Subject: [93attendees] Timely article in Wired - Hackers Remotely Kill a Jeep on the Highway—With Me in It

From: Dan York <[email-masked]>
Date: Tue, 21 Jul 2015 14:17:54 +0000

Given the topic of this morning's technical plenary, I thought it was an interesting bit of synchronicity that this article appeared on Wired today:

Hackers Remotely Kill a Jeep on the Highway—With Me in It

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

... and the article references legislation that will apparently be introduced in the US Congress today: "WIRED has learned that senators Ed Markey and Richard Blumenthal plan to introduce an automotive security bill today to set new digital security standards for cars and trucks".

The security researchers are apparently going to be releasing more information about their work and the vulnerabilities they found at Black Hat in Las Vegas next month.  The article indicates they have been working with Chrysler for some months to get fixes available, although it sounds like getting the fix applied to vehicles involves a manual step and so many may remain unpatched.

The attackers were able to access and manipulate the Jeep over the cellular network from their home by virtue of knowing the car's IP address.  (Exact mechanism of the attack to be disclosed next month.)  Once connected they were able to rewrite firmware and make various modifications to the vehicle's actions.

As our speakers discussed this morning in the plenary, there are a wide range of security issues that need to be addressed, particularly as these wired-up cars are connected to the global Internet.

Dan

P.S. Threads are naturally active on HN and Reddit:

https://news.ycombinator.com/item?id=9921557
https://www.reddit.com/r/technology/comments/3e23ge/hackers_remotely_kill_a_jeep_on_the_highway/

---

From: Chris Morrow <[email-masked]>
Date: Tue, 21 Jul 2015 10:38:04 -0400

On Tue, Jul 21, 2015 at 10:17 AM, Dan York <[email-masked]> wrote:

>  Given the topic of this morning's technical plenary, I thought it was an
> interesting bit of synchronicity that this article appeared on Wired today:
>

if you haven't seen stefan savage's work previously... it's a good read.
this is direct descendants of that work. (ie, this is not news... except
that car folk seem to still 'not get it')

---

From: Alexandre PETRESCU <[email-masked]>
Date: Fri, 24 Jul 2015 21:25:52 +0200

And I hear today Fiat called back 1million(!) such vehicles following 
that risk.

Imagine the costs.  NExt time think it better...

Alex

Le 21/07/2015 16:17, Dan York a écrit :
> Given the topic of this morning's technical plenary, I thought it was 
> an interesting bit of synchronicity that this article appeared on 
> Wired today:
>
> ... and the article references legislation that will apparently be 
> introduced in the US Congress today: "WIRED has learned that senators 
> Ed Markey and Richard Blumenthal plan to introduce an automotive 
> security bill today to set new digital security standards for cars and 
> trucks".
>
> The security researchers are apparently going to be releasing more 
> information about their work and the vulnerabilities they found at 
> Black Hat in Las Vegas next month.  The article indicates they have 
> been working with Chrysler for some months to get fixes available, 
> although it sounds like getting the fix applied to vehicles involves a 
> manual step and so many may remain unpatched.
>
> The attackers were able to access and manipulate the Jeep over the 
> cellular network from their home by virtue of knowing the car's IP 
> address.  (Exact mechanism of the attack to be disclosed next month.) 
>  Once connected they were able to rewrite firmware and make various 
> modifications to the vehicle's actions.
>
> As our speakers discussed this morning in the plenary, there are a 
> wide range of security issues that need to be addressed, particularly 
> as these wired-up cars are connected to the global Internet.
>
> Dan
>
> _______________________________________________
> 93attendees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/93attendees