Nhtsa Cybersecurity

[John Painter]

On October 28 the National Highway Traffic Safety Administration requested comments on its Cybersecurity Best Practices for Modern Vehicles manual. The deadline to submit comments is Nov. 28th, a short window for getting comments in, however from my perspective I appreciate EM's dedication to keeping their vehicle simple and to utilize a BYOD approach versus having the auto company build in the technology. I'm not sure if others have commented on the proposed best practices my comments were to th effect Elio's d dictation to BYOD is not only about how to listen to music but also a potential firewall for cybersecurity while driving.

http://www.nhtsa.gov/staticfiles/nvs/pdf/812333_CybersecurityForModernVehicles.pdf

 

[CrimsonEclipse]

The engine computer and entertainment systems should be COMPLETELY different systems with the engine in a closed non connected (meaning no blue tooth, Wi-FI or any other wireless connection) system

If the fancy Windows, IOS, Android infotainment (I HATE that buzz word) system is hacked, or simply fails or freezes up, it would be nice if the engine will still continue to run.

 

[Coss]

The engine computer and entertainment systems should be COMPLETELY different systems with the engine in a closed non connected (meaning no blue tooth, Wi-FI or any other wireless connection) system

If the fancy Windows, IOS, Android infotainment (I HATE that buzz word) system is hacked, or simply fails or freezes up, it would be nice if the engine will still continue to run.

Reminds me of that old joke "What if Microsoft built a car" and it goes on to list upgrades and updates and a bunch of stuff; the best one was "if it would just quit going down the road, you'd shut it off, get out and run around the car, get in and it would restart and be fine"

 

[Elio Amazed]

So... don't certain people in certain government agencies support the ability to have outside access all vehicles' computers for the purpose of tracking and shutting down any vehicle externally at will as long as there's "just cause"?

 

[W. WIllie]

That's the Catch 22. (JUST CAUSE, no longer "Probable Cause") Which is an improvement.

 

[Coss]

Ummm can we redirect this conversation please?
I can see it going over the line very easily.

I had a comment I was going to put in, but chose not to because it is right at the edge of going down that rocky road.

 

[Critter]

Give up security for convinence. Such as a vehicle stolen with onstar loaded, the vehicle can be located, made to run rough and slow, doors lock, and windows up until police arrive. If hacked, the same thing could happen to the owner..

 

[TheAsterisk!]

The engine computer and entertainment systems should be COMPLETELY different systems with the engine in a closed non connected (meaning no blue tooth, Wi-FI or any other wireless connection) system

If the fancy Windows, IOS, Android infotainment (I HATE that buzz word) system is hacked, or simply fails or freezes up, it would be nice if the engine will still continue to run.

The firewall as a firewall, so to speak?



Sorry, too easy; I had to.

 

[Ty]

Reminds me of that old joke "What if Microsoft built a car" and it goes on to list upgrades and updates and a bunch of stuff; the best one was "if it would just quit going down the road, you'd shut it off, get out and run around the car, get in and it would restart and be fine"

I thought you'd just turn it off, close all the windows and then start it up and reopen the windows to get it working again.

 

[CrimsonEclipse]

I would like to expand this line of thought.

If I want to sabotoage a conventional car, (no computers connected wirelessly) I would have to walk up to it and contact it (cut tires, break lock, etc)
To sabotage a connected car, I could do it from ANYWHERE in the world.

Instead of damaging one car at a time, I can now damage ALL of the cars (that are vunerable to a particular exploit) at the same time, or even more distrubing, in an order that suites my needs.

Need to create a traffic jam? Shut down all (brand name connected car) at rush hour, or when a dignitary is at a certain location, or when you want a IED to fire.... and on and on....

It could be as simple as locking everyone out of their car. Or openening ever car in the local area to make them easy to pilfer. Or making every engine overspeed to damage them, or over volting the electrical systems and charging system to create a battery fire (hybrids).

This is off the top of my head.

Try to hack my Toyota (not a Prius). Go ahead, I'll wait.

Sure, I can't unlock my door with my cellphone, or start it up remotely so I'll have to take an extra .5 second and pull the keys out of my pocket or be cold for 5 minutes in the winter.

And thinking that encryption or firewalls might slow down criminals.... no. Firewalls are to stop spam, not dedicated hackers.
How many accounts have been leaked this year? Are we in the billions yet?

Simple cars break less ofter.
Simple computer systems are harder to hack.