Hackers Demand Automakers Get Serious About Security 120
wiredmikey writes: In an open letter to Automotive CEOs, a group of security researchers has called on automobile industry executives to implement five security programs to improve car safety and build cyber-security safeguards inside the software systems powering various features in modern cars. As car automation systems become more sophisticated, they need to be locked down to prevent tampering or unauthorized access. The Five Star Automotive Cyber Safety Program outlined in the letter asked industry executives for safety by design, third-party collaboration, evidence capture, security updates, and segmentation and isolation. Vehicles are "computers on wheels," said Josh Corman, CTO of Sonatype and a co-founder of I am the Cavalry, the group who penned the letter (PDF). The group aims to bring security researchers together with representatives from non-security fields, such as home automation and consumer electronics, medical devices, transportation, and critical infrastructure, to improve security.
deaf ears (Score:3, Interesting)
Nothing is going to happen until they get sued.
Shouldn't be necessary, but if it is... (Score:5, Interesting)
It's kinda terrifying that the people making fast, heavy lumps of metal with computerised control systems don't already routinely isolate those control systems from any other computerised technologies in the vehicle, particularly any that can interact remotely. They shouldn't need to be publicly admonished about the dangers of these situations. Don't these organisations employ actual engineers any more?
But given that it does seem to be necessary to make a public display of this -- which presumably removes any plausible deniability if the auto makers do get sued after an accident later, so I can believe it will at least get their attention -- I'm glad it seems to be a responsible group with the right motivations who are starting the ball rolling. If it were just a bunch of lawyers or insurers, the general public could write the campaign off as the signatories just looking out for their own interests.
Re:Shouldn't be necessary, but if it is... (Score:5, Interesting)
My 2002 Jetta's stock stereo system is wired to the CAN bus. This means when I run an in-car-diagnostic with the little dongle connected to the computer port in the driver's seat, that the stereo system is part of the diagnostics. It actually told me one of the speakers was broken/disconnected which I was able to leverage another $100 off the price when I bought it used. ... Turned out, it was literally disconnected. Easy DIY fix ;)
Anyway, my car has not internet connectivity. But I bet the newer models have stereos that integrate GPS, Satellite Radio, and internet services. Theoretically, both satellite radio and web services are potential attack vectors into the stereo, and if you can manipulate the firmware on the stereo to be a CAN bus master, you can now talk to anything in the car.
So either take the entertainment stuff off the CAN bus, or install some sort of CAN router/firewall, that allows the rest of the car to talk to the stereo, but doesn't let the stereo talk to the rest of the car.
Re: (Score:2, Insightful)
You are totally ignoring the base issue: The fact that its so easy to get access to any part of the system.
Reflashing a "faulty" component isn't what people are worried about. It's the combination of Wifi/remote accessable parts of a system, that once gotten into leads to total control.
Imagine a virus that is able to jump from car to car once cars are able to simply mesh-hotspot to each other.
Reflashing the stereo means nothing when the entire system is compromised at 80mph.
Re: (Score:2)
It's the combination of Wifi/remote accessable parts of a system, that once gotten into leads to total control.
Exactly. Think how many people run WiFi in their homes that is insecure. Now imagine a world where every script kiddie with a grudge can kill everyone on each of those homes just by running some software they found on the Internet.
Re: (Score:3)
Don't worry, they'll implement the encryption to keep the owner locked out so they can continue charging high fees for simple things like turning the service engine light off. They'll make sure it provides no actual security from infections spreading from a DVD to the engine controller or ABS to make it easier for someone who has paid them the appropriate annual 'certification' fees to diagnose the car.
Re:Shouldn't be necessary, but NOT NEEDED (Score:2, Interesting)
1). Not needed since it will add to the cost of the car.
