While I'm not surprised, it's important that empirical research be done and published. It's needed to bolster calls for regulation. Not that I, for one second, think we'll get any meaningful regulation out of this in most countries.

Our best bet, as always, is to limit our technologies' access to the internet as much as we can tolerate. Cars, doorbells, and refrigerators have no business connecting to the internet at all.

Is anyone actually surprised by this? It's one of those things that any semi-competent programmer could have told you would be the case. The study just formalizes it and adds specifics.

A car is pretty much the last thing you'd want to have a network connection. I'd sooner hook up my refrigerator and let it send analytics data to Frigidaire.

Remotely enabling heating/cooling of my car so it's ready when I get to it is just so god damn nice. This is only possible with internet connection, if it's limited by keyfob range to the vehicle then it may as well not exist.

Some white hat hackers took control of a Jeep Grand Cherokee’s brakes and throttle remotely, like 8 years ago. The only reason to have WiFi or cell service on a vehicle is to let the government kill you lol

Edit: it was ELEVEN years ago

https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

From what I've been reading, not only is this the least of what hackers can do, but it's with any new vehicles. The CIA developed all sorts of hacking tools for cars I hear tell, that were revealed in the snowden leaks, and that was 15 years ago, that they can take control of the gas, brakes, and steering regardless of your controlls in the vehicle.

It's not just academic either, 60 minutes a few years ago got a new vehicle in a parking lot and paid a hacker to take control in a parking lot and he got it to disregard their steering and braking and gas pedal.

There are a couple of suspicious deaths people think are from hacked vehicles causing accidents, Guiffre in Australia is one.

I’m heavily conflicted …. I agree, but I really want to not need to agree. A door bell connected to the internet is extremely useful. Current implementations are a nightmare though.

But if it could be secure, private, and the technology actually served the individual in physical proximity “owner” it would be awesome!

I had a car with its own internet connection for a while, I could check my windows were rolled up from my phone, start it from anywhere, get alerts on fuel levels or oil change intervals…. BUT telemetry was used in evil ways against me.

A connected fridge that didn’t spy on you, show ads, or be designed to fail could be really useful. But we know the “business” behind this makes it consumer hostile.

Heck, my washer and dryer wanted to connect to WiFi and it COULD be useful to get an alert on your phone when it’s done but you’re not in its immediate proximity. But we all know giving this thing internet will be a net loss no matter what.

Smart tvs could be neat in concept, but we all know they’re little corporate spys. Watch out for these, especially Roku is apparently requiring internet connectivity for initial setup. Oh, and this is the company that’s got a patent to identify when an hdmi input is paused so they can inject ads.

I’m sad because technology is so cool and should have served us to make life easier. Instead, it has killed the joy. FOSS is helping revive the passion in technology.

So many things should be possible, but “people” went and ruined it for everyone.

They will make it illegal to remove it from the internet, I think it long has been illegal to remove the onstar and that was a long time ago, but not sure it's been 20 years since I think I learned that after seeing a sopranos episode where they paid someone to remove it from their new car.

They were hacking cars with any kind of computer in them and even able to remotely control some newer models at the time when I was in high school. 20 years down the road, car makers have not done anything to improve security against such hacks, and also have added more computerization.

I mean, yeah? You give anything a connection to a global network with billions of people, and there will always be a chance for it to be exploited. Hell, even my personal OpenVPN instance for remotely accessing my home servers has to fend off attacks.

This is why my next vehicle will be a slate truck. Zero internet connectivity by default, and updates can be done via USB-C from a phone (which can be vetted as needed).

Those are features not bugs. They are bombs on wheels.

If it beep-boops we can hack it

Oh yea, I loved that white paper that came out for that because it gave me what I needed to "jailbreak" my old Jeep's u connect and mod the shit out of it lol

I truly don’t understand why the infotainment systems in vehicles aren’t air-gapped from the systems that run the vehicle.

if it’s a computer, it can be hacked

if it’s connected to the internet, it doubly can be hacked!

There was also an investigative reporter driving a Mercedes who died in an odd accident in SoCal in and around then. It was suspicious, but swept away quickly in the news. I remember believing that he was murdered.

Edit: It was Michael Hastings. He had discredited General McChrystal which resulted in his resignation (The Runaway General). "His last story, "Why Democrats Love to Spy On Americans", was published by BuzzFeed on June 7, 2013." I love how Wikipedia mentions that his body tested positive for marijuana and methamphetamine, but leaves out that the coroner stated that it did not contribute to the crash. And of course the LAPD stating there was no foul play. Case closed!

Internet of Things is a terrible no good idea, but Intranet of Things has some potential. Entirely local mesh networks like Zigbee and Z-wave solve most of your problems, doubly so if you properly confine their controllers into their own non Internet routable subnets.

It's honestly my biggest complaint with the Matter standard, it has Internet bridging baked into the design while the prior standards made that completely optional.

Because the infotainment panel is also used to manage features in the car that need to be controlled by the vehicles main controller, e.g. ESC enable/disable, auto start/stop of the engine, park assist systems etc.

It is not a necessary design element of a car to have a single touchscreen to control the car. It is a willful bad choice.

