Speaker 1: Get in touch with technology with tex Stuff from dot com.
Speaker 1: Hey there, and welcome to tech Stuff. I'm Jonathan Strickland
Speaker 1: and joining me once again despite his incredibly busy schedule.
Speaker 1: Possibly the busiest man at how stuff works dot Com
Speaker 1: Ben Bowling, Oh gosh, hey, thank you for having me back,
Speaker 1: and uh good to talk to everyone here in tech Stuff.
Speaker 1: I do have to say I am, at best the
Speaker 1: second or third busiest man. Uh. The dubious privilege of
Speaker 1: the most busy probably goes to our super producer Noel
Speaker 1: Brown Knowles Knowles pretty darn busy. Matt Frederick also really busy.
Speaker 1: That's true. There's probably maybe five or six people that
Speaker 1: you could all claim are the most busy person at
Speaker 1: health stuff Works, and they would themselves be too exhausted
Speaker 1: to argue the point. But Ben, of course, one of
Speaker 1: the many shows that you are of is car Stuff.
Speaker 1: And when I asked you if you would be interested
Speaker 1: to come back onto tech stuff, and you didn't have
Speaker 1: the heart to tell me. No, I said what would
Speaker 1: you like to talk about? And you came up with
Speaker 1: a ton of different suggestions, which really just means that
Speaker 1: you're eventually going to cover all of them. But today
Speaker 1: we're specifically looking at one of the ones I thought
Speaker 1: was the most interesting, hacking a car. And the reason
Speaker 1: why I think it's really fitting that we do this
Speaker 1: is recently I did an episode with Shannon Morse and
Speaker 1: she is one of the hosts of Hack five, and
Speaker 1: she talks a lot about hacking and coding, including hacking
Speaker 1: electronics and and she said, one of the things you
Speaker 1: really wanted to get more into was the idea of
Speaker 1: hacking vehicles and uh. And so I thought, well, this
Speaker 1: is the perfect opportunity for us to expand on this
Speaker 1: because we introduced it with Shannon's interview, and now we
Speaker 1: can really dive into it and look into it. Now.
Speaker 1: The fact that we're talking about this means that we
Speaker 1: have to you confronts some kind of mythical versions of
Speaker 1: the car hacking lifestyle, because we we've all seen depictions
Speaker 1: of this in various like spy movies or television series.
Speaker 1: So Ben, uh, I know that we've got these great
Speaker 1: notes written down. I want to hear you actually read
Speaker 1: out the opening paragraph, all right, in your most dramatic
Speaker 1: kind of approach. Okay, the old inner world, Yes, okay,
Speaker 1: all right. Now, to be fair, Jonathan I when I
Speaker 1: was writing that, it hit me halfway through that I
Speaker 1: wondered who would which of us would this would fall to? Okay,
Speaker 1: so let's set the scene. Imagine that you're in an
Speaker 1: action film driving on a curving road along the side
Speaker 1: of a cliff, and suddenly the breaks don't work, the
Speaker 1: accelerator jams, and as you careem over the side of
Speaker 1: the road, a voice comes on over your radio saying
Speaker 1: you've made a powerful enemy, old friend. The familiar voice
Speaker 1: over your Bluetooth connection is no doubt making a pun.
Speaker 1: Just as your vehicle, now turned into a jet trap,
Speaker 1: hurdles into the abyss. This being a film, the car
Speaker 1: instantly explodes. I have a nice trip. That's not quite right,
Speaker 1: but you know that's I'm the master of the almost
Speaker 1: but not quite appropriate pun. Um. So yeah, this is
Speaker 1: this is something that I have actually seen in movies where,
Speaker 1: you know, the old version of this would just be
Speaker 1: someone's cut the brake line right. But now cars are
Speaker 1: way more complicated than they used to be, and so
Speaker 1: the question is could this actually happen? Could someone take
Speaker 1: control of your car this way? And it's a little complicated,
Speaker 1: and the answer kind of comes out to maybe, Yeah,
Speaker 1: what do you mean by hacking? Yeah, yeah, So you've
Speaker 1: got a great point in the notes. Cars are increasingly computerized.
Speaker 1: There are more and more electronic systems within cars today.
Speaker 1: So they used to be purely mechanical, right. You had
Speaker 1: an engine that you know, a transmission that would transmit
Speaker 1: the the reciprocal power of the engine into rotational force.
Speaker 1: But the tires, you had breakes, you had steering. It
Speaker 1: wasn't even power steering back in the day. These were
Speaker 1: all mechanical systems right down to the windows. Yeah, so
Speaker 1: you didn't have any sort of electronics. But that's not
Speaker 1: the case anymore. Yeah, those are Now a car is
Speaker 1: more like a series of interconnected digital networks and and
Speaker 1: they could have dozens of computers talking to each other,
Speaker 1: or we call these embedded systems often. And here's the thing, Jonathan,
Speaker 1: their proprietary. So that means that these systems are not
Speaker 1: just plug and play things you could stick into any car,
Speaker 1: a GM car and you know, a Toyota would have
Speaker 1: a different approach. Um, they're also not that smart. Yeah,
Speaker 1: as it turns out, the proprietary thing is both a
Speaker 1: good thing and a bad thing. Now often I say
Speaker 1: I don't like the proprietary approach because I want to
Speaker 1: have the choice as a consumer to be able to
Speaker 1: put together a system. However, I like, I don't want
Speaker 1: to be I don't want to be um, you know,
Speaker 1: beholden to one company's approach, which is why I love
Speaker 1: Apple's design. Don't get me wrong, but I'm not an
Speaker 1: Apple guy because Apple products tend to only work with
Speaker 1: other Apple products, or they they in their best implementation,
Speaker 1: they work with Apple products. And if you try and
Speaker 1: mix and match stuff, things start to fall apart pretty quickly,
Speaker 1: and I like to have more of an open approach. However,
Speaker 1: that being said, the experience I might have with that
Speaker 1: open approach may never get to as good a one
Speaker 1: as I would have if I just broke down and
Speaker 1: bought all the Apple stuff. But the other side of
Speaker 1: that is that with the proprietary approach, and we'll go
Speaker 1: into this more later in the pie cast, uh, it
Speaker 1: means that if you're trying to exploit the system, you
Speaker 1: can't take a one one approach, right. One size does
Speaker 1: not fit all, not a cookie cutter type thing, absolutely, uh,
Speaker 1: and it's not. I guess what we're seeing is that
Speaker 1: it's not as easy to you know hack uh multiple
Speaker 1: cars or control of multiple cars. That will see a
Speaker 1: couple exceptions that rule as it is to you know,
Speaker 1: bot net a bunch of computers right right. You can't.
Speaker 1: You can't build a virus that's going to affect the
Speaker 1: entire fleet of cars out there. But you could write
Speaker 1: a virus that exploits a particular vulnerability and an operating system,
Speaker 1: and then any computer using that unpatched version of the
Speaker 1: operating system would become vulnerable to that attack. So it
Speaker 1: is a little different. It's not the same as uh,
Speaker 1: hacking a computer. And keep in mind, hacking a computer
Speaker 1: is not the same as what you'll see in a movie,
Speaker 1: isn't it. It's not like it's not like that nineties
Speaker 1: film Hackers. We can't just reroute the encryption or or
Speaker 1: the or all all the different versions of hacking where
Speaker 1: they show it as a character like suddenly you're an
Speaker 1: avatar navigating through a maze and you actually encounter like
Speaker 1: floating skull and crossbones and oh no, that's the that's
Speaker 1: the firewall. I need to turn around, And that's not
Speaker 1: what hacking is like. It made so many people's first
Speaker 1: computer experience underwhelming. I've got oh, I've got something. This
Speaker 1: a little bit of a sidebar. Do you know that
Speaker 1: show The Strain? Yes, okay, have you watched it? I haven't.
