Hacker News Reader

Comment by stevendhansen | Hacker News Reader

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow.

Back to the article, I think that this type of exploit will become more and more common as vehicles become more connected and automated. We need to know that we can trust the software and firmware running on the devices that literally have the power of life and death over us. Unfortunately, this is a VERY complicated issue, and no one has a solution yet AFAIK.

I watched a talk by Cory Doctorow last year where he suggested validation at the hardware level (a la trusted platform modules), but unlike the typical TPMs that only allow vendor software to be authenticated, these TPMs would allow the user to directly authenticate the firmware. If you know the firmware is good, then each layer can validate the next layer up all the way to the OS.

I have yet to hear of a system that allows the user to directly authenticate software/firmware at the hardware level. Is anybody working on research of this nature? Or are there insurmountable problems with this approach?

View on HN

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police.

While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and remotely disabling a vehicle on a multi-lane interstate highway, like it was a big joke. The reporter in the Jeep literally says "This is dangerous" and asks urgently for help. This all filmed and posted to Wired for the world to see, like they are proud of it.

Before working with computers I drove tractor-trailers for a while and was lucky to achieve a million-mile safe driving award. I have a pretty good idea of the dangers here and I know that stretch of road well, I've crossed it many times. I know from experience that a car stopped in the middle of a multi-lane interstate is one of the most dangerous situations you can be in. I've had people hit me who didn't see my huge trailer with flashers on and warning triangles out on a sunny day - it happens quite often. I've seen dozens of people killed in situations exactly like this. You see it coming and a random driver just plows into the stopped vehicle.

I exercised my judgement and decided to phone the local Highway Patrol office. I've read the negative comments and I disagree, I still think it was the correct thing to do. If you are a researcher and you do something this dangerous, and are foolish enough to then post it on a high-traffic site like Wired, I think you forfeit any right to a discreet warning and you deserve to have the police show up demanding answers to some tough questions.

I appreciate your call to the cops and your reasoning. I also have driven a significant number of miles for work and have seen a number of people killed in traffic accidents. This "test" was extremely irresponsible. I know I will be downvoted for saying this, but I think you made the correct decision.

Agreed. I missed the video the first time and didn't believe the text that described the shutdown, video shows the stupidity here, let alone release a recording of it. I expect that will come down soon.

Important research but very poorly tested. Wired and Chrysler (research was funded by Chrysler?) legal teams would not like the contents of this video.

edit: wired's link to video, jump to 2:00: http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005...

Reporter: "Seriously, this is fucking dangerous. I need to move."

And that was while the security researchers caused the radio to blare so loud that he couldn't hear them on the other end of the phone. The more I see, the more I think they were really negligent in how they planned this out, and I was already firmly in that camp.

So watching the video, I don't see a vehicle stalled on the highway.

What I see is a vehicle slowed considerably, but at least nominally over the legal minimum speed of 40 MPH on highways, and without the driver being able to accelerate on his own. He's travelling in the rightmost lane, explicitly with his hazard lights on. This is not an unusual occurrence on highways. He's then told that to regain control he needs to stop and restart the car, which he does while remaining in motion.

I was surprised, since this is quite different from the way it's being talked about here, as if he was stopped in the middle of the freeway. See GGP comment about "a car stopped in the middle of a multi-lane interstate."

That's not what happened here.

Here's my attempt at a partial transcript starting from shortly after they disable the accelerator:

  Driver: "It says 43 miles an hour, but it's not really that fast."
  [voiceover omitted]
  Driver: "Guys, I'm stuck on the highway."
  Researcher A: "I think he's panicking."
  Researcher A: "He's not going to be able to hear us with that radio.  So loud."
  Driver: "Guys, I need the accelerator to work again."
  Researcher A: "The accelerator..."
  Researcher B: "It won't work!  You're doomed!"
  Driver:  "Seriously [beep] dangerous, I need to move."
  Researcher A: "You gotta turn the car off!"

Many cars can be seen passing them on the left in the video during the test.

Right, but the video never shows the car stalled on the highway. It's moving in every highway shot. It's in the righthand lane, not in the center. The driver is somewhat panicked. We can see how fast he's moving relative to the background.

This discussion has been distorted and sensationalized, and it has not been based on observable recorded facts.

A car stalling does not necessarily indicate it is stopped. Stalled can indicate the vehicle is stopped, or it can also indicate the motor has stopped. Airplanes stall, and obviously they are not entirely stopped, it's just an indication that the motor has stopped. It's unclear as to whether the motor actually stopped, but it's not without precedent to use "stall" to indicate no power available for propulsion.

I don't think this discussion has been distorted. It's based on the information they provided. They put a vehicle on a public highway traveling at the faster end of what's legal in the US on public roads, and then removed a large portion of the drivers ability to control the vehicle. It's unclear whether this affected the steering or brakes, which in a modern vehicle would both be power assisted, generally through the vacuum system of the vehicle. The vacuum is provided by the engine, so if the engine was actually off (which is unknown, but I think it's more likely they just forced the car into neutral), then they removed a large portion of his ability to control the car.

The bottom line is that they put a driver in a situation not only unsafe to himself (which they could have gotten consent to), but unsafe for the other drivers on the road. They did not have consent from the other people on the road to do this (indeed, it's not possible they could have), and if what they purport to happen in the article and video did happen, then they endangered those people. I've seen accidents from stopped cars being hit by others. If the highway is busy enough, the initial accident isn't even necessarily the largest damage, but it moves vehicles into even more obstructing positions and causes follow-on accidents.

https://www.google.com/search?q=stalled+car+accident&tbm=isc...

I can agree that the car is not shown at a full stall in the video, however it is the case that the driver reports that they are unable to control the vehicle during the test. I cannot agree that this would matter regarding the idea that this is "[beep] dangerous" as was stated by the driver, because that is supported by the driver's own statements as well as observable facts.

They've risked people's lives to produce real life looking footage documenting a life threatening event.

Without such event present in the footage, car manufacturers can just say "Meh - no big deal". And continue recklessly risking lives by manufacturing unsafe cars without air gap between CAN bus and Internet.

Remember, it's the car manufacturers that are the bad guys here, not the white hats... And just think how hard was this decision. It's a choice between risking lives and having footage that doesn't catch attention and thus allows car manufacturers to continue making unsafe cars with horrible security vulnerabilities. Amazing.

So demo it at a race track. The essential point here is that the uninvolved public were placed at real risk of maiming or death.

Your argument is ludicrous, because you're attempting to cast the actors as either good or bad. IMHO they are guys with a good idea and motivation who did a bad thing.

We are a very visual culture, unfortunately. Unless there's a video of your average Joe driving on a regular highway and a regular car going wild, everyone would just dismiss the problem as limited to "race track" and would not connect the vulnerability to his/her own car.

edit: as per the article "researchers already did test these exploits in controlled environments and presented these tests to auto manufacturers. Said tests were dismissed by said manufacturers.".

>We are a very visual culture, unfortunately. Unless there's a video of your average Joe driving on a regular highway and a regular car going wild, everyone would just dismiss the problem as limited to "race track" and would not connect the vulnerability to his/her own car.

If optics is your justification for this, then perhaps having these two irresponsible researchers arrested would bring even more attention to this.

