Hacking of Connected Vehicles Shifts From Theory to Very Scary

[shocka khan]

Turns out, if you have those skills, you just get a job and make bank. Not much need to jack stuff at that point.

Hack a car, kill a person. Hack a bank, no one gets hurt, but you can sure make a trainload of $$$$$.

[shocka khan]

Because of their framework. It's all about the framework.

Haven't you killed enough golphers yet? Maybe you need to kill some more. Or maybe make a batch of Lutefisk with the fish you caught at the Neobara River or whatever it's named.

[Kung Wu]

Perhaps because Chrysler/Fiat had said that the head unit could not be used to control the motor and guidance systems?

Uhhh, they may have said it, but it doesn't make it true. This is from the hackers themselves:

"Miller and Valasek's latest and most frightening exploit is completely wireless. Thanks to a vulnerability in Fiat Chrysler's Uconnect dashboard infotainment system . . . Miller can see a vulnerable car's vehicle identification number, make, model, and IP address, along with its GPS location, in real-time. Once they've found a target vehicle, Miller and Valasek can worm their way into the entertainment system's firmware, implanting malicious code they designed that can transmit commands to any system connected to the car's network of computers—including the devices that control the car's steering, brakes, and engine and transmission."

Now are you calling for Chrysler's CEO's head?

Kung, why don't you read NIST SP 800-82 and get back with me.

Okay I read some of it, skimmed much of it, but skipped over most of it. What in particular would you'd like to discuss?

[Kung Wu]

Haven't you killed enough golphers yet?

Prairie dogs.

[MoValley John]

Haven't you killed enough golphers yet? Maybe you need to kill some more. Or maybe make a batch of Lutefisk with the fish you caught at the Neobara River or whatever it's named.

You can kill golphers? Awesome!

[shocka khan]

Nah, I'll leave the gopher killing up to you. I'll also leave the preparation of lutefisk up to you. Garrison Keillor said:
“Well, we tried the lutefisk trick and the raccoons went away, but now we've got a family of Norwegians living under our house!”
“Eating a little was like vomiting a little, just as bad as a lot.”
“Every Advent we entered the purgatory of lutefisk, a repulsive gelatinous fishlike dish that tasted of soap and gave off an odor that would gag a goat.”

[shocka khan]

Uhhh, they may have said it, but it doesn't make it true. This is from the hackers themselves:

"Miller and Valasek's latest and most frightening exploit is completely wireless. Thanks to a vulnerability in Fiat Chrysler's Uconnect dashboard infotainment system . . . Miller can see a vulnerable car's vehicle identification number, make, model, and IP address, along with its GPS location, in real-time. Once they've found a target vehicle, Miller and Valasek can worm their way into the entertainment system's firmware, implanting malicious code they designed that can transmit commands to any system connected to the car's network of computers—including the devices that control the car's steering, brakes, and engine and transmission."

Now are you calling for Chrysler's CEO's head?



Okay I read some of it, skimmed much of it, but skipped over most of it. What in particular would you'd like to discuss?

Run networks with a different communications protocol , stateful inspection of firewall traffic, employ other control aspects found in software-defined networks.

All these controls should reduce/eliminate the hacking risk.

Everything using technology leveraged from IoT should be using these tactics to protect their network. But even though there are defenses, I really don't think anyone will hack a car for financial gain.

The bigger risk from IoT will be from using vulnerabilities in alarms (like the Honeywell alert last week, though I think it will be some time before the common thief gets smart enough to break into your home alarm system) or hacking SCADA networks to disrupt pipelines and electrical grids. This would be more from a state-sponsored cyber attack. As Willie Sutton said, 'I rob banks because that's where the money is.'

Little or no gain in hacking automobile sensors and telematics systems that manage and control them. Credit cards and the databases that store them are much different.

And yes, I think the head of Chrysler ought to go, but more for all the failed recalls (there was a large fine announced yesterday, one that could grow to over $100 million dollars) that indicates a lack of governance and regulatory awareness but less for this. This is another one of those 'just another data point' situations. Sort of like 'how much proof do you need before you reach a conclusion about X' moments.

[SHOCKvalue]

Nah, I'll leave the gopher killing up to you. I'll also leave the preparation of lutefisk up to you. Garrison Keillor said:
“Well, we tried the lutefisk trick and the raccoons went away, but now we've got a family of Norwegians living under our house!”
“Eating a little was like vomiting a little, just as bad as a lot.”
“Every Advent we entered the purgatory of lutefisk, a repulsive gelatinous fishlike dish that tasted of soap and gave off an odor that would gag a goat.”

Unless there is a connection with MVJ and lutefisk I am not keen to, Nebraska is not Minnesota. If your joke is that Nebraskans eat lutefisk, then the context is about as relevant as poking fun at Kansans for eating gooey ducks. There are no more Scandinavians in NE than there are in KS.

[Rlh04d]

I think the point of hacking an app like that is not to be seen.