Speaker 1: It's on my list of things to watch, but I
Speaker 1: haven't watched it yet. All Right, this is the one
Speaker 1: with the virus that goes through the eye, right yeah, yeah, yeah,
Speaker 1: it's a it's sort of a paradipe. Yeah, adaptation to
Speaker 1: parasites science. But this is not really a spoiler because
Speaker 1: it's a side note here one of and I mean
Speaker 1: I say this with love because I've watched the show.
Speaker 1: One of the dumbest things that happens and that show
Speaker 1: is that there's a you know, there's a hacker lady character,
Speaker 1: and she's she's crazy in this This billionaire finds her
Speaker 1: and he wants to pay her an exorbitant amount of
Speaker 1: money to get this slow down the internet. It's like
Speaker 1: she's he says, we need you to slow down the internet,
Speaker 1: and she just goes how slow, Like she has the
Speaker 1: dial to the Internet on her a computer, like, well,
Speaker 1: let me just crank this down to three and now
Speaker 1: now everyone's working on a three speed as opposed to eleven.
Speaker 1: It's exactly that and that doesn't even work in a car,
Speaker 1: just for some perspective for people who want to know
Speaker 1: more examples, You've got a pretty good, pretty comprehensive list
Speaker 1: here of the various different things likely run by a
Speaker 1: computer in the average person's car today. Yeah, you've got
Speaker 1: a lot of different systems that are now electronic and
Speaker 1: no longer mechanical. So here's just some that could be
Speaker 1: connected to a microprocessor. Uh, the engine ignition, fuel injection,
Speaker 1: missions controls, that's a big one, breaking steering, transmission controls,
Speaker 1: collision avoidance systems, they definitely have microprocessors. Heating and air
Speaker 1: conditioning systems, navigation systems, communication systems, entertainment systems, safety and
Speaker 1: security systems. So that would include things like a safety
Speaker 1: system might be anything from again, collision avoidance, that kind
Speaker 1: of thing too. And security systems would be things like
Speaker 1: a car alarm or the safety system might be the
Speaker 1: way a dealership is able to track down a vehicle.
Speaker 1: Let's say that you have reported as stolen vehicle. Some dealerships,
Speaker 1: some car companies include systems that allow wherever you bought
Speaker 1: the car from to be able to find where that
Speaker 1: particular receiver is. Well, that receiver has to be able
Speaker 1: to connect and communicate through a system somehow, So that's
Speaker 1: you know, any time you talk about a system that
Speaker 1: communicates to the outside world, that's a potential invasion vector.
Speaker 1: That's where someone can get at your your car. Because
Speaker 1: a lot of car, like a lot of cars, we
Speaker 1: just look at them as closed systems, and a lot
Speaker 1: of them are. A lot of them are totally closed off,
Speaker 1: which means that your your invasion h vectors are limited.
Speaker 1: And we'll talk more about that in a bit, but
Speaker 1: at any rate, your typical car today has probably around
Speaker 1: one hundred micro processors, and it maybe more, and within
Speaker 1: the next few years that's going to double. We're gonna
Speaker 1: see twice. In fact, I am I imagine a lot
Speaker 1: of the cars that are coming out this year, especially
Speaker 1: the high end luxury cars that tend to feature these systems,
Speaker 1: before we see it rolled out to the general fleet,
Speaker 1: they probably already are around two hundred microprocessors. Uh. In fact,
Speaker 1: this this figure of a hundred microprocessors was in an
Speaker 1: article from two thousand eleven, So it may even be
Speaker 1: that your average car has two hundred by now, um
Speaker 1: and and five miles of wiring to connect all those
Speaker 1: systems are in the car. Yeah, that's one of my
Speaker 1: favorite statistics that you're pulled up and and before we
Speaker 1: go aiming further, now we we already i think did
Speaker 1: an okay job of saying that, uh, what you've see
Speaker 1: in hollywood's on what you've see in real life. But
Speaker 1: we should also say that hacking in the way that
Speaker 1: we're using it, which is a little bit more colloquial,
Speaker 1: hacking is not necessarily something that a fee would do
Speaker 1: to your car. Right. It's not necessarily an invasive technique
Speaker 1: to take over a system. Right. Hacking just means that
Speaker 1: you are using techniques to get a specific result, using
Speaker 1: a system that wasn't necessarily intended to get that result.
Speaker 1: So hackers can be of all shapes and sizes. They
Speaker 1: can have all different types of interest. It doesn't have
Speaker 1: to be a computer. You know, we've seen life hacks,
Speaker 1: this idea of you want to achieve a specific outcome,
Speaker 1: here's a cool way to do that. They're not always
Speaker 1: the most elegant approach. It's not always the cleanest or
Speaker 1: the simplest, but sometimes it's it's one that just works.
Speaker 1: That's the goal of the hacker is to find a
Speaker 1: way of making that outcome happen. So early computer programmers
Speaker 1: were called hackers because they were hacking together code to
Speaker 1: make something happen. And sure they might have used, you know,
Speaker 1: twice as many lines of code then we're what was
Speaker 1: strictly necessary, but they were just trying to get it
Speaker 1: done in the time. Well, hackers with cars might be
Speaker 1: hacking their own vehicles. It might not be in order
Speaker 1: to try and sabotage a vehicle, but rather to change
Speaker 1: the parameters that it can work within. So you might
Speaker 1: want to, I don't know, make remove any limiting factors
Speaker 1: and yeah, governors, things like that to to make your
Speaker 1: car um work with greater horsepower or more torque or
Speaker 1: moving a faster top speed. And there are a lot
Speaker 1: of systems that are in place to limit that kind
Speaker 1: of thing so that a car works within safety parameters, right,
Speaker 1: because once you get beyond that, you start to really
Speaker 1: test the strength of the vehicle and maybe that it
Speaker 1: can't hold up to greater speeds over a certain amount.
