Hacker News Reader

Comment by scohesc | Hacker News Reader

This is exactly the reason why I'm trying my best to keep my non-smart vehicle running as well as possible for as long as possible.

I have no idea what exactly will be exposed to the manufacturer's backend, what can be manipulated and hacked on the front-end, and the possible safety repercussions involved with this.

Who's to say some government/corporate espionage results in a manufacturer getting their back-end hacked and having every online vehicle immediately get their brakes applied? Definitely some Black Mirror-esque stuff...

Not to mention the convenient ability to surveil any vehicle and their locations with a busted and easily crackable API - why does it take external hackers with a (thankfully good) sense of morals and ethics to bring these things to companies' attention?

It'll probably take something hitting national/international news before lawmakers or companies take this security seriously.

View on HN

There have been many, many past instances of automotive security issues hitting national and international news.

The automotive industry has simply been slow to adapt. Manufacturers were almost universally founded in an era when mechanical systems dominated and that's how they want to treat everything. There's been a painful and ongoing learning process for them to realize that software and computerized systems are fundamentally different from the mechanical systems they understand well.

On the inside, doing things securely takes a lot of deliberate and careful work. COTS stuff is rarely designed for high security systems. I've sat in more than one pen test where we found a wireless interface unintentionally added by some dev board that was selected for a completely different purpose. I've also seen cases where the security team/software teams were hired/onboarded after the vehicle design was essentially finalized with little consideration for their requirements.

The automotive industry has simply been slow to adapt.

And so have the legislators and regulators who should have been preventing the automotive industry from selling products where it increasingly seems plausible or even likely that a vulnerability will be found and exploited at scale by someone really trying to do harm and the consequences will be catastrophic.

The danger has been obvious to many who work in tech for a long time and has been publicly demonstrated often enough against enough different types of vehicles that the threat should be like a giant billboard that is repeated every 100m along every road in the world by now. Someone in power needs to realise that even the kind of intense scrutiny and safety culture that we see in for example aviation or some medical fields or nuclear power stations doesn't scratch the surface of what we need for an industry that sells around 100,000,000 new vehicles every year.

The auto industry is infamous for treating the human cost of its failures as a mere financial cost of doing business and operating accordingly. It simply can't be trusted to "adapt". It must be forced through unprecedented levels of oversight, regulation and sanctions for businesses, executives and investors who don't act responsibly.

> Manufacturers were almost universally founded in an era when mechanical systems dominated and that's how they want to treat everything.

That is a huge understatement, as they mostly (majorly?) employ electrical/mechanical engineers who end up writing code for the ECU's. Cloud services are mostly an afterthought in design. In my experience, regulation isn't the main problem.

With inequality on the rise, I would expect hats to start darkening at increased rates.

I've personally sworn off any more responsible disclosures to companies not paying at least $1,000/hr(USD) in rewards or without clearly good intentions. I am not bending and very backwards to find it either. Any shenanigans is instant disclosure and shenanigans exposure.

I'm about to be homeless and know of exploits currently working at 20billion dollar companies. They can't even bother responding to emails...

There's a point where one has to focus on needs. Morality I want, food I need.

This attitude isn't helping anyone, yourself included... but if you leaned into responsible disclosure you might find your way into a job that saves you from homelessness.

> Morality I want, food I need.

Yes, but jail food isn't all that it's cracked up to be and if you are able to get that kind of work done then your choice isn't $1000/hour for undisclosed vulnerabilities or starving, the viable alternative is just to get a job.

With those skills you are 10x as employable as most people that are currently jobless. At least.

Prison food is okay, depends where you go and how you handle yourself. Low security prison is just adult daycare, which is where a hacker will end up. Hacker knowledge is highly appreciated in prison.

I should mention that I don't intend to release or sell anything harmful. I just recently experienced this issue and I came out on the right side(?). I can see someone coming out the other side too, too easily. My intent rather is to stop working for free. I will notice it, note it, eliminate my personal exposure, and ignore it. I would say that puts me somewhere between white and black.

It's not easy (for me) to find employment. My last company was in automotive advertising(bankrupt) and I am aware of quite a few more problems than what you see in this disclosure. Though the listed brands are outside of my knowledge.