>edit: as per the article "researchers already did test these exploits in controlled environments and presented these tests to auto manufacturers. Said tests were dismissed by said manufacturers.".

Where do you see that in the article? Only thing I read was manufacturers downplaying a wired-in attack they demoed.

> "researchers arrested would bring even more attention to this."

Yep.

> Where do you see that in the article? Only thing I read was manufacturers downplaying a wired-in attack they demoed.

No "air gap" between "CAN bus and Internet" equals vulnerable.

We know that. Auto manufacturers know that.

Yet they dismiss the possibility of a hack and continue producing unsafe vehicles. And the trend is toward more vulnerabilities.

I was to lazy to search a direct quote, but here it is now: "Miller and Valasek represent the second act in a good-cop/bad-cop routine. Carmakers who failed to heed polite warnings in 2011 now face the possibility of a public dump of their vehicles’ security flaws.".

That is very much NOT a quote from this article, if you are quoting another article by mistake please link it. As this article does not even use the word "presented"

In this article it mentions how Chrysler is working with them and has developed a patch, indicating that they did not dismiss previously done tests. So basically saying the opposite of what I take your point to be.

You don't get to say that it's fine to put me and my family in danger because hey, in the end it'll make someone somewhere pay attention.

Yeah, you and your family. Well, you are lucky. These researchers and this reporter had already risked their reputations, lives and their livelihoods. So you, now, don't have to. And maybe you'll be even able to benefit from all their hard work, because were would be fewer vulnerable cars around. Although you would probably never know that.

No. They absolutely did not have to produce a life threatening event. They could have done it 5MPH and car manufacturers would still take notice because it would still spread like wildfire on the Internet. What they did was supremely irresponsible and the cops should have been called.

They already did do it at slower speeds in parking lots. Manufacturers didn't care. They probably still won't care, which means that it's a matter of time before someone even less morally-bound decides to wreak havoc on traffic.

> Without such event present in the footage, car manufacturers can just say "Meh - no big deal". And continue recklessly risking lives by manufacturing unsafe cars without air gap between CAN bus and Internet.

Oh really, can you point to the responsible tests that were done in the past that proved inconsequential necessitating this reckless alternative? Or are you just inventing that the car manufacturers would ignore this and somehow the story would just go away?

Haha, in fact, from the article, Chrysler already fixed one of the issues.

That's borderline like saying using crash test dummies is useless because it's not realistic enough for car manufacturers to take it seriously

The actions - according to the article - of auto manufacturers in response to prior more-controlled tests is exactly equivalent to that. The manufacturers basically said "hey, thanks for showing us this crash-test footage that shows our vehicles are literal fucking coffins on wheels; we don't really care", leaving the researchers with no results after taking more "sane" measures.

Researchers perform controlled experiments. Controlled experiments are ignored. Researchers opt for more damning (though less controlled) experiments to further prove their point, and now they're suddenly the bad guys here.

Researchers opt for more damning (though less controlled) experiments to further prove their point, and now they're suddenly the bad guys here.

Much of the commentary here focuses on the recklessness of the highway test and doesn't weigh in too heavily on who the bad guys are.

I think people mostly find the idea of remotely exploitable and controllable cars so terrible that there isn't anything to discuss about that aspect of it, it's nearly universally considered unacceptable (hence the epic thread about the side issue).

Maybe try reading the comments without imputing a side that the writer is taking.

What they should have done was involve the police from step #1. If the video had been conducted on a closed section of roadway with ambulances standing by, police escorts, and lots of badges and sirens, it would have been even harder for the automakers to blow off.

It wouldn't have been difficult to do this right. Cops love drama and publicity. It wouldn't have taken much convincing to get them on board, and the video would gained a lot of credibility.

I agree completely; there were a lot of formalities that were neglected - and had they not be neglected, there would be less backlash against the researchers.

However, this doesn't change the fact that vulnerabilities were demonstrated, nor does it change the implication that auto manufacturers are excessively sluggish about security patches on things that can and do kill people on a regular basis. Even an imperfectly-conducted demonstration like this particular case is preferable to such a demonstration not occurring at all.

"I have to act bad because of the nature of my enemies." <-- says everyone

> And just think how hard was this decision

Given that they did the easy thing, it wasn't very hard at all.

Blocking the visibility through the windscreen, then shutting off the transmission of a car, that is driving on an interstate overpass in traffic, is not white hat by any stretch of the imagination.

Perhaps not, but it's necessary to get the attention of auto makers so that they stop building such trivially-compromisable systems. This was a couple of security researchers on one car for a proof-of-concept; better to demonstrate these flaws early and with a more limited sample than to watch the pileup of epic proportions that would happen should someone even less scrupulous acquire such control over vehicles on the road.

I don't exactly condone the ethics (or lack thereof) of the researchers, either, but if that's the only way to get proper attention (after previous, more polite and reasoned attempts were simply dismissed by manufacturers), then so be it.

Had that Jeep run into you or you ran into it as a result of this experiment, you may have found that you have a profoundly different threshold for what is, "necessary to get the attention of auto makers".

Just because automakers are seemingly keen on ignoring security vulnerabilities does not justify putting people's lives at risk. And let's face it – a multi-ton vehicle that is not entirely in its driver's control puts lives at risk in just about any situation. The reason you and others argue that the demo's methodology is effective is precisely because of the risks involved; not in spite of them.

It is the responsibility of researchers to demonstrate risks without exercising the extent of those risks. Imagine if virologists regularly demonstrated communicability risk by injecting humans with disease outside of the lab.

> Just because automakers are seemingly keen on ignoring security vulnerabilities does not justify putting people's lives at risk.

So condemn the auto manufacturers for putting hundreds of thousands - if not millions - of lives at risk instead of yammering about a couple of nerds who put at most 2 vehicles in probably-nonfatal danger in a worst-case scenario.

Why can't we condemn both?

And as busy as that highway was in the video, it was far more than just 2 vehicles, especially if one of those vehicles was the 18 wheeler.

At the very least they could have done this on a less busy stretch of highway that had a wide shoulder and with control vehicles in front and behind with paramedics at the ready (just like a movie production that is shooting on public streets). Instead the researchers and the journalist chose to be reckless.

> Why can't we condemn both?

Nobody's saying you can't. I certainly do (I strongly disagree with the researchers' obstruction of communication between themselves and their test subject).

My only point is that there's a massive difference in scale between a couple dented fenders and hundreds of thousands of dead/maimed innocents.

Difference of scale? Ok, I agree with you there, but characterizing the risk as "a couple dented fenders" is intellectually dishonest. A high speed accident on an interstate could easily involve serious, even fatal injuries.

It could in some situations, yes. This was not one of those situations.

We're talking about someone coasting uphill with absolutely no braking whatsoever. There's plenty of reaction time in such situations (as I happen to know firsthand, as was the case when my SUV ran out of gas and I had to coast a quarter-mile over a hill to get to the next offramp while merging from the fast lane to the far right at 70MPH). Even for semis, the reporter's car wouldn't mean having to slam on the brakes. Not to mention that the uphill helps with stopping.

The story would be different if the researchers slammed the car's brakes. If that were the case, then yes, death would be possible. That wasn't the case.

