Fun71

The inherent design of the CAN bus makes it vulnerable to attacks and impossible to patch.

Brilliant. Just brilliant.

Now let's go one step further and force this upon the motoring public.

Hackable flaw in connected cars is ‘unpatchable’, warn researchers
https://nakedsecurity.sophos.com/201...n-researchers/

The news for the motoring public was bad enough a few weeks ago: a team of researchers had demonstrated yet another hackable flaw in connected vehicles – in the Controller Area Network (CAN) bus standard – that could enable a Denial of Service (DoS) attack on safety systems including brakes, airbags and power steering.

Kind of a big deal, since the CAN is essentially the brain of the car – it handles a vehicle’s internal communication system of electronic control units (ECUs) that the researchers noted, “is driven by as much as 100,000,000 lines of code”.

And the news got worse this past week, with word that the flaw – which applies to virtually every modern car, not just a single brand or model – is unfixable. As Bleeping Computer put it, “this flaw is not a vulnerability in the classic meaning of the word … (It) is more of a CAN standard design choice that makes it unpatchable.” To patch it would require “changing how the CAN standard works at its lowest levels”.

To accomplish a redesign that would eliminate the flaw, the researchers concluded in their paper, titled “A Stealth, Selective Link-Layer Denial-of-Service Attack Against Automotive Networks”, would take an entire generation of vehicles.

Which is yet another ominous reminder that security remains an afterthought in too many industries. Instead of “security by design”, the mentality is that it will always be possible to “bolt it on” later. Except, in this case, it’s not possible.

The researchers’ attack worked by overloading the CAN with error messages, to the point where it was made to go into the Bus Off state, and thus rendered inert/inoperable. This, in turn, can drastically affect the car’s performance to the point that it becomes dangerous and even fatal, especially when essential systems like the airbag system or the antilock braking system are deactivated.

Of course, the Department of Homeland Security’s ICS-CERT said in an alert about the flaw that the attack requires access to one of the vehicle’s local open ports.

Which has generated a fair amount of mockery about how dangerous this really is. A number of comments on the blog of security expert Bruce Schneier, who noted it this past week, said a hacker getting access to one of the ports in the interior of the car is about as likely as a passenger in the car grabbing the wheel – possible but highly improbable. One called it “a tempest in a thimble”.

But then another, with equal snark, noted that it might not be necessary to gain physical access to the vehicle, “if someone were daft enough to add wifi connectivity to CAN … or digital radio … or a mobile phone. But who would do such a thing?” he concluded, with links to stories here, here and here about all three being done.

Schneier said “we don’t know” whether attackers could get attack remotely or would need physical access, but added, “my bet is on remote”.

One of the researchers, Andrea Palanca, said he and his colleagues believe remote attacks are possible. “Simply the lack of time and budget planned for the project impeded us from trying a remote version,” he said. And he contended that the risks from the CAN bus flaw are vastly more than “a tempest in a thimble”.

There are cars currently circulating on roads capable of safety-critical partially autonomous functionalities which entirely rely over their CAN buses availability, and whose abrupt and, most of all, unexpected disruption could lead to life-threatening situations – let alone should CAN bus be employed as a backbone for completely autonomous vehicles.

The hope of the research is to instill awareness over the important limits that this design-level vulnerability introduces to CAN bus adoption in such high-reliability demanding situations.

Another member of the research team, Federico Maggi, added that a malicious attacker getting physical access to the vehicle is not as far-fetched as it might have been years ago. “With current transportation trends such as ride-sharing, carpooling, and car renting, the scenario where many people can have local access to the same car is now more commonplace,” he wrote, adding, “A paradigm shift in terms of vehicle cybersecurity must happen.”

And if it does, all it will take is a generation to achieve.

70cutlass831guy

and being that CAN systems use a lot of modules as gateways connected in series to each other there is not any module that cant be controlled I am positive. if the system is compromised . scary stuff.

Olds64

That's a bummer man!

oldcutlass

I bet this will become the new challenge for computer hackers in the future. I still think cars need to go back to basics and get rid of most of the electronic gadgets.

Fun71

I agree. A radio is about the only electronic gizmo that I need in my car.

70cutlass831guy

[QUOTE=Fun71;1040238]I agree. A radio is about the only electronic gizmo that I need in my car.[/QUO


what's funny about that is a lot of new cars the radio is used as a gateway module that is connected to several other modules . I have inspected cars that have U type codes (lost communication codes) caused by aftermarket radio installs. now you cant even change your factory radio and factory head units can be up 1000 to 2000 when they fail . (newer ford f150s with the Sony head unit)

zeeke

Am I reading that 9th paragraph correctly? "Who would do such a thing?" because no one ever bombed Pearl Harbor or blew up a federal building or flew planes into buildings or set bombs off at a marathon or wore a suicide belt in a crowded area or drove a vehicle into a crowd or walked into a movie theater and started shooting. Nope, this is all fiction. I noticed they didn't put a name to that phrase, just described them as an "equil snark" whatever the h-e-double hockey sticks that means.

