Terrifyingly bad design makes jeeps remote murder machines. - Page 1
Forum section: electronics / general

author: jwm_
author_rank: Frequent Contributor
timestamp: July 21, 2015, 11:35:47 pm
content: This is scary, and would have been trivially avoidable with basic mild security foresight. tl;dr. Anyone driving a jeep cherokee can be anonymously remotely murdered over the internet right now.Jeep connected the cell "smartphone" to the cars internal CAN bus. meaning zero day exploits of the phone (which exist) turn into being able to rewire the cars firmware to do anything. like remove tension from the seat belts, do max acceleration, disable breaks and twist the wheel into a roll. _easily_.If anything needed to be _physically_ firewalled, it is a cars CAN bushttp://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

author: TorqueRanger
author_rank: Frequent Contributor
timestamp: July 21, 2015, 11:41:26 pm
content: This is nothing new here ..Check out Defcom they did it before and can be done for many years now but never has either been reported or done but was always possible.. Also there is no way to really stop it cause all they really need is time to hack it and by the time you realize whats going on it's to late ..

author: jwm_
author_rank: Frequent Contributor
timestamp: July 21, 2015, 11:44:56 pm
content: Quote from: TorqueRanger on July 21, 2015, 11:41:26 pmNo, remotely hooking into cars entertainment systems or door unlock mechanism has been done, this is remotely hooking into the CAN bus with full privliges, which is wildly different order of magnitude. Also, should be impossible. For instance the FAA demands a physical air gap between fly by wire systems and other ones, I would have assumed the same would be bleedingly obvious to car manufacturers and would 100% protect against this.

author: TorqueRanger
author_rank: Frequent Contributor
timestamp: July 21, 2015, 11:52:39 pm
content: Please Watch

author: langwadt
author_rank: Super Contributor
timestamp: July 21, 2015, 11:52:47 pm
content: Quote from: TorqueRanger on July 21, 2015, 11:41:26 pmso far it has required physical access to insert hardware to access the CAN bus via the OBD connector or similar. That isn'tso scary since if you can get physical access there is nothing that can stop an attack.If they can really do it all wireless then it is much much more scary

author: TorqueRanger
author_rank: Frequent Contributor
timestamp: July 21, 2015, 11:58:01 pm
content: Maybe I am not understanding here cause I work for a tow truck company and I can gain access to most Cars in under 30 seconds or less and right to your obII plug and be able to control the car remotely and the remove the OBII tool after impact and no one will be the wiser..

author: jwm_
author_rank: Frequent Contributor
timestamp: July 22, 2015, 12:13:06 am
content: Quote from: TorqueRanger on July 21, 2015, 11:58:01 pmPhysical access is a big big difference. you could always just stick a car bomb in there if you had physical access.But physical access means fingerprints, forensic evidence, you having to be in the same jurisdiction as the victim at some point, something for investigators to find after the accident, and a fair amount of skill.This brings it to script kiddies. some 12 year old budding psychopath with an undeveloped moral sense in no-extradition-ia on the other side of the world downloads a script and types in a cars IP address for the lulz with no effort or practical culpability.Or mobsters from another country send extortion letters threatening death to your family and can actually follow up on the threat fairly easily without exposing themselves locally.

author: Tomorokoshi
author_rank: Super Contributor
timestamp: July 22, 2015, 12:17:48 am
content: QuoteWhatever happened to "fail-safe"? It's as if it was engineered with failure capability built-in. What if the processor or some other component has a fault? It seems like automotive standards are quite out of date when it comes to failure modes.

author: TorqueRanger
author_rank: Frequent Contributor
timestamp: July 22, 2015, 12:20:37 am
content: Quote from: jwm_ on July 22, 2015, 12:13:06 amHow many Accident Deaths have you ever cleaned up?

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2015, 12:24:47 am
content: Quote from: langwadt on July 21, 2015, 11:52:47 pmYes, I'm not sure what the fuss is about here.No one can remotely hack into your CAN bus if the physical wireless/internet hardware is not there to do that.How many cars have that?Tesla is wirelsss internet connected, but they have challenged hackers to break it and so far no one has?

author: jwm_
author_rank: Frequent Contributor
timestamp: July 22, 2015, 12:28:18 am
content: Quote from: EEVblog on July 22, 2015, 12:24:47 amThat's what this new attack is. completely wireless, against jeep cherokees (which are not uncommon). They do a remote update of the firmware and are given full access to the CAN bus with no physical access ever needed.That's the bad design I alluded to, they actually put the physical connection in there between the buses. sigh.QuoteJohn

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2015, 12:55:37 am
content: Quote from: jwm_ on July 22, 2015, 12:28:18 amThen they are stupid and they will go out of business if they don't fix it. A recall is in order.

author: jwm_
author_rank: Frequent Contributor
timestamp: July 22, 2015, 01:11:33 am
content: Quote from: EEVblog on July 22, 2015, 12:55:37 amYes. very much so. Actually an air gap should be manditory for the same reason the FAA requires it for planes. I somehow assumed it was as that is very basic security.Every chrysler since 2013 is a lot of cars to recall, maybe 4 million cars based on gross sale numbers.Nowadays a botnet can do an exhaustive search of the entire IP space on the order of tens of minutes. A single person can do a lot of damage, not just to the car owners, but anyone in their path. A coordinated crashing of a few million cars will bring every major freeway to a halt and overwhelm emergency services.John

author: suicidaleggroll
author_rank: Super Contributor
timestamp: July 22, 2015, 01:55:35 am
content: DBW throttle, ECU-controlled fuel and spark, all are fine with me...but I've never been comfortable with electronic brakes, steering, or ignition. I haven't bought a vehicle with any of those yet, and I would have to face a serious internal struggle before ever doing so.I think it goes back to the old rule - you never want to see how sausage is made. Waiters/waitresses don't eat where they work, and electrical engineers don't trust cars driven entirely by electronics. Once you see how things actually work, and the bugs that can make their way into critical systems due to ineptitude and lack of oversight, you have difficulties ever trusting them. Anyone remember this?http://www.edn.com/design/automotive/4423428/Toyota-s-killer-firmware--Bad-design-and-its-consequences

author: Rasz
author_rank: Super Contributor
timestamp: July 22, 2015, 02:34:12 am
content: Quote from: EEVblog on July 22, 2015, 12:24:47 am>any Chrysler vehicle with Uconnect from late 2013, all of 2014, and early 2015GM is not far behind pushing its own car as a hotspot crapQuote from: EEVblog on July 22, 2015, 12:24:47 amNo they didnt. Tesla was recruiting and promoting at Defcon, not running any challenges. They did it only after independent chinese competition that ended in plethora of remote exploits. There were at least 7 remote exploits found in model S to date (wirelessly opening doors while car is moving and so on). This just shows how good Tesla PR is.I imagine car "security" is handled in same stupid way Boeing did it in 747 relying on ethernet VLANs for separation of networks, because adding $100 in wires to $30K car is TOO MUCH!

author: Skimask
author_rank: Super Contributor
timestamp: July 22, 2015, 02:47:20 am
content: Quote from: jwm_ on July 21, 2015, 11:35:47 pmF.U.D.QuoteNot likely as the seatbelt mechanism has a centrifugal locking assembly in it which is actuated mechanically...no electronics here.QuotePossible, but as has been shown in the Toyota Prius debacle, step on the brakes, turn the engine off, no problems here.QuoteEverybody wants to "disable BREAKS".However if you mean "disable BRAKES"...impossible, as even though the braking system is tied into systems such as anti-skid, anti-lock, etc., the fail-OPERATIONAL mode of any and all braking system is purely hydraulic. Barring any failures otherwise (eg. leaks, blockages, etc.), step on the brake pedal, brake shoes/pads actuate, car stops. 'nuff said.QuoteNOT easily. First you gotta spin the steering wheel fast enough and have enough traction to make the vehicle roll over. Second, today's power steering system is a form of an electric power 'assist' system, NOT a steer-by-wire system...and they are easily overcome with nominal effort.Nothing to see here...Move along...

author: Rasz
author_rank: Super Contributor
timestamp: July 22, 2015, 02:57:38 am
content: Quote from: Skimask on July 22, 2015, 02:47:20 ammaybeQuote from: Skimask on July 22, 2015, 02:47:20 amumm NO, like the prius you cited its all in software now, if you control the software (or it crashes) then there are no brakes.Quote from: Skimask on July 22, 2015, 02:47:20 amyou missed a step between "step on the brake pedal" and "brake shoes/pads actuate", that step is 'ECU reads potentiometer in the pedal and decides what to do'.Quote from: Skimask on July 22, 2015, 02:47:20 amnothing to see here except remote exploit on a moving CAR

author: CatalinaWOW
author_rank: Super Contributor
timestamp: July 22, 2015, 03:07:50 am
content: So a Jeep lacks a firewall, and a Prius has a purely electrical element in the brake system. Seems there is still a pretty tall hill to climb for that script kiddy. Somehow he has to get the cell phone to hack the Jeep system into a Prius, or the Prius brakes into a Jeep.The Prius may well have better system separation - it needs it. The Jeep may have evaluated the risk and said it was OK, because it is on their automobile.Maybe some future automobile will be at risk, but in the cosmic scheme of things I'm not going to lose a lot of sleep over this.

