Hacker News Reader

Comment by jacquesm | Hacker News Reader

> The company added that hacking its vehicles was a "criminal action".

I don't think that's the case, but I still commend them for doing a recall this quick.

Shooting the messenger seems to still be quite a strong reflex for corporations faced with bad news. The way to look at it should be that these guys did Fiat-Chrysler a service. After all, it's not only security researchers that have the ability to write code and that have prolonged access to a vehicle to test.

They seem to be mistaken about the time to write the code, after all, you can write the code and test it on a different vehicle than the one you intend to crash.

Law enforcement typically won't analyze the firmware of all the computers in a car after a single vehicle accident (and it would probably be quite possible to erase the evidence once the car has been given a command sufficient to kill the occupants).

View on HN

Shooting the messenger isn't just bad PR for corporations. It's deeply ingrained in most enterprise culture, and it's why problems like this occur in the first place.

You know that engineers on the ground were well aware of this vulnerability. You know they tried to warn. But what happened to the warnings? They didn't make it up to the executive levels necessary, because several layers in between feared for their jobs and careers if they said something like "This new feature you're demanding could be used to brick every single Fiat-Chrysler vehicle we make, or even murder people". So the executives were asking for features but flying blind on danger.

And ultimately, this is a failure of the executive structure and the corporate structure (and it's an inherent antipattern in large organizations). Since the nature of hierarchy is for subordinates to hide unpleasant truths from superiors, they should have been actively asking about the hazards. They could have hired outside security reviewers. But they didn't.

The language in the FCA press release (linked in another thread) is softer:

The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action.

So through the process of extensive journalism, unauthorized remote manipulation got turned into hacking vehicles.

It was hacking. They clearly proved they had control over dangerous parts of random vehicles.

> The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation[...]

Assuming that's not a lie, were they working on that because the 'researcher' (quotes due irresponsible 'testing') had been sending FCA what they found instead of their own internal decision to improve things and they knew this (specifically) was coming at some point?

It was hacking.

I'm not quibbling about that. I replied to this statement:

> The company added that hacking its vehicles was a "criminal action".

I don't think that's the case, but I still commend them for doing a recall this quick.

Which characterizes the statement in the article to be about hacking the vehicle at all. So my reply points out that the manufacturer was probably not putting forth that characterization when they talked about criminal action, they were likely talking about unauthorized remote manipulation (which should be and quite likely is criminal).

So my argument is that the manufacturer statement about criminality is narrower in scope than the BBC translation of it.

The software update release is obviously in response to the research:

https://twitter.com/0xcharlie/status/623492229714313216

Upgrading it to a recall is probably in response to bad press.

Yeah, bad press about the ability of someone to remotely kill you in their products.

>> The company added that hacking its vehicles was a "criminal action".

> I don't think that's the case, but I still commend them for doing a recall this quick.

It is illegal under existing laws. Basically, it falls under the same set of laws as cutting someone break line. You are, at a minimum, in the "Reckless endangerment" category.

It doesn't take new laws, the old ones have seen enough people doing stupid things to other people's cars.

It's not illegal to hack your own belongings. It may be illegal if you trespass on someone else's network to do so, or if you manage to provably put the public in danger, but merely discovering a security vulnerability and exploiting it in something you own outright is not illegal. Chrysler's statement is overly broad IMO.

I think the statement is more for the general public.

"if you manage to provably put the public in danger"

Watching the video, they did it on a public highway with other cars. They killed his engine when he was on the highway. He is damn lucky he wasn't rear-ended and killed someone. Yes, that is illegal and definitely endangerment.

This is crap stunt journalism.

... and the car slowly drifted to a stop.

The only crap stunts here are by the car company pretending to fix the issue and knowingly leaving everyone vulnerable.

... and if the car behind them didn't? You act like there's some sort of protective bubble because of this fact.

Then it would have crashed into any other car that slowed a little. Traffic speed changes with conditions and that changes constantly.