Speaker 1: And usually once you'll get as a car company that
Speaker 1: will dial that back to within a safe limit and
Speaker 1: say all right, well here's the maximum and it's well
Speaker 1: below that that real top limit, which same sort of
Speaker 1: thing we see with overclocking with microprocessors. So there are
Speaker 1: some car hackers who will go in and they'll reef
Speaker 1: flash the engine engine control unit or electronic control unit
Speaker 1: that's e c U, and they'll go in and they'll
Speaker 1: reflash it, which means that they will essentially start with
Speaker 1: a clean slate and and um change a few of
Speaker 1: the parameters can be really dangerous. By the way, Yeah,
Speaker 1: we're not we are officially not recommending that you do this,
Speaker 1: although it is interesting. Um and in some ways, I
Speaker 1: think there's a very positive note. Statistically speaking, the person
Speaker 1: most likely to hack your car is you. Yeah, that's
Speaker 1: the best news. But it can be really dangerous or
Speaker 1: at the very least, it can damage your vehicle to
Speaker 1: the point where you can't drive it anymore. Or you
Speaker 1: might do something where you're you're tweaking something in the
Speaker 1: e CU, thinking that you're going to squeeze another fifteen
Speaker 1: miles per hour out of the top speed, but turns
Speaker 1: out instead what you've done is have it honking forever
Speaker 1: and you can't stop it. Uh. And you know this
Speaker 1: sort of stuff obvious avoids, warranties. You know there are
Speaker 1: a lot of issues that if if things go wrong,
Speaker 1: you could be stuck with the bill period. There might
Speaker 1: not be any help for you. You might not be
Speaker 1: able to get it covered by insurance or warranties, that
Speaker 1: kind of thing, and you'll have to walk somewhere to pay. Yeah. Yeah,
Speaker 1: So I've seen pictures of stuff like um uh, like
Speaker 1: the the pistons that you would find within an engine,
Speaker 1: just they're unrecognizable because they had been put through such
Speaker 1: speed and force that it beat them out of the
Speaker 1: shape that they were supposed to be in. So bad
Speaker 1: things can happen if you don't know what you're doing,
Speaker 1: and very few people really know what they're doing, and
Speaker 1: in order to get into work you often have to
Speaker 1: do stuff like tweak the fuel injection system, which you know,
Speaker 1: if you don't know your physics and chemistry, you're not
Speaker 1: going to get that mixed right and you could just
Speaker 1: end up making your vehicle undrivable. And there are people,
Speaker 1: of course, especially in the world of racing, who professionally
Speaker 1: tune cars and to a degree hack them. Sure, but
Speaker 1: keep in mind these are cars that are already built
Speaker 1: for racing. They have a much lower lifespan and they're
Speaker 1: only built to do one thing. Yeah, and you know,
Speaker 1: the real issue we're having here is something that's kind
Speaker 1: of you know, we didn't really mention this in the notes,
Speaker 1: but something that we see throughout the industry, which is
Speaker 1: that cars are getting so complicated with all these different
Speaker 1: electronic systems that even people who are experienced mechanics can
Speaker 1: encounter issues because you've got all these different proprietary systems,
Speaker 1: you've got all these different electronic subsystems within the car,
Speaker 1: and uh, you can't necessarily be an expert on everything
Speaker 1: all the time. So yeah, it's it's tough for everybody
Speaker 1: out there, like it's tough for professional mechanics now too. Yeah,
Speaker 1: that's a really good point. I'm glad you made it
Speaker 1: because this maybe is a little bit of a tangent
Speaker 1: for us. But it is very important to note that,
Speaker 1: just as you said, mechanics, especially mechanics who came up
Speaker 1: under what I guess we would call the old school,
Speaker 1: would ways now are increasingly finding that a higher number
Speaker 1: of repairs require shipping to the manufacturer, which is not
Speaker 1: what you want to hear when your car is broken down. Yeah,
Speaker 1: if you're looking at any vehicle post nineteen. It's got
Speaker 1: a lot of electronic systems in it, that's true, and
Speaker 1: some of those are mandated, right. Yeah. In fact, that
Speaker 1: was one of the reasons why the cars are the
Speaker 1: way they are is because you had states like California
Speaker 1: that had to put in emissions controls. I mean, we've
Speaker 1: all seen the pictures of Los Angeles and the haze,
Speaker 1: the pollution that hangs above the city, and so there
Speaker 1: were there was a lot of incentive to try and
Speaker 1: clean up the air as much as possible. Part of
Speaker 1: that was controlling the emissions made from vehicles. So emission
Speaker 1: control systems and emission detection systems became an important part
Speaker 1: of vehicles within that state, and once people started to
Speaker 1: develop onboard diagnostics systems to make sure that a car
Speaker 1: was working within the right legal limits of emissions, that
Speaker 1: rolled out to the rest of the United States and
Speaker 1: became a requirement for all vehicles. And so a lot
Speaker 1: of these were originally electronic systems that were designed to
Speaker 1: make a particular model of car safer than previous models,
Speaker 1: but because of their proved efficacy, they are now required
Speaker 1: in all vehicles, not just you know, the ones that
Speaker 1: they viewed it. So, uh, Scott and I talked about
Speaker 1: how that is also driving the average price of cars up. Yeah. Yeah,
Speaker 1: but they those those cars are getting more and more sophisticated,
Speaker 1: they also get more and more expensive. But it also
Speaker 1: means that, again, we have more and more systems that
Speaker 1: could potentially be exploited. And by potentially we mean that
Speaker 1: your car could be potentially exploited. By exploited, we mean
Speaker 1: that there is proven research, peer reviewed. These guys went
Speaker 1: to def Con. They're not just they're not just you know,
Speaker 1: like you and mean Jonathan hanging out in a garage
Speaker 1: and saying let's see what we can do. Yeah, they're
Speaker 1: not They're not feorizing, right, They have actually done some
Speaker 1: hacking to see how cars can be vulnerable to different
Speaker 1: types of attacks. And you've got a pair of hackers
Speaker 1: that that I think you want to talk about, right,
Speaker 1: Oh yeah, yeah yeah. These would be Miller and Valisc
Speaker 1: There two of the biggest names in the world of
Speaker 1: car hacking research. Charlie Miller Chris Valisac. I want to
Speaker 1: set this up for a quotation that maybe you could read,
Speaker 1: um Miller is a or was at one time a
Speaker 1: security engineer. Twitter valisc director of Security intelligence at a
Speaker 1: Seattle consultancy called IOActive or IOActive, but they they received
Speaker 1: an eighty thousand dollar grant from DARPA to research security
Speaker 1: vulnerabilities of cars. And I think in this context it's
Speaker 1: helpful to think of them as white hat hackers. Yeah,
Speaker 1: they were specifically hired to say, can you can you
Speaker 1: breach this cars systems and exploit it? Because we need
Speaker 1: to know if that's a possibility, and we need to
Speaker 1: know where the vulnerabilities are. That's definitely a white hat approach. Yes,
Speaker 1: So we've got We've got a quotation from a summary
Speaker 1: of their um groundbreaking two thousand eleven paper that if
Speaker 1: absolutely here we go, I made you do the first one.
Speaker 1: Previous research has shown that it is possible for an
Speaker 1: attacker to get remote code execution on the electronic control
Speaker 1: units ECU in automotive vehicles via various interfaces such as
Speaker 1: the Bluetooth interface and the telematics unit. This paper aims
Speaker 1: to expand on the ideas of what such an attacker
Speaker 1: could do to influence the behavior of the vehicle after
Speaker 1: that type of attack. So here's what they did. I
Speaker 1: know that's in some dry language, but they're talking about
Speaker 1: some frankly frightening stuff. They essentially they built the software
Speaker 1: tools to uh enable a Mac laptop, going back to
Speaker 1: Apple uh and and also back to Independence Day. Yeah, yes,
Speaker 1: you're going to explore way to technology. You need to
Speaker 1: use Apple computer in order to insert the code, right, Yeah,
Speaker 1: just reroute the encryptions. That's a little callback for everybody
Speaker 1: who listen to our previous series. Uh. Yeah. They plugged
Speaker 1: into the diagnostic port of the car, which again, um,
Speaker 1: there's an overwhelming chance, unless you're driving a classic car,
Speaker 1: that you have one of these. Yeah. And and this
Speaker 1: was one of those things that was mandated by law
Speaker 1: because it allows a very quick assessment of how a
Speaker 1: vehicle is performing. Yeah, and they they found because they
Speaker 1: are white hat, they presented their software and their findings.
Speaker 1: They want public and transparent with the two thousand thirteen
Speaker 1: def con, and they wanted other researchers in on this
Speaker 1: game to help find and fix the security flaws before
Speaker 1: hackers or you know, incredibly sophisticated car thieves got to them. Usually,
Speaker 1: like when we talk about malicious hackers, we often use
Speaker 1: the term crackers, as in people who cracked the security
Speaker 1: in order to exploit it. Ah, that's all right, you're
Speaker 1: putting me on the game here. You know, it's just
Speaker 1: one of those one of those terms I rarely bust out.