No intellectual dishonesty here. Just thorough examination of the situation as described by the author of the article.

Because scale. One is very limited in scope, ie: On one day, in one city, on one road, for a few minutes, one car caused a few other vehicles to make otherwise unnecessary lane-changes. vs the vulnerabilities exposed which affect tens or hundreds of thousands of vehicles in every city, every day, on almost every road, at almost any time.

Agreed, the researchers deserve some criticism, but let's not lose sight of the forest for these two goofball trees.

> it's necessary to get the attention of auto makers

That's mere conjecture. And it's an assertion you could easily test by first doing the remote hack in a controlled environment (e.g. a racetrack) and seeing if automakers respond before trying this on an actual freeway!

If you read the article, you'd know full well that the researchers already did test these exploits in controlled environments and presented these tests to auto manufacturers. Said tests were dismissed by said manufacturers.

I've read the article. Where does it mention controlled environments? The only mention of exploits being dismissed by manufacturers was in regard to a wired exploit, not a remote one.

The paragraphs after the photo of Charlie Miller describe the process of identifying and isolating wireless exploits, including remote-activation of windshield wipers on a vehicle in one of the researchers' driveways. This did admittedly escalate quickly to passive "tagging" of vulnerable vehicles by VIN, but that's a far cry from the experiment in question.

The findings before physical tests (identifying cars with a lack of airgapping or other basic security measures) were also reported to Cadillac (as one example among others); said findings were basically dismissed with a "well we've already released a newer Escalade model with some more security features, so whatever".

This isn't to mention that the wired exploits should've been enough to at least spark some level of concern.

You're reaching.

First, there's no indication in the article that the researchers or Wired presented the remote windshield wiper hack to the car's manufacturer and that they subsequently ignored it.

Second, there is plenty of indication that the exact opposite is true. The remote windshield wiper hack occurred this June, whereas the article states that they've been working with Chrysler on this for nearly nine months and that Chrysler released a patch prior to the publication of this article.

Third, the Cadillac anecdote isn't really relevant here. For starters, it looks like they were contacted by Wired, not the researchers, so it's unclear whether they were contacted before the dangerous freeway demonstration took place. And while the mention of the newer model is a bit odd, the statement also mentions devoting more resources and hiring a new cyber-security officer, making it unfair to characterize it as a "whatever" response.

Sure, it'd be nice if Cadillac was a little more proactive here, but keep in mind that the researchers hacked a Jeep (made by Chrysler), NOT a Cadillac (made by GM). The researchers think the Cadillac is also vulnerable based on its feature set, but absent a specific flaw to patch and given the short amount of time since the initial demonstration (less than two months), it's unclear what GM is supposed to do here.

My point wasn't about Chrysler specifically. My point was about auto manufacturers in general (and I've made this clear from the beginning). By pinning it to Chrysler alone, you're also reaching, I'd reckon.

Also, it's worth noting that the root flaw here - a hole in UConnect - is not limited to Chrysler. The article mentions tracking and surveilling GM vehicles, too (particularly Dodge), which makes sense, seeing as a lot of recent Dodge vehicles have UConnect as well (per http://www.driveuconnect.com/features/uconnect_access/packag...).

> For starters, it looks like they [Cadillac] were contacted by Wired, not the researchers, so it's unclear whether they were contacted before the dangerous freeway demonstration took place.

The article doesn't actually say that. Infiniti was contacted by Wired according to the article, but the initiator of Cadillac's response isn't specified (as far as I can tell).

If they were contacted in the same manner as Infiniti, then it's implied that said contact happened after the wireless hack, since the Infiniti contact involves a notification that the researchers' predictions were "borne out" in at least one of the three of them (in this case, Chrysler).

Did you miss the link in the article to the webpage where you can already download a fix? It's not the manufacturers they were trying to convince.

If you want to get their attention, you demonstrate it on a test track, for a court, as part of a lawsuit against them, for introducing such dangerous features into their vehicles.

I've seen Mr. Miller present at Black Hat and have talked with him about my own vulnerability reports to automotive vendors (I worked with one about two years ago to fix a rather embarrassing remotely exploitable flaw). However, I do not support testing or demonstrating any of the flaws on open public roads. Unforeseen things can and do happen. If the reporter would have been rear-ended this wouldn't have gone well for either researcher & that's enough right there to justify not doing this on public roads. The term "keep it to the track" which is often applied to the automotive racing scene is more than applicable here. The general public already tends to have a negative view of security researchers and performing "research" like this just re-enforces the perception.

You did the right thing. This was completely irresponsible. I'm shocked that Wired, the author, or either of the researchers have yet posted a "we screwed up, sorry" statement.

It's a shame because this is an incredible story and the work they did was great, but what a completely reckless stunt they pulled. Totally unnecessary too, the story would have been just as effective if the demo happened on a test track or empty parking lot.

No he did not do the wrong thing. Reporting them is completely wrong. When we report the people who protect us, well this sounds like a plot to a movie. PS: in movies usually a lot of people suffer before the resolution

You are missing the point by a mile.

These people did the exact opposite. They put others in potentially mortal danger.

They could have killed someone's daughter, son, mom or dad.

Stop and think about that for 10 minutes before you continue posting with this unreasonable point of view. Would your mom, dad or siblings life be worth this test? Imagine they collided with this car and died. Close your eyes and imagine that for a moment. Imagine receiving that call. Going to the hospital. Seeing the, all torn-up and suffering befor they die due to the injuries.

And then you find out it was due to two fuckers who thought it'd be funny/interesting/whatever to disable a car remotely.

Imagine that.

To be fair, a good proportion of the blame -- and a very good proportion of my subsequent lawsuit -- would be directed at the car company whose negligent engineering made the wreck possible in the first place.

Although I do agree with you, I modded you down and the GP up in this case because appeals to emotion aren't the answer. Your post is a form of the "If it saves just one child" thought-ending pattern.

Who protects me from the people who think they are doing the right thing by endangering me?

I support your decision. Disabling a vehicle in uncontrolled conditions on a freeway is reckless, plain and simple.

"Before working with computers I drove tractor-trailers for a while and was lucky to achieve a million-mile safe driving award. I have a pretty good idea of the dangers here and I know that stretch of road well, I've crossed it many times."

Game, set, match.

I agree with your move. Not sure who else was supporting you so I figured I'd offer my support. This was stupid as hell and I'm sure was likely set-up/suggested by Wired as a shock film.

I can't say that I completely disagree with you but I do lack your faith in the authorities' ability to respond appropriately. I wouldn't mind if Beavis and Butthead recalibrated their ideas about how to conduct a demonstration. I also hope that they've edited the video for maximum effect, and that the reality was a little less exciting; but the fact is that a stalled automobile is an everyday occurrence that is about as mundane as mundane gets. Minor events such as this cannot be prevented in all cases, and therefore drivers absolutely must watch and be prepared for such an event. It wasn't the safest thing to do, but it isn't outside the normal range of "dangerous" events that one will experience on their commute daily, often more than once daily. IMO it doesn't increase the danger nearly as much as traffic patrol conducting a routine traffic stop on the freeway. If we're prepared to accept traffic patrol on busy freeways, then I don't think it's justified to treat a rare, even if foolish demonstration such as this one as anything more than a nuisance.