Fair :)

My point was, robbing houses is a pretty lowest-common-denominator type of crime. You don't end up in that way of life if you have many job prospects. People with the ability to "hack an app" tend to have strong job prospects.

With the exception of the occasional juvenile delinquent computer kid, you just aren't going to see (figuratively) many people robbing houses with the ability to legitimately hack into a smart-home (or smart-car). Robbers just don't tend to have a technical background needed to do something like this. And hackers don't tend to go out committing crimes in person -- when they do commit crimes, it's from a distance and the safety of their homes, and generally at much larger targets than someone's home.

A hacker might shut off your cameras and home security system just to screw with you, but that's about the most I'd expect outside of a rare exception.

[shocka khan]

Shockvalue, there are a lot of Lutherans in Nebraska, Minnesota and North and South Dakota. Also, I may be mistaken but I recollect seeing there were a lot of Swedes in Omaha. I dated a Scandinavian Lutheran from South Dakota. Her cousins visited her here in Houston and prepared Lutefisk and Lepsis. She said it smelled horrible and stunk her house up. That's where I picked up the Garrison Keilor quote.


(ref: http://www.adherents.com/largecom/com_luth.html)
Top 20 U.S. States with
Highest Proportions of Lutherans in the Population
(self-identification), 1990


State

Percent
Lutheran

North Dakota 36.50%
Minnesota 33.90
South Dakota 30.30
Wisconsin 26.20
Nebraska 16.30
Iowa 15.40
Montana 12.20

[MoValley John]

I lived in Chicago, married a Norwegian Lutheran from Nebraska. Three years later, she switched to the dark side. Then again, I got to choose the religion, she chose where we live. Second to Bohunks and Catholics, you can't swing adead cat in Omaha without hitting a Lutheran. Like prairie dogs, they're everywhere!

[Rlh04d]

Shockvalue, there are a lot of Lutherans in Nebraska, Minnesota and North and South Dakota. Also, I may be mistaken but I recollect seeing there were a lot of Swedes in Omaha. I dated a Scandinavian Lutheran from South Dakota. Her cousins visited her here in Houston and prepared Lutefisk and Lepsis. She said it smelled horrible and stunk her house up. That's where I picked up the Garrison Keilor quote.


(ref: http://www.adherents.com/largecom/com_luth.html)
Top 20 U.S. States with
Highest Proportions of Lutherans in the Population
(self-identification), 1990


State

Percent
Lutheran

North Dakota 36.50%
Minnesota 33.90
South Dakota 30.30
Wisconsin 26.20
Nebraska 16.30
Iowa 15.40
Montana 12.20

I'm a Lutheran and have no clue what Lutefisk and Lepsis are.

It may be very common in Scandinavian countries, but Lutheranism is originally a German denomination, founded by a (antisemitic) German. I'm not sure why you're generalizing Scandinavian foods on Lutherans. The girl you dated enjoyed those foods because she's Scandinavian, not Lutheran. That's like generalizing all Catholics as traditionally enjoying Coxinhas and Feijão Tropeiro because Brazil has the most Catholics in the world by country. Or associating hot dogs with Judaism because the US has the most Jewish people in the world :)

[SHOCKvalue]

Not to sound like a broken record, but I have a lot of connections to Nebraska, and the Lutefisk reference to NE is square peg to round hole. You could make a joke about bierocks instead and it would be more relevant, but bierocks are good stuff (as opposed to lutefisk), and there's just as big of a chance of seeing bierocks on the menu at the county fair in KS as there is in NE. Only in NE they have bastardized the common name of bierocks through a local restaurant chain.

[MoValley John]

Not to sound like a broken record, but I have a lot of connections to Nebraska, and the Lutefisk reference to NE is square peg to round hole. You could make a joke about bierocks instead and it would be more relevant, but bierocks are good stuff (as opposed to lutefisk), and there's just as big of a chance of seeing bierocks on the menu at the county fair in KS as there is in NE. Only in NE they have bastardized the common name of bierocks through a local restaurant chain.

I can get a shitload of lutefisk in Omaha. Do I want to? Absolutely not, but I know where to get it. Omaha doesnt have a huge Norwegian population, but there are plenty here. My wife, and her extended family, all living here, are Noewegian. There are Swedes, Danish and Dutch, here. Plus, greasy Bohunks.

Lots of Norwegian towns in Northeast Nebraska. Tons of German towns. And greasy Bohunk towns. When I'm hunting, I make a point of seeing what kind of church represents each town. From the church, you know the ethnic makeup of the town. You can also buy great bierocks in lots of towns that aren't from Runza.

[MoValley John]

20150626_211715.jpg

So, I saw this Shosker at Walmart. Shocker tee, Husker hat. Don't see too many Shocker jerseys in these parts, so I had to shoot the photo.

Here is the question, if you like the Shockers, you must love the bierock, but if you also love the Huskers, does that mean you love the Runza?