author: Rasz
author_rank: Super Contributor
timestamp: July 22, 2015, 03:37:16 am
content: Quote from: CatalinaWOW on July 22, 2015, 03:07:50 amIs it my language barrier, or does above read like gibberish?Quote from: CatalinaWOW on July 22, 2015, 03:07:50 amif you define future as past 2013, because this is what this article is about. This isnt some "yo I can haz hax" kid story, one of the researchers is a former NSA geek. Team from the piece has been working on this since 2010.Quote from: CatalinaWOW on July 22, 2015, 03:07:50 amme neither, but that doesnt make it less realHacking a phone is trivial(huge attack surface), automakers decided every car should have a smartphone buildin and tightly integrated with the rest of the system(new revenue stream), sooner or later there wont be any cars left without this functionality.Quote from: datumplane on July 22, 2015, 03:22:07 ambtw Tesla has crtl-alt-del build RIGHT INTO THE steering wheel to reset whole dashboard in case it hangs _while you are driving_. In case you think Tesla is HOLY and Im lying go to garage, put your sweet innocent hands on the steering wheel and hold down both scroll wheels

author: miguelvp
author_rank: Super Contributor
timestamp: July 22, 2015, 04:24:20 am
content: That's pretty major, you might as well have Eugene the Jeep to drive your Jeep.I wonder if the researchers already approached the manufacturer and only came public because they didn't do a thing to resolve the problem.One thing is to illegally enter and alter someone's car and put something in the ODBII that allows you to gain control, because you never know if someone saw you do that and snapped a picture or even film you doing the modification, or just forensics could catch the perpetrator.Doing it by hacking into someone's phone is orders of magnitude worse, that's just insane and totally irresponsible from the engineers that designed the car, or whoever vetoed the engineers to reduce cost instead of doing a proper design and if that is the case I would still blame the engineers for not stepping forward.I don't think I'll ever buy a car that connects to my phone, not even for hands free calls. Any call can wait until I need a break or I arrive to my destination.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2015, 04:26:52 am
content: Quote from: Skimask on July 22, 2015, 02:47:20 amI think there is.AFAIK seat belt pre-tensioners are pyrotechnic charges set off, just like airbags. You are thinking of the regular selt belt mechanism which still exists, that has slack in it hence why pre-tensioners are used a lot now.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2015, 04:28:38 am
content: Quote from: miguelvp on July 22, 2015, 04:24:20 amThat's uninformed FUD.Bluetooth phone connection for handfree calls can in no way access a cars systems.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2015, 04:36:36 am
content: Quote from: suicidaleggroll on July 22, 2015, 01:55:35 amCue Free_Electron who works at Tesla and also owns and drives one...

author: miguelvp
author_rank: Super Contributor
timestamp: July 22, 2015, 04:57:54 am
content: Quote from: EEVblog on July 22, 2015, 04:28:38 amIt all depends on the car manufacturer on what access they allow via Bluetooth, maybe they think it would be cool if you could tap into the CAN bus to get telemetry via an app. Or maybe is not even intended but a flaw because the built in Bluetooth module needs to connect to the infotainment system via CAN and they didn't think in protecting other CAN channels from being accessed.To be clear I'm not saying it's possible on current cars, just that it "might" be possible.In any event I don't need to make calls or answer them while driving anyways.Quote from: EEVblog on July 22, 2015, 04:36:36 amYeah, I thought Tesla had separate independent CAN buses, but then again:http://www.instructables.com/id/Exploring-the-Tesla-Model-S-CAN-Bus/?ALLSTEPSCAN 6 looks a bit dangerous:QuoteAnd the link:https://github.com/openvehicles/CAN-RE-Tool/blob/master/rules/teslamodels

author: Skimask
author_rank: Super Contributor
timestamp: July 22, 2015, 05:45:47 am
content: Quote from: EEVblog on July 22, 2015, 04:26:52 amYep. Absolutely right. My bad.Ejection seats are similar. Pull the yellow/black handle and all the straps go tight milliseconds before the main ejector mechanism goes off.

author: Marco
author_rank: Super Contributor
timestamp: July 22, 2015, 06:04:29 am
content: So this is going to be the second massive recall for Daimler over screwing up X-by-wire ... hard to feel sorry for them.

author: pickle9000
author_rank: Super Contributor
timestamp: July 22, 2015, 07:12:10 am
content: So do train locomotives use CAN? I'm thinking that the general goods transportation industry (large trucks) would be a target for this sort of thing.Anyway, interesting topic.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2015, 07:23:53 am
content: Quote from: miguelvp on July 22, 2015, 04:57:54 amThat is different to what I am talking about.I'm talking specifically about handsfree calling. Pairing your phone via Bluetooth for handfree calling is done via a defined accessory protocol, and AFAIK it can't do anything else but that.

author: G7PSK
author_rank: Super Contributor
timestamp: July 22, 2015, 07:51:00 am
content: What I understood was that Jeeps have a mobile phone system built into the cars computer system, if Chrysler are using the system does that mean Mercedes or Fiat are as well.

author: TMM
author_rank: Frequent Contributor
timestamp: July 22, 2015, 08:09:08 am
content: Quote from: Rasz on July 22, 2015, 02:57:38 amAs far as i know, the brake pedal is still connected mechanically to the hydraulic brake system in all modern vehicles... Cars equipped with anti-lock brakes have electronically controlled hydraulic valves which is how the anti-lock functionality is implemented. If the vehicle detects that the wheels are skidding due to excessive braking force (by monitoring the data from the wheel speed sensors at each wheel), the valves temporarily disable the braking system to allow the wheels to start turning again. That way the driver can just slam the brake pedal to the floor and still be able to steer the vehicle, instead of locking up the wheels and skidding in the straight line. It also means that if the vehicles suffers electronic failure you will probably still have a functioning braking system.In the video you hear a whirring/hammering sound when the hackers 'disable the brakes', this is them enabling the anti-lock braking valves via software so stepping on the pedal doesn't hydraulically engage the brakes, or at least becomes very ineffective.There may be a potentiometer in certain cars to provide extra functionality such as electric regenerative braking in hybrid vehicles.

author: Rasz
author_rank: Super Contributor
timestamp: July 22, 2015, 08:24:42 am
content: Quote from: miguelvp on July 22, 2015, 04:24:20 amIts not a car connecting to your phone, the car IS a phoneprogrammed by same people that did rest of entertainment system. You know, the one with "loading, please wait" screen when you turn on the radio in the morning, the one you can hack by playing specially crafter MP3 file (true story).

author: G7PSK
author_rank: Super Contributor
timestamp: July 22, 2015, 08:45:07 am
content: So what happens if you pull the sim card out.

author: Someone
author_rank: Super Contributor
timestamp: July 22, 2015, 08:46:47 am
content: Quote from: EEVblog on July 22, 2015, 04:36:36 amExcept when challenged doesn't disclose any commercial relationships back to Tesla.

author: nctnico
author_rank: Super Contributor
timestamp: July 22, 2015, 09:18:22 am
content: Quote from: jwm_ on July 21, 2015, 11:35:47 pmThere are a couple of red flags in this article. In the EU there has to be a physical connection between the steering wheel and the wheels. Same goes for the brakes. Unless these are not requirements in the US as well I really see no way to make the steering wheel and brakes quit working in any scenario. Maybe you need to press the brakes harder but they will work even without the engine running.

author: BradC
author_rank: Super Contributor
timestamp: July 22, 2015, 09:24:15 am
content: Quote from: nctnico on July 22, 2015, 09:18:22 amSo these self parking cars obviously have no way for the computer to control the steering, and the ABS systems have no way to dump brake pressure to a wheel? You can disable braking on all 4 wheels and send the pedal to the floor by manipulating the ABS module, and you can control both the steering and power assist magnitude by manipulating the steering control module. What's so hard to understand?

author: ruffy91
author_rank: Regular Contributor
timestamp: July 22, 2015, 10:14:08 am
content: Most new cars can even brake themselfes (automatic emergency brake and automatic pedestrian brake). So the actors are there. Electronic throttle isn't even new to 10 year old cars and todays key-less cars could even be manipulated to not turn off the engine (manipulate the firmware of the start-stop-automatism) when given write access to the CAN-bus.

