Most security workers at companies overestimate hackers abilities. That’s why all these companies are hacked all the time and there are tons and tons of data breaches.
The thing very few people understand about hackers is that they can code and they share their hacks as tools with each other on the black market. This means you’re essentially up against the combined effort of all hackers on the black market. When one succeeds, they all succeed. When one piece of server software is hacked, all companies who use that software get hacked.
They are taking over Internet accounts though. They hack people’s social media profiles, Netflix accounts, Amazon accounts etc. They also take down websites via DDoS attacks.
Here’s the thing with fleets of self-driving rental cars: unlike power plants or manufacturing robots, these cars will be on the public Internet. They cannot be airgapped on a private LAN the way a fixed robot in a factory can.
So all it takes to control these things is to hack into the authentication system and steal the credentials for the master control account for the cars. Then they’ll be able to connect to the cara remotely and issue commands to control them, just as the company would for say, ordering them to return to base to recharge, get cleaned up, or be repaired.
That’s the vulnerability. And even if they put all the cars on a VPN it’ll still exist because hackers can and do steal VPN credentials just like any other credential.
By the way, there has been at least one high profile hack of manufacturing robots: the Stuxnet worm which targeted Iran’s nuclear program. Since a fleet of self-driving cars is going to have millions and millions of dollars in value (tens of thousands of cars on the road) it’s going to be an extremely high value target for criminal gangs. While their resources might not be as extreme as the probable Stuxnet creators, they will be very large (and might even gain state actor support from unfriendly countries).
The Stuxnet worm was created by the US government likely with hundreds of people working on it for half a decade or more, not some random hacker group.
There are ways to protect self cars, giving them a command to drive somewhere isn’t inherently dangerous. The commands to send them to a destination will not be able to control HOW the car gets there, that will all be done locally on the vehicle self-driving software. It won’t be possible to tell the car “go drive into this building” since the driving software simply won’t allow for such a request remotely.
The most impactful thing that hackers could do is tell all the vehicles to pull over and stop where they are, which would cause problems of course, but it’s hardly the end of the world. Essentially a form of DDOS attack on cars, but it would be detected almost instantly and likely the vehicles with occupants could just override it locally.
What exactly is a hacker group going to do with a fleet of cars that can certainly still be located by the corporation that owns them since they’re literally connected to cellphone (and probably satellite these days) networks all the time. There’s not that much value for a hacker in obtaining a self-driving car that can’t drive by itself because it’s not connected to it’s network. The resale value for the fancy sensors and chips inside them is pretty much zero.
Again if people want unattended cars they can do this a lot easier than hacking a massive corporation to get access to them.
chonglibloodsport@lemmy.world 1 week ago
Most security workers at companies overestimate hackers abilities. That’s why all these companies are hacked all the time and there are tons and tons of data breaches.
The thing very few people understand about hackers is that they can code and they share their hacks as tools with each other on the black market. This means you’re essentially up against the combined effort of all hackers on the black market. When one succeeds, they all succeed. When one piece of server software is hacked, all companies who use that software get hacked.
BlameThePeacock@lemmy.ca 1 week ago
There’s a difference between grabbing data, and controlling physical systems.
Hackers are not regularly taking over power plants or shutting down manufacturing robots.
chonglibloodsport@lemmy.world 1 week ago
They are taking over Internet accounts though. They hack people’s social media profiles, Netflix accounts, Amazon accounts etc. They also take down websites via DDoS attacks.
Here’s the thing with fleets of self-driving rental cars: unlike power plants or manufacturing robots, these cars will be on the public Internet. They cannot be airgapped on a private LAN the way a fixed robot in a factory can.
So all it takes to control these things is to hack into the authentication system and steal the credentials for the master control account for the cars. Then they’ll be able to connect to the cara remotely and issue commands to control them, just as the company would for say, ordering them to return to base to recharge, get cleaned up, or be repaired.
That’s the vulnerability. And even if they put all the cars on a VPN it’ll still exist because hackers can and do steal VPN credentials just like any other credential.
By the way, there has been at least one high profile hack of manufacturing robots: the Stuxnet worm which targeted Iran’s nuclear program. Since a fleet of self-driving cars is going to have millions and millions of dollars in value (tens of thousands of cars on the road) it’s going to be an extremely high value target for criminal gangs. While their resources might not be as extreme as the probable Stuxnet creators, they will be very large (and might even gain state actor support from unfriendly countries).
BlameThePeacock@lemmy.ca 1 week ago
The Stuxnet worm was created by the US government likely with hundreds of people working on it for half a decade or more, not some random hacker group.
There are ways to protect self cars, giving them a command to drive somewhere isn’t inherently dangerous. The commands to send them to a destination will not be able to control HOW the car gets there, that will all be done locally on the vehicle self-driving software. It won’t be possible to tell the car “go drive into this building” since the driving software simply won’t allow for such a request remotely.
The most impactful thing that hackers could do is tell all the vehicles to pull over and stop where they are, which would cause problems of course, but it’s hardly the end of the world. Essentially a form of DDOS attack on cars, but it would be detected almost instantly and likely the vehicles with occupants could just override it locally.
What exactly is a hacker group going to do with a fleet of cars that can certainly still be located by the corporation that owns them since they’re literally connected to cellphone (and probably satellite these days) networks all the time. There’s not that much value for a hacker in obtaining a self-driving car that can’t drive by itself because it’s not connected to it’s network. The resale value for the fancy sensors and chips inside them is pretty much zero.
Again if people want unattended cars they can do this a lot easier than hacking a massive corporation to get access to them.