On another note: I'm really broke up over all this, does this mean I have to actually steer my 71' Cutlass now? That's like telling kids you don't need to know math you just need a calculator. Because my evil streak gets the best of me constantly, I wait until the draw is open at the store before I tell the cashier "Oh, I have exact change". It amazes me how 99.99% of them just freeze up. Even better when they say that's OK and just give me back what's displayed on the screen. Last week I had a kid break out a calculator because I gave him a 20 & a nickel and the total was $15.03. Yep, it's a rough life being a smart a$$.

Koda

Article does not understand current auto methods. Every essential system is only assisted. Antilock brakes fail. Ok? I'm not too concerned. Airbag fails....won't even notice unless you wreck. All of these are assists, and as long as they fail safe, there's nothing to worry about. Now, it could shut your engine off, but you should be able to recover from that safely.

Most doom articles on this fail to understand that any automotive failure is supposed to be easily dealt with by an experienced driver. People act like if they lose their power steering then it becomes a matter of nuclear apocalyptic concerns.

Olds64

Unfortunately, with today's cars the loss of steering/power assist doesn't mean you have to deal with Armstrong steering in a parking lot. Since modern cars use electronic steering disabling that system could result in loss of control... if someone is dumb enough not to use their brakes or emergency brake. Are people that dumb?

coldwar

In this case I'll wait to see what the Japanese come up with. With their super congested urban roadways it would seem the environment suited to the perceived need.

I am not ready for this level of Japanese automation, either. Glad to see the act of urination and defecation is still incumbent on the being using the toilet. It can wipe your *** but it can't clean itself, note brush to right on floor.

Bfg

I think we need to go back to simple basics like the horse and buggy. Only the strong will survive!

Koda

Electronic power steering, in its most common definition, is the exact same thing as hydraulic power steering that we have had forever, it just uses a stepper motor to assist you, as opposed to hydraulic pressure from the pump on the accessory train. Brakes and steering are assisted. Gas pedal, though, is completely electrical, and can be overrode.

rustyroger

Driving a car has become much less involved than it was, steering and stopping a pre war car required not a little physical strength, shifting gears needed some skill, and drivers needed to be very aware of the road ahead.
Modern cars are much safer than older ones, requiring far less input to negotiate a journey safely.
As a consequence drivers are less skilled when driving aids stop working. I know of many people who have never changed a wheel, and even a few who don't know how to open the hood, still less have any idea of what goes on in the engine bay.

It may well be automated roads will be safer, but many of us are rotten passengers, mentally driving every inch of a journey although we are sat beside a perfectly competent driver who may even be a better driver . This last statement is of course impossible.

Roger.

edzolz

Call me old but I learned to drive and drove to school in a 1929 Model A Ford. You can't anymore basic than that. No electronics at all, no radio, no power steering, no power brakes, nothing modern compared to what is available today. The good old days. Let's see if they can hack into that.

Indy_68_S

Agree. The only real problem would be when the steering is totally electric (steer by wire) which is coming, but I'm not aware of any production vehicles using it now.

"easily dealt with" - That's why while teaching our kids to drive I've done 'power out' drills. While rolling thru a big empty parking lot I'll turn the key off (one click, not lock column-du'h) so they can feel the loss of power steering/brakes and react properly. I think if everyone learned this, the whole 'GM ignition switch' debacle wouldn't have happened.

Most of these articles over dramatize the issue(s) for sensationalism as tabloidism has metastasized in modern 'journalism'.

wr1970

I love it when the geeks who think this stuff is great and it fails. No self drive for me.

ELY442

Yes, lets all of us turn into Amish and we can save money on electric, gas, cell phone and car insurance bills

Olds64

This is what I was referring to, not electronic assisted steering but drive-by-wire steering. It was my understanding that it was more common. Here's an article about a 2014 Infiniti Q50 with drive-by-wire steering. Apparently there are safety systems in place in case the drive-by-wire system fails.:

https://gizmodo.com/what-its-like-to...ire-1501915995

Koda

Ah. Your comment makes more sense now. I don't think my company puts that on anything we make, even Lexuses, so I plead Da Ignorance.

coldwar

Well here we go....

https://www.google.com/search?q=fata...hrome&ie=UTF-8

Indy_68_S

Not sure how that applies here. This idiot killed himself by watching a movie instead of the road.

Fun71

Yeah, driver inattention has been killing people for a hundred years or more.

coldwar

"....The report's findings state that while the driver of the truck failed to yield the right of way to the Tesla driver, the latter was too heavily reliant on the car's automated system, which is the likely reason he did not try to avoid the oncoming collision. Data from the Autopilot system show that the Tesla driver's use pattern reflects a lack of understanding regarding the system's limitations -- which the NTSB says need to be configured to restrict themselves in order to prevent misuse. The Tesla Autopilot system monitored the driver's attention through his interaction with the steering wheel, which previous findings have determined was incredibly limited. The NTSB report notes that the method isn't adequate for measuring driver engagement..."

A movie? That isn't in the NTSB findings.

https://www.ntsb.gov/news/events/Doc...G-abstract.pdf

rustyroger

Looks like the Cyborgs will take over. I never realised the Terminator movies were made in the late 21st century and sent back through a timewarp...

Roger.

Indy_68_S

https://www.usatoday.com/story/tech/...-ago/86592458/

(Note: Turn down your volume before clicking link - Loud autoplay ads )