned around to look behind me I could have avoided a thousand dollar repair.

The geekwire article confirms it is disabling the backup camera and gps nav. You can only listen to npr while it boot-loops.

My Seattle Mazda was hit by this bug. The backup camera still functions for the most part, although it does flicker and occasionally blank for a second or two (presumably while the system reboots). Annoying, but not horrible.

And since nobody drives in reverse at high speed

That's my cue ;)

The Netherlands used to have national championships reverse driving for many years on the official race track at Zandvoort (part of the Formula 1 circuit).

https://www.youtube.com/watch?v=Kn-v2pLBx_s

The backup camera isn't critical, but it's been required in the USA since 2018.

https://www.fleetowner.com/safety/article/21687582/nhtsa-to-...

I'm quite certain the dev teams here did ask themselves this.

And decided it was worth it. (If my experience told me anything: Probably under some pressure of marketing or C-level)

I'm less worried about somebody attacking more radio and more annoyed that radio stations have taken to using an information mechanism designed to tell me what I'm listening to and used it to serve ads.

Unless we are calling serving unwanted ads as an attack.

But in a broader sense, I am absolutely unsurprised that there is terrible security on automotive hardware and software. Things like this are one of my major personal concerns about self driving cars.

Car ownership has become pretty interesting in the last few years.

Reply on news.ycombinator.com