2). The Computer is not accessible via wireless to change the program (stand still or not) - no issue
3). How to eleiminate insurance company access to impact data
4). The whole hobby market would be eliminated i.e. tuner groups, and the DIY since besides just encrypting or isoalting the internal computer, it would be taken to the next step to encrypt the communications such that 3rd party tools couldn't access the data or they would have to pay a licens
Re: (Score:2)
Re: (Score:2)
It's kinda terrifying that the people making fast, heavy lumps of metal with computerised control systems don't already routinely isolate those control systems from any other computerised technologies in the vehicle, particularly any that can interact remotely. They shouldn't need to be publicly admonished about the dangers of these situations. Don't these organisations employ actual engineers any more?
But given that it does seem to be necessary to make a public display of this -- which presumably removes any plausible deniability if the auto makers do get sued after an accident later, so I can believe it will at least get their attention -- I'm glad it seems to be a responsible group with the right motivations who are starting the ball rolling. If it were just a bunch of lawyers or insurers, the general public could write the campaign off as the signatories just looking out for their own interests.
Problem #1; you can't isolate those systems, in the context of the reason for why they exist.
So, let's look at OnStar, or Hyundai's Bluelink. These are systems that connect to larger infrastructure over public or semi-public communications channels (i.e., cellular) for a variety of purposes. Such purposes include being able to start your car remotely, notify authorities of an accident even if you are incapacitated and unable to call for help (especially in that case, actually) and recover your car in case
Re: (Score:2)
I'm afraid I don't buy your examples.
Why does anyone need the ability to mess around with starting my car remotely, ever? I see no need to start my car if I'm not in the driver's seat, and if I'm in the driver's seat and we've got cell reception why I can't I just turn the key or push the button?
Accident detection and related safety systems absolutely should be independent of engine control and the like. Why can't they be? (If your answer involves having both the normal control systems and the safety syst
Re: (Score:2)
Remote Start: My car has a rotary motor. One lovely aspect of its design is that it really should be gotten to operating temperature before driving under any sort of load. And in the winter, I'd love to be able to warm the engine and the interior from inside my house while I gather my things for work.
Crash reporting: Agreed on sensor redundancy but at the same time, part of the reporting includes detection of airbag deployment, ABS / traction control usage prior, speed prior
Re: (Score:3)
And in the winter, I'd love to be able to warm the engine and the interior from inside my house while I gather my things for work.
This is clearly a case of prioritising convenience over security, which you're welcome to do as your own personal preference but I would never choose myself.
This data is used to help triage the severity of the crash before the EMTs roll out.
Well that's probably the single most disturbing thing I've seen in this whole discussion. Are you really telling me that in the event of a known road traffic accident, which is severe enough that no-one on the scene can immediately respond to verbal contact, they don't routinely send the full works where you are?
In any case, I would point out that this
Re: (Score:2)
This is clearly a case of prioritising convenience over security, which you're welcome to do as your own personal preference but I would never choose myself.
How much does your front door weigh, and how many locks are on it? How much do you pay your security guard? Etc etc
Re: (Score:2)
Fair point, but perhaps not the one you intended to make: my house has high-spec security doors and windows. :-)
No doubt someone sufficiently determined and well-equipped could still break through, and this is deliberate, because that person might be a paramedic or fireman trying to reach a child in an emergency. However, no casual burglar stands much chance of getting inside, and even a professional thief has poor odds of getting inside, collecting valuables, and getting away again before someone arrives t
Re: (Score:2)
Why does anyone need the ability to mess around with starting my car remotely, ever?
I want to start my car before I get into it, so that the climate control can bring it up (or down) to temperature, and the seats and steering wheel can preheat if it 'tis the season.
As for recovering my car in case of theft... Unless you are suggesting that someone is going to take over control of my car and auto-pilot it home against the will of someone physically in the driver's seat, again I don't buy it.
No, it's just a remote kill switch. They can also locate the vehicle.
And if you are suggesting that, I really don't want that system in my car.
Frankly, the existing systems are enough to scare me away from them, just for the privacy implications. At least I can put my cellphone into a mylar bag, if I were ever that paranoid. Bagging the car will prevent my driving it, rendering it fairly useless. But
Re: (Score:2)
Frankly, the existing systems are enough to scare me away from them, just for the privacy implications.
