In Letter To 20 Automakers, Senator Demands Answers On Cybersecurity 80
chicksdaddy writes "Cyber attacks on 'connected vehicles' are still in the proof of concept stage. But those proofs of concept are close enough to the real thing to prompt an inquiry from U.S. Senator Ed Markey, who sent a letter to 20 major auto manufacturers (PDF) asking for information about consumer privacy protections and safeguards against cyber attacks in their vehicles. Markey's letter, dated December 2, cites recent reports of 'commands...sent through a car's computer system that could cause it to suddenly accelerate, turn or kill the breaks,' and references research conducted by Charlie Miller and Chris Valasek (PDF) on the Toyota Prius and Ford Escape. 'Today's cars and light trucks contain more than 50 separate electronic control units (ECUs), connected through a controller area network (CAN) ... Vehicle functionality, safety and privacy all depend on the functions of these small computers, as well as their ability to communicate with one another,' Markey wrote. Among the questions Markey wants answers to: What percentage of cars sold in model years 2013 and 2014 do not have any wireless entry points? What are automakers' methods for testing for vulnerabilities in technologies it deploys — including third pressure technologies? Markey asks specifically about tire pressure monitors, bluetooth and other wireless technologies and GPS (like Onstar). What third party penetration testing is conducted on vehicles (and any results)? What intrusion detection features exist for critical components like controller area network (CAN) buses on connected vehicles?"
Re: (Score:2)
I like manual brakes.
If they were good enough for the Flintstones they're good enough for a Senator!
Yeah, but it takes weeks to build up the callouses necessary for one trip to the quarry and home. You don't see all of Fred's down-time while he grows those callouses back.
For my money, throwing a rock on a rope out the window is the last word in brake technology.
Re: (Score:2, Flamebait)
Re: (Score:3)
+500 insightful!
Seriously, a senator wants to know about high-tech exploits, and doesn't ask the single highest tech auto manufacturer in the US today about it? That just screams "Agenda!".
Re: (Score:1)
Tesla MIGHT be the single highest tech auto manufacturer in the US, but they are insignificant [and will be for years] in terms of cars on the road [past, present and future].
Re: (Score:2)
Uh, guys, the GP AC was making fun of the semiliterate summary: a car's computer system that could cause it to suddenly accelerate, turn or kill the breaks
What is it with you guys and homophones? If you write code like you write English, no wonder software is so buggy.
That said, though, don't blame the slashdot editor or submitter -- it was cut and pasted from the fucking article. Remind me that "the security ledger," being run by aliterates who obviously never finished high school, is NOT a good source of
Re:I hope (Score:4, Funny)
Follow the links to the actual letter on Markey's site. It really does say "kill the breaks".
Gimme a brake ! (Score:1)
If the senator thinks that "break" = "brake", we should send him the "Gimme a brake" email to remind him that as a role model (albeit a very crummy one) to the young people, at the very least he should be able to discern "break" from "brake".
Now ... can someone gimme that senator's email address ?
Re: (Score:2)
Would've thought the politician would have thought of that, though...
Re: (Score:1)
Thanks for fact-checking that. I'm not sure I could drive more than 8 hours or so without breaks, so I'm glad the senator has my interests in mind.
Re: (Score:2)
Sure you could [disposable...xpress.com]. Heck, an astronaut has even proven the technology works great for long road trips.
Somebody please explain... (Score:2)
What the (bleep) third pressure technologies are? (car analogies welcomed)
(don't blame the /. editors on this, one of TFA [securityledger.com] has used it
Re: (Score:2)
Maybe it's an erroneous interpretation of the acronym TPMS, which is supposed to mean tire-pressure monitoring system [wikipedia.org]. Alternately, it might be some new term meant to introduce tire pressure as a third metric for standard monitoring, in addition to oil and brake fluid pressure levels.
Grumpy? (Score:3, Funny)
There, get your ... campaign contribution... and stop asking questions.
Just trust us, we know how to build cars and we know how to keep them safe. We're Totally and Extremely Professional and Competent Organizations, you can trust us with stuff that goes boom.
Re: (Score:3, Informative)
Have you read what researchers have written about the firmware for phones, your television, your router?
A little poking around Blackhat Convention videos, Bruce Schnier posts and OpenWRT You bet your life it's well worth a few minutes of your time and a letter of support.