The issue is what the extra risk is compared to the baseline risk.

its extra risk because the jeep's engine was turned off by someone accessing the car's computer on a public highway in traffic with the vehicle in the right lane

What's the baseline risk? Did this triple anyone's risk, or increase it by 0.01%?

Then combine that with the recall it spurs. The value of a live highway hack is very high. It got all the media to pay attention and got a commitment to a fix. You're freaked out about one car slowing down in traffic. Imagine many of the 500,000 vulnerable cars simultaneously accelerating wildly all across the nation if this was actually exploited.

What's the risk of doing nothing? Or of wasting years more with ignorable private disclosure?

"You're freaked out about one car slowing down in traffic."

No, I'm pointing out an idiot reporter endangered his fellow citizens to create hype instead of doing the reporting in a safe environment. Your the one who seems to be trying to justify endangering people to report someone else is endangering people.

The demonstration could have been done safely and effectively on a rented race track. It happens all the time when you want to test something around motor vehicles. Instead he went for cheap and sensational.

The extra risk is slowing or stopping when people don't expect it. Unexpected things cause collisions. There's also extra risk in creating an obstruction, which creates risk for other drivers.

There's no doubt that driving is inherently a terribly risky activity. But I also don't think that pretending that taking your foot off the gas on a highway is a risk-free activity is particularly helpful.

...on the right lane of a highway - which is mentioned in the video as he has no way to get off the road

This happens all the time as part of normal driving. It's not like the car stopped suddenly, or veered wildly, etc.

Some traffic may have backed up for a minute until he restarted the car.

When it happens, it is an accident, not the intention of a third party. Arguing it can happen accidentally isn't a defense against endangerment.

>It's not illegal to hack your own belongings

Doesn't the DMCA make that illegal? Isn't that the big fuss about John Deere tractor fixing and the like?

There should be push back against the idea it's inherently a crime to either R&D the operation of your own property, or modify it. There is a long standing tradition of car modification in the U.S. especially, I think it's unacceptable for this to be proscribed by making it a crime or even subject to civil action. Obviously any modification I make, is my liability, but that's a totally different thing that saying it's disallowed.

The messenger did some stunt hacking on a highway to promote their talk, and didn't follow any guidelines of responsible disclosure to the company so they could less drastic steps to fix the problem or have some time and perhaps do it in a way that isn't quite so expensive or rushed.

Should they be criminally charged, no, not for the hack itself, perhaps for the highway theatrics. But they deserve to sweat and hire some lawyers, and perhaps face a civil case for the irresponsible way they disclosed it.

The surest way to get legislative pressure put forward to regulate the info sec industry and put red tape that hampers or outright outlaws security research and activity is to have guys like this being so irresponsible with research that affects people's lives as to give them cause to.

The messenger reported the problem privately 9 months ago[0] and it was only fixed as they were preparing to go to the press. The day before the "stunt hacking" Jeep were claiming it was not a problem[1].

[0] https://twitter.com/0xcharlie/status/623492229714313216

[1] https://twitter.com/daviottenheimer/status/62351634451271270...

FCA deserved the press, but demoing it on a public road (at high speed) was horrendously dangerous and irresponsible.

They deserve to be charged/locked up for that portion of it.

>horrendously dangerous and irresponsible.

Not something that I would do, at least not on that stretch of road. But, nobody was actually harmed, nor was anyone even inconvenienced beyond perhaps having to make a lane-change. It could have caused a pile-up accident, but to give some perspective, I commuted into Houston on that same day and counted half a dozen disabled vehicles on my route, and two police officers trying to catch speeders; both of which add at least the same magnitude of risk to other motorists.

>They deserve to be charged/locked up for that portion of it.

"They" the two that did the risky road demo, or "they" the ones who waited 9 months to mitigate the safety defect in thousands of cars? Locking one of those groups up makes us more safe, and the other less.