author: McBryce
author_rank: Super Contributor
timestamp: July 22, 2015, 11:24:27 am
content: Thought I'd give my 2 cents here as I work(ed) on the design of some of the stuff they claim to be hacking here (not for Jeep, but for other manufacturers).1 - Legally a physical connection is always required between steering / braking (worldwide). These may be assisted by electronic systems, but the driver can always override the electronics. The brakes still work, they just aren't as effective. Even the steering during automatic parking can be stopped by holding the wheel. So all of their hacks are entertaining, but hardly dangerous.2 - I have no knowledge of the Jeep system, but other systems would all require physical access to the wiring and they seem to imply that there is just one big CAN bus going around the car with everything connected to it. There isn't. To hack the car you would need to get physical access to more than one bus system and in most cases they won't all be CAN, there'll be flexray involved in many of these systems. Some of these are burried under the dashboard, some are only within the engine bay. It's also not possible to just add a module to most systems and push CAN data. The modules are even matched in some cars, so even swapping an entire module out wouldn't be easy. I'm pretty sure the owner of the Prius would notice that someone had removed their dashboard.Regarding "Fail-safe" brakes (mentioned by someone above). This is something that gets discussed forever in the automotive industry, especially when future drive by wire systems are being discussed. What is fail-safe for a brake system? If my brakes register a failure, what is the "safe default"? Putting the brakes on fully? Not if you happen to be on the motorway at 250Kmh, or stuck on a railroad crossing! What is the safe position for a steeringwheel? Without knowing exactly what situation the car is in, it's impossible to decide what's safest. This is why "fail safe" in the automotive industry is usually called "limp home mode". It throttles the system enough to reduce the danger, without removing the functionality completely.McBryce.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2015, 11:30:22 am
content: Quote from: Someone on July 22, 2015, 08:46:47 amFree_Electron has made no secret of the fact that he works at Tesla:https://www.eevblog.com/forum/blog/eevblog-306-jim-williams-pulse-generator/msg553852/#msg553852

author: amyk
author_rank: Super Contributor
timestamp: July 22, 2015, 11:54:50 am
content: Quote from: BradC on July 22, 2015, 09:24:15 amABS can release brake pressure but there needs to be an override in hardware so that it's impossible for electronics to maintain the brake pressure in the released state. This could be incorporated into the hydraulic module.QuoteA manual hydraulic brake, like cars have had for decades.Assisted steering should remain entirely separate, I prefer the old hydraulic system.QuoteI agree, electronics can be pretty fragile compared to the mechanical/hydraulic systems they replaced. I wonder if mechanical engineers feel the same way.Fun fact: TheBoeing 737can be controlled even with complete loss of hydraulic pressure, because it still has cables from the flight controls to the control surfaces. Physical linkages are the best.

author: McBryce
author_rank: Super Contributor
timestamp: July 22, 2015, 12:07:54 pm
content: Quote from: amyk on July 22, 2015, 11:54:50 amYes, but the question was actually referring to complete drive by wire systems. Obviously the manual hydraulics offer the best fallback, but given that Manufacturers are handing out bonus packages if you can remove 50g from the weight of the vehicle, you can understand why they are eager to remove massive systems like hydraulic brakes and steering racks (if the law let them).Further funny fact: A well known OEM asked to trial and test a prototype brake by wire system. It failed their tests, because according to the test report: The test procedure requires that the "Brake System must be able to supply a Hydraulic pressure of at least....."McBryce.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 22, 2015, 12:09:03 pm
content: Why on earth does the entertainment side haveANYdirect access to the CAN bus? I'm sorry but I don't see this as an electronics vs mechanics argument at all but the all too typical laziness and arrogance of car designers.

author: McBryce
author_rank: Super Contributor
timestamp: July 22, 2015, 12:14:02 pm
content: Quote from: Mechanical Menace on July 22, 2015, 12:09:03 pmOn 99.9% of cars it doesn't. It seems that Jeep have been the first to have (stupidly) decided to do this.McBryce.

author: dr.diesel
author_rank: Super Contributor
timestamp: July 22, 2015, 12:21:37 pm
content: I don't own a newer vehicle, but doesn't the central display (perhaps said as entertainment center) also display vehicle diagnostic info? Tire pressure, vehicle speed for GPS Nav, etc? Probably more integration than we realize.If so, the communication path is or must be there.

author: tomlut
author_rank: Regular Contributor
timestamp: July 22, 2015, 12:33:25 pm
content: Fasten your tinfoil hats, the CIA have already used this technology to murder Michael Hastings.http://nymag.com/news/features/michael-hastings-2013-11/

author: McBryce
author_rank: Super Contributor
timestamp: July 22, 2015, 12:36:37 pm
content: Quote from: dr.diesel on July 22, 2015, 12:21:37 pmIt's usually just receiving display information. It's definitely not reading this data directly from the devices themselves and doesn't have way of writing information back to a device. If this link is a CAN connection, then it's an entertainment or control CAN bus which wouldn't be directly connected to any engine management or safety system bus.McBryce.

author: Kevman
author_rank: Regular Contributor
timestamp: July 22, 2015, 12:38:00 pm
content: Quote from: amyk on July 22, 2015, 11:54:50 amSo you're saying that there's a requirement for some sort of... Mechanical timer that prevents the ABS system from working beyond a certain amount of time? Sounds like it'd be tough to implement, as you could just repeatedly add and release pressure (like an ABS system is designed to do), so you'd need an integrator that looks at it over the course of a few seconds. Of course such a thing would be good to know about if you happen to hit several ice spots...I'd like to read about this requirement - do you have a source? Of course, such a system would take a second or two to kick in anyway and I wonder how long it takes to "reset..."

author: dr.diesel
author_rank: Super Contributor
timestamp: July 22, 2015, 12:45:45 pm
content: Quote from: McBryce on July 22, 2015, 12:36:37 pmWell, not a great comparison, but here goes. I don't own a newer car, but I do own a 2015 Indian motorcycle. The main display is interactive, shows speed, engine RPM, diagnostic trouble code info, ABS status, battery voltage, tire pressure, transmission gear selection and even software revisions. I can even reset trouble codes, might very well be a two way street.Given the volume of people here, bets are there is an auto expert that will hopefully fill us in.The most scary part, no such thing as unhackable software.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 22, 2015, 01:06:55 pm
content: Quote from: dr.diesel on July 22, 2015, 12:45:45 pmMore likely than not through an OBD connection of some sort. OBD has a much different goal than CAN and while newer standards may even have a CAN bus connection on the same socket it's a very different sort of beast. Yes it will give you diagnostics info the ECU knows how to supply and let you reset codes but it won't let you talk to the registers of any given body computer for example. It's "simply" a way to report information and clear flags after a repair.QuoteHopefully, then they can correct any stupid mistakes I've made above.QuoteThere's no such thing as unhackable anything given time and access.

author: McBryce
author_rank: Super Contributor
timestamp: July 22, 2015, 01:14:58 pm
content: Quote from: dr.diesel on July 22, 2015, 12:45:45 pmI'm not up to speed on motorbike architectures, but I would assume they use the same concepts as cars do. Critical data is only accessable by the systems that need them. Values for displays are sent on a seperate bus to the display device. This may be a two way system if for example the display has buttons. This information is usually coming from a BCM (Body Control Module), not directly from the ECU or ABS Module. The BCM gateway, which passes the required information from the ECU/ABS to the display will not suddenly decide to pass information from the display back to the ECU/ABS. To hack this you would need to completely re-write the BCM Firmware, no easy task.BCMs will usually have several buses coming together. The one I'm working on at the moment has 6 CAN buses (and a few others too), but the rules for which data can be passed from one to the other is decided by the Firmware. To send hacked data directly to any critical system, you would have to either directly access that systems bus, or rewrite the Gateways Firmware. In many systems, this firmware can't even be updated through the OBDII, the module would need to be opened.I've been designing Automotive Electronics for very well known companies for the last 22 years.McBryce.

author: dr.diesel
author_rank: Super Contributor
timestamp: July 22, 2015, 01:26:10 pm
content: Quote from: McBryce on July 22, 2015, 01:14:58 pmExcellent info!I wonder how vehicles that allow for other-the-air reflash handle security? ie, is there some "lock" of sorts that prevents such an action while in motion etc?

author: Rasz
author_rank: Super Contributor
timestamp: July 22, 2015, 01:38:45 pm
content: Quote from: Mechanical Menace on July 22, 2015, 12:09:03 pmDoesnt have to, as long as the next hop has a vuln you can jump over. Those subsystems might not be logically connected, but they use same wires, or at the very least terminate in same place.Imagine an office with HR dept on a separate lan. How do you stea^^borrow payroll documents? You send HR pdf worth printing. Specialpdfthat will reflash network printers firmware and build you a beachhead on this physically separate network.PCL/PostScript/TrueType are not document formats, those are full programming languages with huge attack vectors. M$ has some sort of truetype bug leading to privilege escalation (GDI runs in kernelspace since NT, they started slowly moving some stuff back since Vista) every couple of years, includinglast week patchfor a7 months old bug. Just think about this one - bad font embedded in an email can own your computer.As long as there are electrical connections there is a way to bridge the gap.