Speaker 1: But that is in fact one because because hacker does
Speaker 1: not necessarily mean malicious exactly, but it often has portrayed
Speaker 1: such in the media. It's a it's a because it's
Speaker 1: a shorthand way of saying, this person who wants to
Speaker 1: get access to your stuff, this is crucial, this kind
Speaker 1: of information. It's crucial because more and more cars have
Speaker 1: onboard WiFi networks, each of which is to a degree proprietary. Know,
Speaker 1: General Motors has on Star, Toyota's got Safety connect etcetera. Um.
Speaker 1: But of course they are not the only researchers in
Speaker 1: the game, and their methods, which we'll talk about in
Speaker 1: a little bit, are not the only options because if
Speaker 1: you recall earlier, ladies and gentlemen, we talked about an
Speaker 1: exception to the rule of multi car hacking. Yeah, so
Speaker 1: car dealerships. You know, I mentioned the idea of having
Speaker 1: those systems in place you to be able to track
Speaker 1: down a vehicle in case it's been stolen, and this
Speaker 1: is becoming a standard feature in a lot of automobiles.
Speaker 1: These days. In two thousand and ten, Omar Or Ramos Lopez,
Speaker 1: who was a former employee of an Austin card dealership,
Speaker 1: used the vehicle tracking system to get revenge. This is
Speaker 1: where we see a well intentioned system, which is, you know,
Speaker 1: designed to do one thing very well, can sometimes be
Speaker 1: put to misuse by someone who has ulterior motives. Reminds
Speaker 1: me of a lot of discussions I've had about the
Speaker 1: n s A. Your your your intentions may have been pure,
Speaker 1: but you've built a tool that humans use, and humans
Speaker 1: have some pretty base desires occasionally. So the system allowed
Speaker 1: the dealer to send wireless reminders about the linquent payments
Speaker 1: to customers and also allowed this particular ex employee to
Speaker 1: remotely hack the vehicles of nearly one people, which, uh
Speaker 1: the result of the hack was that their car horns
Speaker 1: started honking uncontrollably and disabled their the ignissions of their cars.
Speaker 1: So not only was their car honking and honking and honking,
Speaker 1: they could not you know, turn on the car. Wow.
Speaker 1: And that's that's weird because ordinarily those functions which are
Speaker 1: in that existing hardware are I imagine for people who
Speaker 1: are not paying their car payment or their leasing or something,
Speaker 1: or they have their car stolen, and that way, the
Speaker 1: car suddenly becomes inoperable and it's making a nuisance of itself,
Speaker 1: two things that you want if you have, say, police
Speaker 1: out there looking for your stolen vehicle. Yeah, that's a
Speaker 1: really good point. But Omar managed to hack the system.
Speaker 1: Of course, he did later get arrested ladies and gentlemen,
Speaker 1: which is how he knows his name. Yeah, and clearly
Speaker 1: it was a an ultimately unsuccessful attempt because he didn't
Speaker 1: get away clean. It was not a successful exploit. Now,
Speaker 1: in many of the cases that you'll here mentioned about
Speaker 1: car hacking in the news, there's this very important caveat
Speaker 1: the hackers needed some sort of physical access to the
Speaker 1: vehicle through its o b D the onboard diagnostic port.
Speaker 1: And you know that that makes sense. So Valsake and
Speaker 1: Miller plugging in the thing directly to a car or
Speaker 1: Omar using pre existing hardware on the car, so they
Speaker 1: have that access, and they have to have that to
Speaker 1: get there right well mostly okay, So generally speaking, that
Speaker 1: is the surest way to to be able to get
Speaker 1: access to a car subsystems is being able to plug
Speaker 1: physically into that car, which means they already have to
Speaker 1: have physical access to the inside of your car, and
Speaker 1: not to not to do a spoiler. But there's a
Speaker 1: point I think that you make later in the notes
Speaker 1: that it behooves us to bring up. Now, if you're
Speaker 1: gonna go through that much trouble, there's probably other stuff
Speaker 1: you can do to the person you're aiming at that
Speaker 1: that you know, you can save a lot of time
Speaker 1: and effort and not go to the trouble of getting
Speaker 1: access to their vehicle, plugging in secretly without them knowing
Speaker 1: about it, yes, and being redundant there, then inserting whatever
Speaker 1: malicious code you have and and changing all of their
Speaker 1: systems around and then leaving. That's a lot of that's
Speaker 1: a lot of trouble, whereas you could do something like,
Speaker 1: I don't know, disabled their their brake system, like physically
Speaker 1: disabled their brake system. Yeah, so uh yeah, there's certainly
Speaker 1: the possibility and the plausibility are two different things. But
Speaker 1: then the idea of getting at a car without physically
Speaker 1: plugging in is something that people are exploring because, as
Speaker 1: you mentioned, a lot of these have these these various
Speaker 1: communication systems that connect to the outside world. That's a
Speaker 1: possible point of intrusion. Now, it all depends on whether
Speaker 1: or not that system is connected to any other systems
Speaker 1: in the car. Now, if you're talking about safety system,
Speaker 1: it probably is at least on a diagnostic level, because
Speaker 1: it has to be able to send an alert to
Speaker 1: whatever agency is in charge of responding to those Right, So,
Speaker 1: if you have a vehicle has a safety system in
Speaker 1: it that can detect something wrong with your vehicle, send
Speaker 1: that message off to a security firm whatever it may be,
Speaker 1: like on Star is a great example. And then on
Speaker 1: Star response, Well, that that that connection, that wireless communication
Speaker 1: is a possible point of intrusion, and since it can
Speaker 1: at least diagnose problems and systems, it may give people
Speaker 1: the opportunity to mess with those systems. But this is
Speaker 1: a big there's a lot of big ifs. These are
Speaker 1: a lot of big gifts. But the research is there,
Speaker 1: you know. Yeah, So you have the research from the
Speaker 1: University of California and University of Washington hacking the controller
Speaker 1: area network or CAN of an unnamed late model car,
Speaker 1: and they were able to put in malicious commands through
Speaker 1: the cars satellite radio. So I assume they made the
Speaker 1: person listen to Robin Thick or something, right, I guess
Speaker 1: not it's two thousand eleven blurredlines wasn't around yet, but no,
Speaker 1: it was just him just that that's something that no
Speaker 1: one should have to endure except possibly Alan Thick. But yeah,
Speaker 1: So the idea was that they could sneak malicious commands
Speaker 1: and actually it's a satellite radio, WiFi or a CD
Speaker 1: containing the virus, which is interesting. I never would have
Speaker 1: thought that a sound system presumably that's what you're putting
Speaker 1: the CD into, or at least an entertainment system, that
Speaker 1: that would have any kind of access to other important
Speaker 1: systems within the car. But it may very well be
Speaker 1: that it's connected to that same network, and then once
Speaker 1: you have access to the network, you can start to
Speaker 1: try and get access to some of the more critical subsystems,
Speaker 1: things like power steering, which would be you know, catastrophic
Speaker 1: obviously potentially. So yeah. One of the one of the
Speaker 1: professors involved in some of these tests, a guy named
Speaker 1: Stefan Savage Uh, said that these wireless hacks still remain possible.