There's calling the police, and then there's publishing their phone number in the hopes of directing an angry mob.

Angry mobs are dangerous and volatile and can push prosecutors to overreact. And prosecutors and politicians love to overreact when it comes to hacking.

He published the number of the local law enforcement agency. That is not directing an angry mob, that's helping people voice their opinion to the people responsible for enforcing laws.

Bogging down the local police dispatch isn't a responsible way to voice your opinion.

Imagine: you're a local and you're trying to call the police. But, you can't, because the number is busy. Or you wait forever on hold, because people on the internet are angry about a reckless driving incident that happened weeks ago and that the police already know about.

OP called the police, that's enough. They know about it now. If you want to express your opinion, write the editor of Wired or, if you're really angry, the local district attorney.

I think the level of exposure comes into play here. I'm not sure there's enough people that will make that call from the crowd here to cause an actual problem, but if it's an emergency response number better to not risk it, so I do agree with your reasoning to a point. Perhaps directing people to call a number that is not expected to handle emergency requests would have been more appropriate (and I see OP has amended his comment to remove the number).

> I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up.

The fact you have included their phone number seems to me like you are instigating some sort of lynch mob.

If you actually though it was an issue you would have privately contacted them without telling the world.

Very childish.

This is a big story that the appropriate authorities will be looking at anyway.

You've seriously seen "dozens" of people killed?

Is it really inconceivable that someone who has literally driven tractor trailers more than a million miles has seen dozens of people killed in accidents?

No, not at all. I'm just a regular middle aged driver with perhaps 300k miles under my belt and I've passed numerous fatal accidents on the roadway.

I just sat back and tried to estimate (since of course, I don't have a CB in my car and can't follow traffic details like a trucker) but I'd guess I've driven past at least 5 fatalities -- and that's just fatalities I've noticed (body on stretcher, read about it on the news later, etc)

Many car drivers forget a basic concept of physics named inertia, which is the reason why heavy vehicles (ex. trucks) take ___too long___ to brake.

Emphasis in too long, because this is the reason why road signs announce dangerous sections of a road with even miles in advance.

Whenever I'm hauling >10K lbs with my pickup truck, I get most nervous going downhill through mountains. The only thing between me and hitting something are a thin set of brake pads on all four disc brakes and the extremely limited compression braking on a ~6L engine.

40,000 people a year in the US. I wouldn't be surprised at all if an experienced truck driver has seen dozens of dead people.

>I exercised my judgement and decided to phone the local Highway Patrol office.

That was rash. You called the police within an hour of reading this article? You didn't think it's possible the writer is embellishing or exaggerating the danger he was in here? As of right now, everything they've done has been done in good faith to try to point out the need for extra security.

Also, if they get arrested, even convicted of a crime, then what? You have two extremely angry researchers who know how to hack your car, and what, you're hoping some jail time might help them see the error of their ways and use more caution in the future? You can't see any potential problems if one of them feels vindictive about being jailed over your phone call when they weren't trying to do anything wrong in the first place?

While you may question the morality of notifying the Highway Patrol, your second paragraph doesn't address that issue at all. In fact, if you think that's how the security researchers think and behave, then I'd argue notifying the Highway Patrol was definitely the right choice.

EDIT: Formatting.

I suggest you view the video[1] that bengali3 linked.

1: http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005...

The journalist is lying. Carefully look at the tachometer when he says that he can't accelerate, it's running at normal speed.

That doesn't really mean anything. They "cut the transmission", which could mean they forced the vehicle into neutral. The accelerator may be supplying gas to the engine, but if the engine is not supplying power to the wheels, the accelerator will have now bearing on whether you accelerate.

Making factual statements contrary to how a situation was reported by those involved is fraught with pitfalls you can't anticipate, from things you don't know about. Until there's careful investigation, or the people involved recant or make factually impossible statements, you should be careful about making assumptions.

In any case, their reported actions are what people are upset about. If someone makes false statements about illegal activity and it results in the police showing up, they have only themselves to blame.

The part before that showed the tach dropping to zero. The cut away to the journalist talking about how he didn't have control then shows the tach at normal. It doesn't take a rocket scientist to tell that it's staged.

That's easily explained. If the car is indeed in neutral, taking your foot off the accelerator would result in a zero (well, idling, say 600-900) tach reading. Pressing the accelerator would result in a higher reading. This of course has no affect on the power to the wheels, exactly the same as if you are stopped and put your car into neutral and do the same.

I understand it's tempting to see a single bit of evidence and want to use it to invalidate an entire narrative, but is it so hard to accept that while editing could have made a situation less dangerous seem more dangerous, the inverse could be true as well? We really have no authoritative source of what happened other than the story put forth. The story may indeed be fabricated or subject to hyperbole in parts, but unless you have a source beyond what's here, you are not qualified to make that assessment from the little evidence presented.

"It says 43MPH but I'm not going that fast"does make me wonder if the display remains accurate after the engine is cut.

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior.

But putting many lives in danger is considered acceptable behavior by security researchers? Does it actually matter that it was security researchers? Do security researchers working on banking software need to steal a million dollars in order to prove that they've found an issue? Would calling the police be acceptable in that situation?

Actual outrage is acceptable when there's actual danger. Calling the cops on a loud neighbor might not be acceptable, but calling the cops on a neighbor firing a gun in the general direction of your house certainly would be.

> But putting many lives in danger is considered acceptable behavior by security researchers?

We don't know, for sure, what happened. There might be some creative license in the journalism. There might be some omission of them talking to authorities (even if someone called the highway patrol and they said "oh, we don't know about this," all it proves is there's bureaucracy at the highway patrol). etc.

Calling the cops is invoking a powerful and hard-to-control force. Unless you think that the cops and the legal system are capable of talking to people fairly and understanding security research and making sense of tech journalism and reaching a reliably just outcome, there are better ways to exert your outrage.

For instance, the researchers are very well known in the security community. They're not rogues or mobsters or fugitives. If they recklessly endangered lives, we can pressure them to turn themselves in to the legal system.

I happen to have more faith in the ability of the hacker community to fairly figure out what happened than the legal system to fairly figure out what happened. If I shouldn't, then we have a serious problem as a community.

Your post basically boils down to:

1. You don't trust the police/legal system.

2. You trust our own community more.

Not saying I agree or disagree, but there are a LOT of people who would really disagree with this, and a lot more who would think that someone saying "why involved the actual people the public has chosen to deal with this, we can deal with it ourselves" would be very wrong.

It's hard to imagine how anyone familiar with any part of the police/legal system's pattern of clueless, ham-handed, hierarchy-ridden interaction with technology over the last 30 years could find justification to continue extending them trust.

So what are we supposed to do instead? Rely on self policing by the individuals or the industry? The the police or judicial system is off track, you attempt to correct them, not ignore them and route around them. That may unfortunately end up with injustice for some while the correction is ongoing, but that's the normal state. There's always correction that needs to happen, and there's always injustice, that's the normal state, the point is to try to minimize the injustice as much as possible. Ignoring the built in mechanisms for steering the government in the right direction doesn't yield a better situation in the end.