I share those concerns as well. I'm just trying to avoid conflating them with the security risks that pose a direct threat to life and limb.
But there are some very nice cars out there which don't have a navigation system built in
The trouble is, these remote functions are useful and they are seen as purely beneficial by people who don't yet understand the implications of the technology, which of course means most people who are going to buy a car. And so more and more cars, starting from the high end and pushing down over time, have this crazy stuff built into them.
I'm happy to see this campaign
Re: (Score:2)
Looking at problem #1, the on-star system needs read only access to know when the airbags deploy. It needs to be able to send a start command to a computer that is attached to the bus, but does not need that connection itself. A simple serial link to a proxy/firewall would do. It needs read only access to the current GPS data for finding a stolen car. Again, let it ask the proxy.
It does not need to be actually connected to the same CAN bus as the ABS and ECU.
In actuality, OnStar should be re-designed in ge
Re: (Score:2)
Problem #1; you can't isolate those systems, in the context of the reason for why they exist.
Ah, but you can, and the way you can do it is to add more buses to the car. Each bus only listens for certain types of messages, greatly reducing the attack surface. There is no reason why the radio should be on the same bus as the transmission, but clearly the engine and transmission need to communicate with one another, and the transmission and engine alike may need to communicate with the ABS/AYC unit. You're only realistically going to be able to do so much segmentation without just using all point-to-p
Re:deaf ears (Score:5, Interesting)
Nothing is going to happen until a serious mishap occurs.
Meanwhile the automakers looks into strange hacks instead of proper physical segmentation and gatewaying. They do have a gateway, but it is just a gateway between different IP address series on the same physical net in some cases - in order to save money on hardware. So a rogue unit can just look at the different series and fake it being a different type of unit causing interesting things to happen.
Re: (Score:1)
Wait until people start dying because of these security loopholes, only then will they wake up. :(
Re:deaf ears (Score:5, Insightful)
What I am afraid of is what happens after. There is a difference between security from remote attackers, and security from "jailbreakers". For example, my Android phone is just as secure rooted as not.
My fear is that what steps would be taken would force the car into the shop for any minor issue. Already, one automaker, if you change the battery out, the vehicle will refuse to start until the vehicle goes into the dealership and the battery is "registered" into the ECM.
Automakers should just keep stuff isolated. The radio should not have access to the brakes. Hell, the radio should not even be on the CAN. It should just be vital components, and have the doodads be stuck on another bus that can be "dirty".
Re: (Score:2)
Already, one automaker, if you change the battery out, the vehicle will refuse to start until the vehicle goes into the dealership and the battery is "registered" into the ECM.
Which automaker is that? I want to be sure to avoid them.
Re: (Score:1)
BMW and Cooper
http://atlanticmotorcar.com/tech-tip-bmw-and-mini-battery-registration-replacement-2/
Re: (Score:1)
If this cannot be performed by the owner of the vehicle, it is nothing more than a rip-off service for BMW dealerships.
Re: (Score:2)
I'm afraid we may see a rehash of the DMCA being used to protect profit margins on the Printer Toner cartridges. Already it's about $200 to get a spare key because they have a chip in it. There's a whole host of problems that occur where you just go in and they reinstall software or replace some CPU chip worth $5 -- but they are the sole source. So as the car gets more reliable, they build in "must get dealer to fix" and it's just a quick software patch -- it just costs a few hundred and the money goes dire
Re: (Score:2)
Automakers should just keep stuff isolated. The radio should not have access to the brakes. Hell, the radio should not even be on the CAN.
I agree with you, I prefer to have a physical knob or switch for all the adjustments which can be adjusted, but the trend now is to have a display in the dash which can be used for everything from watching television to adjusting the ride firmness or even the engine's maximum output. Consumers are asking for it, so they're going to have to figure out how to make it secure.
Re: (Score:2)
My fear is that what steps would be taken would force the car into the shop for any minor issue. Already, one automaker, if you change the battery out, the vehicle will refuse to start until the vehicle goes into the dealership and the battery is "registered" into the ECM.
