Hacker News Reader

Comment by px43 | Hacker News Reader

No no no.

The reason you hear about security flaws in newer cars with OTA updates is because research on unpatchable cars is regularly silenced. Multiple friends of mine who thought it would be fun to look into bluetooth security in cars have had their work shut down by law enforcement and teams of lawyers, and told to back off.

I'd estimate that at least 90% of cars on the road without OTA updates are vulnerable to some sort of Bluetooth based attack that will never get fixed. Your "write enable" trick does more harm than good in these scenarios.

View on HN

Maybe critical systems shouldn't have wireless transceivers (especially Bluetooth, the implementations seem to be full of bugs and CVEs.)

Exactly. Why are they not air gapping everything that controls the multi-ton beast?

Short answer: because it was easier.

Aren't vehicles and their safety capabilities regulated? Just because new cars are fly-by-wire shouldn't mean the control mechanisms are suddenly exempt.

Steering wheels made of cardboard would be easier to manufacture, yet they'd fail safety inspection.

An FM/AM antenna is a wireless receiver. Not a transceiver (though CB is and is still common in long-haul trucking), but still, it's always been possible for someone to hijack the channel and send an unwanted signal into your speakers. That's how pirate radio worked for a century. If all an attacker can do is send sound into your cabin, that isn't a meaningful vulnerability. They could do that with a megaphone.

If car makers are actually hooking the bluetooth chip up to anything except the sound system, that's the problem. Although, assuming a class 2 device, it only has a 10 meter range. If an attacker is that close and wants to shut down your car, they can use a nail strip.

The real problem here is hooking up WWAN to control software.

The trouble is, the sound system is inevitably connected to the rest of the car. For example, in most cars the volume automatically increases with vehicle speed to compensate for increased road noise.

These connections could be physically 'one-way' but in practice most modules are simply wired in parallel on a CAN bus and something like the radio would be set up to send data to the car's CAN bus (for diagnostic purposes at least).

More than just speed sensitive volume now. Replacing the stereo in my van requires a conversion box (Maestro) that deals with the various car settings that are done through the stereo, such as dome lights out duration, dash clock setting, auto door locking, etc.

The stereo is way too tightly coupled with the rest of the vehicle.

All they need to get a bluetooth transmitter within a 10 meter range is a shell on your phone, and those are very common.

Cars go in for service. They can be updated then, with the mechanic pressing the "write enable" switch.

Well, maybe cars shouldn't have Bluetooth in the first place? Also, it's not like these updates are ever going to fix the situation. They'll just be slightly less vulnerable.

Not to mention that updates can obviously brick things. Imagine waking up one day and finding out that your car is bricked due to some update.

I don't really think that's the moral of the story, Bluetooth in car stereos brings value to people, many use it. You could fix this pretty easily with more separation between the stereo and the "important" components.

Well, you could buy an aftermarket stereo with Bluetooth then. Something that's not integrated in any way with the rest of the car other than power.

..sure? The average person who buys a car does not want to do that though, so selling stereo-less cars is completely unrealistic.

Not having Bluetooth would cause accidents, as more people would use their phones while driving.

Actually, by default having your car connected to cellular, wifi, bluetooth and more is the problem.

But car owners are not given a choice, and most systems are then gradually engineered to depend on online access to function.

Now I'm curious; who exactly told them to back off, and why?

Reply on news.ycombinator.com