"So what are we supposed to do instead" and "Do I trust the police right now" are different questions.

I don't like the fact that I trust self-policing by any community (even my own) more than the institution that is supposed to be doing policing. But whether I like it doesn't affect things.

I agree that it is important for us, as a free society, to fix policing. In the meantime, the best way to minimize injustice is not to invoke police when there is no immedate threat that can't be otherwise solved.

This is exactly why I don't think self policing is suitable. If someone broke the law and endangered other people, you or I as possible community members should not be able to decide no police action is involved when others are the people that were actually endangered. Do the people on the road during this situation not have a voice? We are not incentivized correctly to handle this situation suitably.

The police and judicial system sometimes have conflicting incentives as well, but at least they are aligned more with the public good than ours are. There are laws and they are, for the most part, rewarded for enforcing them.

>Do the people on the road during this situation not have a voice?

Of course they do. They can call the highway patrol or 911 and report a disabled vehicle. Let's imagine how that call would go.

  911: 911, What's your emergency?
  Driver: Hi, there was a vehicle travelling slowly on the freeway with its emergency flashers on, I had to switch lanes.
  Pause...
  Driver: Hello?
  911: Sorry, I was waiting for you to finish. Was there any other information? Did the driver or occupants appear to be in distress?
  Driver: I don't think so, he was alone and appeared to be talking to someone, perhaps on hands-free, or maybe On-Star?
  911: 911 is for emergencies only, in the future please report events of this type to local authorities' non-emergency number accessible via 411. Goodbye.

Exactly. In this situation, the people on the road have less information that we do after the fact. People deserve to know if they were put in danger and why. Since this was done on a public highway, anyone that uses public highways has a right to feel upset about the behavior.

I would like to think that a call to 911 with more information (which of course a fellow driver wouldn't have) would be handled differently:

  911: 911, What's your emergency?
  Driver: Hi, someone on the freeway has purposefully disabled their vehicle in a location without shoulders, and is slowing while driving, impeding traffic.  I'm not sure if the power brakes or steering are functioning, but the driver is definitely not in full control of the vehicle.
  911: We've dispatched an officer to your location.  Has there been an accident yet?  Has the driver recovered control of the vehicle?

With other recent news releases about insiders being fired in internal affairs departments for findings against the police, I believe, we must assume that the police are self-policing in their own right.

If an angry bear is terrorizing your campground, then yes, call fish & wildlife so they can shoot it with a tranq dart and haul it off somewhere safe. In the meantime, though, do you go about your life as though nothing is wrong? Hell no, you get the fuck away from the angry bear!

And tossing chocolate bars into your neighbor's campsite in hopes that the angry bear will wreck their stuff is just not cool.

I agree, but I fail to see how that relates to the current context.

Unless the unruly bear is these security researchers, the fleeing campers are other security researchers in the same field, and their fleeing is them correctly assessing that some LEA is going to be taking down any bears nearby that even twitch wrong after this.

Bad actors ruin it for everyone.

It is true that bad actors ruin it for everyone, and that's why it does not make sense to interact with cops if you have any way of avoiding them. You have no way of knowing which ones are the bad actors until it's too late to do anything about it, and you have no recourse once they have decided to mess with you. Furthermore, they have effectively unlimited resources when it comes to making your life difficult.

You seem to think that because the police are theoretically under democratic oversight, that one can safely interact with cops as though the nominal rules of engagement will restrict them, but even if - in the long run - it is possible to rein them in, the law enforcement system we actually have right now is unpredictable, unjust, and unsafe.

If you don't want to interact with the police, you shouldn't do illegal things, or present your actions as possibly illegal.

If you distrust the police to the degree that you think even if your actions weren't illegal you will still have negative consequences from interacting with them, definitely don't do the above.

When someone's actions extend to endangering the public to the degree we see here (which I think is obvious once you've watched the video), they are past any good will I would have extended them in not contacting the police for fear of an overreaction. Their clear disregard for public safety is reason enough for me.

Additionally, on the chance that it was entirely intentional and they are counting on the media and possibly even law enforcement response to help make this an issue, they they definitely don't need our restraint, and nor do they want it.

Dude, have you not been paying any attention to the War on Drugs, or the Ferguson thing or really any of the Black Lives Matter stuff? The cops will fuck with you if they want to fuck with you, and they will write up whatever paperwork they need to write up to justify it afterward. The courts will believe their testimony by default. The only way to get around this is to release video afterward showing that the cop lied on the stand, and even then the best you can hope for is an overturned conviction; the officer is extremely unlikely to face any consequences. This is the system we have.

It does not matter that we theoretically have democratic oversight. In practice, what we have is a system where cops can do whatever they think fit and expect to get away with it. They are armed and dangerous; it is not safe to interact with them. It is not a good idea to call them, or to talk with them if someone else calls them, because they - the cops - have a clear disregard for public safety when it is counter to their own interests.

You see, the thing is some of us still believe the the police are staff by people, not some faceless conglomeration of drones that all follow the same horrible behavior, and that while there are some, probably many bad police officers, and many systemic problems, they still serve a purpose, and that life without any form of law enforcement would be a big step back in many, many ways. The amount the media reports on something often has no bearing on how common it is.

If I was robbed, I would call the police. If I saw someone waving a gun around in public, I would call the police. If I saw someone using a car as a weapon, I would call the police. If I see a situation where people are endangering the public and someone might get hurt, I would call the police. Not doing so when I clearly knew I should would make me feel somewhat responsible for any negative outcomes otherwise.

I'm not really interesting in continuing a discussion where the other side's position seems to be "the police are racist scumbags and they will ruin your life with the slightest contact, so don't call them on criminals." You might find that characterization unfair, but then again, you're the one over-generalizing using large media events as evidence instead statistics.

Edit: Removed reference to ad-hominem, which wasn't factually correct.

> you're the one pulling an ad-hominem on the police

While I agree with much of the rest of what you right in that comment, this is not accurate: overgeneralizing a negative stereotype of someone other than the other party in a debate isn't "pulling an ad hominem".

That kind of argument is generally considered to be 'poisoning the well' -

https://en.wikipedia.org/wiki/Poisoning_the_well

You're right, so I'll update it to reflect your wording, which I think is clearer, and actually correct.

Have you seen the damage being caused by "hackers" lately? I don't trust the police, but I don't trust my fellow hackers any more, especially when you consider their clueless, ham-handed interaction with the general public over the last 30 years.

Hackers can steal your money. You may be able to get reimbursed, depending on how they did it. The novel thing about this Jeep story is precisely the fact that hackers are demonstrating an ability to do something worse than stealing money.

The cops can wreck your house, break your stuff, take your money, shoot your dog, deprive you of your liberty, and - if they think they can get away with describing you as a threat - shoot you dead. Even if you spend the time and money it would take to prove in court that all of this activity was illegal and unjustified, most of the time you'll fail, and even if you succeed you'll never get anything back.

I don't trust hackers or cops, but I can sure as hell see which one is the bigger threat.

It's not really novel because hackers are having a physical presence, it's novel because hackers are attacking cars. Even then, it's novel because hackers are remotely controlling cars. They've been able to unlock your car and drive away with nothing but their Android phone for years.

