DEF CON 23 - Charlie Miller & Chris Valasek - Remote Exploitation of an Unaltered Passenger Vehicle
Why Hacker News recommends it
HN uses it as the canonical reference that modern connected cars can be attacked remotely.
What it is
Charlie Miller and Chris Valasek present their DEF CON 23 talk on remotely compromising an unmodified Jeep, pivoting from the entertainment system to the vehicle's internal networks to send control messages. They aim to show the reality of car hacking.
Recommended by 0 HN commenters across 0 different months, 2016 to 2023.
What Hacker News said
Cites patcheudor · 2016-09 · on “Upgrading Autopilot: Seeing the World in Radar”
In terms of the SDR stuff, I'm thinking more about it being in the hands of a threat actor. One of the things that Tesla nor Google have had to contend with to date in their trials are intentional disruption and subversion of their systems and I only hope they've hired security engineers to consider more than just IT stack vulnerabilities like those explored by Charlie Miller & Chris Valasek ( [this video] ). A great number of jobs are at risk from this technology from long haul truck drivers to bus and cab drivers. This will certainly result in tensions which could result in threat actors going after sensing systems. Readily available radar frequency SDR in those conditions really could be used
Cites michaelmcmillan · 2017-11 · on “macOS High Sierra: Anyone can login as “root” with empty password”
"Apple root bug appears to be triggered only by logins coming from com.apple.loginwindow. Running "su" with a blank password won't get you a root shell." [1] As for your subsystem argument, explain this: [this video] [1] [LINK]
Cites bradleybuda · 2018-08 · on “Former Tesla Firmware Engineer Discusses the System”
At DEF CON 23 there were two car-hacking talks that made an impression on me: one about hacking a Tesla [1] and one about hacking a Jeep [2]. FWIW, I came away thinking that the software architecture of the Tesla was light-years ahead of what Jeep (and presumably many other legacy manufacturers) was shipping: [1] [LINK] [2] [this video]
Cites l-p · 2021-12 · on “No Easter Eggs in Curl”
Yes because it'll load an image from a domain that expired and is now controlled by a nefarious third-party. The image is now a payload targeting the out of date image loading lib used by the onboard entertainment system that has seen no updates for 5 years. This entertainment system is connected to the actual driving electronics of the car that will now brake at full force the next time it reaches 130 km/h. This scenario is fictional, but possible. cf. the works of Charlie Miller and Chris Valasek. [LINK] [LINK] [this video]
Cites LinuxBender · 2023-07 · on “FBI: AI Makes It Easier for Hackers to Generate Attacks”
I believe they should have instead phrased it something along the line of " AI facilitates a new generation of Skiddies [1] lowering the bar even further to malicious behavior without much technical knowledge." or something along that line. They're not wrong. Now a person with little or no technical knowledge can ask an LLM in plain English how to generate a more complex script that does {x+y+z} vs. at least having to know some degree of a scripting language or being limited to one of the well known and defended against skiddie tools that only perform {x}. A theoretical example would be a low-tech person taking full control of an internet connected car on a live highway. It's been done by te