That crap is finally coming to an end.
Automakers agree to 'right to repair' deal
http://www.autonews.com/article/20140125/RETAIL05/301279936/automakers-agree-to-right-to-repair-deal [autonews.com]
January 25, 2014
Last week, two trade groups representing automakers -- the Alliance of Automobile Manufacturers and the Association of Global Automakers -- announced an agreement with independent garages and retailers to make Massachusetts' law a national standard.
[...]
Under the deal, all auto companies would make their diagnostic codes and repair data available in a common format by the 2018 model year, as the Massachusetts law requires. In return, lobbying groups for repair shops and parts retailers would refrain from pursuing state-by-state legislation.
The Massachusetts law requires that anything an auto manufacturer would sell to a dealer/authorized facility, the manufacturer must also sell to an independent mechanic.
So all those ridiculous automotive DRM systems will no longer automatically require a trip to the dealer.
Re: (Score:3)
Nothing is going to happen until they get sued.
Nothing is going to happen until (1) a senior officer at GM has his car hacked, (2) a very public hacking makes security a point on which automakers compete, or (3) they get sued.
Re: (Score:2)
Nothing is going to happen until they get sued.
Nothing is going to happen until (1) a senior officer at GM has his car hacked, (2) a very public hacking makes security a point on which automakers compete, or (3) they get sued.
Correction: They get sued after multiple deaths have occurred as a result of lax security resulting in a penalty in the hundreds of millions of dollars. (This is not unique to GM, All of the manufacturers will react the same.) You can strike 1 and 2 from the list.
Re: (Score:2)
Nothing is going to happen until they get sued.
Nothing is going to happen until (1) a senior officer at GM has his car hacked,
GM Exec blames the wrong person, like the driver and problem doesn't get fixed.
(2) a very public hacking makes security a point on which automakers compete
Automakers complain to government until hackers are arrested, charged with terrorism and made to cover up their work.
they get sued.
The plaintiffs are paid of using a small amount, law suit is forgotten within a week.
The Auto industry is terrible at doing things that might cost money on their own. They'd rather ignore the problem and sue/arrest/pay off people to make it go away than fix it. The only way Automakers will get serious about secu
Re: (Score:2)
I'd say it's the other way around. Nothing is happening because they get sued. All the time. Every time there's a serious accident involving injury or death, the automaker gets sued. Doesn't matter if something about the car contributed to the accident or not, they're the ones with the deep pockets so the lawyers sue them as a matter of course. Defending against these suits costs enough that in many cases it's cheaper for them to just settle rather than r
Re: (Score:2)
Nothing is going to happen until they get sued.
For what? Somebody broke into your Bluetooth connection and loaded a bunch of MP3's you didn't like? Or that they managed to unlock the doors or steal the car using some hacking? Are you going to sue the car maker because your car got stolen? Maybe, but I don't think you will win.
Personally, IMHO there just isn't that much the car makers need to do. The cars they now produce are NOT insecure in practice, only in theory. Car companies are not going to spend money on *theories* without some kind of pay
Re: (Score:2)
Someone put your brakes in maintenance mode and caused a crash...
Re: (Score:2)
Someone put your brakes in maintenance mode and caused a crash...
Oh, you mean they "hacked" your car by connecting directly up to the CAN buss which requires physical access to the car and disabled the breaks? This is so much tripe.
Tell me this... IF somebody cuts your break line, are you going to have a cause to sue the manufacturer? Short answer is: NO. What you suggest is not different as it requires PHYSICAL access to your car too.
Re: (Score:2)
No, I mean someone got in through the OnStar, the back seat entertainment system, or on and on and disabled the brakes while I was at speed.
Re: (Score:2)
Not going to happen, you needn't worry. Folks that say you need to care are just fear mongering.