Meanwhile hackers can break into the control systems for the power grid and shut down electricity, causing major damage. They can open or close hydroelectric dams, causing flooding and death. They can control hospital systems and kill or injure patients. They can control the airplane you're riding on while sitting in their seat. And all of these have been demoed at security conferences I've been to. I've seen these all in person.

There's a lot of physical harm that hackers can do. Sure, with a cop it's more personal since they're standing there in front of you pulling the trigger and a hacker doesn't even have to see your face.

Love them or hate them, both hackers and cops exist for a reason and are not going anywhere any time soon. One of the reason hackers exist is to point out dangerous security flaws like this. One of the reasons cops exist is because sometimes hackers are just as dangerous as the actions they're trying to draw attention to.

If there's been journalistic licence employed then they should be able to demonstrate that to the authorities since the entire footage was recorded. So there isn't an issue.

It also should be noted (since nobody else has raised this point) that some people within the police force likely read Wired anyway. So complaining about the police involvement for a piece posted to a popular news site is like moaning that your boss reads your Twitter feed.

If only there was some agency or agencies responsible for investigating possible illegal activity, we could have contacted them instead, and then they could investigate the matter with the input of the judicial system, interview the people involved, and come to the appropriate response.

After Alice Goffman, a publication with this kind of journalist involvement has to be seen with a certain suspicion.

Slowing down and eventually driving off on to a grass shoulder wouldn't even crack the bottom 1% of crazy shit I've seen people do on highways, on purpose.

IMO, the danger to the public caused by the researchers somewhat-controlled exploit is utterly dwarfed by the danger Jeep/uConnect is causing by directly connecting its cars to the internet. If the researchers are successful in getting car manufacturers to remove features like this entirely, the net result will ultimately save lives.

> Slowing down and eventually driving off on to a grass shoulder wouldn't even crack the bottom 1% of crazy shit I've seen people do on highways, on purpose.

The article claims that the transmission was cut on a section of the freeway with no shoulder, so I'm curious how being stuck in the middle of the freeway translates to "slowing down and eventually driving off onto a grass shoulder." (And just because something "isn't the craziest thing I've seen" doesn't mean it isn't dangerous)

>'Slowing down on the freeway'...

With or without shoulder, a stalled automobile is an everyday occurrence that drivers must absolutely watch and be prepared for. It wasn't the safest thing to do, but it isn't outside the normal range of "dangerous" events that one will experience on their commute daily, often more than once daily. IMO it doesn't increase the danger nearly as much as traffic patrol conducting a routine traffic stop on the freeway. If we're prepared to accept traffic patrol on busy freeways, then I don't think it's justified to treat a rare, even if foolish demonstration such as this one as anything more than a nuisance.

Grass shoulder: http://www.wired.com/wp-content/uploads/2015/07/IMG_0724-102...

I agree that it probably presented some level of danger to the public, but I maintain that (i) the added danger was small relative to the normal everyday danger of driving with humans; and (ii) the media exposure they've achieved by doing this on a public road has the potential to pressure Chrysler to remove tens of thousands of hazards (read: vulnerable Jeep Cherokees) from the road, which could ultimately reduce danger and save lives. It's not clear-cut when you're dealing with a vendor who chooses to ignore and/or litigate upon an initial disclosure instead of fix their product.

I think the point is that you, and the researchers, have no right to make that decision for other people. It's illegal to purposefully stop in the middle of the highway. It's illegal to cause someone else to do so as well.

People who routinely test things that have the capability for real harm learn to take precautions for as many of the the things you don't think off as you can. For example, the Mythbusters are routinely testing things with cars and other bits of machinery that can cause physical harm if something goes wrong. They also routinely retire to abandoned airforce bases, remote locations, and the salt flats to test things.

Point taken. Maybe I'm just being horribly jaded and/or emotionally invested from too much driving, but after a while it gets hard to discern malice from incompetence, and you start (wisely or unwisely) worrying more about actual outcomes than intent. If I'm hit by a security researcher or a drunk driver or a million miler who had one black swan of a bad day, the result is the same to me: I'm hurt or dead.

But perhaps a little more objectively, there's certainly a moral hazard here; if every security researcher did this on public roads it'd likely be chaos. An appropriate response, IMO, would be for the police to make a phone call and tell them not to do it again.

I agree, I don't necessarily want them to go to jail, but I would be happy if they were suitably scared shitless for a while as the enormity of how bad they fucked up (if the facts are as they seem) hits them. Part of the benefit of the extreme reactions from the people here is that future security researchers working on interactions between software and hardware appliances that may pose a physical threat will have an example of exactly why you should show your proof in a controlled environment.

It's actually not that different than pure software security research. You don't show a POC for your new DNS exploit by doing it against Comcast or AT&T public DNS servers without expecting some blowback. You set up a test environment.

> the danger was small relative to the normal everyday danger of driving with humans

The danger of a car having its transmission crap out on the freeway is non-zero, yes. On the other hand, they explicitly cut a vehicle's transmission on the freeway. The danger for the people in the immediate area of this vehicle was increased because the situation (a cut transmission) went from "maybe it will happen" to "it is definitely happening." At that point, whether or not an accident happened depended entirely on the skill and attention of the drivers around this vehicle something completely out of the control of the researchers.

That photo is next to the parking lot where he "found an empty lot where [he] could safely continue the experiment" and then "they cut the Jeep’s brakes, leaving [him] frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch"

Not the highway.

FYI, here's a link to a video[1] of the situation (which bengali3 posted up-thread). The grass shoulder was later, cutting the power was actually done on a fairly busy stretch of highway with no shoulder. The reporter's words during that incident are particularly telling.

1: http://dp8hsntg6do36.cloudfront.net/55ad80d461646d4db7000005...

The hackers' behaviour was utterly reckless.

Demoing it on a test track with no other vehicles and a volunteer driver with helmet and roll cage -- that'd be acceptable, maybe, with suitable safeguards.

But doing it on the open highway with unaware third parties driving past, merely telling the test guinea pig "not to lose control" while being blasted with cold air and loud noise, having the controls disabled, and visibility impaired? That's gross recklessness with public safety. (Here's a clue: you could have put me in that car and given me all the warning in the world and I could not guarantee maintaining control or not causing a potentially fatal accident at 70mph under those conditions.)

You shouldn't run experiments on big powerful machines in public places where you can't keep by-standers out. Gross ethical breach. I just hope the journalist is exaggerating or making things up.

To me it seems like it is gross recklessness with public safety from car manufacturers. The car manufacturers are risking lives of all these people by not keeping the air gap between CAN and Internet...

It can be both, security researchers don't get a free pass just because they are exposing a wrong.

Had someone died you might (in countries which have it) get corporate manslaughter on a company that ignored security warnings. You absolutely would on the researchers and the journalist for their reckless disregard for the lives of others.

Yes, researchers don't get a free pass. Nothing is free. They've risked lives and their reputations to save lives. It had happened before in the history. And hopefully it will happen again. Some times it is worth it.

(*) without risking lives there wouldn't have been a video documenting these life-threatening vulnerabilities in the cars.

Rubbish - there would be a video of them on a test track. Much like all the videos proving quite how fast the cars can go. You don't drive a McLaren F1 at 240mph on the Interstate and post it to Wired expecting to get away with it...

