[k_ajay]

Apparently, just having airbags and ABS isn't going to be safe enough, the more 'digital' our vehicles become.

A very interesting read and seems like potential danger, if not tended to in the short term.

http://www.forbes.com/sites/andygree...e-wheel-video/


Mods: If such a thread exists, kindly merge this post with it please. I did a quick search and didn't find a related topic.

[mukundmenon]

This hack was showcased in the latest Fast and Furious movie, where the bad guys take control of the EPS of another vehicle remotely and cause the steering to turn involuntarily. Like all F&F movies i thought it was a bit far fetched, now i stand corrected. Car hacking seems very simple according to that article, just like re-mapping. Better to stick to HPS and power brakes it seems

[vikram_d]

Originally Posted by mukundmenon

This hack was showcased in the latest Fast and Furious movie, where the bad guys take control of the EPS of another vehicle remotely and cause the steering to turn involuntarily. Like all F&F movies i thought it was a bit far fetched, now i stand corrected. Car hacking seems very simple according to that article, just like re-mapping. Better to stick to HPS and power brakes it seems

Mukund, just get a car without traction control/ESP and none of what is shown in the video will happen.

[mukundmenon]

In the near future i believe hi-tech car thieves will be able to remotely turn on the ignition (thanks to push button starts and proximity keys) and literally drive the car out(in case of Automatics) of our garage/parking slots unlock it, get in and make a clean getaway. The irony is that only the high end segments have these features which make them vulnerable to such hacks. Lets hope it isn't as easy as it sounds

Originally Posted by vikram_d

Mukund, just get a car without traction control/ESP and none of what is shown in the video will happen.

Yeah.. You won't find a OBD port anywhere on my Contessa

[mayuresh]

A recent article on this topic:

http://articles.economictimes.indiat...k-cars-hackers

"Imagine driving on the freeway at 60 mph and your car suddenly screeches to a halt, causing a pileup that injures dozens of people. Now imagine you had absolutely nothing to do with the accident because your car was taken over by hackers."

...

"The researchers completely disabled a driver's ability to control a vehicle. No brakes. Distorted steering. All with a click of a button."

...

"The researchers hacked a Toyota Prius and Ford Escape, two hybrid cars that are already on the road."

[DerAlte]

Amusing, to say the least. Sure, there have also been a lot of very believable UFO sightings, alien landings and people being kidnapped by aliens - surprisingly only from US.

This information seems to be coming from people who have no clue about car subsystems and what their exposed interfaces are. What one cannot connect to, one cannot gain control of.

If those guys hooked on directly to the programming / diagnostics port of the EPS ECU (serial link, not CAN Bus; one can't change software over CAN Bus) and meddled with it, they seem to be some very intelligent people - except that they are not 'hackers' at all. Anyone at any car workshop can do it and drive around, but to think that one can do it from remote is a far-fetched fantasy. They are dragging the word 'hackers' through mud. It is nice when appearing in movie plots - but then movie makers also manage to make sparks come out of computers or project images on actors' faces from a common LCD screen, or even make actors levitate in fight scenes defying gravity. But, that is not a feasible reality. If those guys think they are smart, the automotive electronics design guys are not dumb idiots with their heads buried in sand.

The things that people do for cheap publicity!!!

[FlatOut]

Anyone know if it's possible for your car's computer to be 'interrogated' remotely?

[mayuresh]

Originally Posted by DerAlte

Amusing, to say the least. Sure, there have also been a lot of very believable UFO sightings, alien landings and people being kidnapped by aliens - surprisingly only from US.

This information seems to be coming from people who have no clue about car subsystems and what their exposed interfaces are. What one cannot connect to, one cannot gain control of.

If a car is connected to a computer network and has interfaces that some of its functionality may require, it is as good (or as bad) as a computer or a tablet or smart phone in terms of security vulnerability.

Note that, changing the software isn't the only way to make a piece of software malfunction.

Of course, this applies to the cars that have those features (and the associated vulnerabilities.) This means, this wouldn't apply to majority of the cars in use in the world today.

I don't see a reason to doubt the news article's claim that the hackers could actually bring a car to halt by hacking its software. (While I have no way to cross check this, this sounds to be in the realm of possibilities - if a car does have above mentioned characteristics.)

Terms like "Vehicle Area Networks", "Internet of cars" (See thread http://www.team-bhp.com/forum/intern...rnet-cars.html ) will bring more features as well as more vulnerabilities with them in the future.

[DerAlte]

Originally Posted by mayuresh

If a car is connected to a computer network and has interfaces that some of its functionality may require ...