Where your scenario is *theoretically* possible, the chances of it happening are less than you winning the lottery or getting hit by a Mir space station part. It's just not going to happen. A cost risk analysis says it's not worth the cost to harden such systems beyond where they are now and unless you are a high value target, hacking your car as you suggest is not worth the cost and effort over just cutting the
Re: (Score:2)
I'm pretty sure it won't happen tomorrow, or next year so I'm not going to run around shouting like my hair is on fire, but it should be a cheap and easily addressed problem if it is done even half right.
They didn't think people would figure out the funky sequences for bypassing the immobilizer in the ignition key either but many such sequences are well known now.
The first application I would expect would be unlock door, start car.
I'm not too worried about that one personally since I tend to make utilitaria
Re: (Score:2)
Re: (Score:2)
If they weren't getting steadily worse with no sign of awareness, I'd agree. Hopefully some prodding and making sure they can't claim ignorance in court will convince them to think about the problem.
Then it will likely be OK.
Re: (Score:2)
Re: (Score:2)
How fortunate I don't have OnStar, remote unlock, or remote start capability.
Re: (Score:2)
Re: (Score:2)
That's because after universal garage remotes hit the streets, they toughened security a bit.
Easier to parallel park a train (Score:5, Insightful)
Getting the automakers to make any kind of substantive change requires either legislation or expensive PR disasters like a Pinto or Firestone/Explorer event.
Re: (Score:3)
Or GM Ignition Switches?
if this goes the same way as the computer desktop (Score:2, Insightful)
it won't be long before we are forced to install antivirus in our cars : /
Re:if this goes the same way as the computer deskt (Score:4, Funny)
it won't be long before we are forced to install antivirus in our cars : /
Lets hope it doesn't make them run significantly slower ;-)
Re: (Score:2)
it won't be long before we are forced to install antivirus in our cars : /
Lets hope it doesn't make them run significantly slower ;-)
2015 Dodge Challenger SRT Hellcat (707 hp, capable of 10 second quarter mile times with the sole modification of using race tires. And if you can keep your foot off the gas pedal you can get about 20 MPG) + McAfee Antivirus 2016 Automotive Edition = Prius-like performance @ 10 MPG
Re: (Score:1)
I believe they mean 'automobiles which are inefficient at actually getting you anywhere', which is what environmentalists actually want, so we'll start using their beloved buses and bikes instead.
Hackers (Score:4, Insightful)
So is it "Hackers" demanding better security or is it "a group of security researchers"? Because the inflammatory headline surely conjures the modern, media definition of Hacker and not "A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary". And the headline certainly doesn't make me think of security experts at all!
Come on /. , you can do better than that...
Re: (Score:2)
Well, the article has a link to Security Week and they swiped the headline from there... No thinking included...
Re: (Score:3)
Yeah, I noticed that after I posted. You'd think I'd learn to RTFA before posting!
Security Week can do better than that! :-)
Re: (Score:2)
I'm surprised they didn't name the publication "Security weak"... but perhaps they're not the laughing type?
Re: (Score:3)
You prefer the media continue to bastardize the word "hacker" into some sort of evil-doer?
Boston Brakes and more. (Score:1)
People are going to be murdered like Diana, only it won't be MI6, it's going to be script kiddies and highway griefers.
We can't even get automakers to admit they put faulty ignition switches in for decades... A solid "good luck" to these hackers raising the issue to them.
Right to repair (Score:1)
I'm all for this *provided* these 'researchers' don't cause the prevention of access to diagnostic data so that users can continue to have the right to repair their own vehicles.
Otherwise the next headline will be a repeat of old ones where vehicle owners can't repair their vehicles because the automakers have locked things down *far* too much so you can only use their dealerships to reset computers, etc, etc.
An easier solution (Score:5, Insightful)
I know, I know, simplicity is such an ugly word. It would be truly horrible if people had to concentrate on their driving rather than the six-channel, streaming video playing on their dashboard while they blend margaritas [wikipedia.org].
Re:An easier solution (Score:4, Insightful)
It would be truly horrible if people had to concentrate on their driving rather than the six-channel, streaming video playing on their dashboard while they blend margaritas.
