Thieves Break Into Cars Using Mysterious 'Black Box'
chicago.cbslocal.com
chicago.cbslocal.com
"UNLOCK" "OK"
That said, its annoying. I've gotten in the habit of pulling the fuse to the car locks in my car when I park it in the long term airport lot.
With peoples' lives at risk and with cars representing huge investments for many people, it's probably about time to get regulation that requires the software systems that are interacting with vehicles to be open to experts at large.
The same goes for things like in-home security software.
The competition should not be in the critical software. That much needs to be standard. The competition should be around fluff, construction quality, body design, brand, perks, horsepower, etc.
How is this kind of thing handled in the medical and aviation industries? How about NASA? Life-critical and safety-critical software isn't something you should hire the lowest bidder to create, nor is it something that should be hidden away in the belief that "obscurity is (the best, and the only) security."
Since you ask, I'll draw on what I've learned from my childhood best friend (an electrical engineer who worked first in the aviation industry and now in the medical device industry) and my son (who was a summer intern for a medical device company). Simply put, safety-critical devices are heavily regulated in those industries, and everything new is assumed to be safety-critical by default. My son's summer work designing the doctor-facing user interface of a new bedside patient monitor was subject to a line-by-line code review by programmers on the FDA staff. He estimated that the product he worked on would take six years to get to market, even thought it was just version 2 of a device that already worked and had clinical usefulness. Federal government regulators try to be extra careful in review of new software that protects human lives in those industries.
You need government approval (FDA or FAA respectively) to bring a product to market. Are you sure you want that kind of bureaucratic overhead (and the associated politics) in your car and home alarm?
I'm not sure if the FDA or FAA are capable of doing that, given how the government is really, really bad at building or contracting software (in general).
If only we could have some kind of standardized software to power these devices that is built by the community at large and thoroughly reviewed for correctness. Even at the cost of limiting hardware, I think that's an option.
Somewhat (but also not at all) like a more advanced ODBII[0]
Could you explain your reasoning for this claim? Does competition lead to better/more efficient products, or doesn't it? Why do you desire to leave non-critical parts to competitive forces, but not the critical parts?
Until we have a car that kills 500 people because of faulty software, it's just not that important to people, which means there's no pressure in industry to get it right. People understand "my car will kill me if X isn't good." That's why people understand getting their tires rotated and replaced. That's why they understand to get checkups and to replace belts, filters, oil, etc. That's why they understand you need to replace your brake pads and other such hardware, even if it feels a little expensive. But when you point out that very few people have ever even been injured by bad software in a car, they think "well it can't be that bad." And "good enough", especially in a market like the US where mediocre is what sells the most, is where the market stops innovating.
I hope a company like Tesla is a little more concerned with the quality, though. Maybe we can get a decent example of how to do things.
I agree with that. But what is your alternate proposal, and where does the pressure to get it right come from in your proposal?
It's 2014.
"Someone stole my car by using a packaged exploit that is easier to find and abuse than breaking anything on DVL"
This is just unacceptable.
I think most of us (here) care about the software our cars are running. It's also absurd that we can't access the computers and put our own software on them. It may be difficult to get legislators to realize just how bad this software is and how much important it is to get right, but it's their job to listen. An alternative is to push for openness of these computing devices. Having access to put your own software on any computer you own may enable the existence of open source implementations that are better than the defaults, and sensationalist headlines might get enough attention of the right people to make something happen. "These hackers can keep your car from being stolen, for free."
Alternatively, headlines about this kind of issue need to be more specific. 'Mysterious "black box"' seems like the headline created by someone in the pocket of the industry. Instead, how about a headline like "a black box created by low-tech criminals exploiting massive security holes that car manufacturers know about allows anyone to unlock and start any car". Maybe it's a bit wordy, but it's somewhere to start. And it shines a light on the real problem. It doesn't paint it as a mystery with only the thieves at fault.
With knowledge of cryptanalysis and lots of free time I think it's conceivable that someone could have cracked the system. I wonder if car companies test their crypto very rigorously?
There are a couple of different ways that are significantly better than brute force (as in: works against real cars in seconds to a few minutes). (Though since key length is only 48 bit, even brute forcing might be practical.)
This might interest you:
https://www.usenix.org/system/files/conference/usenixsecurit...
Knowing nothing about how it was done, I'd just assume the security was really bad [2] and the box simply emitted all possible combinations. Has any industry ever taken security seriously before the first major breach?
Our solution is to never store anything of value in the car.
[1] Pretty sure because almost never leave a car unlocked. Two cars unlocked is even more unlikely.
[2] By way of example, unlocking my Chevy with its fob routinely set off a car alarm for a different car. That tells you right there that the car alarm receiver has zero security.
I have no idea if thats what all these devices are, or how legit the article was, but seems legit to me.
Source: this is part of my job, I work in fuel systems.
Things like backdoors in key/locking mechanisms or even gross incompetence would be difficult to hide when the underlying hardware and software was open source.
The issue becomes when opening sourcing engine components it becomes very easy to damage engines in ways that could injure the driver/other people on the road, as well as maintain EPA standards for emission and fuel consumption.
Not every mechanic is a Fuel System Engineer, its relatively easy to hydrolock an engine. If you screw up the internal mechanics then just a hop-skip-and-a-jump to a VERY rapid dis-assembly.
It's a lot like overclocking, but instead of a 500CPU you have a 5,000 6 chamber bomb.
Gee, you guize! Oh noes, scarey people is
doing bad, bad tings, and let's all worry now!
Police no can help! Meesuh gonna die now???
"...AND NO ONE KNOWS WHAT IT IS!"
Someone knows exactly what it is, and where it came from, and they're just not permitted to explain on public channels, because classified. This is just an all-points-bulletin to make sure an otherwise disinformed citizenry starts reporting on a type of crime that they might've been previously unfamiliar with.
Yes, getting eyeballs and selling ads. The simple model of appeals with high emotional resonance and low rational content that generates among a large segment of the population a feeling that the world is a scary, scary place and if they don't keep tabs on the latest danger by watching the news it will be even more dangerous for them is a very effective way of doing that.
Just look at how many times that particular 'story' mentions 'CNN reported' and 'CNN says.' And the whole thing is like ten sentences. I bet someone didn't even have to put down their coffee for this one.