Industry Average: "about 15 - 50 errors per 1000 lines of delivered code. Source www.forbes.com
Re: (Score:2)
I know this is a scary issue that needs to be properly addressed before I can't by a dummy car anymore (I'm currently 100% immune to remote hacking).
I also realize that the senator has an election to win in 11 months.
Re: (Score:2)
I know this is a scary issue that needs to be properly addressed before I can't by a dummy car anymore (I'm currently 100% immune to remote hacking).
I also realize that the senator has an election to win in 11 months.
My vehicles are in the same category as yours. When I get that '72 Charger back on the road it might have some fancy stuff throughout the vehicle, but it will not have any go/stop systems that need to phone home for anything. Hopefully the government will stay out of my life enough to keep it that way too.
Re: (Score:3)
I feel your pain. I bought a second-hand truck with On-Star. They were really eager to turn it on for the three month free trial. then I read the Terms of Service. It was of the type "All possible liabilities shall accrue to you, and any possible benefits shall accrue to us."
It too longer to find the box than it took to pull every connector off of it. Now the terms of service are "You leave me alone and I'll leave you alone." Much more acceptable. Still too much gadgetry on the truck, but at least the remot
2 months is an unofficial industry standard (Score:3)
Most car manufacturers dimension their batteries such, that a car parked with a full battery should be able to start after 2 months under normal circumstances. If your car only lasts ten days, either your battery or charging circuit isn't working properly, or you indeed have devices in the car that consume too much electricity in standby mode. If your radio is the culprit, it really needs to be replaced. Fortunately, car stereos follow an industry standard form factor and plugs, so replacing that should be
Re: (Score:3)
Chances are the On-Star box did more than just contact On-Star. Probably controlled power management for the radio, and allowed remote locking of the vehicle. Since you pulled all the wires out the signals that control those features are now just floating (not connected to anything, subject to any EM interference that comes along) and so appear to randomly malfunction or simply not work at all.
Re: (Score:2)
The truck also randomly locks it's own doors for no reason
My 2002 Chrysler does that, but it's by design -- when the car reaches 15 mph, the doors lock. However, unlike yours, I can easily unlock them.
I know for a fact I couldn't leave mine for a month, the blinking LED on the dash to show that the alarm is armed alone would drag it down (never mind the actual alarm circuits).
Re: (Score:2)
(I'm currently 100% immune to remote hacking)
100% Immune, eh? Mind that air-gap!
Re: (Score:2)
No audio input either.
I've got the least technology available in any car made in the US after 2010.
Unless you somehow find it a worthwhile challenge to try to reprogram the injection or the gauges by tapping rhythmically on the hood, go and play with my neighbors' easy targets instead.
Re: (Score:2)
So I'm thinking, with a $50 oven magnetron at 1100 W and a parabolic reflect
Re: (Score:1)
Stupid Senator (Score:3, Interesting)
If you don't know the difference between "breaks" and "brakes", will you really understand the answers to your questions?
Re:Stupid Senator (Score:5, Insightful)
Ah yes, the culture of "zing". It's much more important to catch a politician (or more likely, one of his staff) in a typo than to pay attention to the substance of what he's written.
My hat's off to you. You, sir, are obviously a genius.
Re: (Score:2)
If either the pol or one of his staff is semi-literate, why should anyone take him seriously?
Re:Stupid Senator (Score:5, Interesting)
If either the pol or one of his staff is semi-literate, why should anyone take him seriously?
Well, that's begging the question. We don't *know* that Senator Markey or anyone on his staff are illiterate; we only know that they aren't as careful with proofreading as they could be.
That said, I'll attempt to answer your question: because he (or his staff) is raising a serious, important point. That's not enough for you to listen to him? It's not enough that he served thirty years on the House Committee on Communications and Technology either? He (and his staff and the secretarial pool in his office) have to be *infallible* in matters of proofreading before you'll listen?
Re: (Score:1)
If you don't know the difference between "breaks" and "brakes", will you really understand the answers to your questions?
American tax dollars at work. Shouldn't these bought dogs be looking to balance the budget? I'm sure with all the busy schedules for re-election, trying to make sense of what these bastards are doing to the American people becomes secondary.
