Cyber Attacks Demonstrated On Autonomous Ground Vehicles 52
An anonymous reader writes As vehicles increasingly rely on automation, software and technology enhancements to run basic functionality, those systems serve as a potential safety risk when under cyber attack. Mission Secure uses a proprietary methodology developed by the University of Virginia with the Department of Defense for identifying the most consequential and easy to carry out cyber attacks on any system that a defense capability must address. The goal of the pilot is to demonstrate how to identify vehicle safety threats malicious cyber attackers could use to easily compromise the vehicle's key control systems and how these attacks could be detected and protected.
Sounds like concentrated bullshit.... (Score:5, Insightful)
There is no need for any "proprietary method". You do what any competent security consultant does: You understand the system, you identify critical components and attack vectors. If needed, you consult with experts on the technology evaluated. You correlate the attack vectors and critical components, rate according to your experience and propose fixes. That is it. There is absolutely nothing new or surprising here. There are absolutely no new threats here. The whole article is sensationalist bullshit.
Re:Sounds like concentrated bullshit.... (Score:5, Insightful)
Apparently, they don't seem to understand that computers already control airplanes, submarines, other boats, trains, and nuclear missiles.
Not to mention computer controls power plants (including nuclear power plants, dams, our traffic systems, etc.
Re: (Score:2)
And that an old carbureted vehicle without a single transistor can be carjacked with a gun and a mask. And can crash into other cars. The real question is: Is the risk of causing deaths higher for autonomous vehicles or human driven vehicles?
Re: (Score:2)
Well, if autonomous vehicles do not manage to be significantly better than human drivers, they will likely not take off. And once they are significantly better, it may eventually spell the end of humans driving in the long run.
Re: (Score:2)
If something like that is the case, your security 'expert' is most likely a brain damaged rhesus monkey, kind of like the guy that suggests you leave your loaded gun on the front porch.
Re: (Score:2)
Yes, sounds very much like it. I think we also already have seen demos last year about hackers engaging brakes remotely and starting engines.
There is a drive to integrate everything, because a modern car has an inordinate amount of cabling, which is expensive and heavy. Just running power and data everywhere would be a lot cheaper. And, as you point out, it is done in a lot of other places already.
Re: (Score:2)
Yeah but can we all just agree that connecting some of these systems to the internet or a wireless network is a bad idea?
I want a person who sees one screen with internet access, makes a decision, and presses a physical button on the controls for the nuclear power plant.
So auto driving cars are great -- can be secured, but let's not be cavalier about "other things are computer controlled" -- there's going to be iPhone software that tweaks the car and that means 100X more access by script kiddies to mayhem.
Re: (Score:2)
I predict that the cars in question will have no wireless connection from the controlling computer. There will be a wired plug, just like in current cars.
Because adding wireless capacity to the part of the car that controls fuel injection is a moronic idea - as you pointed out.
Re: (Score:1)
"proprietary methodology"
Somebody is trying to sell the electronic equivalent of 'distressed properties'.
Re: (Score:2)
Indeed.
Re: (Score:2)
Well, much like dish soap, concentrated bullshit is better than regular-strength bullshit!
Re: (Score:2)
Nice one! ;-)
Re: (Score:1)
Indeed. And neither TFS nor TFA mentions any attack that's actually been "demonstrated", they're couched in purely theoretical/hypothetical terms. "Oh, if you pay us some stupid amount of money we can tell you what attacks you need to defend against. But no, we're not going to show you any for free, what do you take us for?"
Development process is just as important (Score:4, Interesting)
I interviewed for a job working on an autonomous vehicle project, many years ago. Oh, to clarify, this was an autonomous MILITARY vehicle. I see this is just about cars.
My job would have been to do retro-documentation.
That's a violation of the approved development process. I turned the job down.
There is an annoyingly-complicated process that is supposed to be followed. And then there is how things are ACTUALLY done.
Based on this, I suspect your auto-parking Lexus may well be less susceptible than some driverless tank. :( Auto companies don't have to follow standards so ridiculously-difficult to follow that they aren't followed, and then go through the motions after the project is completed.