author: McBryce
author_rank: Super Contributor
timestamp: July 22, 2015, 01:40:45 pm
content: Admittedly I have yet to work on a system that allowed over the air updates. The normal way for updates is through the dealer, where either a non-critical update will be done when the car comes in for it's next service, or a critical update will trigger a callback (no-one wants to be responsible for causing one of these!). These all usually happen through the OBDII, although there are systems that require a direct connection to the module.I would assume that for an over the air update that the controller would have to be put into program mode (as it does with wired updates) and that this is locked out if the engine is running.Our biggest problem at the moment is the influx of multimedia companies, that seem to want to turn cars into mobile phones, but are unaware of how critical automotive hardware and firmware is. I've had presentations from several well known Computer/Phone companies that made my hair stand on end with their suggestions. Including one that was looking to connect all systems to a cloud! When I asked them how they defined the ASIL levels for their modules, the answer was "What's ASIL?"Personally I don't see any reason for having over the air updates for cars. If your software is so bad that you need to broadcast updates, then you're in the wrong industry. If an update is required, cars tend to have wheels, drive it to the update.McBryce.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 22, 2015, 02:10:51 pm
content: Quote from: McBryce on July 22, 2015, 01:40:45 pmI don't think you should everneedupdates on a lot of things. You shouldn't need online updates to fix game breaking bugs on console games, or updates to fix (the shipped with the device) OS bugs on consoles and phones. TVs should never, ever, ever require updates to fix bugs in the shipped firmware. If they can't deliver a feature bug free (or in the case of games allow you to at least finish the game) without resorting to online updates then the release date should be put back until they can. If you don't you're willingly selling something that's unfit for the advertised purpose.When it comes to cars and the like this is even more serious than living up to what you've promised. Failure to deliver could be much worse than not been able to finish CoD Absurd Warfare:Malibu Stacey's New Hat Edition's single player campaign or having to pull your battery to be able to make a call.

author: McBryce
author_rank: Super Contributor
timestamp: July 22, 2015, 02:31:47 pm
content: That's why we have all these ASIL, ISO 26262, IEC 61508, FMEAs etc. to make sure that the product has been tested and verified as much as possible. Games companies don't do any real testing, they just throw together a product, test = Let a few kids play it, and ship it out, but nobody dies if a game crashes, although I did get quite upset when CoD: Pink OPs - Malibu Stacey's New Hat Edition kept freezing on me (If she wasn't so skinny she'd be a lot easier to shoot too!).A certain software company that was trying to enter the automotive industry mentioned "monthly updates" in one of their presentations and half the room stood up and left shaking their heads. Yes, they wanted to broadcast them over the air too.McBryce.

author: discomike
author_rank: Contributor
timestamp: July 22, 2015, 03:00:06 pm
content: Any communication medium can be abused for hacking if there are vulnerabilities in the other end - this includes the bluetooth headphone profile - or maybe the wireless TPMS sensors etc.As McBryce points out people are also complaining that it's outrageous that the telematics/infotainment system is "on the same bus" or "connected directly".. it doesn't really matter here if they are connected directly or go through some gateway/firewall - since as long as you have two-way communication you have a potential attack path.And why do you need two-way communication? Now for some features such as automatic volume control you could imagine a one-way system working, but for other things like lowering the temperature in the car (done on the infotainment unit in all new cars) then you also send a torque-request to the engine so it will increase power to meet up with the load increase due to the compressor so that you don't get that AC-jerk as well as better emissions. Some newer cars with automatic transmission also adjust the gears in anticipation of slopes - using position data that is collected from many sources such as satellites, cell phones, or by identifying wifi networks ala google.As for brake systems all the ones I've seen have had an external watchdog ASIC (that is not connected to any network or not updateable) that monitor for how long the hydraulic valves and pumps (or drivers) are open/on and if the maneuver does not look like a normal ABS/ESP-event it will kill or reset the brake controller so that you can stop your car. Of course having a extra chip is expensive and adds complexity so maybe they are skipped by some.Finally whenever the topic of automotive safety is brought up there is always a lot of talk about the automotive industry doing nothing or not taking the problems seriously etc. I think this is because you don't hear about it in the same article as you read about the exploits in - there is a lot of car-manufacturer funded research and cooperation with the universities resulting in papers, best practices, recommendations etc on how to deal automotive software security. Of course getting all of the developers to follow these methods is harder - especially since most of the development is not done by the OEMs themselves. It's really hard to verify if secure coding practices have been followed everywhere when you only have the object code and the suppliers promise.What you have to do to achieve real security is a multi-layered approach - we'll never be truly secure but we can make it pretty though by applying the following things:* Simplify the interfaces between these units to reduce the attack surface* Follow best practices from the PC world* Educate all of your developers on software security* Use attack mitigation techniques* Test and fuzz your stuff and then test some more* Use separate security solutions such???- I'm not really a fan of firewalls and other security products since they make everything more complex and might actually introduce additional attack surface - but it's a judgement call.I recently went to a seminar for one of these research programs at my local university (HEAVENS - HEAling Vulnerabilities to ENhance Software Security and Safety) where this year's students presented their papers and it was quite interesting, you can check out the papers below:http://studentarbeten.chalmers.se/publication/219731-testing-and-evaluation-to-improve-data-security-of-automotive-embedded-systemshttp://studentarbeten.chalmers.se/publication/219075-applicability-analysis-of-intrusion-detection-and-prevention-in-automotive-systemshttp://studentarbeten.chalmers.se/publication/202917-threat-modelling-and-risk-assessment-within-vehicular-systemshttp://studentarbeten.chalmers.se/publication/219822-vehicle-control-unit-security-using-open-source-autosarhttp://studentarbeten.chalmers.se/publication/218477-study-on-open-source-in-vehicle-infotainment-ivi-software-platformshttp://studentarbeten.chalmers.se/publication/218280-safety-mechanisms-for-random-ecu-hardware-failures-in-compliance-with-iso-26262http://studentarbeten.chalmers.se/publication/212488-a-security-evaluation-and-internal-penetration-testing-of-the-can-bus

author: miguelvp
author_rank: Super Contributor
timestamp: July 22, 2015, 03:21:07 pm
content: Quote from: Rasz on July 22, 2015, 08:24:42 amI know it's more vulnerable because the phone is built into the car, but that doesn't mean other vehicles are not vulnerable because they don't have direct external communication.I also did see the article you referred to:http://www.itworld.com/article/2748225/security/with-hacking--music-can-take-control-of-your-car.htmlSo taking it, into the extreme. Someone that knows you are in your car could call you and inject a trojan to your car while talking to you over the car's hands free system.

author: TerraHertz
author_rank: Super Contributor
timestamp: July 22, 2015, 04:20:33 pm
content: Quote from: EEVblog on July 22, 2015, 12:24:47 amMost cars since the last few years have GSM data links. The manufacturers include it for 'fault monitoring', even if there's no user-visible net connectivity. And of course if there's a GSM module then a GPS receiver is also likely to be included - certainly in all cars with navigation systems built in.In the last couple of years the US gov (and probably others) have been pushing to make GPS location logging and GSM data linking mandatory in ALL new cars. I'm not sure how far that has advanced. The reasoning usually mentioned is that they'd like to be able to impose per-mile driving taxes, and monitor speed, etc. I can think of other reasons they probably have but wouldn't mention, and these should be obvious. To do with mass surveillance and control. Then there's the potential benefit of having every car a potential way to off the driver, but off course who'd believe a government could imagine such a thing? Another such idea I've heard, is that once most cars are net-connected, there's potential for some entity to brick an entire nation's car fleet all at once. But that's crazy talk, same as the DHS buying enough hollow point ammunition to shoot the entire US population 20 times over.Mazda has 'Skyactiv' in their new cars, which is all of the above. My mum bought one recently, and frankly there is no way in hell I'd own a car with that much stupid over-automation and net connectivity.Mercedes - somewhere I read last year about someone finding a GSM module built into a body cavity in a place that normally no one could access.As for the idea that cars should have physically separate control bus circuits for critical systems and entertainment... pfft. Irrelevant. Even if there were multiple independent busses, they are still bridged by common processing modules. Which can be compromised to provide data connectivity - exactly as noted in the OP's article.I notice the only mention here of Michael Hastings' death, included an obligatory 'tinfoilhat' tag. Regardless, there were many very suspicious circumstances in that case. A collection:http://everist.org/archives/links/_Assasination_Michael_Hastings_info.txtAnother thing that bothers me, is the trend to include more and more complex on-screen user interfaces in cars. My mum's Skyactiv Mazda is ludicrous. It worries me that she (late 80s) is going to be fiddling with screen menus while driving. It totally freaks me out to think that I'm driving amongst other drivers who are potentially paying more attention to some screen menu on the console than the road. Too bad there's no way to see statistics of how many accidents this bullshit causes.Ha ha... though the manufacturers, with their vehicle data logging and collection via GSM, could probably generate those stats. 'Impacts coincident with UI activity' or something like that.