> But, nobody was actually harmed

That's ends-justifies the means. I'm not arguing someone was hurt, I'm arguing they put people in a situation with a higher than necessary risk.

> I commuted into Houston on that same day and counted half a dozen disabled vehicles on my route, and two police officers trying to catch speeders; both of which add at least the same magnitude of risk to other motorists.

You can't control what other drivers around you do to cause road hazards, but in this case that's exactly what the hackers did. By cutting the transmission they caused a possibly dangerous situation.

They could have done this test safely in numbers ways. On a rig designed for testing horsepower, an abandoned parking lot, a private track, or asked some police to close a section of road.

Instead they did it in about the most dangerous way possible: live on uncontrolled roads with other traffic.

> "They" the two that did the risky road demo, or "they" the ones who waited 9 months to mitigate the safety defect in thousands of cars?

The 'researchers'/hackers. They directly put people's lives at risk to have a stunt to prove their point.

FCA screwed up big, and deserve some sort of penalty from the government. This shouldn't have been possible in the first place. But they didn't modify a running vehicle at 70mph surrounded by unsuspecting motorists.

If the hackers had done this reasonably safely, I'd have no issue at all. But they don't deserve the title 'researcher' after behaving like that.

The "ends justifying the means" is not a fallacy, unless you think Consequentialism is completely wrong[1]. In this case, it seems a lot of people do think the ends justify the means. In other words, the risk was morally justified given the results.

[1] https://en.wikipedia.org/wiki/Consequentialism

I don't think it its a good argument in this cases since they had much safer options.

>That's ends-justifies the means.

I don't like it either, but it's a common philosophy that we experience in our daily lives, whether we want it to be that way or not.

>Instead they did it in about the most dangerous way possible: live on uncontrolled roads with other traffic.

There are a number of ways they could have made it worse.

>The 'researchers'/hackers. They directly put people's lives at risk to have a stunt to prove their point.

We tolerate the same kinds of risks daily by allowing police to conduct traffic stops on busy roadways. We do so ostensibly because safety, but the reality is that it is mostly for some pretty dubious financial reasons. That's ends justify the means, and in this case ends are traffic fines collected, and the means are lives of police officers and motorists and man-decades of time lost in traffic every day.

>FCA screwed up big, and deserve some sort of penalty from the government.

But not jail, like for the evil hackers-not-researchers?

>This shouldn't have been possible in the first place.

Another uncomfortable reality for you. Software verification is a huge challenge which nobody has gotten right yet. There will be more of these vulnerabilities. We have to get this disclosure/update process right. The best thing that automakers can do to prevent disclosure stunts like this is to fix vulnerabilities ASAP when they're discovered.

>But they didn't modify a running vehicle at 70mph surrounded by unsuspecting motorists.

What they did/do (months worth of nothing) is far worse, and endangers far more lives. Imagine if someone/somegroup/somegov't had managed to bundle this vuln with a popular cell-phone app, or mobile website, and decided to activate it one day at rush hour.

>If the hackers had done this reasonably safely, I'd have no issue at all. But they don't deserve the title 'researcher' after behaving like that.

That's just petty, and nobody really cares what you call them. It does nothing to move the discussion in a fruitful direction; but it does make you appear a bit shallow in your reasoning.

> We tolerate the same kinds of risks daily by allowing police to conduct traffic stops on busy roadways.

We've chosen to accept that risk, and have control over it though government. People could choose to make it illegal.

Also note that when the police do it they take precautions such as having bright multi-colored lights on the car to draw attention.

It also bothers me that the Wired guy didn't know what was going to happen, so he couldn't prepare as well. Even that would have helped (though I still think the stunt was dangerous enough for someone to go to jail).

> But not jail, like for the evil hackers-not-researchers?

We can't put a company in jail and we don't usually do it with the CEO for much bigger crimes. I doubt the CEO had any idea this could happen.