Speaker 1: Specifically said, the vulnerabilities that we found were the kind
Speaker 1: that existed on PCs in the early to mid nineteen
Speaker 1: hundreds when computers were first getting on the Internet. And uh,
Speaker 1: here's I think the strangest example that I've read so far,
Speaker 1: and maybe maybe readers and maybe you have a different one. Uh,
Speaker 1: what if you could take a car's tire pressure monitoring
Speaker 1: system and use that as a way to monitor the
Speaker 1: movements of a car? To me, that sounds like a
Speaker 1: sci fi writer was running out of ideas and season uh,
Speaker 1: you know six of an anthology show, right, yeah, yeah,
Speaker 1: and they said, let's make this next season six. But
Speaker 1: the researchers from Rutgers University and University South Carolina demonstrated
Speaker 1: in the possibility of this that's pretty incredible and it's
Speaker 1: and they use the wireless seeing signals sent out by
Speaker 1: the pressure monitoring system to to I guess, uh trace
Speaker 1: ping's on. Yeah. Well, let's talk about some of the
Speaker 1: other things that you could do potentially if you were
Speaker 1: able to access a car's computer systems, keeping in mind
Speaker 1: that most of these again are probably due to uh,
Speaker 1: physically connecting with the vehicle and inserting yeah, as opposed
Speaker 1: to you know, it's not like someone whipped out a
Speaker 1: giant remote control and suddenly suddenly they make your car
Speaker 1: feer left. But they could. We've mentioned honking the horn. Uh,
Speaker 1: that's certainly possible. Uh. There was one about the Toyota
Speaker 1: Prius and being able to slam its brakes when the
Speaker 1: car is already traveling at high speed, thus uh, potentially
Speaker 1: leading to a situation where the car gets out of control.
Speaker 1: At the very least, it's going to lead to a
Speaker 1: situation where the car is going to become a hazard
Speaker 1: to anyone who's traveling at that same rate of speed
Speaker 1: behind them. Uh. Then there's the killing the power steering.
Speaker 1: Anyone who's ever driven a vehicle without power steering or
Speaker 1: where the power steering has suddenly become uh inactive, knows
Speaker 1: that that is no Joe. I mean that you really
Speaker 1: don't know how much that power steering helps you until
Speaker 1: you try and drive a vehicle that does not have it.
Speaker 1: Um spoofing the GPS, So this would be a way
Speaker 1: of making a car appear someplace where it's not actually
Speaker 1: used a GPS spoofer for a while. Yeah, Um, I'm
Speaker 1: not proud of it. It was for a really dumb
Speaker 1: reason too. You want to know what it was. Okay,
Speaker 1: So when I say dumb reason, I'm not saying anything like, um,
Speaker 1: like illicit, or or or like salacious. I was using
Speaker 1: a GPS spoofer because I had downloaded an app that
Speaker 1: was a promotional app for a popular science fiction film,
Speaker 1: and part of it would give you achievements for checking
Speaker 1: in at certain physical locations. And some of those physical
Speaker 1: locations because of the particular film I'm talking about, we're
Speaker 1: located in San Francisco. I am not in San Francisco,
Speaker 1: but I wanted those achievements, and so by spoofing my
Speaker 1: GPS I could make it appear as if I were
Speaker 1: in San Francisco at the specific locations, check into those
Speaker 1: locations and get the achievements. It was Star Trek Star Trek, Yeah,
Speaker 1: it was the j J Abrams Star Trek reboot. It
Speaker 1: was actually Star Trek Into Darkness. To be specific. I
Speaker 1: think I finally achieved the rank of captain. My wife
Speaker 1: is an admiral, so that'll tell you. Isn't that against
Speaker 1: Star Trek code. Look, look, if Captain Kirk can cheat
Speaker 1: during the Kobe y Ashi Maru, then I can cheat
Speaker 1: in the check in sport. But anyway, spoofing GPS is
Speaker 1: that's a serious issue because let's say that the GPS
Speaker 1: is tied to again the car monitoring system. If if
Speaker 1: the car appears to be someplace that's not then any
Speaker 1: sort of response physical response sent from say on Star
Speaker 1: again is going to go to the wrong location. So
Speaker 1: that's a real thing. Then there's a falsifying speedometers and odometers.
Speaker 1: I mean it's falsifying an odometer that you can see
Speaker 1: lots of ress. Um. There's violently making the vehicle just
Speaker 1: jerk around not good um. And also they demonstrated that
Speaker 1: they can exploit both of Toyota and Affords self parking
Speaker 1: functions to hijack a vehicle steering, essentially turning it into
Speaker 1: a primitive kind of remote controlled vehicle. And you you
Speaker 1: can sort of see where that would come into play,
Speaker 1: because obviously if you have a parallel parking automated system,
Speaker 1: it has to be able to control the steering and
Speaker 1: breaking of the vehicle in order for that to work.
Speaker 1: So you just give it a new set of instructions. Yeah. Now,
Speaker 1: again this is all stuff that you know, you would
Speaker 1: have to have physical access to the vehicle first before
Speaker 1: you could have introduced these problems. So if you're really
Speaker 1: careful with the way your you know, your vehicle is
Speaker 1: like your your vehicle secure, then you don't need to
Speaker 1: worry about this so much. But yeah, that's that's a
Speaker 1: good point. And before this becomes too uh too scary
Speaker 1: for anybody, let's also keep in mind that when Miller
Speaker 1: and val Sec were demonstrating these things, especially to a
Speaker 1: couple of journalists, one of the guys was literally sitting
Speaker 1: in the car with his laptop plugged in running the code. So, uh,
Speaker 1: I guess if you see someone you don't know in
Speaker 1: the backseat of your co there might be some other
Speaker 1: questions you come up with before you actually get the
Speaker 1: car in motion, right, Yeah, so it's not it's the
Speaker 1: odds of you hopping into your two thousand ten preus
Speaker 1: or escape and then finding that the car is completely
Speaker 1: not under your control are very, very very low. Yeah.
Speaker 1: The the point that these hackers were making was that
Speaker 1: the vulnerabilities existed, and that the vulnerabilities could be addressed
Speaker 1: and sealed up so that it would no longer be
Speaker 1: a point of entry for a hacker. So it was
Speaker 1: you know, they didn't need for the demonstration to be practical,
Speaker 1: They just needed to show that, look, with enough work,
Speaker 1: you can do this, and presumably if you're really determined
Speaker 1: you could create, say a module that plugs into the
Speaker 1: onboard diagnostic system and has a wireless communication with a laptop,
Speaker 1: and then I don't have to be in the back
Speaker 1: seat anymore because I can just send those the communications
Speaker 1: straight through. But not that anyone's developed that, but rather
Speaker 1: that we need to address the vulnerabilities that would make
Speaker 1: such a thing possible. Yeah, exactly, And again just underlining
Speaker 1: that if something is controlled by a computer in your car,
Speaker 1: then another computer can be come involved and and anything
Speaker 1: from your power windows to your breaking that function could
Speaker 1: be hacked. We talked a little bit already about the
Speaker 1: the evolution of the e c U, right. Yeah. The
Speaker 1: whole point about these are these were systems made to
Speaker 1: make either cars safer or to have a smaller environmental impact,
Speaker 1: and that these were things that because they were because
Speaker 1: of their benefits, they ended up being required, you know,
Speaker 1: and you've got some you've got some great notes here
Speaker 1: about the can bus. Ultimately, what what Millar and valis
Speaker 1: act we're doing, is they're analyzing the can bus and
Speaker 1: they're they're using that kind of like their skeleton key
Speaker 1: or their highway. Now you can think of the can
Speaker 1: bus that's sort of its own little maniature network. Uh
Speaker 1: So think of it like, you know, think of the
Speaker 1: Internet in microcosm, except it's all within the context of
Speaker 1: a car. And the can is what pretty much allows
Speaker 1: various uh subsystems to be interconnected, and it can interconnect
Speaker 1: up to forty different systems for the different devices anyway,
Speaker 1: and information travels at about one megabit per second, which is,
Speaker 1: you know, compared to broadband speeds. Well in the United States,
Speaker 1: broadband is defined as four megabits per second, so it's
Speaker 1: really not that far behind, but it's it's uh more
Speaker 1: than sufficient for the kind of data that the vehicle
Speaker 1: tends to work in because it's not you know, it's
Speaker 1: not con scarned with everything. It's concerned with very specific
Speaker 1: systems like fuel injection or spedometer or that sort of stuff.
