That shouldn't be too hard. Disconnect all radios from management computers with an airgap. And if that goes at the cost of some functionality then so be it but the downsides of interconnected systems are heavier than the upsides.
At a minimum stick an 'airgap' switch in the dash somewhere and default it to 'on', or label it 'insecure' when off so the users know the risks.
a proper separation model with a bridge controlling which message can go from each zone would work as well without reduced functionality - the problem for now is not even that they had some fault in their security but that there was no security to begin with, everything listen to every other thing and can send messages to (almost) anything over the common car bus.
I am not sure why you would need access to the system that controls the breaks/steering/engine. Perhaps to pre-heat the car, or the sat-nav may feed topology to suspension etc.
If they introduce over the air software updates I would be more worried :/
even if information required is one way read only by being read it's not airgapped, and thus requires some deliberate consideration in how the information flows and is filtered, because in a car there are physical wires carrying bit arounds
Perhaps they could have two systems reading the data separately. Even if it means two battery monitors etc.
I know in the Audi Virtual Cockpit (virtual dashboard) they have two graphics cards for the display. I wonder how much of that is for performance, and how much is so if Google maps slows up, your speedometer doesn't freeze.
The earliest linkage that I know of between the vehicle data network and an entertainment system was to be able to automatically increase the radio/CD volume at higher speeds. This was long before phones were built in to the dashboard so there wasn't as much of a requirement for security, once you are inside the car the diagnostic connector will give you access to the whole network anyway.
I don't know of a read-only CAN controller, plus not all data values will be periodically broadcast over the vehicle network so you may need to be able to send out a request for something as well as listen for a reply. The standard firewall tools ought to be easy enough to adapt to filter CAN messages.
The first time I updated ECUs over the air would be over 15 years ago, I have not kept up with whether manufacturers were thinking of doing it routinely.
These days we could work around these sorts of things by using microphones, which would then take things like road surface, or opening a window into consideration.
> The first time I updated ECUs over the air would be over 15 years ago
You had a car with a wireless data connection in 2000?
My fear is that it's too late to start thinking about security. How many manufacturers will be willing to re-think their cyber security, and re design it from the ground up, when some are willing to release a car with a faulty ignition to save a few dollars.
The problem is that doing so removes the ability to do the self parking, or doing something like the remote kill switch that they can invoke in case the vehicle is ever stolen.
Me personally, I know how to park and particularly care if my car is stolen..that's my insurance companies problem. So I could live without both of these features, but you can see how some would argue the opposite. I'm sure there are other tie ins, I'm just can't think of any other that as obvious.
The insurance company could make it your problem, by charging you a higher premium for theft coverage than the next customer if your vehicle doesn't have the feature.
But if these cars can be "commandeered", they (i.e. my movements) could also easily be tracked by the companies themselves (with the information then sold to "trusted partners"). For some reason, that frightens me more.
While this is true, it only works where cameras are present, and adding a significant number of cameras costs time and money.
COTRAVELER[1] is much easier and costs almost nothing. Just having a cellphone in a car (either in the driver's pocket or "OnStar") - which only needs to be on and giving presence notifications to the local tower - is enough to get very accurate near-realtime tracking information. The only costs are read-only access to the tower logs and a few SQL JOINs.
This title should only be "news" early on in the design stage. Were they not trying to prevent hackers from commandeering cars before they released them?
Can't we just stop using the (admittedly convenient) CAN bus for this sort of communication? It was never designed for what people are using it for these days.
Part of the reason cars have gotten more reliable in recent decades is due to this sort of standardization and refinement.
What would you replace it with? If you replaced CAN, you still would need an in car network of some sort. It would have its own layer of security issues to worry about. Mechanics/Service centers would need an entirely new suite of diagnostic tools, this isn't just something you can quit using.
Individual wires transmitting analogue signals; differential voltage or current loop, depending on application. Add a bunch of RC filter networks on either side to limit the bandwidth to the kind of signals going over the wire and you got a pretty tight, hardwired system.
