Path: csiph.com!optima2.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!1.eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!news.dfncis.de!not-for-mail From: =?UTF-8?Q?Hans-Bernhard_Br=c3=b6ker?= Newsgroups: comp.arch.embedded Subject: Re: Semi-OT: Hackers Remotely Kill a Jeep on the Highway Date: Thu, 23 Jul 2015 23:56:00 +0200 Lines: 63 Message-ID: References: <2b477b24-3685-41cb-977f-9832e6803b98@googlegroups.com> <92a1ra5pcdrn5abq9gs88u6kph6qas13u0@4ax.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Trace: news.dfncis.de YWTY+9EwbgFYcdp+NeyiMgNzbe8eFmDGOXrAJVTqy1hVQgL/wU3dKJm4B0 Cancel-Lock: sha1:nzWl7lWNfroflwOXWvMW58s6E5g= User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 In-Reply-To: Xref: csiph.com comp.arch.embedded:21474 Am 23.07.2015 um 22:36 schrieb rickman: > On 7/23/2015 3:38 PM, Hans-Bernhard Bröker wrote: >> There are still some nodes that are so central that it would be hard to >> the point of impossible to isolate their security-sensitive functions >> from their other ones, e.g. the steering wheel group. These days >> buttons and levers on and around the steering wheel (for very good >> reason, too) control a wild mix of systems, only some of which are >> critical (cruise control, driver assistance, control over what gets >> displayed in the combination display, blinkers, wipers, radio, >> telephone, ...). And then there's the airbag sitting in the middle of >> all that. And the meaning of buttons will change based on what the >> multimedia central display currently shows, or what options were ordered >> with the car. Good luck trying to implement security isolation zones in >> _that_! > > So why would there be only one bus to the steering column? Because the electric pass-through mechanism from fixed to rotated assembly is brittle enough with just a few wires. Adding wires makes it worse. > Using one UI for both secure and insecure functions is problematic and > should not be done. That assumes the distinction is just two-fold. So: is the navigation system's next-turn indicator to be secure or not? Or the indication motor temperature gauge? Or the one for outside temperature? How much place would you need in the central behind-the-wheel combination display to be able to reserve a dedicated area (and isolated hardware to control it!) per security level? There's only that much space available... It's really not that simple. Automotive security involves not just data security. Some of it is safety-oriented UI design. E.g. all those user input devices are on and around the steering wheel for a reason: not because their function is safety-critical, but because it's safety-critical that the driver should keep his hands on the wheel, which _is_ safety-critical. And then there's that other unholy beast, called "the market", which flat-out _demands_ that of course it must be possible to navigate the entire 6000-entry MP3 collection while driving, and without taking the hands off the wheel. So now you "have to" put multi-purpose navigation buttons on the wheel, and a free-text display behind it that can show full ID3 tags, or people and magazines will laugh at your "prehistoric" infotainment system. >> And then new legal requirements like "E-Call" practically require to >> break any isolation barriers between established critical systems and >> others like the multimedia/navigation/telephone ones that are by _huge_ >> popular demand about as architecturally open and as connected as a >> desktop PC, and consequently about as security conscious as those. > > Why would any of that have to connect to the secure systems? Because it's the secure systems that diagnose a crash. eCall, in case you missed it, is an upcoming government requirement to implement an Automated Crash Response via cell-phone emergency calls, coupled with GPS and manual interaction. Basically, OnStar by law.