That IF is the biggest single flawed presumption - no one is trying to couple conventional computer networks to any part of the car, hence those interfaces are and will always be missing. Not coupled / connected because there is not reason to do it. Safety critical subsystems in a car are autonomous. Engine, Transmission, Brakes, Power Steering, ABS, ASR / ESP etc. To function, they don't necessarily need any other input other than the driver's. That is true even for the interdependent functionality - engine on transmission (reduce RPM at onset of shifting) and vice-versa, ASR on braking (brake that wheel only) and vice-versa, etc. EPS doesn't talk to any one else, as it doesn't need to. All of them put out messages on CAN Bus during their assigned slots, but don't modify their behaviour based on messages from anyone else.

Originally Posted by mayuresh

... Note that, changing the software isn't the only way to make a piece of software malfunction. ...

There is a major non-semantic difference: The software (I am not talking of MS Windows) *cannot* be made to malfunction, even though you can make a setting or give data to exceed design limits (that's what all 'performance enhancements' do). However, one cannot make an EPS assist a left turning steering make it turn right, or decouple physical movement of steering - that would be ignorance of how *any* Power Steering works. If however one *wires* the servo sensor in reverse, it will result in CCW turning of steering wheel result in turning the wheels right. *Wires*, not changes settings or data in ECU via Network.

Originally Posted by mayuresh

... Terms like "Vehicle Area Networks", "Internet of cars" ... will bring more features as well as more vulnerabilities with them in the future.

Gross misunderstanding, with the predominant assumption that all networks are built and designed for generic data access like Computer networks. They are not!

[laluks]

Originally Posted by FlatOut

Anyone know if it's possible for your car's computer to be 'interrogated' remotely?

Yes, Remote diagnostics are possible these days especially in higher end cars. They are often coupled to the telematics systems in such cases.

There are several levels of security access algorithms to gain access, and change configurations.

[DerAlte]

Originally Posted by laluks

... There are several levels of security access algorithms to gain access, and change configurations.

All the remote diagnostics usually boil down to listening in on CAN Bus, and asking pre-programmed "questions" to specific devices, to which the answers are expected in a pre-specified format. There is no flexibility of asking a "new question", or "intelligently interpreting a question".

Configuration changes are not part of Remote Diagnostics usually, definitely not in production cars. Not a safe practice to influence behaviour from remote without being able to verify intended physical change. Configuration changes are made only in Service Centers.

[laluks]

Originally Posted by DerAlte

All the remote diagnostics usually boil down to listening in on CAN Bus, and asking pre-programmed "questions" to specific devices, to which the answers are expected in a pre-specified format. There is no flexibility of asking a "new question", or "intelligently interpreting a question".

Correct.

Originally Posted by DerAlte

Configuration changes are not part of Remote Diagnostics usually, definitely not in production cars. Not a safe practice to influence behaviour from remote without being able to verify intended physical change. Configuration changes are made only in Service Centers.

As an example even in the nineties, McLaren service engineers could query their F1 cars remotely anywhere in the world and change a few parameters. But then this is also for the subset defined like calibrating the gauges etc.

[mayuresh]

Originally Posted by DerAlte

That IF is the biggest single flawed presumption - no one is trying to couple conventional computer networks to any part of the car, hence those interfaces are and will always be missing. Not coupled / connected because there is not reason to do it.

As I already agreed in my post, what you are saying is true for majority of the cars on the roads all over the world _today_. Can't say whether it will always remain like that.

Besides, if we were to trust the news article (and I don't see a reason to distrust), hacking has been demonstrated on two cars which are on the road.

I am not saying it's a large scale panic topic. But it can be a concern with future cars.

[DerAlte]

Originally Posted by mayuresh

As I already agreed in my post, what you are saying is true for majority of the cars on the roads all over the world _today_. Can't say whether it will always remain like that.

Besides, if we were to trust the news article (and I don't see a reason to distrust), hacking has been demonstrated on two cars which are on the road. ...

Does it occur to you that the news article was just for publicity, since both the cars were normal production cars? So even if they did manage do something crazy, they would have done something that any mechanic can - doesn't need 'hacking'. Anyone who understands the internals of a modern car can figure that out.

Originally Posted by mayuresh

... But it can be a concern with future cars.

Very true, especially if you read that other thread "Employability of Indian Technical Graduates"

[mayuresh]

Originally Posted by DerAlte

So even if they did manage do something crazy, they would have done something that any mechanic can - doesn't need 'hacking'.

I didn't quite get this terminology. The discussion is on whether a car can be controlled externally, particularly in an unintended and potentially harmful way or not. It's immaterial whether a mechanic does it or a non-mechanic does.

In other words, if you are referring to legitimate ways deliberately left open for mechanics to control the car, they do qualify as vulnerabilities, particularly if they can be exploited.