Hacker News Reader

Comment by pabs3 | Hacker News Reader

Probably a bigger problem for modern cars (including EVs) is how long security updates will be provided for.

Why would a car even need to have security updates in the first place. Or are we arguing that software updates and patches become like car parts, and you can go to your local parts dealer to get an oil filter, fan belt and a USB with the latest security updates?

Cars are full of software now, they are basically smartphones with wheels, cameras, microphones etc. Even a 20-year-old car has an Engine Control Unit, a computer that controls the engine, handles the immobilizer etc.

I'm not questioning why cars have software, I'm questioning why they need software updates. Specifically OTA updates, which means the car has an attack vector.

A car should be an embedded system, there is arguably no need for any of its core subsystems (ECU, BMS,immobilizer etc) to have a wireless connection to the outside world. If updates are needed, the dealer can handle it physically.

At a minimum, cars have LTE modems in them for telemetry and other things, those alone are complex enough to need security updates.

Next up are the wireless unlock systems, if there was a security problem there, anyone could potentially steal your car. And there are issues with these systems, relay attacks and the like.

Then the infotainment systems parse complex data like videos, and need network connections to download video, games etc

There should be some reasonable mandate how long security updates have to be provided from last manufacturing date. Say 25 years.

In the EU the CRA would have mandated something like that -- not 25 years but a support period defined by the manufacturer that reflects the time the product is expected to be used. The auto industry managed to get themselves excluded.

Reply on news.ycombinator.com