No doubt, but it would be more horrible if modern systems for things like braking and traction control went away. People who've grown up with cars that are full of three-letter technologies like ABS and EBD might not appreciate how much more skill is required to drive a car safely at the same speeds and in the same environments without these driver aids.
Re: (Score:1, Interesting)
It would be truly horrible if people had to concentrate on their driving rather than the six-channel, streaming video playing on their dashboard while they blend margaritas.
No doubt, but it would be more horrible if modern systems for things like braking and traction control went away. People who've grown up with cars that are full of three-letter technologies like ABS and EBD might not appreciate how much more skill is required to drive a car safely at the same speeds and in the same environments without these driver aids.
Grr! If the U.S. would teach people how to drive and have real penalties for not doing simple things like using directional indicators before taking any other action, like turning ones head to see if the way is clear there would be little need for ABS, electronic stability control or driverless cars. Finland comes to mind as an example of the proper way to teach people how to drive and appropriate testing and licensure of drivers. Not only do they have to learn to drive a real car (one you have to shift and
Re: (Score:2)
Grr! If the U.S. would teach people how to drive and have real penalties for not doing simple things like using directional indicators before taking any other action, like turning ones head to see if the way is clear there would be little need for ABS, electronic stability control or driverless cars.
You sound like you're 85 years old.
But, in any case, you've got to be kidding me. First, that was a very long stretch to go for a vague anti-American rant. Second, the idea that ABS is somehow only necessary because people aren't driving properly is laughable. Third, antilock brakes were invented in Europe.
Finally - how on earth do you mentally link ABS, stability control, and driverless cars together? Did you briefly consider adding windshield wipers to the list? What about kids and their loud music, or gi
Re: (Score:2)
You find me a human driver who never makes a mistake, and I'll find you someone who has little need for ABS, ESC and their friends.
No human can outperform a modern ABS system using manual cadence braking. ABS is essentially cadence braking judged at the speed of a computer and applied to each wheel independently.
You don't need to control a skid you never got into.
And speaking of skids, for driving on public roads under normal conditions, I don't know what handbrake turns have to do with the price of fish.
Separate Physical Concerns.... Physically (Score:2)
Things like ABS EBS and the many engine control computers that i have probably never heard of do not need to be connected to the car stereo or the internet, they should be physically separate from any other non crucial set of components that they have no need to communicate with...
As Andrew Tenenbaum would put it:
When you flush the toilets on an airplane; an error in the toilet flushing mechanism should not be able to possibly cause missile launch systems to go off or engines to shut down.
The same applies f
Re: (Score:2)
I couldn't agree more. I was just challenging the idea that not using modern technologies at all was a viable solution to the problem. Some technologies do make cars safer, more reliable, and more efficient, and the important practical question is how we secure those technologies, not whether we should use them in the first place.
Re: (Score:1)
Re: (Score:2)
It would be truly horrible if people had to concentrate on their driving rather than the six-channel, streaming video playing on their dashboard while they blend margaritas.
No doubt, but it would be more horrible if modern systems for things like braking and traction control went away. People who've grown up with cars that are full of three-letter technologies like ABS and EBD might not appreciate how much more skill is required to drive a car safely at the same speeds and in the same environments without these driver aids.
ABS doesn't distract you, ABS cant be broken into externally because it's not connected to your stereo.
Drivers aids like lane assist are debatable at best, with my experiences, they serve as better distractions rather than aids. Most drivers will ignore them, the best result is that drivers get lazier and start to ignore the bad habits that cause these alarms to go off.
Re: (Score:2)
ABS cant be broken into externally because it's not connected to your stereo.
The major security concern in this debate is whether essential vehicle control systems like ABS can in fact be influenced remotely, because they are connected to non-essential systems that (some of us are arguing) they shouldn't be.
Re: (Score:2)
It's a decent point, but you didn't follow through. The whole point is that cars depend on computers MORE than having a computerized dashboard. What you are mentioning in your second paragraph is quite trivial.