author: SeanB
author_rank: Super Contributor
timestamp: July 22, 2015, 05:25:16 pm
content: BMW already had to recall vehicles for this, because they has a reflash upgrade utility built in, which did not use any verification of the new firmware, used a common to all vehicles in the range encryption key ( and not the very slightly more secure VIN as key, though the first version of the fix did do that, but they conveniently also included a service over the air call that returned the VIN in cleartext) and which would accept any firmware upgrade as valid if the CRC passed. Built in GSM phone, so you could use the BMW Assist feature and could book a service call automatically via the system display.As the entertainment system would have to be able to send CAN to other systems ( to request engine RPM for speed sensitive volume as a minor example), and as well the firmware is based on a very common ARM chipset and has a documented architecture and toolchain, used for the rest of the cellphone industry, you can of course update the firmware, or use a vunerability to get root acess to the firmware. Thus you can get root, do some small firmware update and have a back door built in, then use it to download more firmware or a malicious app to drive the documented CAN controller. Then it is trivial to send messages that you are skidding or are in a corner so need auto braking to the ABS module, or send a command to the ECU to slow down or speed up pretending to be the cruise module, or tell the auto trans to gear down or coast.Even just jabbering on the bus to contend it would be enough, send enough so the real messages are delayed, but not triggering the tranciever to shut down from it's internal checks and you could delay the bus enough to cause an accident.As you can also reflash ECU units over CAN you can get a firmware that appears valid but which does not work in the module after the reflash, or simply send the CAN airbag deployment incollision message, which will brick the ECU and all the control modules from operating.

author: Someone
author_rank: Super Contributor
timestamp: July 22, 2015, 10:32:39 pm
content: Quote from: EEVblog on July 22, 2015, 11:30:22 amOver in the long thread specifically calling out Tesla cars they added huge amounts of spin (Astroturf?) and when challenged presented this:Quote from: free_electron on July 07, 2015, 12:43:56 am

author: CatalinaWOW
author_rank: Super Contributor
timestamp: July 23, 2015, 02:34:40 am
content: Quote from: Rasz on July 22, 2015, 03:37:16 amPerhaps not adroitly worded, but shouldn't have been challenging to understand. Identifying a weakness in two separate vehicles and then combining them to claim a deadly weakness is cheating. You identified a system isolation weakness in a Jeep, and then used a Prius as an example of how this would impact steering. If Jeep does indeed have the same control over steering (or has a brake pedal position sensor in line with the brake system as you mentioned for another vehicle) you should have said that.The statement about system isolation in Prius and Jeeps evaluation of their vulnerabilities was a brief description of what has been expanded greatly in this thread. The automakers put a lot of time and effort into evaluating the safety of their vehicles, possibly to protect their consciences and definitely to protect their bottom line.Will they make mistakes? Of course. We all know that bug free software does not exist. But the vulnerabilities are likely to be beyond the reach of script kiddies. The number of people searching for and attacking these vulnerabilities will also be far smaller because the ability to convert this effort into financial gain is more limited and difficult than for those attacking desktop computers and cell phones to get financial and identity information. Even the always popular corporate and national black agencies may not spend much effort on this because their are far easier ways to assassinate someone than to hope that they purchase a specific model of car, and then drive it in a location or manner where loss of control would have a high probability of fatality.

author: Rasz
author_rank: Super Contributor
timestamp: July 23, 2015, 03:20:45 am
content: Quote from: blueskull on July 23, 2015, 03:01:40 amBecause this istheircar. You dont own it, you merely license the privilege to drive.>'In Copyright Dispute, GM Attorney Says Customers Just License Vehicle Use'http://www.autoblog.com/2015/05/20/general-motors-says-owns-your-car-software/This is their way of keeping full control overtheir property. Plus they anticipate additional revenue stream arising from presence of network endpoint in the car. It enables new recurring revenue business models, why sell when you can charge monthly? Plus not only can they sell you shit, they can sell YOU as a product to third parties. Its a win win.

author: amyk
author_rank: Super Contributor
timestamp: July 23, 2015, 06:45:11 am
content: Quote from: discomike on July 22, 2015, 03:00:06 pmThe early cars with AC and carburettor had a "high idle solenoid" that was actuated together with the compressor clutch, and would just increase the idle speed - by manually pushing on the throttle slightly - when it was on. With today's engines having closed-loop-governed idle speed, I don't see how that would be necessary as the increased load will be compensated automatically, but it's definitely doable without requiring full CAN access - perhaps an extra unidirectional, binary input to the ECU.QuoteThat seems like too much complication for little gain - how about a tilt sensor?For many of these things there are solutions that don't involve software and have a far simpler failure mode as a result.

author: Zucca
author_rank: Unknown
timestamp: July 23, 2015, 07:13:54 am
content: Quote from: McBryce on July 22, 2015, 01:14:58 pmI am also working for a very well know company in the automotive... now I am now managing technical things and I am kind of far away from technical design (which I did in the past).it is very temping to find out how many of us are here at the EEVBlog, for example the legendaryfree_electronis working for Tesla. It would be interesting to exchange some information here, nothing restricted of course.Only issue I am scared to death to lose my job because I wrote here too much...

author: TerraHertz
author_rank: Super Contributor
timestamp: July 23, 2015, 07:18:00 am
content: Quote from: blueskull on July 23, 2015, 03:01:40 amWhy the hell so many people insist on trying to understand events in an entirely innocent worldview, in which no company or government authorities could ever lie or conspire or have any ulterior motives at all, let alone really really evil motives?A more sane approach when dealing with large organizations with layered power structures, is to examine the actions and effects. Then ask yourself who benefits - taking into account known and potential motives, from the top down.Also, if publicly stated reasons for doing something seem beyond stupid, they are probably not the real reasons.Incidentally, I've seen a suggestion that if you are unfortunate enough to have a car with always-on GSM-net link and the rest of the car-automation nightmare, it's a wise precaution to install a 'rip cord'.This is a solid bit of nylon cord woven under all the fuses in the under-dash fuse panel, with the end tied to a nice solid bit of wood somewhere easy to reach. Then if something bizarre happens like your engine suddenly goes full power and ignores the ignition/off button, the gearbox won't disengage, and the brakes do nothing, then grab the ripcord handle and yank it. Breaking a few fuse contacts is probably better than impacting a palm tree at 150Km/Hr.Personally I'll just stick with my old 1993 Subaru for as long as possible. The only CPU is in the add-in CD player. The quirks in that are annoying enough, but at least there's no potential battle for control of the car while driving.

author: TMM
author_rank: Frequent Contributor
timestamp: July 23, 2015, 07:38:05 am
content: Quote from: dr.diesel on July 22, 2015, 12:21:37 pmAlso vehicle speed dependant audio volume control, steering wheel controls, instrument cluster integration (display entertainment system info such as volume, track/radio station so driver doesn't have to look across to central display), adjustable instrument backlight intensity, audio muting in the case that a vehicle warning chime needs to be heard. There are so many possibilities.

author: McBryce
author_rank: Super Contributor
timestamp: July 23, 2015, 07:56:14 am
content: Quote from: zucca on July 23, 2015, 07:13:54 amWe may even work for the same companyI'm kind of in the same situation, designed for many years, then "fell up the ladder" and now I just get to push a pen and manage projects, which is why I have rekindled my hobby electronics. As for writing too much. I never mention the company name, I never reveal any strategies, company information or any technical documents. Just my personal opinion.McBryce.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 23, 2015, 08:27:21 am
content: Quote from: TerraHertz on July 23, 2015, 07:18:00 amAnd the ECU, ABS, AWD...

author: Zucca
author_rank: Unknown
timestamp: July 23, 2015, 09:04:38 am
content: Quote from: McBryce on July 23, 2015, 07:56:14 amI hope you are my boss.

author: EEVblog
author_rank: Unknown
timestamp: July 23, 2015, 09:40:28 am
content: Quote from: Someone on July 22, 2015, 10:32:39 pmFree_Electron is bang on, he is an owner, he's not trying to sell you a Tesla, he's talking as an enthusiastic owner. There is norequirement for him to disclose he works for them in every post. He was an owner before he worked for them.Just like I didn't have to disclose that I worked for Altium when I talked about them.

author: McBryce
author_rank: Super Contributor
timestamp: July 23, 2015, 10:24:27 am
content: Quote from: zucca on July 23, 2015, 09:04:38 amI'm notI have Italians in my team, but you're not one of them.McBryce.

author: madires
author_rank: Super Contributor
timestamp: July 23, 2015, 01:03:19 pm
content: Quote from: McBryce on July 22, 2015, 11:24:27 amI've seen some block diagrams of car bus systems. Most got something like a central bridge with some sort of firewall connecting all busses. There are dedicated busses for specific groups of systems, but all busses connect to the central bridge. Is this the current standard design?On youtube you'll find a few presentations from Defcon and Blackhat about hacking cars. All those hacks require physical access to the CAN bus so far. But the new hack of the Cherokee is done remotely via a mobile telephone based service called Uconnect which also provides internet access to the Uconnect infotainment system. The hackers had to connect to the same mobile phone provider to gain access to the car. Jeep offers a firmware update already (via USB stick or a visit to the garage). The hackers claim to have control over:- braking system- acceleration- door locks- A/C- wipers- steering wheel if in reverse gear- retrieving the car's locationI'd say that this is pretty bad and can't be considered just a nuisance.