"But two Democratic senators, Edward Markey of Massachusetts and Richard Blumenthal of Connecticut, have introduced a bill that would force the industry to seal off critical computers and add technology to stop hackers in real time."
Why do governments feel the need to dictate the little details? Instead of forcing all car manufacturers to secure cars in the exact same way how about just holding them liable for the consequences if a car is hacked? Car makers can then decide how best to secure the car which would lead to a more diverse and hopefully innovative security measures.
This is the easiest problem in the world to fix going forward... The entertainment system (usually the entry point for this kind of stuff) has no business being connected to any core systems (steering, throttle, brakes, ignition). Just keep the core systems separate, without any connectivity to ANYTHING that can be accessed remotely.
Except the cars are not wired that way, and design changes are expensive once cars are in production (kind of like software in that way, only moreso because they are physical things).
I had this same thought but someone in another hn thread had a good point about how a lot of features still use the core systems. Remote starting your car (a common aftermarket feature for the last 20 years) from an app now obviously needs access to the engine. Even if you disconnect the "core systems" they're still probably going to be connected to the internet.
My ideal car has no power-anything: no power windows, door locks, brakes or steering. Accessory-wise, just an AM/FM radio with a 1/8" AUX jack, a 12V outlet and some cup holders. 5 or 6 speed manual transmission, unless it's electric.
28 comments
[ 3.5 ms ] story [ 77.7 ms ] threadAt a minimum stick an 'airgap' switch in the dash somewhere and default it to 'on', or label it 'insecure' when off so the users know the risks.
I am not sure why you would need access to the system that controls the breaks/steering/engine. Perhaps to pre-heat the car, or the sat-nav may feed topology to suspension etc.
If they introduce over the air software updates I would be more worried :/
even if information required is one way read only by being read it's not airgapped, and thus requires some deliberate consideration in how the information flows and is filtered, because in a car there are physical wires carrying bit arounds
I know in the Audi Virtual Cockpit (virtual dashboard) they have two graphics cards for the display. I wonder how much of that is for performance, and how much is so if Google maps slows up, your speedometer doesn't freeze.
I don't know of a read-only CAN controller, plus not all data values will be periodically broadcast over the vehicle network so you may need to be able to send out a request for something as well as listen for a reply. The standard firewall tools ought to be easy enough to adapt to filter CAN messages.
The first time I updated ECUs over the air would be over 15 years ago, I have not kept up with whether manufacturers were thinking of doing it routinely.
These days we could work around these sorts of things by using microphones, which would then take things like road surface, or opening a window into consideration.
> The first time I updated ECUs over the air would be over 15 years ago
You had a car with a wireless data connection in 2000?
My fear is that it's too late to start thinking about security. How many manufacturers will be willing to re-think their cyber security, and re design it from the ground up, when some are willing to release a car with a faulty ignition to save a few dollars.
Me personally, I know how to park and particularly care if my car is stolen..that's my insurance companies problem. So I could live without both of these features, but you can see how some would argue the opposite. I'm sure there are other tie ins, I'm just can't think of any other that as obvious.
COTRAVELER[1] is much easier and costs almost nothing. Just having a cellphone in a car (either in the driver's pocket or "OnStar") - which only needs to be on and giving presence notifications to the local tower - is enough to get very accurate near-realtime tracking information. The only costs are read-only access to the tower logs and a few SQL JOINs.
[1] https://www.washingtonpost.com/apps/g/page/world/how-the-nsa...
Also as others have said, airgap the systems.
Individual wires transmitting analogue signals; differential voltage or current loop, depending on application. Add a bunch of RC filter networks on either side to limit the bandwidth to the kind of signals going over the wire and you got a pretty tight, hardwired system.
Why do governments feel the need to dictate the little details? Instead of forcing all car manufacturers to secure cars in the exact same way how about just holding them liable for the consequences if a car is hacked? Car makers can then decide how best to secure the car which would lead to a more diverse and hopefully innovative security measures.
If they did things the right way, we wouldn't be at this point. Now they get the hammer.
"Add technology to stop hackers in real tie." Because backdoors never backfire.
Boom. problem solved.