They did not only risk their own lives. They put other people around them at an increase risk when it was unnecessary. That is the argument, that it was not necessary. This same demonstration could have been done on a track or other controlled environment where the public was not in danger.

I don't know where the threshold is, but calling yourself a "security researcher" is not a blank slate to do whatever you want.

I think it's 100% OK to test on a private car on a private track.

Or test on an official research highway such as Virginia Tech's Smart Road: https://en.wikipedia.org/wiki/Virginia_Smart_Road

Had my car stall on the highway once. Pretty scary because you lose power-brakes and power-steering as you're trying to pullover.

Was it a hacker? Nope, just a dumb mechanic that got trash deep into the air intake during a routine oil change.

How many (dumb mechanics)*(routine oil changes) are there in this country? Five-Six orders of magnitude more than auto hackers, which is why I don't see any harm in one more (where the driver knew ahead of time it was going to happen).

Cars aren't toys. Just because there are many stalls doesn't mean adding one more becomes acceptable.

Here's the good test: since humans were involved, how did they present this to their ethical review board?

I'm pretty confident the answer would be "what's an ethical review board?".

DARPA don't need no ethics board.

The difference is your 'dumb mechanic' made an unintentional mistake.

These people, on the other hand, knowingly and deliberately disabled a car on a highway. Yes, they had a plan, but they are still running their little experiment on other unwitting drivers on the highway. I don't consider the manner in which they ran their test to be ethical; it should have been performed on a closed track.

I will point out that the car didn't stall. Power brakes and power steering weren't affected. The transmission was forced into neutral which did affect his ability to accelerate. Still reckless and stupid. And probably worthy of a call to the police -- though debatable. I don't understand why they didn't just test this in the drive way or on jackstands or at a track or on a dyno. Driving the car on a public street was not needed.

Your recklessness is judged by the extra harm risked.

You can't just waive it away because other risk is more dangerous across the entire nation. Under that standard: One little murder is a rounding error compared to the 2.5 mil who die each year.

The fact that the driver knew ahead of time does mitigate the danger but does not excuse the remaining danger. The fact that there are already lots of dangerous stalls seems completely besides the point to me.

Bad calculation. One auto hacker can shut down all vulnerable cars simultaneously.

They did test in controlled environments previously, according to the article. Said tests were ignored by the auto manufacturers.

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. A much less aggressive (and thoughtful) move would be to contact the researchers directly. Wow.

What would contacting the researchers achieve? They arbitrarily did the experiment in a public highway "to make the headline more shocking".

As much as I support any kind of security research, and as much as I support getting the attention of people to raise awareness, contacting the authorities was the correct move; a public highway is not a research lab without the proper permission from authorities.

>Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior.

There is even a bigger problem. These researchers, even if they were negligent, are far more at risk of legal punishment for creating a small risk for the sake of increasing safety standards overall than the people who choose to cut security funding and put magnitudes more people at risk for the sake of making more money.

Isn't it odd that we have a legal system where the ones attempt to expose and fix the problem for the sake of safety are facing far greater legal trouble than those who knowingly allowed for the problem to first occur due to increasing profits?

I think researchers should have complete 100% legal cover if they test private vehicles and private roads.

But as someone who says the car manufacturer ought to face legal consequences for failing to fix a remotely exploitable stall-out in a timely manner (even without demonstration of anyone being harmed), I also say that people who fuck with moving cars on the road are a menace as well.

Depends. For example, in some states, it's still illegal to put someone intoxicated in a car driving on private vehicles on private roads.

http://www.lawyerinlongbeach.com/Torrance-DUI-Attorney.html

We could easily reverse that reasoning:

Security researchers should only be liable for potential risks if we manage to hold those companies for potential risks.

If we fail to do the latter it's quite unfair to let individuals bear the brunt of legal enforcement.

Unfair but also of great benefit to the corporations creating products with security holes. It reminds me of 'identity theft' where the average citizen bears the risk due to the poor verification practices of loaning institutions instead of the institutions who create the risk as a byproduct of profiting off making the loans. If anyone thinks this is accidental, you should contact me as I have a great deal on this new bridge that is about to hit the market.

A small risk? Disabling a car on a busy highway is not a small risk.

What about this "experiment" could not be done in controlled environment on a track… or a country road… or an empty parking lot.

I suppose we could just have infectious disease researchers set up shop on a street corner by this logic. Whatever! It's just a small risk! They're doing it for the sake of increasing safety standards!

Small compared to the risk of under-funding security research as a cost cutting measure knowing that weaken security will allow for these exploits to occur.

Using violent methods (such as intentionally sabotaging a car on a busy freeway with someone in it) to get media attention in order to further a political goal sounds a lot like the definition of terrorism.

Only if your sense of scale has stopped functioning. It is a dangerous journalistic prank that probably does deserve a telling off from traffic cops, to much the same level as someone who is drunk driving. But I think trying to classify it as terrorism is not helpful or particularly sane.

Seeing as how drunk driving kills a very large number of people every year and is now punishable by imprisonment and extremely steep fines, you might be onto something here.

If people were screwing with cars like this as often as drunks were driving, I think you would end up with mortality figures that were at least in the same ballpark.

At what scale would you consider it to be terrorism?

To my mind, it would have to be some form of an attack, if untargeted, at least hundreds of cars, and if small would have to be targeted and strongly political, dangerous stupidity in a single instance for the purposes of having a good press story, doesn't qualify as either causing terror, or having an intent to, notwithstanding the broad legal definition that has been adopted over the past 15 years.

OK, just making sure I follow: They should exploit security holes and put people at risk to ensure that security research is not underfunded, which could lead to someone exploiting security holes, which would put people at risk.

Your argument would make sense if all exploits were equal. Think of it more like infecting people with weakened/dead forms of potentially deadly diseases so they will be better protected against that disease. The weakened form, while it may not be risk free, is not equal to the harm of a full own infection.

> Think of it more like infecting people with weakened/dead forms of potentially deadly diseases so they will be better protected against that disease.

If these guys want to be regarded as researchers, they need to act like them and be accountable like them. No ethics committee would ever approve a test like this.

The IRB as it currently stands it too strict with its regulations. Also, why should the researchers be regulated when the ones producing the things that are initially putting people into danger are not regulated (or are regulated by bureaucrats who couldn't tell you the difference between a buffer overflow and a SQL injection).

> The IRB as it currently stands it too strict with its regulations.

WTF are you talking about? There is no the IRB.

>The IRBs as they currently stand are too strict with their regulations.

Better?

So they should get away with it to ensure that their funding isn't cut? I'm intrigued what you'd consider a "big enough" risk that they should face punitive measures.

It doesn't strike me as so odd, and your framing of the situations doesn't strike me as particularly conducive to honest discussion.

The people who "choose to cut security funding" (I'm assuming you mean congress?) acted within the bounds of the law and within their power as elected officials. They broke no laws and your disagreement with the results does not make them criminals.

I don't know if these researchers broke the law. All that's happening now is they are being investigated. If they did break the law, then it seems to me perfectly logical that they would be in "far greater legal trouble" than someone who didn't.