Speaker 1: So it's definitely sufficient for that kind of thing. But
Speaker 1: that is again, you know, anytime you have a system
Speaker 1: where data is traveling around, then there's the potential of
Speaker 1: exploiting it if you can get that point of entry.
Speaker 1: So when they were defcon they explained this sort of stuff.
Speaker 1: They also said that, uh, part of their process was
Speaker 1: to get these proprietary messages. One of the most base
Speaker 1: ways to think of it is speaking the language of
Speaker 1: the car, right, and so by learning some of those links,
Speaker 1: those phrases uh, in this tortured analogy I painted myself
Speaker 1: into UH, they can replay these on a device that's
Speaker 1: hooked up to the diagnostic connector ports, and then they
Speaker 1: can uh influence the breaking in the steering. And then
Speaker 1: as you said, they can also modify the existing firmware
Speaker 1: so that they can still have this signal interplay without
Speaker 1: having a guy in the back. Um. But to me,
Speaker 1: it's interesting that this is not more of a big
Speaker 1: deal externally with companies. You know, this seems like the
Speaker 1: kind of thing that could easily become alarmist, and I'm
Speaker 1: surprised that there hasn't already been more examination of it.
Speaker 1: I think part of it is that we're still in
Speaker 1: the early days right right now. It's in the hacker culture,
Speaker 1: it's something that's being discussed, and in car culture, where
Speaker 1: you have people who mod and tune their own cards.
Speaker 1: It's being discussed, but usually from the perspective of how
Speaker 1: can I make my car do something it was not
Speaker 1: meant to do? Yeah, without how can I over clock
Speaker 1: without falling apart right right from the hacker culture, it's
Speaker 1: more about what are the potential vulnerabilities and either how
Speaker 1: can I exploit them or how can I prevent them
Speaker 1: from being exploited companies, I mean, bringing attention to it
Speaker 1: is probably not something that most companies want to do.
Speaker 1: They want to sell cars, but a lot of them
Speaker 1: are definitely responding by saying, this is something we really
Speaker 1: are concerned about. We want to make sure that our
Speaker 1: our cars as as safe as possible. We take it
Speaker 1: very seriously. We want to make sure that it's not
Speaker 1: a trivial task to tap into one of these cars. So, yeah, exactly,
Speaker 1: And the statements of various companies, of course, for its
Speaker 1: is to take it very seriously. In other car companies
Speaker 1: are saying that there is a differentiation that needs to
Speaker 1: be made between hacking a car with physical access versus
Speaker 1: remote hacking, and uh, for many car companies, the focus
Speaker 1: is on preventing that kind of exploitation remotely. Well, yeah,
Speaker 1: because that's the one that is more likely to like,
Speaker 1: if it's a possible, that's the more likely vector because
Speaker 1: it's the one that requires less work on the part
Speaker 1: of the person who's trying to get access to the car.
Speaker 1: You know, if if I find out the only way
Speaker 1: that I'm going to be able to sabotage my enemies
Speaker 1: vehicle is if I get physical access to the inside
Speaker 1: of the vehicle, and then I have to be there
Speaker 1: for a couple of hours while I reflashed the engine
Speaker 1: control unit. That's not really that attractive to me. I mean,
Speaker 1: do you have any enemies that, like I was gonna say,
Speaker 1: I would wing man on that wing, but that would
Speaker 1: take all afternoon. See Ben, what I'm telling you now
Speaker 1: is that I didn't use this approach because I'm much
Speaker 1: more efficient. But at any rate, uh the Yeah, if
Speaker 1: you could get access remotely, then clearly that would be
Speaker 1: a big draw for potential hackers. Now, they also point
Speaker 1: out that it's usually a one on one kind of
Speaker 1: thing that the approaches we've seen so far, with the
Speaker 1: exception of exploiting the dealership system, which you know, again,
Speaker 1: then you have to get access to the dealership system,
Speaker 1: which is which is even more difficult at least presumably
Speaker 1: than an individual vehicle. But because these are one on
Speaker 1: one attacks, you would have to be targeted specifically. Now,
Speaker 1: if you own a really high end luxury vehicle. That
Speaker 1: might happen, right but the likelihood of having a vehicle
Speaker 1: stolen if it's a high end luxury vehicle is already increased.
Speaker 1: Right there. There are multiple there are multiple avenues that
Speaker 1: people will go through in order to get hold of
Speaker 1: that vehicle. Some of them might involve electronic hijacking, some
Speaker 1: of them might involve just getting physical access to the
Speaker 1: car and hot wiring the thing. I mean, it's you know,
Speaker 1: that's that's a risk to take with a high end
Speaker 1: luxury vehicle, and you usually will take uh, you know,
Speaker 1: you'll take steps to prevent that from happening, hopefully, you know,
Speaker 1: like possibly hiring a very large person to stand right
Speaker 1: next to the vehicle and uh and discourage people from
Speaker 1: getting too close. But um, yeah, because we're not getting
Speaker 1: this kind of car communication where the cars are constantly
Speaker 1: part of the larger Internet, then it's it's fairly it's
Speaker 1: fairly safe right now from the remote attacks. As cars
Speaker 1: get more and more Internet capable and Internet connected, then
Speaker 1: you have to sit there and say, all right, well,
Speaker 1: how is the car interacting with the Internet. Can that
Speaker 1: be identified from an external source? If it could be identified,
Speaker 1: can it also be exploited. And that's those are the
Speaker 1: questions that are really going to be important to answer.
Speaker 1: And I suspect we're going to see more and more
Speaker 1: cars get this sort of Internet connection. I mean, we're
Speaker 1: already seeing it with entertainment systems again, right, so you
Speaker 1: have cars that have entertainment systems that do connect either
Speaker 1: to the Internet via satellite or through the cellular network.
Speaker 1: You know, however it may be, um, that's again a
Speaker 1: potential point of entry, assuming that the subsystem is designed
Speaker 1: to communicate with other systems. One way to prevent this
Speaker 1: is to say, all right, well, which systems need to
Speaker 1: talk to each other and which ones totally don't need
Speaker 1: to talk to anything, And let's make sure that those
Speaker 1: are boxed away so that if someone gets access to them,
Speaker 1: the worst you're gonna get is they're making me listen
Speaker 1: to I don't know, modern country. That would drive me crazy. Yeah,
Speaker 1: you know, we could do an entirely different show on
Speaker 1: modern country versus classic country. Yeah, okay, like Hank Williams Sr.
Speaker 1: Brilliant man. But you know, okay, you're right, I'm not
Speaker 1: gonna go down. I have I have some questions for
Speaker 1: you as our resident tech expert UM and to ask
Speaker 1: to set up one of these questions. First, I have
Speaker 1: a have a short little anecdote here. In two thousand
Speaker 1: thirteen is reported by the Guardian, there was a scientist
Speaker 1: named Flavio Garcia, which name, which is a wonderful name.
Speaker 1: I I had first assumed he was a name scientist.