Computers are used to regulate just about every system in your car. If a "hacker" gets into your car and shuts down the brake system then it's a whole lot worse than if he's just putting a picture of Goat.se on the dashboard.
Re: (Score:2)
" If a "hacker" gets into your car and shuts down the brake system then it's a whole lot worse than if he's just putting a picture of Goat.se on the dashboard."
For him as well because he would have to be stuffed up under the dashboard to do his hacking, therefore he will probably die in the accident.
All of these stories are dripping with scare tactic bullshit from these "researchers"
Re:An easier solution (Score:4, Insightful)
For him as well because he would have to be stuffed up under the dashboard to do his hacking, therefore he will probably die in the accident.
These vehicles overwhelmingly share a single bus between everything including powertrain and infotainment. If you can control the infotainment system you can control the diagnostic bus. The infotainment system now commonly includes internet access, so it's not even necessary to be near the vehicle to gain attack surface.
Has anyone in fact demonstrated such a hack, so far? Nope. Does that mean it's not a realistic threat? Also nope. Indeed, it's becoming a more realistic threat as more internet-connected features are being added to autos.
Re: (Score:2)
These vehicles overwhelmingly share a single bus between everything including powertrain and infotainment.
Cars that ride the bus, and the bus doubles as a train?!? Transport really is getting complicated nowadays.
Re:An easier solution (Score:4, Informative)
Don't put this crap in cars in the first place.
I know, I know, simplicity is such an ugly word. It would be truly horrible if people had to concentrate on their driving rather than the six-channel, streaming video playing on their dashboard while they blend margaritas [wikipedia.org].
What's even crazier is, you don't even need what they are doing to get the the same services. Just give the car radio bluetooth and be done with it. I've got an after market headunit in my car that cost me less than $150 and it can stream, do audio calls, shows my contacts in the head unit, I can use voice activation to say "Call home" and my phone will dial... etc... for another $50 I could have even gotten an LCD screen and streamed movies if I wanted. The last thing I want is to buy a car with some proprietary system in it that I wont be able to upgrade for the next 15yrs until I trade the car in.
The last car I bought had "Ford Sync" in it, and it was a pain in the butt to take out. The entire dashes electronics were integrated into the radio. WHY?!?! I had to purchase an after market computer module to replace the functions of that head-unit so I could put in a real radio. What a joke.
Re: (Score:2)
Which headunit did you get?
Then again, a lot of integration could have purpose:
1. Steering wheel switches that don't have separate wiring to the stereo
2. Speed-controlled-volume adjustment (esp for convertibles!)
I never got the "enhanced" option from the dealer because it turned out to be a $1200 adder :/
Mine does both of those.
The computer I bought hooks into the cars buss and adjusts the headunit via the remote control input on the back of the unit.
If you get one of the Kenwood units, it's just strait up compatible with Sync. Fairly sure they have to pay ford a licensing fee for that because the units are $$$
Or do what I did and get one of the computers that does the translation.
http://www.crutchfield.com/S-N... [crutchfield.com]
Re: (Score:2)
Or do what I did and get one of the computers that does the translation.
So is that a Microsoft tax brought to you by Ford, or a Ford tax brought to you by Microsoft? Either way, $150 ouch.
Hoping For Maven, PIP, easy_install (Score:1)
Hackers Demand Automakers Get Serious About Security
I misread the subject line as being about automake systems, like Maven, PIP, and easy_install, and was very excited. All of those are vulnerable to DNS cache poisoning attacks, allowing injection of arbitrary code into software builds.
An enormous first step in improving security is the incorporation of PGP signature checks, but at least in Maven, many of the most popular libraries aren't signed.
Given how many of the people here use these tools on a daily b
A Modest Proposal (Score:5, Interesting)
Re: (Score:1)
That is among the reasons I am apprehensive about buying a new car of any kind. Mine has the little diagnostic port, but not the wifi access. If someone is in a position to plug something in and hack my car, it would be easier and more profitable for them to just hotwire it and drive it over to the recycling yard to get scrap value for the steel.
