Driverless Cars

[airbiscuit]

Even new-tech auto companies like Tesla don't have a great record when it comes to security, IMO.

As more driverless cars hit the roads, they will become more of a security target. Shutting down an Uber fleet, would make your bones as a hacker.......... Shut Engine Off, Retain Steering Control would be a relatively benign hack...... worse scenarios are easy to imagine......

Any guesses if the military will allow widespread use of driverless vehicles....... ?

Rgds, D.

I'm pretty sure the military is researching driverless vehicles and robotic mules to transport materials to the front. The next thing you know, they will have pilotless planes ... oh, wait ....

 

[vvanders]

Even new-tech auto companies like Tesla don't have a great record when it comes to security, IMO.

As more driverless cars hit the roads, they will become more of a security target. Shutting down an Uber fleet, would make your bones as a hacker.......... Shut Engine Off, Retain Steering Control would be a relatively benign hack...... worse scenarios are easy to imagine......

Any guesses if the military will allow widespread use of driverless vehicles....... ?

Rgds, D.

Got a source on that? As far as I know Tesla was the first auto company to create a bug bounty program, the only manufacturer to have the ability to send OTAs out to the fleet at scale *and* they do the proper thing by isolating the CAN bus from all other systems(entertainment + dash is run on a variant of ethernet). Yeah, they've had small scale breaches but all of them were rapidly patched and I'm not aware of any major issues(aside from replay attack on the keyless entry system which Mercedes, BMW and other vendors have the exact same problem with) as a result.

Remember the last Jeep hack where you had to bring the car into the dealership or have a USB stick shipped out? What a joke. Pivoting from the entertainment system to vehicle controls via CAN bus is such a basic security fail that it's hard to emphasis the scale of what happened with Jeep.

As someone who's paycheck depends on getting these sort of things right there's basically two ways companies go about it:

1. Assume that they will never be hacked and pray that nothing happens.
2. Assume there will be breaches, put in place fast update systems, implement principal of least privilege and have multiple plans in place for a variety of scenarios including bug bounty programs.

Every auto manufacturer I've seen fall squarely into #1. All the information I've been able to find about Tesla(both from my own investigation and others who've torn them down) put them in the #2 category.

 

[3930dave]

I'm pretty sure the military is researching driverless vehicles and robotic mules to transport materials to the front. The next thing you know, they will have pilotless planes ... oh, wait ....

It's that reliability vs. complexity thing again ...... saw a tender not that long ago, where the US military was looking for non-microcontroller based anti-drone defensive tools.

Obviously, modern military forces use lots of tech; smart ones don't over-complicate things when a simpler solution works more reliably under adverse conditions.....

Rgds, D.

 

[3930dave]

As someone who's paycheck depends on getting these sort of things right there's basically two ways companies go about it:

1. Assume that they will never be hacked and pray that nothing happens.
2. Assume there will be breaches, put in place fast update systems, implement principal of least privilege and have multiple plans in place for a variety of scenarios including bug bounty programs.

Every auto manufacturer I've seen fall squarely into #1. All the information I've been able to find about Tesla(both from my own investigation and others who've torn them down) put them in the #2 category.

A few years back, someone who worked for me about 5 years previously sent me an email out of the blue. (No contact between the time I left that company, and that email, or any subsequent time.... ie. not someone who I socialized with). Email basically said "Hey Dave, just wanted to say that you were the best boss I've ever had, or maybe ever will :-( "

I wasn't just being modest when as part of my thank-you reply I commented "Thanks L - but probably it's not so much that I'm that great, rather that the rest have been so bad".

I agree with your 1/2 split above. I'm not a Tesla hater by any stretch - I consider any one of Elon's accomplishments to be significant. It's just that my reliability perspective is a bit broader than the average consumer.....

Something like 10 years back, I was at a tools (uC) presentation. In the breakout session at the end, the presenter commented about a project they had just done with Audi - there were tens of thousands of threads, just within the infotainment system.

Yourdon wrote years ago, when Star Wars was being proposed - How can those of us who spend time considering if 100 lines of code is truly bulletproof, ever be satisfied that the mountain of code in these systems is reliable ? (That was the essence of what he was getting at, I've not tried to find the original direct quote recently).

^ He's forgotten more about writing code than many people learn..... that comment above summarizes how I look at complex software systems.

Rgds, D.

 

[airbiscuit]

 

[airbiscuit]

 

[Jstpssng]

Perhaps someday our wars really will be fought like a video game... all sorts of high tech machines destroyed yet nary a human life lost. Wouldn't that be a lofty goal!

 

[vvanders]

A few years back, someone who worked for me about 5 years previously sent me an email out of the blue. (No contact between the time I left that company, and that email, or any subsequent time.... ie. not someone who I socialized with). Email basically said "Hey Dave, just wanted to say that you were the best boss I've ever had, or maybe ever will :-( "

I wasn't just being modest when as part of my thank-you reply I commented "Thanks L - but probably it's not so much that I'm that great, rather that the rest have been so bad".

I agree with your 1/2 split above. I'm not a Tesla hater by any stretch - I consider any one of Elon's accomplishments to be significant. It's just that my reliability perspective is a bit broader than the average consumer.....

Something like 10 years back, I was at a tools (uC) presentation. In the breakout session at the end, the presenter commented about a project they had just done with Audi - there were tens of thousands of threads, just within the infotainment system.

Yourdon wrote years ago, when Star Wars was being proposed - How can those of us who spend time considering if 100 lines of code is truly bulletproof, ever be satisfied that the mountain of code in these systems is reliable ? (That was the essence of what he was getting at, I've not tried to find the original direct quote recently).

^ He's forgotten more about writing code than many people learn..... that comment above summarizes how I look at complex software systems.

Rgds, D.

:thumbsup:

Yeah, there's an interesting continuum of software robustness. I think the falacy that people fall into really easily is that you can get nine-nines of security when the surface area is so large.

Just like we don't build cars that never crash but instead design them to deflect/absorb force to protect the passenger space. Security follows the same cut where you know how you'll respond to a threat at all levels before it actually happens.

 

[Gale Hawkins]

Spoon-feeding AI data.....

Why Big Tech pays poor Kenyans to programme self-driving cars - BBC News

Rgds, D.

Thanks for sharing the story.

 

[bcp]

I'm pretty sure the military is researching driverless vehicles and robotic mules to transport materials to the front. The next thing you know, they will have pilotless planes ... oh, wait ....

Military has been working on it for years.

DARPA Grand Challenge - Wikipedia

Here's one of many videos.

DARPA Grand Challenge: Final Part 2 - YouTube

Bruce