I imagine this is one of those things where dozens of people in different departments (and even companies due to auto parts suppliers) all made small but not terrible bad decisions that added up to a huge problem. I doubt there is a smoking gun email someone where a manager says 'I know someone could disable the car on the freeway but it will save us millions!'

And while this is happening to FCA there are other cars with cell connected systems (VW, BMW, Audi, others). I imagine if we had enoug time we'd find at least 2 or 3 other companies with vulnerable systems in other car brands's 2015 models.

I just don't see how we could jail anyone in FCA. That's why I didn't call for it. On the other hand the hackers seems like a pretty cut and try case.

> That's just petty, and nobody really cares what you call them.

The words you use to describe something matter. Having taken such a stupid risk I don't see why they should ask to be acknowledged on the same level as security professionals who don't put people in danger for headlines.

Frankly the number of people in these threads defending the overly dangerous demo scares me, as does the number of people who seem to tacitly encourage such behavior.

>We've chosen to accept that risk, and have control over it though government. People could choose to make it illegal.

I'll expect to see you down at the legislature lobbying for reform and threatening jail for the opposition.

>Also note that when the police do it they take precautions such as having bright multi-colored lights on the car to draw attention.

It's hard not to notice something so distracting! That's another argument against the practice, isn't it?

>We can't put a company in jail and we don't usually do it with the CEO for much bigger crimes. I doubt the CEO had any idea this could happen.

It's a funny thing. We can never seem to find anyone in a company who knows anything or has any responsibility. We just have to satisfy ourselves that if popular opinion moves against a company strongly enough, or the gov't gets shamed into prosecuting them, that maybe then they might address some problem, usually after it actually kills people, so long as nobody has to admit fault. It's almost like a huge stunt is needed to get peoples' attention sometimes!

>I imagine this is one of those things where dozens of people in different departments...

Yeah, we all know about how corporate structures insulate decision-makers from the consequences of their decisions.

>cut and try

"Cut and dry" So, because it's easy to prosecute these two, and hard to prosecute the others, justice should take the easy route, even though one may have endangered tens of people on one occasion, and the other endangers tens of thousands of people for months? I see a different value proposition here than you.

>Frankly the number of people in these threads defending the overly dangerous demo scares me

I guess it would surprise you to learn that I feel the same way about you after this conversation?

I'm gonna take this argument in a slightly different direction. While I agree with you that the way this experiment was conducted was needlessly unsafe and irresponsible, I don't believe these researchers deserve jail time given that only positive outcomes resulted from this event. Pragmatically, society has nothing to gain from punishing these individuals and in the best case scenario doing so costs us money and pointlessly devestates likely several lives. For that matter, I am also against sending people to jail even when their actions have negative effects if it is not clear that isolating them from the public will reduce future harm.

My reason for suggestion jail is because I worried if they're not punished (just a week would be perfect) other people will think such needlessly unsafe public demonstrations are acceptable.

I dont know another way to say 'this is not acceptable'. To literally just say it but not punish... I do t think that would be heard and someone else would take a stupid risk.

They certainly don't need 5 years or something like that. Just a very noticeable slap on the hand.

> responsible disclosure to the company

When are you going to start discussing the criminal implications of the company in ignoring that disclosure?

> a way that isn't quite so expensive or rushed.

Since when is the company's expense our problem?

The fix is trivial. Yank the cellular connection. The company is refusing to do the simple, easy, and quick fix. They're the ones making it a painful process. They're the ones choosing to leave everyone vulnerable while they hide the problem with a bandaid.

> legislative pressure put forward to regulate the info sec industry

Your country's laws are your problem. That would be disastrously dumb, but it's your responsibility to forbid your politicians from shooting the country in the foot.

If you blame this on hackers you'll only ensure that a foreign hacker will start a campaign of trying to get you to pass broken laws.

I don't think they're necessarily asserting that the security researchers carried out a criminal act in demonstrating that the vehicle could be hacked (they almost certainly didn't). But they would be correct to assert that anybody who hacks someone's Jeep without their permission certainly WOULD be carrying out a criminal act. As such, I think they're reasonable in pointing out that this is not a safety issue but rather a protecting-their-customers-from-assholes issue.