It is entirely possibly to have a car who's main driving components are air gapped from the windows, ac, radio, locks, etc. It just isn't done for a lot of modern cars.

Parts of Iot are great, but not the whole "smart home sending multiple video and microphone feeds to Amazon/Google/Facebook" thing.

The ability to set up remote sensors on critical infrastructure to give early alerts is a benefit.

I'm not saying it is necessary, I'm just explaining why it is not air gapped.

But if you were to have a physical button for every single thing you can adjust in modern cars, you'd literally need over 100 buttons which is absolutely insanely bad design.

Edit: not to mention that most of these settings can't be clearly identified with small simple pictograms. All in all it would make a confusing and horrible mess of the interior.

This really depends on Keyfob range. My current cars tend to be around 50ft, though i haven't tested it tons past that. Prior to these, I had a Mazda Protégé5 that I could lock/unlock from 300'+ with line of sight. Thats more than enough to start/cool/heat/etc without actually leaving the house.

Honestly, even 50ft is probably fine. Only time I can think of wanting more would be leaving a large venue and wanting it heated/cooled in the parking garage before I got there... but I'd be worried about it being stolen while running at that point.

And it can be done without a cloud connection.

An infotainment screen can be separate from the thing that handles driving without a need to replace everything with physical buttons. It's just a matter of having 2 computers (and thus extra cost) that are not connected. The driving computer can handle things like ECS, ABS, acceleration, braking, locking, unlocking, headlights, turn signals, and of course managing the motor components all while being disconnected from the Internet. The cabin computer can handle everything else and appear to the user the same as it does today. You can even connect the cabin computer to the Internet without risk of dying if you want the ability to remotely heat or cool the cabin or want an auto emergency response call in cases of a crash.

You don't need an individual control for all the things that happen in a car, you just need intelligent, security aware decisions to be made when deciding what is critical for driving or safety and what is just there for comfort.

Uh.. cars existed for decades without needing hundreds of buttons everywhere. Modern cars are still made without Internet connected infotainment systems.

Your argument doesn't hold water.

So many issues with tech can be traced to crappy software where I'm not even sure there should be software to begin with. Vehicle manufacturers come out with many models and trims with different equipment, I don't have a lot of faith their software people can keep up with the complexity and changes of all that, especially when you factor in all their suppliers and the fact they make new/updated models every year.

Laughs in old, primitive, disconnected, paid for car

I'm sure that soon it will be illegal to drive a car that isn't connected.

Yes and for the past few decades the features of cars has exploded giving the driver a lot of options for configuration. Go through the car settings menu on any new car that isn't just the cheapest scraped version, there's dozens upon dozens of options that you can configure. Without a screen (not necessarily touch) to manage this, it would be button-hell where you couldn't find anything.

Where it's the most beneficial is when I can walk around e.g. a mall and the decide to heat/cool the car before leaving, or coming back from a hike I can start cooling 15min before we arrive at the car so it's nice and cool when we get there. If I can only start it 300' feet from the car, I might as well just wait the 30sec it takes to keep walking until I get there, it won't make a difference.

Edit: for EVs it doesn't need to start/enable the entire car, it only starts the AC unit.

My infotainment system doesn't control any features of my car besides the speakers. Everything is either buttons, or is configured via dashboard, but even then that's like 5 options that could definitely be buttons.

I guess you might believe that it's required if your only experience with automobiles is a Tesla.

Doing it yourself is the only practical way to have those nice conveniences and not expose everything to the Internet.

anything connected will be hacked eventually

I mean yeah, thought this was common knowledge by now tbh...

WHAT!!???!!

Only drug dealers and child predators have a need for an untracked car /s

Egads! Evildoers?! On MY Internet??? But how am I supposed to know when my car's seats are filled with too many farts if it doesn't have the potential to send a tweet??

I think a similar thing happened to an investigative journalist in DC

My experience is from VW/Skoda, Hyundai and volvo...the volvo was by far the worst and an absolute button-hell, it has insanely bad interior design.

I 100% prefer managing settings on a screen where I can get a proper detailed layout and logic representation of functional structure.

I first found out about this from Game Theory

It's been ingrained in my head, along with mobile games are designed to addict

So use a different panel/controls for that. I should not be able to start a car from a USB port or Bluetooth EVER, no matter how locked down the system is. Nothing with that sort of connectivity should come anywhere near the engine.

Yes they could do that, they choose not to probably to save cost. I'm just explaining to you why it is that way in cars available, not that it can only be that way.

I seriously need a GrapheneMobile

Remote hacking infotainment stuff is one thing, but if actual vehicle controls aren't air-gapped, someone seriously fucked up. All vehicle controls should be strictly local.

And non connected cars too.

And water is wet.

Hey not fair eleven years ago was like 2005

If it can be physically connected to, oh boy...

I think many vehicles still use the old CAN bus that just wasn't setup with external connectivity in mind. It's well known that even premium brands often reuse all the same components.
I've heard that Tesla were the first to replace this with something closer to a modern network in the cybertruck, of all things.

The only secure computer is the one you're holding the power cord you just yanked out of the back of it, and even then it's only temporarily secure.

They should be, of course- but in more than one case they are not