back to article Hacker hijack 'threat': Your car's security is Adobe Flash-grade BAD

Democratic Senator Ed Markey (D-MA) has published a report after questioning 20 automakers about the security of their cars' internal networks – and how much personal data they store. The results aren't great. In short, as we've long suspected, the computers in today's cars can be hijacked wirelessly by feeding specially …

  1. asdf
    Mushroom

    >and one manufacturer said it felt consumers shouldn’t even be told records was being kept, Markey's report states.

    And somewhere a millennial reading this is disgusted that they would hide this instead of integrating it with their foursquare profile. That is if it is one of the rare ones that even has a driver's license.

  2. bazza Silver badge

    Anyone else get the feeling...

    ...that this could all boil over into a mega privacy/security omni-shambles for the car industry?

    We all think that <insert desktop OS name that suits your personal allegiance> is pretty crummy security-wise, but cars sounds heaps worse than any of them.

    1. asdf

      Re: Anyone else get the feeling...

      Here stateside in many states they already allow the insurance companies access to the mandatory blackbox built into every car the last five years.

      1. Robert Helpmann??
        Childcatcher

        Re: Anyone else get the feeling...

        Progressive Insurance even touts their data collection kit that they will give you for absolutely free so that they can monitor every move you make in your vehicle for the benefit of lowering your rates for an undisclosed amount. Alas, it opens your car to even more exploits than would otherwise be available to the black hats. The good news: your rates go down. The better news: you'll be getting a new car as hackers wrecked your old one for you.

    2. Eddy Ito

      Re: Anyone else get the feeling...

      of fond nostalgia?

      Oh how they laughed at the old joke about GM's answer to Bill gates asking if folks would really want a car that would crash twice a day. Oddly it's starting to look as if that might not actually be preferred to what the automotive industry has right now.

      1. Neil Barnes Silver badge
        WTF?

        Re: Anyone else get the feeling...

        Funnily enough, the entertainment stuff in my Fiat Bravo is by a well-known Redmond software company. And yes, every now and then I have to stop the car and start it again to make everything work (though I don't have to close all the windows).

        I do rather prefer the 1995 Coupe Fiat I've had twenty years and am currently rebuilding; just three ECUs, and the one that matters I can get inside and read the assembly code if I have to (I hacked the comms protocols years ago).

  3. Anonymous Coward
    Anonymous Coward

    and people wonder why I refuse to own anything made after the late 90s...

  4. Mark 85
    Devil

    Oppurtunity stirkes....

    Symantec and McAfee will probably soon offer their products tailored for you automobile. Things will alright then.

    1. Bob Dole (tm)

      Re: Oppurtunity stirkes....

      >>Oppurtunity stirkes....

      Symantec and McAfee will probably soon offer their products tailored for you automobile. Things will alright then.

      So basically we should expect that camaros and mustangs won't be able to go faster than about 10mph? Lovely

      What I want to see is someone go back into the Toyota floor mat recalls that supposedly caused cars to speed up uncontrollably and keep the brakes from working. I suspect we'd find out that those cases were actually caused by hackers but no one wanted to admit it.

      1. Voland's right hand Silver badge

        Re: Oppurtunity stirkes....

        That mat was deadly - they fitted it also on the last real (2004) Daihatsu 4x4 Sirions before they completely crippled Daihatsu in 2005. I got one of these and it got caught on the clutch several times (no clutch on USA cars so break or accelerator will be the victim). To add insult to injury the f***ers did not include it in the recall list so no free mats from Toyota for us cheapskates.

        I have tried anything and everything to deal with this and finally found something last year - the same OEM part as used on Isuzu trucks:

        http://www.amazon.co.uk/gp/product/B00NC0ICWS (no association with the links). Two of these dealt with the problem once and for all.

        So no hackers involved I am afraid. Just terminally (literally by all means) bad design (resulting from terminally bad management).

  5. An0n C0w4rd
    Big Brother

    Missing data?

    Quote: "On the privacy side, all of the 2014 models put out by car makers that responded to the survey collect some form of information from their customers, with 25 per cent storing it on the car and half transmitting it back to corporate servers, where it is kept for up to ten years in one case."

    So if I am reading it correctly, all the 2014 models collect data, but 75% or less store it on the car and/or transmit it back to corporate servers. What do the rest do?

    1. Hero Protagonist

      Re: Missing data?

      "half transmitting" -- they only send every other bit

    2. Voland's right hand Silver badge

      Re: Missing data?

      Hand out the data to the authorized dealership which in turn transmits it back to the corporate servers.

      There is a "Sony Pictures" waiting to happen somewhere in here. The question is not if it will happen, it is a question of when it will happen.

      1. An0n C0w4rd

        Re: Missing data?

        @Voland's right hand

        Where does the dealer get the data from? It would have to be stored in the car. So the missing data source is still missing,unless I'm being dumb (always a possibility)

  6. John Tserkezis

    "security experts consulted by the senator noted that all the cars, save for motors built by one manufacturer, can be hacked using previously published techniques"

    Name names or it doesn't count.

    No wait, it's vastly more important we protect the guilty and the lazy. That's all right then, as you were...

  7. MJI Silver badge
    Devil

    Car security & Senator

    Made me think my worry about security on the old Vauxhall/Opel Senator

    Red car icon

  8. Down not across

    Data collection

    On the privacy side, all of the 2014 models put out by car makers that responded to the survey collect some form of information from their customers, with 25 per cent storing it on the car and half transmitting it back to corporate servers, where it is kept for up to ten years in one case.

    Doesn't that potentially violate data retention laws in EU. Or don't non-US versions report back to mothership?

    All of these data collection systems are mandatory, and one manufacturer said it felt consumers shouldn’t even be told records was being kept, Markey's report states. The permission to slurp up this potentially sensitive data is usually mentioned in the purchase contract or owner's manual, and two manufacturers claim to have systems in place to allow customers to delete some of the information if they choose.

    Mandatory? If that is mandatory as set by legislation in the US, then surely customers can't be kept in the dark about it (unless the laws requiring the collection are secret too).

    If its in purchase contract then at least purchaser has option to decline to purchase, but including it just in owner's manual is kinda bit too late.

    And good on the unnamed manufacturers that at least allow culling some of the information (if you believe that it is really deleted).

    Just as well I prefer older cars that most definitely can't phone home. On that note, shouldn't be too difficult to cripple the phoning home even if you can't (no idea how embedded it is) stop local collection. And surely there will be nice gadgets (just like now to read OBDII and reset MIL etc) to deal with the collected data.

  9. MJI Silver badge

    I am scared about newer cars.

    They are nice, but I can't afford £60,000 for the one I like.

    But road tax is high, maintenance is not too easy, some parts can fail and not easy to fix.

    My current car (2 versions older of above) has 4 ECUs I think, but I can read them with a £300 code reader, Most things are easy to fix, under £300 road tax, but the ride is not good.

    I know I will have to replace parts to keep it on the road, everything is available (including galvanised chassis). But how long for?

    The manufacturer is also going more upmarket and moving away from its enthusiast market.

    Ok I have no idea whatsover what my next car will be!

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like