author: Marco
author_rank: Super Contributor
timestamp: July 23, 2015, 01:20:00 pm
content: Quote from: discomike on July 22, 2015, 03:00:06 pmSecurity in depth, it matters. Application level firewalls help.A firewall which sanity checks anything coming from outside and tries to make sure it can only gets passed on to the code designed for sending back telemetry and to update firmware (preferably with PKI) is the least you should do. Concentrate the potential for exploits into the minimum number of LOCs.

author: Zucca
author_rank: Unknown
timestamp: July 23, 2015, 01:44:57 pm
content: ..and the smart people like us makes the life of a car developer not easy. Every time I got an idea to implement in the field (remote assistance or whatever) I have to get the approval of the security team which requires triple encoding/cryptography with all the risk assessment bla bla. They always send me back home with a sad face.... and the idea remains an just a nice idea.Sometime I think an open source/ open hardware car would be so cool (more or less dangerous than a drunk driver?)... yeah sometime it´s so beautiful to dream.

author: TerraHertz
author_rank: Super Contributor
timestamp: July 23, 2015, 02:05:34 pm
content: Quote from: Mechanical Menace on July 23, 2015, 08:27:21 amDid you see that1993? No, there are NO OTHER CPUs. No ECU, no ABS, no AWD, no central locking, no seatbelt sensors, no airbags, no auto-on interior lights, no beeping at me under any circumstances, and if I want to leave the headlights or parking lights on with the engine off that's my damned business.The only electronics associated with the engine is an inductive spark timing pickup and transistor drive for the spark coil. That's it. There's an actual lever to engage 4WD (H or L) which means _I_ control when it's on, not some stupid algorithm that doesn't know squat about actual off-road driving.Like the retarded code in my ex-wife's Honda CR-V, which doesn't understand the concept of sand, so it fails to engage 4WD and gets bogged to the floor-pan within a few meters of driving onto deep sand. Making it completely useless as a 4WD off-road vehicle. I'd pointed out to her in the car dealers that there was no manual '4WD-on' control, and so I doubted it would be workable. But ohhh no, the car sales guy insisted it was fine, and she believed him. Then soon after, on a holiday planned to take it onto Frazer Island, the mainland ranger office said "Honda CR-V? Nope, sorry, not giving you a permit. Those things can't drive on sand and we're sick of towing them out. Go try it on the beach here if you don't believe me." Ha ha ha... sure enough...Anyway, that wasn't the origin of my cynicism about computerized cars. Just one more small confirmation. A larger one was talking to the head mechanic at a Subaru workshop (which also serviced Mercedes) and hearing all his tales of incredible stupid fuckups due to CPUs and code in cars. He too refused to drive any car with a processor involved.My old 1993 Subaru was possibly one of the last pre-CPU-crazy cars. I'm sticking with it as long as I can keep it running. And willneverbuy an automated car. I can't even stand auto-wind windows; especially that the driver's window acts differently to the others, and you have to double-guess it to try and get the window where you want it.Meanwhile, I nervously await my old mum's next car accident. So far her past accidents were all other's fault (given that extreme defensive driving habits are a bit beyond her) and didn't result in any injuries. But if her next one is due to that ridiculous Skyactiv piece of junk distracting her with with fancy console screen graphics (that requires a thick manual, and which Iknowshe can't fully comprehend) then I'm flatly blaming Mazda.

author: McBryce
author_rank: Super Contributor
timestamp: July 23, 2015, 02:13:56 pm
content: Quote from: madires on July 23, 2015, 01:03:19 pmThe central bridge you're talking about is what we call the gateway. Although all the buses might physically come into the same box, they may not be connected in any way if they don't need to be. The steering bus would have no reason to be talking to the A/C bus for example, but some buses may be software connected for different reasons. The Headlight bus (CAN) might be connected through software to the interior lighting bus (LIN) and the switch bus (LIN). However this doesn't mean that the gateway just blindly passes the information on. It's usually a case of something like this:Driver switches on headlamps (LIN bus) - Processor gets message and sends "on" command over CAN to headlights and "on" command to interior lights through LIN bus. So the message is being interpreted and causing a message to be sent on a different bus, but they aren't what I would consider "connected".If two buses that use the same protocol (2x CAN) are connected to one gateway then it would probably be possible to program it to blindly shovel commands from one to the other, but this would involve reflashing the gateway firmware, which shouldn't be possible without physical access to the device, unless it's a Jeep with uConnect that is....I've been trying to read up on the exact details of the Jeep fail as much as they have revealed and it seems they failed on many levels. From what I have read:- The infotainment seems to have much more power and potential access than should ever have been allowed. - The gateway may even be in the infotainment module!- The gateway firmware was updateable through uConnect. Most likely without proper verification.These are pretty major fails and go against everything that ISO 26262 and ASIL try to achieve. Luckily uConnect is a US service, so EU cars won't be effected. But even if they have updated the firmware to avoid this hack, the physical level architecture seems to be flawed, so it's only a matter of time before the next weakness is found.McBryce.

author: Marco
author_rank: Super Contributor
timestamp: July 23, 2015, 02:17:32 pm
content: Quote from: TerraHertz on July 23, 2015, 02:05:34 pmWhoever came up with that needs to be fired, out of a cannon.

author: Zucca
author_rank: Unknown
timestamp: July 23, 2015, 02:26:12 pm
content: Quote from: McBryce on July 23, 2015, 02:13:56 pmIn this way you can also distribute the traffic in different buses. A CAN bus with a bus load over 50% is as good as a warm beer. The solution is to squeeze more CAN togheter with a gateway in the middle.Or you just use a FlexRay bus...

author: McBryce
author_rank: Super Contributor
timestamp: July 23, 2015, 02:37:06 pm
content: Quote from: TerraHertz on July 23, 2015, 02:05:34 pmI don't know the inner details of the 1993 Subaru electronics, but according to the info I have here, the engine has several sensors (Mass airflow, temperature sensors, knock sensors etc) and the ECU gives out error codes, so it must have some sort of CPU even if only very basic.McBryce.

author: Zucca
author_rank: Unknown
timestamp: July 23, 2015, 02:42:27 pm
content: Quote from: TerraHertz on July 23, 2015, 02:05:34 pmHumans are losing the war against the machines... no one will stop them.TerraHertzI will fight with you until the last day...

author: Stonent
author_rank: Super Contributor
timestamp: July 23, 2015, 03:03:12 pm
content: I've seen the diagnostics software used in assembly plants, and from the computer they can turn the wipers on and off, test all the lights, tell the guages to do anything.Though the software that I saw used would not let you into this mode unless the hand brake was set.A separate program made by the company that designed the antilock braking system would let you individually actuate the brakes. But there was no full control. It would just do a press and release.Most of the computer modules in cars are made by other companies like Bosch, Continental/VDO, and Delphi. Some will come in essentially blank and the firmware gets loaded during the assembly process to set parameters like wheel size, gear ratios, model of engine so that the speedometer will read correctly and things like the estimated miles worth gasoline are correct.Car ECUs are basically not much different than big microcontrollers. They have IO, ADCs, PWM just like microcontrollers do and the pin functions can be remapped via firmware changes.Now there are many more than just 1 or 2. Typically each major component has its own ECU. If the engine or transmission is made by a different company than the car it will probably come preloaded with the firmware and then the assembly plant can alter a few parameters within a certain range and then it gets password protected against further modification.

author: TerraHertz
author_rank: Super Contributor
timestamp: July 23, 2015, 03:49:38 pm
content: Quote from: McBryce on July 23, 2015, 02:37:06 pm1993 L-series (Leone) 'sportswagon'. In Australia.There's definitely no ECU. I do virtually all of the servicing myself. Standard totally mechanical carburetter, but a spaghetti tangle of 'emission control' pipework. Carburetter has a thermally operating auto choke, and a solenoid-operated float chamber isolating valve, that just opens an air path so long as the ignition key is on. (That solenoid burned out a couple of years ago. When I discovered it was like $150 for a new one, I unwound the former and rewound it myself. Plus this time with heat conductive paste so the coil doesn't overheat.)

author: SeanB
author_rank: Super Contributor
timestamp: July 23, 2015, 04:38:45 pm
content: IIRC there are issues with aftermarket radios that plug into the standard radio connector, and use the CAN bus to read things like light settings, speed ( for both disabling DVD playback in motion and to do audio level changing with speed), where the add on extra bit of kit ( strips the speed signal so the kids can watch a DVD in motion in the back seat, not that the driver ever watches as well {seen that one night, he was watching a movie at 130kph in driving rain, I wanted to see him crash} but for the whiners in the back) had a side effect of driving the engine crazy after a while. Turns out the entertainment system CAN bus is also the connection between the console and the engine and the steering wheel.