Same here, I've pretty much given up on owning a modern vehicle, my daily driver is 25 years old this February and it's the last car I'll own.

My threat model must be a bit different.

I imagine my odds of being an accident in which 25 years of crash safety advancements help are higher than being hacked.

(and for the inevitable flood of "But the A pillars are bigger" comments, if you're safety conscious you can still get cars with reasonably sized A pillars. A few years ago Honda specifically called out smaller, further recessed, A pillars for visibility in the Accord redesign)

I'm fine. But I was almost in two crashes with a very new model car on account of buggy software. And the chances of that are higher than being hacked. Considerably higher.

The best way to avoid crashes is to drive less, which is what I'm also doing and why I expect this car to last the rest of my life (and probably well beyond, the way I'm maintaining it). It's my daily driver because that's what I would be driving if I were to drive on any given day but I'm actually quite surprised to find out that I spent more last year on insurance than on fuel.

Yes, the functionality that tries to keep the vehicle in the lane nearly steered me into a concrete barrier in a construction zone when I rented a vehicle a few years back. Not exactly the kind of stuff I want happening while I'm driving on a highway in a foreign country. Could have ruined the trip, or worse.

In my case a fairly new C-class MB that decided that posts on bridges are in front of the car and not to the side and a large advertising board in a corner was about to be hit. In both of those cases the car turned what was a perfectly safe ride into instant near accident and if not for many years of experience I'm pretty sure the first would have resulted in a major crash. I got rid of the car after the second one.

Automatic emergency braking is probably great if all you do is highway traffic and stop-and-go but it really sucks that you can't disable it and that it isn't able to distinguish between safe and unsafe to a degree that it will turn a safe situation into an unsafe one all by itself. At that point in time a safety feature becomes a risk in itself. Possibly the statistics are still in favor of the solution but I'd rather take my chances.

I tend to drive almost exclusively older cars. Once I had an accident in a 15 year old golf (this was around 2015 so the golf was made in around year 2000). This was basically emergency breaking on wet road at motorway speeds(about 130kph or 80mph)followed by loss of traction, then some sideways sliding finished with head on smashing into a side barrier with enough force that the car ended in the middle of the road (it must have bounced, but I have to admit I can't remember the exact moment, I estimate it was probably still going at last 45kph 30mph when it hit). I was perfectly fine except loosing few seconds of time. I managed to jump out of the car and have enough presence of mind to drag it off to the side of the road before incoming traffic crashed into it(thankfully wheels were fine enough for this). The car was totaled, and I didn't even have a scratch. That's an example of now 20 year + car safety...

Doing 80 mph in the rain and having a road barrier save your life is great, but I don't think I said "A 25 year old car is a death sentence"

It's just pretty well established that in the last 25 years we've made huge strides is vehicle safety.

People routinely walk away from accidents where they would die in a 25 year old car because of those advancements.

The difference in survivability is not small: https://crashstats.nhtsa.dot.gov/Api/Public/ViewPublication/...

I wouldn't say a road barrier had any positive effect on the situation. What probably saved the situation is that a 20 year old golf handles way better in a slip than the cheapest of current cars (at least back then in 2015) which was the usual choice when I rented at the time. Would I be doing 80mph in a Fiat Punto in the first place?Probably not. Would 60 mph be enough to loose traction in it? Who knows.

If you extend the time range to 25 years I might agree, but let's say we start at year 2000. I fail to see those "huge strides in vehicle safety". Perhaps what you mean is that certain "upper tier" features made their way into basic equipment. That no doubt has positive impact on an average driver.

However, at least for me, any time I bought/rented an old car it was always a top spec version, so as mentioned. I don't see those huge strides.

The last 25 years have seen some improvements, but nothing nearly as dramatic as the change between the 25 years prior to that. Seatbelts, airbags, crash testing and designing a car for survivability in case of an accident are all things that happened between 1970 and 1990, since then we've seen incremental improvements but for the most part things have not changed all that much. That's also why automobile manufacturers have trouble introducing new models because the older ones are really pretty good. The car I'm driving has gone through 2 upgrades since 1997 (the year it was built) and neither of those is a huge improvement safety wise over the one that I've got. The biggest question mark is probably the longevity of the pyrotechnics and the airbag materials, but for both I've been reassured multiple times by the dealership that they are fine (not something you want to test), and that this goes for any airbags manufactured after 1993 except for one particular notorious bad batch made by Takata, and those fortunately are not in my car.