Well, boy (Score:1)
The latest in braking technology involves radars which detect obstacles, vehicles, pedestrians etc. That information is processed and then fed to the ABS/ASR/ESP brake, the motor, the clutch and an electric steering unit.
So,... being in a warfare mode I say you could potentially eliminate that rich guy in his S-class by means of a $500 laptop and a $50 USB microwave transmitter. You could also do this with a nice directional antenna from 50 kilometers distance from a Cessna. Or a Rivet Joint.
I am not privy
Re: (Score:2)
You could also do this with a nice directional antenna from 50 kilometers distance from a Cessna. Or a Rivet Joint.
It would take more than one rivet joint to defeat one of these cars. One of the dirty little open secrets of the mainstream automotive industry is that a truly disgusting percentage of the spot welds in your car may have been bad ones which will pop apart at the least provocation. By contrast, every last rivet and spot weld in an S-Class (or an Audi A8, or any other similar vehicle which costs a lot and involves Aluminum and/or carbon panels) will have been inspected.
If the radar unit gets very funky data i
While you're at it... (Score:2)
Since people are now talking about car computer security, now is the time to start thinking about including a secure keyed police shutdown mode.
When we get to autonomous vehicles, the nay-sayers are are already worrying about how this would permit alleged felons to drive off form robberies all the while taking pot-shots at the police (not having to drive, and all).
If we're building a Star-Trek ® flavor of car, start thinking about including Command Authorization Codes on a per-car basis.
Re: (Score:2)
When we get to autonomous vehicles, the nay-sayers are are already worrying about how this would permit alleged felons to drive off form robberies all the while taking pot-shots at the police (not having to drive, and all).
Perhaps, but that self-driving car is going to be obeying all traffic laws while making the getaway, including stopping for said police.
Automakers = conflicted (Score:2)
Every stolen car, and every damaged car = $$ for the automakers for a new car, as the cost of parts is so high that a small amount of true damage = writeoff. or for the repair network for damaged parts.
Better security has been easy to implement for decades, but has not been implemented due to this conflict of interest.
Secure handshake key fobs are the way. Hard wired into the computer so they can not be bypassed or copied.
It's all about the costs (Score:2)
Automobile companies make a large number of vehicles - both GM and Toyota make around 10 million per year. Saving just one dollar on each vehicle adds millions to the company profits.
Something as simple as the extra wiring to create multiple data busses in the vehicle could add a couple of dollars to the vehicle cost. The auto makers will not do it unless it is mandated (either by law or their legal department fearing lawsuits) or they see some sort of a competitive advantage (somewhat unlikely) or there'
Automatic jail sentences (Score:2)
Well, obviously not. We also need 30 years minimum for anyone trying to pin fake evidence of such a crime on someone else, and 40 years for anyone who suggests doing this on slashdot.
I suppose the obvious answer (Score:1)
Of don't own a car with all those gadgets doesn't occur to anyone? On the other hand, laws are funny things. Everyone claims to want to end drunk driving no matter what but as soon as you suggest lifetime revocation of all licenses upon first conviction and mandatory long prison time for second offense, all of a sudden it's a 'societal problem'.
Oh well.
Re: (Score:2)
Of don't own a car with all those gadgets doesn't occur to anyone?
So, where are we going to buy cars which don't have all these gadgets? New cars need the gadgets to meet economy and safety requirements, and there aren't enough old cars to go around.
Re: (Score:1)
I doubt it's impossible to buy a car w/o a built in GPS and it's equally unlikely that having one for instance is a requirement for registration. Anyway this /. are there not some bright lights out there who know how to pull a fuse out?
Garbage post (Score:1)
I am yet to read anything even close to correct on how CAN works and how wireless for vehicles work. These articles all compare the vehicle network to a computer network. They are not the same. Wireless systems have existed in vehicles for years. Only recently have cell phone modems been included but the connection to the vehicle systems is hardware separated.
You can communicate with the modules,on the vehicle network but you need to know what bits to send. Also there are limits to what cannot change o
MILS for embedded compartimentalization (Score:1)