author: vk6zgo
author_rank: Super Contributor
timestamp: July 23, 2015, 05:58:16 pm
content: Quote from: TerraHertz on July 23, 2015, 03:49:38 pmInteresting----I would have thought that in 1993 all vehicles in Oz would have had an ECU .---certainly my 1988 Falcon had one.The Falcon had a delightful throttle solenoid that used to jam,causing the throttle to stick open---that was fun!My 1982 Camira had an "Engine Management module " with a bunch of vacuum hoses leading to it----GMH transposed two,making the car drop back to idle when you pushed the accelerator briskly,as when taking off--they swore there was nothing wrong,after the bloody thing nearly killed us!

author: nali
author_rank: Frequent Contributor
timestamp: July 23, 2015, 06:52:55 pm
content: At the risk of fanning the flames for this thread...http://www.bbc.co.uk/news/technology-33622298"Car hack uses digital-radio broadcasts to seize control"Definitely seems to be a trendy topic for the media at the moment!

author: briselec
author_rank: Regular Contributor
timestamp: July 23, 2015, 06:59:20 pm
content: After having to drive myself everywhere for the last 40 years I'm really looking forward to having a car smart enough to do it for me. So kudos to DARPA for financing these guys to see if they could hack a car and the US government who were already working on legislation to force the car manufacturers into making their systems more secure.All adds up to me feeling more comfortable catching up on my reading while my car safely drives me to work.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 23, 2015, 06:59:40 pm
content: Quote from: TerraHertz on July 23, 2015, 02:05:34 pmSince 89 on Legacies so yeah. Saw ABS and ECUs on 80s Fords FFS.

author: McBryce
author_rank: Super Contributor
timestamp: July 23, 2015, 07:11:07 pm
content: Quote from: TerraHertz on July 23, 2015, 03:49:38 pmWow. It's not that I don't believe you, I just didn't think that such a basic setup was still being sold in AU in 1993. If you said you lived in South America it would have been completely normal.@Stonent: I work for a company like the ones you mention (and worked for one you mentioned in the past). The end of line test will test non-critical systems controlled by the BCM (wipers / lights etc) and can start selftest routines in critical modules, but it's not directly controlling anything critical. Some modules do get flashed at end of line but as you say, usually only parameters are programmed, not the entire firmware.@Seanb: Aftermarket devices should be banned completely. They cause more problems than they are worth. Many people talk of allowing 3rd party software to be installed! When that happens I'll leave the industry. The best security that cars have is the fact that they are completely closed systems.McBryce.

author: SeanB
author_rank: Super Contributor
timestamp: July 23, 2015, 07:31:22 pm
content: Quote from: McBryce on July 23, 2015, 07:11:07 pmWorst thing you can do is to place a data connection there, and then have the connection open to the whole Internet with minimal or no security, and a code common to a range or associated with a VIN in the firmware is NOT security. If you are going to have the data connection, then it must be via a decent VPN with absolutely bullet proof security, using a PSK generated per vehicle and which is never disclosed to anybody other than the central server ( or distributed server farm units for large numbers of vehicles) and the internal firmware, and which can only be updated with a physical connection using a sealed (sealed with a tamper evident seal in the vehicle itself) signed firmware updater, not an OTA upgrade.The owner of the vehicle must also have the option to disable the data service from inside the vehicle.

author: McBryce
author_rank: Super Contributor
timestamp: July 23, 2015, 07:38:37 pm
content: Quote from: SeanB on July 23, 2015, 07:31:22 pmActually, with "closed" I meant not allow anything to connect or communicate with the car system at all. Other than the 12V and GND all other connectors should be out of bounds. It's not a PC it's a vehicle. 3rd party can have power, but that's it!McBryce.

author: vvanders
author_rank: Regular Contributor
timestamp: July 23, 2015, 11:18:45 pm
content: As a Tesla owner I'd much rather have a Software company building my Hardware than a Hardware company building my Software when it comes to this stuff.FWIW Tesla's public APIs have been pretty thoroughly reverse engineered and very little stuff has come up. Kinda nice as people have built logging apps for kW usage/charging/etc.

author: Someone
author_rank: Super Contributor
timestamp: July 23, 2015, 11:24:40 pm
content: Quote from: McBryce on July 23, 2015, 07:11:07 pmWe often have models sold 3-4 years beyond other markets, add in the mandatory period of keeping spare parts and it must be a nightmare for the automakers.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 24, 2015, 02:10:03 am
content: Quote from: Someone on July 23, 2015, 11:24:40 pmDo you get them new 3-4 years later or do you just insist on it?

author: Someone
author_rank: Super Contributor
timestamp: July 24, 2015, 03:03:19 am
content: Quote from: Mechanical Menace on July 24, 2015, 02:10:03 amYes, there can be a long delay before they are released here and then sometimes only in certain spec/body/colour packages. Finding cars with small and efficient engines in laughably hard here at the moment compared to Europe.

author: Rasz
author_rank: Super Contributor
timestamp: July 24, 2015, 04:21:22 am
content: Quote from: McBryce on July 23, 2015, 07:11:07 pmpoints at the article that started this thread ...points at any other closed secretive software everEDIT: oh, you meant close in another wayQuote from: vvanders on July 23, 2015, 11:18:45 pmare you suggesting Tesla is software company? tried your 'hold both scrolls on steering wheel' ctrl-alt-del yet?Quote from: vvanders on July 23, 2015, 11:18:45 pmas mentioned before there are bugs, including popping open doors remotelywhile you drive

author: vvanders
author_rank: Regular Contributor
timestamp: July 24, 2015, 05:07:45 am
content: Quote from: Rasz on July 24, 2015, 04:21:22 amThat's a fair bit of Tesla FUD ya got there.I'll address it anyway:1. The company is based in SV with a CEO who built software and services, I'm pretty sure they know more about software than the other auto mfgrs.2. The car is completely driveable with either the center console or dash rebooting. Not sure why you're calling that out as an issue.3. They issue OTA updates 4-5 times a month which means any issue is resolved quickly. Also service is really top notch, there's a reason Tesla has been rated top in customer satisfaction for a few years in a row now.Anyway, getting back to the Jeep. I think the worst part about it is the demonstrated all this on a public road at 70 MPH. Reckless and could have easily killed someone innocent just to grab a headline.

author: Rasz
author_rank: Super Contributor
timestamp: July 24, 2015, 06:10:15 am
content: Quote from: vvanders on July 24, 2015, 05:07:45 amIm sure CEO himself wrote all the software!They know enough to sell you two 'tablets' that can freeze at any point in time, so they conveniently put ctrl-alt-del on the surface you keep hands on, Windows 95 style. They are so good at software they shipped and sold car that would eat almost 200W while sitting in the garage turned off (both Nvidia based computers ran full tilt) for a year before patching it. Then we have remote exploits.Quote from: vvanders on July 24, 2015, 05:07:45 amholy shitPlease say that out loud to yourself: "the product I bought has buggy software andcrasheswhile I drive, and this is perfectly fine with me". Or better yet, say that to someone else who doesnt own tesla.Quote from: vvanders on July 24, 2015, 05:07:45 amsounds like Windows! There was this joke about microsoft making cars, tesla realized itQuote from: vvanders on July 24, 2015, 05:07:45 amselection bias, post purchase rationalization) j/k. Its a great car, but that doesnt justify ignoring negative properties.Quote from: vvanders on July 24, 2015, 05:07:45 amreally? That isthe worst partabout it?

author: Rasz
author_rank: Super Contributor
timestamp: July 25, 2015, 02:15:17 am
content: And we have cherry on top:http://www.autonews.com/article/20141028/OEM02/141029851/betts-leaves-chrysler-after-another-poor-quality-showinghttp://blog.caranddriver.com/fiat-chrysler-quality-chief-resigns-one-day-after-terrible-consumer-reports-rankings/Quotehttp://www.techtimes.com/articles/70582/20150721/apple-hires-fiat-chrysler-executive-doug-betts-beep-beep-beep-icar-coming.htmQuoteCant wait for Apple smart connected car. Doug Betts, former FCA 'Head of Quality' will make sure they are top notch!btw Chrysler just recalled 1.4m cars, butQuotehttp://www.media.chrysler.com/newsrelease.do;jsessionid=87C95901102C5D2CD022BFC07ACBA220?&id=16849&mid=1

author: SeanB
author_rank: Super Contributor
timestamp: July 25, 2015, 08:28:58 am
content: Admitting the computers can crash and designing around that is good. Better than other manufacturers, where the onboard computers are just as likely to crash, and the only way to restart them is to carry a spanner to disconnect the battery and wait 2 minutes before reconnection.BTW according to el Reg, the recall for the Govt Motors was forced on them by the NTSB, the same agency that allowed the Ford Pinto to go without a recall, even though the demo vehicle delivered to them by Ford was made in Canada where the Canadian government forced them to install bolt protectors so it would not catch fire. They pretended it was a US made vehicle, where the extra $1 per vehicle meant the cover was not installed. Kind of puts this recall into perspective.BTW, the attack requires a phone on the network, so easy to exploit, as you just can use any phone with known vunerabilities to turn it into a scanner botnet to search with pretty much little way to trace back.

