Hacker News Reader

Comment by skimmas | Hacker News Reader

One got to love bright minds who ever thought connecting any relevant part of a cars control mechanisms to the internet was a good idea.

View on HN

It's not just internet. There's also a vector that uses Digital Audio Broadcast (radio).

source: http://www.bbc.com/news/technology-33622298

Doesn't Tesla send over-the-air updates for critical systems to its cars? From my understanding, that means there is a way for a similar attack with a fake-firmware. Am I wrong?

Pretty sure Tesla signs their OTA updates.

Not that that's perfectly secure

Yeah, it's only as secure as Tesla's ability to secure its private key.

And their ability to verify the signature on the car. Even if the private key is totally secure, you could either find a weakness in the signature verification, or find an exploit that lets you bypass it entirely.

That's an extremely rare vector for exploitation. I can think of one specific case where a vendor completely forgot to check the result of a signature check, but aside from that signature checking is well understood and rarely goes wrong.

But to be honest people are taking their specification and dooms-day-ism to stupid extremes. Soon we'll be talking about "it is only as secure as the CPU, what if you find a CPU bug and bypass all security?!"

> signature checking is well understood and rarely goes wrong

I would argue otherwise, plenty of signature schemes give you enough rope to hang yourself. The Playstation 3 example springs to mind!

Signature verification for android applications has been a tough one: http://www.saurik.com/id/19

There's plenty room for bugs in mechanism like that. For example Motorola Droid (back in 2010) was locked and only accepted signed updates. There was a bug where you could bypass it by using authentic update and appending your payload at the end of that file.

Interesting, can you point me to a news article or link? Shouldn't that have been rejected as an improperly signed file as (update+payload) should have a different signature than (update)? I'm want to know whether I'm misinterpreting something, misunderstanding something, or the signatures were misimplemented.

Only the header was signed – that was the issue. It was made to save computational power on the device.

The original forum where it was posted doesn't exist anymore and there doesn't seem to be archived copy.

Here's another page which is describing the steps: http://www.areacellphone.com/2009/12/motorola-droid-rooted-h...

Here is the commit with a bug fix: http://review.source.android.com/12807

and actual diff: https://android-review.googlesource.com/#/c/12807/1/verifier...

Yes, but I don't think skimmas is fully right. Updating firmware over the internet is not a terrible idea. Public key decryption is well established technology and simple enough for even big corporations to get right.

Of course.. there's some room for them to screw up, but I would argue that that's set off by the risk of having buggy vehicle control firmware killing people. Especially with a new vehicle like the Tesla.

There's also such thing as "key stealing". I imagine it would be quite a valuable target.

When you're signing a binary blob, protecting the private key is actually pretty easy since it can be air-gapped/offline. Or heck you can buy appliances where they'll perform specific functions using the private key but won't expose it themselves without physical intervention.

If I were a mega-corporation protecting a firmware private key, your name would have to be Tom Cruise to get it. Though unfortunately responsible corporations seem to be as rare as real-life Tom Cruise characters, so I guess it's a valid concern you have.

The ability to send OTA updates is a much better option than having to physically touch every single vehicle with a recall...

I'd prefer it if my car didn't have any connection between a public network and it's control systems, but if it does I want it to be able to automatically install patches ;)

Indeed, and I remember the vast majority of the people getting super excited at the possibility of "getting an OTA update that can improve your acceleration by 0.1s" - without realizing what exactly that means in terms of security. In particular, that others could also control your engine and car the same way through updates.

The car manufacturers who do OTA updates for their cars are sitting on time-bombs. The clock is ticking for them until people get killed this way (regardless of them using HTTPS or signed updates - which some manufacturers don't even use now).

yet it's an order of magnitude easier to just go buy the parts to a real 'time bomb' than to crack an OTA update. Security is relative after all, and evil geniuses have much better ways to kill you.

like open(not unlock, open) doors while you drive?

http://www.theregister.co.uk/2014/07/21/chinese_uni_students...

With self-driving cars, this is definitely going to be the norm, and this really draws attention to how dangerous they could be, although human-driven cars are also pretty dangerous.

Seriously. That's the real criminal action here.

The issue is the stupid media center. People want that to have Internet. Then at the same time they want it to display all of the climate details and other system info that comes off the CAN.

But surely they can be isolated systems

They can be but they're not. Once you share a wire all bets are off.

By that logic there's no security on the internet at all. Everything "shares a wire" after all.

Security is about degrees and nuances. These kind of black & white statements are unhelpful and unrealistic.

> By that logic there's no security on the internet at all.

Have you /been/ on the internet, lately? ;)

Two systems that accept input from the same touchscreen can't be isolated in hardware. From the software side, any portion of each system's interface that overlaps at the touchscreen cannot be isolated. On top of that, if the touchscreen is reprogrammable, then it can be attacked directly and touchscreens are commodity devices not normally considered part of the security infrastructure.

I don't think anybody is upset that their climate control system is exposed to hackers. There are no accelerator/steering/braking controls on the touchscreen (I assume) so those could be isolated but it would require having to separate systems for critical and non-critical operations. The only reason not to do that is because it's more complicated which translates to more expensive.

Exactly

The climate control isn't mechanically independent of the engine and other mechanical systems. Even in the primitive cars before digital contols, the heater is dependent on the engine's thermostat (well except for old Bugs and 911's, but then that heat never really worked). In modern cars, the AC may be connected to the engine control system so that power can be redeployed for fuel efficiency or for power in emergency situations or to keep emissions within specification.

"Climate control system" is an abstraction over belt driven moving parts.

> People want

Yeah, no. Auto mfr.'s want to reduce the display count to make cars cheaper to make and the interiors simpler to build. I've never ever spoken to or heard form anyone who 'wants' or even kinda likes having their climate controls on the same screen as their maps, pandora, etc. It's confusing, usually cluttered, and complicates things unnecessarily.

Have you ever been in a Tesla?

Then it should only read the CAN, or have a limited write capability

Customers want things, it's not their responsibility, it's the manufacturer's responsibility to not ship something unsafe

There are typically at least two CAN buses in many recent cars, one for critical stuff like engine, transmission, etc, and another for less critical things like environmental controls, there is also LIN, FlexRay, MOST, and maybe another one or two that are less popular.

One problem is that there is no limitation in the CAN protocol to prevent a node from impersonating the master node. Another is the mutability of a node's firmware.

It's all on the CAN bus anyway. That's how modern cars are built. And hey, if you don't like that, you can always fly on a plane... those surely aren't internet-connected, right? ... Right?

http://www.gpo.gov/fdsys/pkg/FR-2014-06-06/pdf/2014-13245.pd...

http://www.gao.gov/assets/670/669627.pdf#page=23

The Internet of Things has lots of bright minds working on it...

It's not just internet. There's also a vector that uses Digital Audio Broadcast (radio).

source: http://www.bbc.com/news/technology-33622298

Reply on news.ycombinator.com