Disappeared News

“
Security bug allows remote attack of Uconnect system, letting hackers apply the brakes, kill the engine and take control of steering over the internet—The Guardian, 7/21/2015

by Larry Geller

Imagine driving along and finding that your car is braking and steering “on its own.” Scary, huh? A manufacturer made this scenario possible.

I would never buy a car which connects the Internet to anything that controls the vehicle. I know too much about the basic vulnerability built into systems that we all must rely on, from the Internet, to Windows, to yes, even a Jeep. I also know it does not have to be this way.

A security hole in FCA’s Uconnect internet-enabled software allows hackers to remotely access the car’s systems and take control. Unlike some other cyberattacks on cars where only the entertainment system is vulnerable, the Uconnect hack affects driving systems from the GPS and windscreen wipers to the steering, brakes and engine control.

[The Guardian (UK), Jeep owners urged to update their cars after hackers take remote control, 7/21/2015]

The first mistake here is that Fiat Chrysler designed a system that connected vital vehicle controls to the Internet. The second is that someone bought the car.

Hackers thrive because our networks and interconnected systems provide them with an intellectual playground. There is a large and distributed group of humans playing a game in which they match their intellect against the flawed products that provide myriad targets for their efforts. The hackers will eventually win. Somewhere. If not a Jeep, then another car. Or your desktop computer. Or the Ashley Madison website. Or that huge hack that scored a massive number of US Government records.

It doesn’t have to be this way.

As to the Jeep, knowing that the Internet is not at all secure, and that the cars are likely under constant attack, the manufacturers should never have connected the cars to the Internet in the first place, and I suggest that the best thing to do, if it is possible, is to disconnect them. Physically. Let the brakes be operated by the driver and no one else. Period. End of problem. End of future problems. Cut that wire.

As you contemplate “the Internet of Things,” which seems to be based on getting you to pay quite a bit of money to control home appliances from your smartphone before you leave work, understand that you may, one day, find that you are not the only one operating your air conditioner. You could come home and discover the stove at 500 degrees, the aircon at full blast, the refrigerator off, and the security system disabled. Whose fault would it be? Yours, for making it possible. Just as if you purchased that Jeep, it’s your fault when a hacker takes over the driving.

Or suppose that your smartphone is stolen. There are services that can disable a lost or stolen phone, but it takes a little time to activate them, even if you can remember how to do it. In the meantime, everything your phone controls is compromised, along, of course, with all your passwords, selfies, and pictures you don’t want anyone else to have. Simply pulling the SIM card from a stolen phone disables the ability to remotely wipe it, and thieves know this. If they are interested, they can peruse your private data at their leisure.

In other words, simply buying that Jeep or installing network-connected devices in your home makes you vulnerable. Don’t do it. Or do it, and live dangerously. If it’s that Jeep, very dangerously. Up to you.

It was not always this way

A huge industry sprung up around computer and network security—because unfixable flaws and an army of sociopaths with laptops make it necessary.

This was not always the case.

In a past life I wrote a prototype for an email system that was a model for GE’s first commercial email system years later. Better programmers than I wrote subsequent prototypes and the final product.

GE’s commercial email system was certainly almost completely secure, except, of course, for someone deliberately stealing your password at work from a post-it on the wall. Sure, if you leave your computer on and walk away, you’re exposing your data, there’s little that can be done about that. But technically, if the password was strong enough, the system was secure. [I’ll admit to pulling a prank a couple of times by removing those post-its from someone’s wall to teach them a lesson.]

GE charged for its email system, and so it was doomed when free email came out on the Internet. You got what you paid for, though.

GE did not use the Internet for either its email or for its time sharing service, on which the email ran. It used a private network made up of leased telephone lines that spanned the country like a huge spider web. Nor were users’ computers separately addressable, as they are now.

Time sharing is dead, though its ghost (cloud services) has come back and may haunt us for the time being. Do you want your data on the cloud? Not me, for the moment, anyway.

The time sharing operating system was very secure. Each user ran in hardware-protected memory. It was physically impossible to access the memory space or disk files of any other user. It wasn’t something a hacker could override. The systems designed by Honeywell or later NEC compartmentalized users and there was no way around it. So a system couldn’t be hacked. Maybe, if a password were leaked, one user’s data could be compromised. If Ford could possibly get any of Chrysler’s data, it would spell the end for GE. It didn’t happen.

And now we have Windows, an operating system which permits any program to write to (say) /windows/system32. A program can read or write pretty much anywhere to memory or the hard disks that it likes.

It is impossible to make the Internet or Windows perfectly secure. And the old “dinosaur” design that worked so well has been forgotten.

Let’s not even talk about the Android system which leaks like a sieve, since it allows users to give away their privacy every time they install an app. The apps are so appealing that users readily give permission for someone out there (who?) to have unfettered access to their private information.

Many phones (including mine) came with software designed to report my personal data to who knows where (see this Wikipedia page).

In February 2015, HTC One users began reporting that the Carrier IQ agent software was overriding GPS device settings in order to obtain location information even when the GPS was turned off.

I’m pretty sure that my personal information is spread out all over the place, and if I want to continue using my smartphone, there’s little I can do about it.

But I won’t buy into the risks involved with connecting my home or car to a basically insecure system.

Another way to look at this issue: corporations will put harmful substances in your food, or will find ways to part you from your money for their profit. The commercial media are happy to advertise anything to you, it’s how they make money. Snake oil, gold purchase schemes, anything goes. So don’t expect anything to change. Basically, nobody is looking out for you or me. Look out for yourself.

And the media inevitably blame “hackers.” Sure, a government website was hacked. Sure, Target’s data was stolen. But if you park a car on the streets of Manhattan full of groceries on the back seat and leave the windows open, you’re just as guilty as the thieves who will open your doors and help themselves.

There’s no solution in sight for increased security in the devices or services we use. The necessary rebellion hasn’t yet started, and probably won’t any time soon. We’ve been set up to blame the hackers instead of (say) Target and to value convenience over privacy on our phones.

The only thing to do, for the moment, is just don’t buy that Jeep. Don’t connect your oven to the Internet. Connect sensibly, don’t ask for trouble. Be at least as careful as you can, even though that’s not enough.

Permalink posted by Larry @ 7/21/2015 11:54:00 AM