These CONgressMEN can only think of eliminating term limits for the presidency. A time will come when someone thinks up a way to eliminate all of THEM once and for all. I on the other hand would rather watch the new Doctor Who, where more reality is evident than what's s
Re: (Score:2)
Shouldn't these bought dogs be looking to balance the budget?
The deficit has been falling for years. [washingtonpost.com]
Re: (Score:2)
Shouldn't these bought dogs be looking to balance the budget?
The deficit has been falling for years. [washingtonpost.com]
So has employment, buying power, intelligence levels compared to other countries. On the rise, unemployment, homelessness, death by war, death by starvation, death by out of control policy enforcers.
Re: (Score:2)
If you don't know the difference between "breaks" and "brakes", will you really understand the answers to your questions?
Why not? Typos, missed auto-corrects, or brain-farts aren't a reflection of one's intelligence. I'm sure the the senator knows how a car stops, despite his spelling mistake.
Government would be wise to fear government (Score:2, Informative)
After all, there are factions within government and if one doesn't agree with another, you may find yourself the victim of an unfortunate accident. Only a tiny minority of government gets the secret service and paramilitary police protecting them you know.
Perhaps we are seeing some government players waking up to the reality that even THEY have good reason to fear the government they are participating in.
Awesome (Score:4, Insightful)
Out do nothing congress is finally doing something useful. These are the kinds of questions we should be asking before problems start to occur and while there are chances to try to introduce standards. It's like the Toyota sudden acceleration thing, everyone assumed it was careless people until someone did a proper audit and discovered a complete lack of industry best practices that everyone assumed had been in place.
Re: (Score:2)
A lot of modern cars no longer have mechanical link to transmission. Buy a stick-shift if you want to be completely safe.
Tell him to pound sand (Score:3, Insightful)
There is no such thing as security (Score:1)
Now, here's a spoon.
How about senators self immolate? (Score:2)
why not pass the buck and make the uses pay (Score:2)
why not pass the buck and make the uses pay for the dealer to do the updates and lock out DIY'er and 3rd party shops.
My reply would be (Score:1)
Sir, our vehicles are just as secure as healthcare.gov.
Take the NSA route (Score:2, Troll)
If only Senator Markey... (Score:2, Insightful)
are you an automaker shill? (Score:2)
there wasn't a car analogy for healthcare.gov security. i'm guessing someone made a car analogy about his car.
For fucks' sake... (Score:3)
Stop calling everything computer related "cyber".
Re: (Score:2)
we shall now call it 'e' or 'i'. Wait, we've used those vowels. I suggest "y"
yAttack..
yDoit
I like it.
Re: (Score:2)
Electrically heated seats are underrated. Now you can get cooling seats. All the rest, GPS, complicated, vendor-locked in car entertainment, OnStar (which I ripped out of my car) are all wastes of money. It's getting so that you can't find cars (except very small, low-end models) that have hand crank windows.
Bean Counter Effect (Score:2)
20 major car manufacturers? (Score:2)
let's see.. According to Forbes... [forbes.com] In order of sales here's the largest 11 in the world.
VW
Toyota
Daimler
Ford
BMW
GM
Nissan
Honda
Hyndai
SAIC (Chinese)
The top 10 up there represent the major manufacturers that sell cars in the US other than Tesla and Fisker is about dead anyway [delawareonline.com].. SAIC doesn't sell anything in the US, so really what's the other 8 on his list? Some guy in a garage building kit cars?
Re: (Score:2)
That list omits a few more or less independent automarkers. For US market examples, where are Mazda, Subaru, Mitsubishi, Suzuki and Chrysler?
Re: (Score:2)
Chrysler is now Fiat so they're not independent but I agree that the others aren't listed but again, that list was the top 10 worldwide. I'm thinking the good senator probably didn't realize that Chrysler and Fiat are one in the same (thanks to the current administration) and that Hyundai also owns Kia for example. I imagine there's a lot of duplication in his list. Having worked in software in automotive electronics for a short time awhile back (MSFT AutoPC... don't ask..) I can tell you that vulnerabil
Silly question... (Score:2)
Among the questions Markey wants answers to: What percentage of cars sold in model years 2013 and 2014 do not have any wireless entry points?
Zero, all cars have wireless entry points. They are called windows, doors and vents and probably a few others.