Re: (Score:2)
A requirement of the approved development process is that certain documentation be produce in advance of or commensurate with development. Not after-the-fact. You're not supposed to do a skunk-works project and then later go through the motions of producing the required lifecycle documentation. (And, presumably, back-dating it...)
I believe this was the standard in place at the time (and still is?):
http://en.wikipedia.org/wiki/M... [wikipedia.org]
Be Concerned About More than Computer Hack (Score:1)
Re:Be Concerned About More than Computer Hack (Score:4, Interesting)
Re: (Score:2)
So what was your friend's next move: check the glove box for the name of the person who was at that moment driving his car?
Re: (Score:2)
Re: (Score:2)
"And then?"
Re: (Score:3)
Re: (Score:2)
On a pet peeve note, the cars with alarms that would tell me to "step away from the car" when I walked past on the sidewalk always went off, but that was because I would reply by jumping on the bumper to set it off. You may own your car douchebag, but you don't own the space around it. (
Re: Be Concerned About More than Computer Hack (Score:2)
Most of us learned to ignore car alarms.
In college, our dorm was next to the parking lot. One night, some car alarm malfunctioned & went off with a the car horn on continuously. It woke us up at 2am. After 20 minutes we went out to try to shut it off. We were not willing to break things & couldn't pop the hood to disconnect the batt. So we tried to go to sleep. 2 hours later, the horn's 2nd tone stopped. In 20 minutes it was quiet as the battery died & we cheered.
Now the owner had a dead b
What a future you have here... (Score:2)
imagined threats (Score:2)
meanwhile the tried and true methods of bombs planted on vehicles, tampering with brakes, shooting drivers, etc. continue to get body count
"I don't need no high tech shit to whack somebody" -- Vinny "Dago Football" Bartoli
Re: (Score:2)
you watch too many movies, the majority of assassins don't mind the world knowing their target was assassinated; the acknowledgement and recognition that an assassination has occurred is normally part of the agenda of the party with motive.
Just like the Viper Mark VII (Score:2)
The Cylons were able to defeat the new, shiny, electronically controlled Vipers while the older Mark II Vipers were impervious to cyber attacks.
Once again, analog is better than digital.
Re: (Score:3)
Once again, analog is better than digital.
Not quite. Being networked together was a major vulnerability for the colonial fleet. A patch sent out from the defense mainframe prior to the attack created an opening for the Cylons to exploit by shutting the navigation systems for the battlesars and vipers in battle. Battlestar Galactica survived because it's computers weren't networked together and the patch wasn't installed.
Re: (Score:2)
Actually, it is the same since (some) cars, such as Tesla, can be remotely updated. They don't have to go to a shop to get their software changed.
While in BSG they installed a patch to the mainframe first, there is nothing to say a similar process couldn't be done or found to compromise vehicles which allow this operation.
Re: (Score:2)
Imagine someone able to hack this type of system and the chaos they could cause.
Again, analog is better than digital.
Re: (Score:2)
Galactica was being retired, and thus wasn't slated to receive the upgrades (and Adama was opposed to network systems anyway). The Battlestar Pegasus had the Command Navigation Program, but it was offline for maintenance since Pegasus was in dock at the time of the attack, and thus Pegasus was unaffected.
The lesson is that patch management and updates are seriously important t
Re: (Score:2)
Re: (Score:2)
Does it have a computer and field range interface? (Score:1)
Then it can be hacked.
This is why you don't trust computers.
Says the guy who has worked in computers since the 80s and rolled his own in the 70s.
Re: (Score:1)
Wish it wasn't a theory.
There are three methods of dealing with it.
1. ability to disconnect and reset systems in case of hacks.
2. surprise (difficult in a rich EM environment)
3. more highly independent systems, so you can isolate one and still function.
car spam. (Score:3)
you will find your car pulling into the nearest walmart, telling you there is a sale on things you like to buy, that your friends are already there shopping, and you must sit in this parking lot for at least 10 minutes before going home or pay the unlock fee on various 3rd party apps your car installed for you at 2am this morning.