A single anecdote is not data. I can fall by slipping on ice dressed in shorts and a tshirt, and walk away fine. But i can also do the same, but dressed in a way more padded and protective winter coat, pants, boots, then fall and twist my ankle. That doesn't say much about relative safety of shorts+tshirt and protective winter gear when it comes to falling on ice.

Back to the topic at hand, are you claiming that all of the safety improvements added to the cars over the past 20 years didn't make a massive positive impact on passenger safety during collisions? Arent't there agencies worldwide that issue safety ratings after performing variety of tests and studies (that are way more rigorous and quantitative than a one-off anecdote), and they show massive safety improvements over time for all cars in general? Or are you trying to claim that those agencies can't be trusted, and that their tests are not valid?

I am not trying to be combative about it. I am just genuinely trying to figure out what point you were trying to make with this anecdote, but all I have right now is pure guesses.

Not the op, but I'll note all of those tests are about what physically happens once you're in crash or specific situation. Many or most don't gauge how or why you got into that situation, or how likely you are to do so in that vehicle. I don't know how "firmware update made care less safe" or "adaptive cruise control disengaged unexpectedly" or (my personal concern) "car UI negatively impacted drivers situational awareness and reaction time" etc would show up in e.g. IIHS rating?

A good 10-20 year old car may have as good crash rating as many modern cars. top or average modern cars may be better than top or average 10 year old cars. Stats are interesting thing. But then there's the average driver assistance vs average UI vs average visibility vs average handling of these cars.

Bottom line, I don't feel less safe but I do feel differently safe, in my old Subaru and new Honda.

> I don't know how "firmware update made care less safe" or "adaptive cruise control disengaged unexpectedly" or (my personal concern) "car UI negatively impacted drivers situational awareness and reaction time" etc would show up in e.g. IIHS rating?

What percentage of crashes can be attributed to that? Let's make it simpler, how many crashes per year as a raw number happen due to those reasons you listed?

Because out of all things I would be worried about when it comes to car safety, this is the one that is least concerning to me. Especially since for most modern cars that have such a thing as "software updates" in the first place, they have the driving subsystem and infotainment subsystem entirely detached (yes, even on Teslas). Very easy to confirm yourself by force rebooting the infotainment center and seeing that the car still drives just fine.

This is false, even more so for most Tesla models. Cars have a distributed E/E architecture where embedded software runs on several computers (called ECUs that range from anywhere between 10 and 100+). Most newer Tesla models are ahead of the curve and have a more centralized (zonal) E/E architecture with very few number of ECUs.

In summary, the infotainment system and the drivetrain definitely speak to each other and unless a secure architecture comes along, I would not discount the possibility of unintended interactions due to bugs. In fact, most famous car hacks start from the infotainment system and make their way into the drivetrain.

1. I am not a car engineer,or anywhere near it, but everything I've ever read about modern cars indicates their infotainment system and engine control unit are at very least on same bus and can and do communicate.

2. I don't have those numbers, in fact point of my post I'd that I don't know how we get those numbers. When I'm a passenger I'm terrified how distracted people can be by poor UI. I wish we had more hard data. Some studies are slowly emerging.

I'm all for forbidding touch screens for driver interaction in vehicles and I'm honestly surprised that this hasn't happened yet. Anything that takes your eyes of the road is a risk. Where I live we're pretty hard on smartphones in the car while driving (and rightly so) and yet we accept touch screens with menus four levels deep for basic stuff.

The point I was trying to make is that from crash safety point of view an upper tier car(for example a well equipped golf) made 20 years ago might be a lot safer than a cheapest modern car(at least here in EU where safety standards in 2000 were pretty good already, I have no idea about other countries). Yes, this is just a single anecdote, but I seriously doubt I would be here to tell it if I was driving let's say a 2014 Fiat Punto or similar.