Speaker 1: But he had an academic paper that he had written
Speaker 1: with several colleagues revealing the secret codes used to start
Speaker 1: luxury cars out He's Bentley's and so on. And the
Speaker 1: judge in the case, uh, there was there was a
Speaker 1: suppression case right right, Uh to suppress the paper rights
Speaker 1: some car companies wanted to us, and the judge ultimately
Speaker 1: ruled that it should be suppressed. I think specifically this
Speaker 1: was the parent company of Volkswagen, and the idea here
Speaker 1: was um. The the idea was that the scientists, by
Speaker 1: publishing this paper were endangering you know, hundreds of thousands
Speaker 1: of car owners minimum and and even even if you
Speaker 1: don't consider it a danger immediately, let's say that it
Speaker 1: inspires the companies to do a recall, or that all
Speaker 1: those customers go out to have this system changed. That's
Speaker 1: a real monetary impact. Either to the owners or the
Speaker 1: car companies or both to both most likely and uh
Speaker 1: what they found in the course of the investigation was
Speaker 1: that Garcia's team was deriving these codes but by cracking
Speaker 1: the algorithms there. They used complex mathematical models to check
Speaker 1: the software behind in the code. But here's the thing, man,
Speaker 1: the code, they the process they were using in their
Speaker 1: conclusion and stuff like that, we're in some pieces they
Speaker 1: were available and since two thousand nine. So what my
Speaker 1: question is with this, with this dilemma, and I think
Speaker 1: it is, um, where where would you fall? Like professionally,
Speaker 1: what's the idea here? Is this a case? Where is
Speaker 1: this a case where security trump's transparency or I think so?
Speaker 1: I think my my general philosophy and these matters, and
Speaker 1: this goes to all sorts of all types of white
Speaker 1: hat hacking. My general philosophy is that it is the
Speaker 1: responsible thing to do is to alert whatever governing body,
Speaker 1: whether that's a country, a company, uh, some some specific programmers, whatever,
Speaker 1: whoever is responsible for the hacked system, to let them
Speaker 1: know what the vulnerability is and to say, here is
Speaker 1: how I exploited thatulnerability. You need to address this. I
Speaker 1: think that's the responsible thing to do. It's also fair too,
Speaker 1: I think to say that there is a vulnerability, that
Speaker 1: you found a vulnerability, not to say what the vulnerability
Speaker 1: is necessarily or how you exploited it, but that one
Speaker 1: does exist because then it creates the incentive on the
Speaker 1: part of the the person in charge to actually address
Speaker 1: the problem and fix it. I see, So go straight
Speaker 1: to the source, not to USA Today or something. Yeah,
Speaker 1: I mean, go to the source first, and then give
Speaker 1: the source enough time to sit there and at least
Speaker 1: evaluate what you have said, and then go to the
Speaker 1: press and say, all right, here's the deal. There's there's
Speaker 1: this problem and if it's not addressed, then this is
Speaker 1: what could happen. This is the potential outcome. Uh. And
Speaker 1: that was you know, like the heart bleed bug is
Speaker 1: a great example. You know, this is one of those
Speaker 1: things where when you discover it, you kind of, I think,
Speaker 1: have the responsibility to let people know, hey, there's this problem. Here,
Speaker 1: here's how how exploited it, here's what needs to happen,
Speaker 1: and then reveal it to everybody because the potential impact
Speaker 1: is so great. But you don't actually unveil how step
Speaker 1: by step to exploit the vulnerability that is irresponsible as well,
Speaker 1: and that goes from white hat hacking to black hack
Speaker 1: hacking in my mind. So I've seen this over and
Speaker 1: over again in the in the computer world, where an
Speaker 1: operating system comes out and someone or an operate system
Speaker 1: that's been out forever, someone discovers that there's a vulnerability,
Speaker 1: and generally speaking, what they do is they alert the
Speaker 1: operating system, uh, you know, developer, and then after a
Speaker 1: set amount of time, will say, all right, we found
Speaker 1: a vulnerability. Here's what the vulnerability does. I'm not going
Speaker 1: to tell you how to do it, but here's what
Speaker 1: happens if someone exploits it and this company needs to
Speaker 1: fix it, and that again puts that social pressure on
Speaker 1: the company. Yeah, I see what you're seeing, and I
Speaker 1: think that's I think that's a decent compromise. But between
Speaker 1: the two principles and it sounds pretty ethical. And now
Speaker 1: we go to Now we go to the question that
Speaker 1: might be on everybody's mind. Uh so, wait, guys, Jonathan Ben,
Speaker 1: will my car be hacked? Probably not, that's true. There's
Speaker 1: no silver bullet hack. As we've said, and with the
Speaker 1: exception of that dealer fleet. Um, you know, as you
Speaker 1: as you point out Uh, someone would have to the
Speaker 1: whomever would do this to you would have to have
Speaker 1: a lot of time on their hands, a heck of
Speaker 1: a lot of book smarts, right, and a lot of motivation,
Speaker 1: a lot of They would have to have it out
Speaker 1: for you specific must have done something really awful to
Speaker 1: that person, kill their father and gave up fencing. Let's
Speaker 1: let's just look at the the plots for taking one
Speaker 1: through three. You've done something on those plots against Liam Neeson,
Speaker 1: and he has the reason to hack your car now, right.
Speaker 1: The truth of it is, it's just incredibly inconvenient to
Speaker 1: do so. And if we look at I love that
Speaker 1: you said, taken. But because if you look at all
Speaker 1: the stuff we've said now, for something like this to
Speaker 1: have to happen, honestly, those would be like action movie
Speaker 1: problems that most people, uh hopefully don't have. Yeah, it's
Speaker 1: the same sort of thing like if you if you
Speaker 1: are flying back on Christmas and you have to go
Speaker 1: to Naca Tomi Plaza, you're probably not gonna relive die hard.
Speaker 1: You know, it's just it's it's an action movie thing,
Speaker 1: not a real life thing. But uh, you know, it's
Speaker 1: certainly one of the things that awareness is good because
Speaker 1: we're getting into a more uh you know, the trend
Speaker 1: of of computers and electronic systems getting getting more advanced
Speaker 1: in cars is not going to reverse, it's going to continue,
Speaker 1: it's gonna evolve, and we're getting closer and closer to
Speaker 1: autonomous cars. Clearly, when you get to a system where
Speaker 1: the car itself is taken over, then at least the
Speaker 1: idea of the possibility of hacking becomes more realistic to people.
Speaker 1: Keep in mind, the systems we talked about, they can
Speaker 1: affect a manually controlled car. We're not suggesting that if
Speaker 1: you have your hands on the wheel you can prevent
Speaker 1: this from happening. But I think once you get to
Speaker 1: the point where you no longer have to have your
Speaker 1: hands on the wheel that you're on one of those
Speaker 1: Google cars that can that doesn't even have a wheel,
Speaker 1: the mindset is that, oh, computer is controlling this. Someone
Speaker 1: could get control of the computer. It just seems like
Speaker 1: it's more possible in that model, even though even though
Speaker 1: it may not necessarily be more possible, But as we
Speaker 1: get these cars that communicate more and more with the
Speaker 1: outside world, then clearly that's something for us to keep
Speaker 1: in mind. And uh. It also drives home a point
Speaker 1: that Scott Benjamin and I made in our Autonomous Cars episode.