> As such, I think they're reasonable in pointing out that this is not a safety

If your system ALLOWS other assholes to take over my car, it's DEFINITELY a safety issue.

I would add that shipping cars with such vulnerabilities should be a criminal action, if it isn't. It's certainly negligent (however unintentionally) and unsafe for consumers.

Are there other areas where shipping with known vulnerabilities that can endanger lives is criminal? EG in medicine?

There is such a thing as "criminal negligence", but I don't know if this case or anything in medicine would qualify. My guess is no, based on some examples I'm looking at.

An argument could be made that putting the vehicle control system on the same bus as the internet-connected entertainment system was criminal negligence, but they would just hang the guy who probably put up a fight against it in the first place for not putting up a bigger fight or something, the company would never feel any pain. :/

Given the complexity of the software components in a modern car I think it would be a safe assumption that all of them are shipping with such vulnerabilities. If there is one area where we could benefit from some openness it is the embedded world, these are life critical systems in every sense of the world and what I've seen of such code bases does not inspire confidence at all (rather the opposite).

The issue isn't vulnerabilities, it's connecting those vulnerabilities to the net. This isn't about software quality in general.

But that's exactly how these things happen. People program insecure stuff thinking 'well, at least this isn't connected to the internet', then one day someone else takes the blackbox the original guy (long departed) put together, hacks up a TCP/IP interface or does something else without looking through the codebase and boom you're wide open.

You can replay this story 10's of times over the next couple of years and lets hope it's only the nice guys finding them.

See also: SCADA

Don't get me started on that one, yes, it's probably even worse than automotive because these are 100's of thousands of legacy systems quite often without any security at all connected to the net. Obscurity is the only thing that keeps these systems working.

Not to go all law school on you, but criminal actions are defined by statues. There are many actions that are ethically wrong, but perfectly legal.

Now, for a civil action, it is always fuzzy. Whether or not it is negligent is going to be based on many things, a big one being whether it was "reasonable". Shipping cars before this event may have been reasonable, but continuing to do so many be negligent. But at least in the US, that needs to be decided in court, not on the internet.

I'm pointing all this out because you said "Certainly". That word really has no place in the US legal system.

Yeah, good luck with that. Law enforcers find it incredibly useful to be able to remotely take over a (suspected) criminals vehicle and force it to stop, so they're hardly going to support a law that makes that impossible. And let's face it, the only way to truly make sure a hacker can't take over a vehicle remotely is to make it impossible.

I assume there was security, no matter how weak, that was bypassed. That's criminal in the US under the DMCA. Hell, even bypassing ROT13 "encryption" is criminal under the DMCA. Furthermore, even if the system was wide open, I have no doubt Chrysler can claim criminal action under the CFAA.

Ain't America's laws wonderful?

> even bypassing ROT13 "encryption" is criminal under the DMCA.

Is it? I thought the encryption has to be "effective", which would not be the case for ROT13. I would even argue that ROT13 is merely an encoding.

"effective" as in "in effect", i.e. it exists and is used, not in that it's actually secure. The law would be rather pointless otherwise, as it would only make it illegal to bypass encryption which cannot be bypassed.

Right, it's like a password or a door lock. The strength of them isn't the issue, it's more that they communicate the owner's intent.

Effective would probably have more to do with covering all the routes of ingress rather than doing so strongly.

http://www.stoel.com/the-anti-circumvention-rules-of-the-dig...