Why do I compare an old "upper class car" with a modern "lowest tier"? Isn't this unfair? No, because that is usually the choice people have. If they can afford just the cheapest of new cars, there is likely a much better one that is not new available for the same price or a lot cheaper.

This is pretty much on the money. Car safety with respect to the occupants is increasing over time, but it has always also increased over the budget with the time pegged to a certain point. So your 1997 high end car may well be safer than your 2015 budget car.

Case in point: I've restored a Daihatsu Trevis, a small Japanese budget car, and after working on it and bringing it back up to the standard required to pass a salvage title inspection (which is a higher standard than the original one where I live, you have to book an inspection for the vehicle that takes several hours and that will have cross frame measurements and all kinds of assessments to make sure that the vehicle is safe) I decided that this is not a car that is suitable for many kilometers of highway driving. A crash in that car that would be survivable in even the cheapest Golf or Skoda would be lethal in that little car. So I ended up passing it on to people that only drive in the city and got an elderly Golf instead.

And a Golf was definitely not the high end of safety at that time, but it was tons better than the much more modern Trevis.

This somewhat reminds me of my first car. An Eastern German VW Trabant with a two stroke 600cc engine. It was a car I did drive on motorways occasionally as it was my only car (I bought it for $100 when I was 18,the car was 18 years old too at the time).

That car was often a butt of many jokes as people thought its chassis was made off "recycled paper" (in fact it was one of the first composite chassis cars). It was called a plastic-soap-box, but it was so simple to repair one needed a push bike set of tools to fix anything (until once a suspension strut in a rear wheel failed). Then all it took to be able to get back home slowly was to wrap it with some steel wire... Fun little car. Unfortunately it was scrapped against my will when I was abroad (my parents weren't happy I drove it). Today many people consider it a classic and it has quite a following.

I’d add that the pollution from older vehicles causes the premature deaths of quite a lot of people and sickness in a whole bunch more. Particularly if it’s burning oil, which a lot of old cars do.

My daily driver is from 1996. My son's daily driver is from 1963 and he's about to take it on a 3k mi trip. We also have a 69 and a 61.

We are monsters.

The US Clean Air Act is estimated to prevent over 200,000 premature deaths each and every year.

https://www.epa.gov/clean-air-act-overview/benefits-and-cost...

Like it or not, old cars spew highly toxic crap out their exhaust.

I'll happily bet that mine is in better shape than 80% or so of what rolls of the assembly line. It's better than it was when it was first built. Anyway, it's interesting how 'old' is immediately associated with 'unsafe', whereas the main deciding factor isn't really how old the car is but how well it has been maintained, what price bracket it is in (cheap cars are much less safe than expensive ones) and what make & model. Then there is the driver, experience level, whether they drink and drive and are well rested. Because the best way to survive an accident is to avoid getting into one in the first place. There are obvious outliers on all of these and my personal safety is rather high on my list of things to be careful with.

>my daily driver is 25 years old this February and it's the last car I'll own.

I've gritted my teeth every time somebody on HN has referred to their computer as their "daily driver", but I will remain silent no more: You, sir, are the daily driver of your automobile, and NOT vice versa.

However, I'll allow that to connect any new auto you purchase to your computer, you might need to download new drivers.

We need an open database correlating make/model and years with connectivity information.

Wouldn't it be cool though to use the same back doors to disable all the telemetry automakers are pouring into our cars though? Well I mean cool until somebody steals the car but all you'd have to do is have your own tracker on it.

I have a couple of late-90s Range Rovers. They're pretty secure from hacking, having nothing more sophisticated than an FM stereo on board.

And also, given that with Range Rover reliability they'll perpetually be in the shop, you'll always know where they are!

I've never actually had one fail in service. My older one (which is actually a few months newer than my "newer" one which I got a couple of years ago) did over 100,000 miles with only fairly minor repairs, and is currently on 270,000 miles.

I'd drive either of them to any spot in the world. I'd carry tools and spares, but I'd still drive them there.

Still Classics or already P38s?

P38s, way simpler than RRCs and far less rot-prone.

Rot prone I agree! Nice cars either way!

I feel the same way about our 1961 Sunliner. Except it's a 5 tube AM radio.

Reply on news.ycombinator.com