Speaker 1: We talked about how early implementations all imagine that the
Speaker 1: autonomous car was going to be part of a larger
Speaker 1: autonomous system. Right, You're gonna have the the super Highway
Speaker 1: of the future, and that was going to be the infrastructure,
Speaker 1: and the cars were going to be largely passive and
Speaker 1: receive direction from the outside world. Well, in that world,
Speaker 1: you could definitely imagine a system that takes advantage of
Speaker 1: that and sends conflicting commands to the cars that are
Speaker 1: going down the road. But as we've seen this technology mature,
Speaker 1: it turns out that it's all being self contained in
Speaker 1: the vehicle. It's not dependent upon the environment outside the vehicle,
Speaker 1: which means it's harder to get at that system so
Speaker 1: that we benefit from that. So, um, I think that
Speaker 1: because we didn't go in this world where all the
Speaker 1: cars have to talk to each other, and we discovered no,
Speaker 1: they don't really need to talk to each other. If
Speaker 1: they have the sensors to detect each other, that's enough.
Speaker 1: They don't actually have to have two way communication. Well,
Speaker 1: then you start cutting down on those vectors we were
Speaker 1: talking about. So just the way the technology is matured,
Speaker 1: which I don't think has anything necessarily to do with security,
Speaker 1: benefits us in a security way. I see what you're saying.
Speaker 1: And to be completely candid, we know that we are
Speaker 1: on the course of a very very swift evolution, not revolution,
Speaker 1: because the progress made in automotive science, in uh just
Speaker 1: electronic communication means that the cars children born today drive
Speaker 1: are going to be radically different. They might not be driving. Yeah,
Speaker 1: they That's That's where I'm getting at, man, they may
Speaker 1: just not be driving. Henrik Kristensen over at Georgia Tech
Speaker 1: made the prediction on one of my episodes of forward
Speaker 1: thinking that children born today will never have to drive
Speaker 1: a car because the cars of their generation will all
Speaker 1: be like, at least a car that you you could
Speaker 1: buy a car once they reached the driving age that
Speaker 1: does all the driving for you and uh and it's
Speaker 1: that's one of those things that's going to require a
Speaker 1: lot of changes, not just in technology but in policies.
Speaker 1: Um And there are a lot of important questions that
Speaker 1: you have to answer personally. I think that most technologies
Speaker 1: are going to be able to behave more responsibly than
Speaker 1: people do. But that's because you know, I have a
Speaker 1: lot of faith in the reaction time of a computer
Speaker 1: compared to the reaction time of a human being. I've
Speaker 1: seen I mean, look, I've played those games and those
Speaker 1: computer bots that they cheat. Man, they are cheap. They
Speaker 1: juggle you. It's terrible. But anyway, um, yeah, I mean
Speaker 1: this this is one of those things that I'm glad
Speaker 1: you brought it up. I'm glad that this was a
Speaker 1: discussion we could have because, uh, it's it's certainly an
Speaker 1: area that people are getting more and more interested in,
Speaker 1: and there's so little information that the average person has
Speaker 1: access to, and and we've seen so much in the
Speaker 1: hacking world as far as computers go, that it could
Speaker 1: very quickly escalate into a fear, uncertainty, and doubt. Uh
Speaker 1: you know, chaos, right, Because you look and see the
Speaker 1: kinds of exploits people have made with like credit card systems,
Speaker 1: you think, well, what if we apply that same sort
Speaker 1: of exploit system with a car that the results could
Speaker 1: be devastating. Yeah, there was already a huge stink that
Speaker 1: was raised when we in the United States there's this
Speaker 1: mandate that's going to require every car to have the
Speaker 1: equivalent of a black box like you would see on
Speaker 1: a plane, right, just captures all the data. And there
Speaker 1: was this huge stink raised about it when it hit
Speaker 1: the news. Uh, so much of a huge stink that
Speaker 1: people forgot to do their research and find out that
Speaker 1: the vast majority of US cars have had those very
Speaker 1: number of years. So it's I think you're right, uh,
Speaker 1: if you're in the uncertainty, because we have such a
Speaker 1: dichotomy and when we contemplate the future, it's dystopic or
Speaker 1: it's utopian, you know, utopic, Yeah, yeah, exactly. We we
Speaker 1: tend to see things in the the extreme ends of
Speaker 1: the spectrum, and the truth is we're going to live
Speaker 1: somewhere in the middle and if if we're lucky, it's
Speaker 1: gonna be leaning heavier on the utopia side than the dystopia.
Speaker 1: And if we're not observant and responsive, it'll definitely be
Speaker 1: on the second one to dystopia rather than utopia. But um, yeah,
Speaker 1: I think I think it's good to to just you know,
Speaker 1: keep in mind that there are electronic systems in your car.
Speaker 1: Electronic systems can fail just like any other system. Uh,
Speaker 1: they can be sabotaged with the right amount of um
Speaker 1: of vim and vigor and elbow grease. But it's probably
Speaker 1: it's more likely than not it's never gonna happen to you, like,
Speaker 1: far more likely than not um, at least in the
Speaker 1: current iteration of the wave vehicles work. Uh, You're much
Speaker 1: more likely to encounter something that would be a problem,
Speaker 1: like a driver cutting you off in traffic, which happens
Speaker 1: all the time and could lead to really disastrous results,
Speaker 1: then you ever would be with someone hacking your car. Uh.
Speaker 1: So I'm glad we could talk of out it. Uh.
Speaker 1: It's really an interesting topic. Ben People can find your
Speaker 1: work all over the darn place. With how stuff works.
Speaker 1: You are a host of car stuff. Along with Scott Benjamin,
Speaker 1: you are a host of stuff they don't want you
Speaker 1: to know. Along with Matt Frederick, you are one of
Speaker 1: the many hosts of brain stuff. I am also occasionally
Speaker 1: on brain stuff. Are you doing what the stuff? We're
Speaker 1: both on what the stuff? Uh? I don't even know
Speaker 1: what shows I host anymore, so I have to ask
Speaker 1: you which ones you do? Have I missed any you
Speaker 1: will know? We're I think those are most of the
Speaker 1: food science Oh, food stuff stuff your food stuff? Okay, now,
Speaker 1: folks on got another another final little tangent. If you
Speaker 1: have not watched the How Stuff Works Food Stuff episodes,
Speaker 1: you have got to do that, and you need to
Speaker 1: do them in order because there's the narratives from one
Speaker 1: episode to the next, so it does actually progress. And
Speaker 1: you will also see occasionally other people from How Stuff
Speaker 1: Works pop up. Joe McCormick, who is one of the
Speaker 1: hosts of Forward Thinking podcast and also one of the
Speaker 1: writers for Forward Thinking. He pops up in a recent
Speaker 1: episode and they are informative and they really exercise the
Speaker 1: comedic chops of Mr Ben Boland and Ms Kristen Conger,
Speaker 1: both of whom are brilliant improvisers. So you've got to
Speaker 1: treat yourself and go check out the Food Stuff So
Speaker 1: it's they're fantastic. Wow, that's high. That's high. It's I'm
Speaker 1: buttering you up so that you put me on the show.
Speaker 1: I want to be on an episode, but I'll have
Speaker 1: to come up with whatever the topic will be. But anyway, guys,
Speaker 1: check out those shows. Remember you can get in touch
Speaker 1: with tech stuff. Let's know, any suggestions you might have
Speaker 1: for future episodes. Maybe there's another guest that you want
Speaker 1: to have back. Maybe maybe you're thinking, Hey, we gotta
Speaker 1: have Ben back on the show as soon as possible.
Speaker 1: Let me know. Send me an email. My address is
Speaker 1: tech Stuff at how stuff works dot com, or you
Speaker 1: can drop me a line on Facebook, Twitter, or Tumblr.
Speaker 1: The handle it all three is tech stuff H s W.
Speaker 1: And I'll talk to you again, really soon