TL;DR it's not odd that someone who broke the law is in more legal trouble than someone who didn't

"A much less aggressive (and thoughtful) move would be to contact the researchers directly."

Not conducting this demonstration on a public highway would also have been a much less aggressive and thoughtful move, not to mention less dangerous.

Finally some IT guys getting how the press works and now you want to change their story to something like "how I hacked a car in my backyard".

I understand why they did it this way, and I'm glad that this issue getting more publicity. But that does not mean that the means they chose are justified by the end of greater publicity. They simply did not have the right to endanger the other people on that road without their consent.

It's particularly because getting big headlines is so enticing and intoxicating that research labs have review boards.

Test pilots work from very careful plans in order to gradually test the envelope of huge powerful machines filled with explosive fuels.

Their test-engineers don't say "hey, we're going to do some stuff, but try not to kill anyone".

Gross negligence.

Perhaps you are simply unaware of how dangerous the situation was? Several experts (ex-truckers) have described how they have seen people killed in circumstances like this. If you're being intellectually honest, that should inform your responses.

What would be more thoughtful is for the researchers to plan this better. I think calling the police was the right action in this case. Why do researchers get a free pass? If it were some pranksters publishing the exact same thing on youtube, would you still consider it unacceptable behaviour? No, what I find unacceptable is your hypocrisy in trying to shame the guy who did the right thing.

Reminds me of people who will call the police on a loud neighbor instead of just, you know, talking to them first.

This isn't just a loud neighbor. This was a drunk loud neighbor waving a loaded gun around.

The driver was clearly distressed and they were just laughing it up.

No, these are knowledgable security researchers doing serious work who are probably amenable to discussing their research methods with concerned party via email or phone instead of the concerned party immediately phoning the police.

I don't agree. They breached their own covenant, which doesn't afford them the benefit of the doubt you might assign to 'knowledgeable researchers doing serious work': "We won't do anything life threatening." Then they did precisely that: they disabled the transmission on an uphill freeway ramp with no shoulder, with a very large truck bearing down on the Jeep. Trucks cannot stop quickly. Substantial danger for the driver, the trucker, and everyone around them.

Doesn't matter who they are. They have a loaded gun in their hands. Use it somewhere private or not at all. Anything else is unacceptable and extremely dangerous.

Well, let's just have these guys arrested for marauding around the freeways with a "loaded gun" and we'll let the Russian hackers figure out the Cherokee's vulnerabilities.

You honestly don't think these "security researchers" did anything wrong? They could have easily demonstrated the same vulnerability on a private course and made the same point, no need to recklessly endanger everyday people.

You have not met our neighbours! Drug dealers, they run a vehicle repair 'service' from their garden despite local council enforcement notices. They regularly have fights in the street, my wife has been verbally abused and followed on numerous occcasions and there have been two police 'drugs raids' that have resulted in absolutlely nothing useful happening. I could go on, but it's not relevant.

This has no bearing on the original issue ('Calling police on security researchers'), but I'm just saying that you can't debate nicely with everyone.

You're certainly right, you can't debate nicely with everyone. Is there evidence here that the researchers in question aren't open to critique or aren't willing to discuss the safety issues involved with their research methods?

So, you don't care about the fact that this experiment on public roads could have killed people? Just because it's for security research it's ok to recklessly endanger lives? What Wow's me is your cavalier attitude, I'm glad he informed the police and I hope they face repercussions. What they did needlessly endangered people's lives and public safety to add a sensational bit to a story, I find that way more "aggressive" than informing the proper authorities of those actions.

This is like testing the new trigger safety on a gun by firing into a crowd. Its incredibly negligent and unethical. That section of i-64 is very busy and the police should get involved.

> Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior

> they cut the transmission. [...] Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed

In what world do we not call the police on this kind of behavior?

>unlike the typical TPMs that only allow vendor software to be authenticated, these TPMs would allow the user to directly authenticate the firmware. If you know the firmware is good, then each layer can validate the next layer up all the way to the OS.

nothing novel there in terms of having to have some "new" TPM. Just OEMs choose to lock down their boot chain. Probably most secure boots are minimally implemented to only support the use case of secure/trusted boot (device/chip/OEM key) xor untrusted boot (no key).

If both are supported, whatever functionality that relies on OEM firmware or chain of trust would be disabled if it is an untrusted boot (like fastboot oem unlock for some android devices) situation.

May be tricky to enable certain desirable/required features if user wants to run their own firmware.

>I have yet to hear of a system that allows the user to directly authenticate software/firmware at the hardware level. Is anybody working on research of this nature? Or are there insurmountable problems with this approach?

I think chromebooks/chromeOS folks have been looking at this. Not sure of the current state of things.

p.s. TPMs kind of suck if they are not able to be updated OTA.

The security researches behaved irresponsibly by performing this demo on a public highway, especially one with no shoulder. They could have driven around a private track just as easily. Performing the test on a public road endangers the journalist, other drivers, emergency assistance personnel, etc.

I'm not for agitating the authorities on this one. Sometimes security research like this requires a little performance art to get the message across. Guys like Elon Musk just need a proof of concept to modify his designs, incumbents like Fiat Chrysler need exactly this. Remember Toyota?

Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior.

Who cares what their job title is? They deliberately blocked visibility and then cut the transmission of a vehicle being driven on a public road in traffic. That is well into the territory of criminal negligence.

Same here. Posts like these make me take the effort to log in just to downvote. Sad to see such a mindset to gain so much traction.

Calling the police was completely inappropriate, but downvoting the comment as a way to signal your disapproval with his action in the real world isn't helpful. The comment itself is well written, on topic, and leading to good discussion.

I agree with what others have already said: Since nobody was actually hurt he should have contacted the researchers to make his point.

Right, yesterday my neighbor shot a gun at me several times but since he missed and no one was hurt, it would have been utterly inappropriate for me to contact the authorities.

Being shot at (intentionally or otherwise) is entirely different than a car in front of you slowing to a stop.

One problem with this reasoning is that the researchers really didn't know what they were doing with 100% certainty. Their code could have accidentally affected the stability control subsystem that most cars have nowadays -- the one that's designed to apply full braking to a single wheel to recover from a skid. In fact, just corrupting the data from the steering-wheel angle sensor could have had that effect (which I personally find rather terrifying in itself.) Good job, guys, now you've caused a 70 MPH rollover in traffic.

The right way to do this would have been for the researchers to call the police up front and arrange a demonstration on a closed road with police escort. That would have lent the video more credibility and shielded the researchers from liability, while addressing any concerns about safety or ethics.

Firing a gun at someone is dangerous. A car slowing down and/or with reduced visibility on a busy highway is dangerous. Then either of these situations happen by accident, we understand that there's not a lot to do about them because there was no intentional behavior that needs correction. When they are purposefully done, that's endangering people, and is unacceptable behavior that needs correcting. In this respect, they are no different.

It is a never ending discussion around here but my take away is that votes express opinion as well as quality of the posting.

We are here not an intellectual debate club were people take pro and contra sides and points are distributed based on the rigor of the argument, but discussions around here are about real world problems.

And somebody calling the cops on security researchers just because he read an article on the intern is in my view highly questionable behavior for somebody familiar with the tech community.

Reply on news.ycombinator.com