author: edy
author_rank: Super Contributor
timestamp: July 25, 2015, 11:57:16 pm
content: How can you tell if your car is "fly by wire". I thought I have power steering and brakes which just hydraulically amplify my movement. I thought my windshield wipers were just controlled by a separately wired knob switch. In fact, I had no idea a modern car turned into a remote controlled car and the driver had no physical mechanical connection anymore to the car.I drive a 2011 Honda CRV.And somehow I feel this is leading up to self driving cars or at least more aware cars that take over control for safety collision avoidance. We will have to get used to software holding our lives in its hands, certainly safer than human drivers (so goes the idea).

author: G7PSK
author_rank: Super Contributor
timestamp: July 26, 2015, 08:07:30 am
content: Software crashes and so do cars but which does it more often. As long as the software crash does not cause the car to crash all is well. A few years ago I hired a car in the US. after I had driven it a hundred miles there about something went wrong with the cruise control and when I had to pull up for red lights etc the engine would start to rev up and as the car was auto it tried to pull away, I phoned the car hire company and they said bring it back but I was not about to drive anywhere in a car like that so they brought out another car of the same make and type,on a low loader mind you after they said the original was perfectly safe to drive, anyway a week later the replacement had a problem with the power steering and without that the steering was so heavy I could hardly turn the wheel, and I am quite used to moving heavy stuff around and driving plant without power steering etc. So both cars became dangerous on the road for minor faults. The car by the way was a Chrysler the model a Cruiser. So cars should fail into the manual control mode but making steering that is only a turn and a bit lock to lock is also a bad idea, if I had been a little old lady and one or both those faults had occurred together whole crowds could have been mowed down. Mind you in the event of something bad happening a good legal defended would be I don't own the car and I was the one in control the manufacturer owns the car and their software was in control after all the likes of GM and Chrysler claim the buyer does not own the car they do as they own the software, thats public statement as to resposibility. Now I think I will go shopping for a model T Ford.

author: SeanB
author_rank: Super Contributor
timestamp: July 26, 2015, 09:04:47 am
content: At the moment I am driving a rental car, Chery QQ. Annoying little things, like an auto box that changes gear by correspondence, ABS warning light every so often ( tyre pressure not balanced it seems, took them all to the same pressure and so far all right) and known issues with the electronics of the auto box where it occasionally will just stop for no reason. Restart and fine again. Other than being interactive ( it leans with me, the power windows want to push themselves out of the vehicle in operation) and needing to read the manual to operate the lighting, and you really do not want to go over 100kph because you think the engine will rip itself out of the front. Found the owners manual is not exactly correct, both poor translations, totally wrong illustrations and even sections that are completely unrelated to the headings they are under. Page numbering in the index as well is more of a suggestion rather than an accurate indication, you might be only 20 pages out.

author: Zero999
author_rank: Super Contributor
timestamp: July 26, 2015, 10:19:21 am
content: Reading all of this makes me glad I don't drive a car.I own a motorcycle which doesn't have any of this BS.I can drive a car but find it restrictive and feel less in control. Although one is more vulnerable on a motorcycle, at least they're more in control and can get out of trouble quicker.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 26, 2015, 10:45:09 am
content: Quote from: Hero999 on July 26, 2015, 10:19:21 amUntil you hit the roads in North Yorkshire. Cars just corner better than bikes on those windy narrow roads and I'm happy for the bodywork between me and those dry stone walls.But I don't like being in control of a vehicle on public roads. I wouldn't be a bad driver if it wasn't for the fact I am an idiot speed demon and am dangerous enough on a push bike. Had a two year driving ban for speeding on one once :/

author: SeanB
author_rank: Super Contributor
timestamp: July 26, 2015, 11:35:23 am
content: Quote from: Hero999 on July 26, 2015, 10:19:21 amYou haven’t seen BMW's latest models then........ At least there the controls only can be made to fail into "not work" mode, and you will at least still have steering and hopefully some braking, with the option of just baling out and take the road rash.

author: edy
author_rank: Super Contributor
timestamp: July 26, 2015, 12:17:18 pm
content: Modern airplanes have no mechanical connection of levers and buttons to the parts. It is all fly by wire. Yet flying is safer than driving.What happens when the software fails on an airplane? What fail-safes are there? The results of a failure are much more catastrophic.Cars have to be designed with the same level of quality engineering. I wouldn't mind fly by wire if it had been made by the engineering team at Boeing and McDonald-Douglas and DeHavilland.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 26, 2015, 12:34:53 pm
content: Quote from: edy on July 26, 2015, 12:17:18 pmAt least double redundancy. Even down to backup wiring looms, computers, and actuators on engines.

author: edy
author_rank: Super Contributor
timestamp: July 26, 2015, 12:40:23 pm
content: Quote from: Mechanical Menace on July 26, 2015, 12:34:53 pmExactly. We need the same kind of thought with cars. Especially since there are many more on the road, in much closer proximity to other people and piloted by much less capable trained people than airline pilots.I understand the engineers are trying to "virtualize" the car in software, completely separating the driver controls from the mechanics... And slowly year by year allow software updates to take more and more control of the car, eventually to get a software update one day for self-driving cars... If you do this now you can upgrade the car without any hardware modifications. The software is still lagging but hardware wise they can implement it already.

author: amyk
author_rank: Super Contributor
timestamp: July 26, 2015, 12:50:59 pm
content: Quote from: edy on July 26, 2015, 12:17:18 pmThe Boeing 737still has mechanical linkage.Flying is safer not only because of the increased reliability, but pilots are trained to a much higher standard than drivers.However, if cars were designed and manufactured to aerospace standards, they'd probably cost 10x to 100x more.

author: G7PSK
author_rank: Super Contributor
timestamp: July 26, 2015, 01:17:03 pm
content: Planes are also built up to a standard cars are built down to a price. Double or triple redundancy would not be an option price wise.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: July 26, 2015, 01:29:05 pm
content: Quote from: amyk on July 26, 2015, 12:50:59 pmTo be fair that is a 50 year old design. And that's only for redundancy too. FBW is used when there isn't a catastrophic engine failure. And after you get to the servo tab it's pretty much still FBW just with meters upon meters of cable until you get to the switches so meh.QuoteActually it's mainly safer due to how little flying commercial pilots actually need to do. I was on the first commercial flight with automated take off and landing* and safety has improved dramatically since then and that increase is directly attributed to the autopilots just as old autopilots that couldn't take off or land also improved safety.You want to make a vehicle as safe as possible you take as much control as possible away from people and put it in the hands of a computer. The aviation and shipping industry get that very well, car drivers refuse to admit a machine could do it better than them.*EDIT: Just thought I should add that yes I know that Autoland and assisted landing tech was around long before I was born for emergencies, but I'm on about it just been used as a matter of course. I can remember most of the passengers being terrified, I was ecstatic. And given what commercial pilots can be like for drink and drugs I'd rather have them well rested if an emergency situation does crop up lol.

author: edy
author_rank: Super Contributor
timestamp: July 26, 2015, 04:53:02 pm
content: I'm happy at least to see all the attention being brought to this... What were the car makers thinking?From a systems point of view I see the advantages of having software control of everything. It is easy to tweak everything, monitor and diagnose. Like going from hardwired sound processors using analog components to create effects to using ADC/DAC and all digital bit manipulation.It is just a matter of time, but security and safety can't fall behind. This is a wake up call.

author: G7PSK
author_rank: Super Contributor
timestamp: July 26, 2015, 04:53:51 pm
content: When selling cars if it does not immediately impinge on the customers personal comfort or is mandated by law the customer will not want it. I learned this first hand when I owned a trailer manufacturing company, I would get customers coming in and saying they had just ordered a new Range Rover and wanted a trailer to go with it they would then start asking if they could cut the price by not having things like rear fog lights side markers or even brakes and anti burst valves on the hydraulic tippers were turned down as an extra so I started fitting them as standard. If their bum was not going directly on it they did care is how it went, safety not an issue. So automating cars has got to be cheap or the law or it wont get sold except to a few. Very hard to judge by the people on this forum as they have above average brains but Joe sheep does not give a rats ass as long as its cheap cheaper the better.

author: McBryce
author_rank: Super Contributor
timestamp: July 26, 2015, 08:30:07 pm
content: At the moment there are no pure drive by wire vehicles on the market, because the current laws don't allow it. They may come in the future, but redundancy is a major parts of the design regulations that are being considered. They will be as safe or safer than todays fly by wire planes.McBryce.