No, the exemption is this:

Encryption Research. The DMCA exempts encryption research from its circumvention and trafficking bans. Circumvention of access controls by one who has lawfully obtained the encrypted copy is permitted if the circumvention is done in the course of "an act of good faith encryption research." The researcher must first have made a good faith effort to obtain authorization before the circumvention, and the circumvention itself must not constitute infringement. The researcher may also develop and employ tools to circumvent the access controls for the sole purpose of carrying out the research, and may share those tools with collaborative researchers. The DMCA lists several factors to be used in determining whether the exemption for good faith research should apply in a particular situation, including whether and how the research results were disseminated, whether the researcher is engaged in a course of study or is trained or experienced, and whether the researcher provides the copyright owner with the results of the research.

And even with this exemption, researchers have to tread very lightly to avoid prosecution.

Something I'm big on in life is that the worst thing you can say to someone is that you don't understand them. To not understand someone is to deliberately not give the issue thought because you're so deeply embedded in the idea that you have enough background on an issue to decidedly say that you are right and that the reasoning behind your stance is flawless, and thus that they are wrong. I believe that everyone's beliefs and actions are understandable. They might used flawed logic, or they might value things differently than you, but I believe 100% that everyone on this earth uses reasoning for every action and opinion we have.

But when it comes to politicians trying to ban encryption and automakers trying to ban me from editing bits on a memory chip that I got as a part of purchasing one of their cars, I really am unapologetic when I say I really don't understand them. I completely and utterly lack an ability to get into their heads. It would be fascinating to lose my knowledge of everything I know about computers for a day and give these issues thought. To have computers be mystical voodoo magic would be an amazingly different world.

If I had to give it a guess, that's probably what I'd say. Politicians and automakers and middle aged Edward Snowden haters all lack an idea of what is possible and what is unpractical when it comes to computers. They lack an appreciation for just how much commonality there is between the computer running a McDonald's register and the one making sure their car doesn't kill them.

Politicians think we can just "ban" encryption, as if this isn't some mathematical concept with freely-available professionally made implementations. They think Apple has gone to great lengths just to implement their end-to-end iMessage encryption... when in reality they almost certainly took the path of least resistance and merely stand on the shoulders of giants that collectively implemented encryption for them. PR reps for automakers think of code in such an abstract way that they think modifying it must be terribly difficult and thus inherently malicious, when in reality their programmers stood on the shoulders of giants and used the same common interfaces that every programmer uses. Hacking their car was probably done by a curious man decompiling the firmware which they pulled off via JTAG or a test clip. They think Edward Snowden must have been sneaking around in underground tunnels with a ski mask and plugging his laptop into servers, when in reality this was just a drive that was mounted on a machine he used.

Tl;dr: Programmers all pretty much follow the path of least resistance. The general populations lack of background makes them think that things are much more difficult and thus deliberate than they really are.

> Politicians and automakers and middle aged Edward Snowden haters all lack an idea of what is possible and what is unpractical when it comes to computers.

Plenty of the Edward Snowden haters are <= 30 and plenty of the people that applaud him are > 40 so let's not add age into that discussion.

Whether you are pro/against Snowden probably has more to do with your life experience to date and your general views on what a government should be able to get away with.

> Plenty of the Edward Snowden haters are <= 30 and plenty of the people that applaud him are > 40 so let's not add age into that discussion.

> Whether you are pro/against Snowden probably has more to do with your life experience to date and your general views on what a government should be able to get away with.

I only said, "middle aged" for exactly that reason: you might hate Edward Snowden and be a totally technically literate person. Age doesn't necessarily shape your view on Snowden, but age almost certainly correlates with technical literacy, and I think technical literacy definitely plays into your perception of how much effort Snowden went to in order to gain access to the files he leaked. If you think that he went to great lengths to gain access to the files, you might think his actions were more malicious / that he was looking for trouble.

That "criminal action" statement was repeated multiple times; obviously they're trying to send a message. We need whistle-blower protection laws so that the auto companies can't try to eliminate this research by sending the researchers to jail.

Law enforcement won't try to analyze the firmware, but class-action lawyers certainly could. Won't do any good if the bad actors have erased their tracks of course.

If we outlaw hacking then it will only be the criminals that have the hacks!

Reply on news.ycombinator.com