Security quotes of the week [LWN.net]

“I can take echoes of a fake car and put them at any location I want,” says Jonathan Petit, Principal Scientist at Security Innovation, a software security company. “And I can do the same with a pedestrian or a wall.”

Using such a system, attackers could trick a self-driving car into thinking something is directly ahead of it, thus forcing it to slow down. Or they could overwhelm it with so many spurious signals that the car would not move at all for fear of hitting phantom obstacles.

— Mark Harris in IEEE Spectrum

All three backdoors introduced significant problems. TSA locks can be opened by anyone despite their promise of security, the CALEA interface has been used for nation-state spying, and the biggest potential victim of the Dual_EC backdoor is probably the US government.

We have a difficult enough time building secure systems without backdoors, and the presence of a backdoor must necessarily weaken the security of the system still further. With the dreadful history of backdoors, its little wonder most security professionals believe building backdoors right is practically impossible.

— Nicholas Weaver in "A Tale of Three Backdoors"

to post comments

Security quotes of the week

Posted Sep 11, 2015 20:21 UTC (Fri) by raven667 (subscriber, #5198) [Link] (6 responses)

> the car would not move at all for fear of hitting phantom obstacles.

Isn't that effectively fail-safe? I'm not seeing the problem with the car stopping and turning over manual control if it sees potential dangers that it can't safely dismiss. It's an inconvenience, not a security vulnerability.

Security quotes of the week

Posted Sep 11, 2015 20:45 UTC (Fri) by PaXTeam (guest, #24616) [Link] (4 responses)

> It's an inconvenience, not a security vulnerability.

...unless the car happens to stop on the tracks or in the middle of an intersection...

Security quotes of the week

Posted Sep 11, 2015 21:17 UTC (Fri) by raven667 (subscriber, #5198) [Link] (3 responses)

So what if it does, a car can stop anywhere on the road any time for any reason, even with manual drive cards people will choose to stop whenever they see an unsafe situation, or have mechanical failure, other drivers around them are expected to adjust and themselves stop or go around, that doesn't change with the introduction of self-driving cars. If the car stops in a place that is itself unsafe to be, your train track example, then the rider needs to either take manual control and drive off, push the car out of the unsafe place or abandon the car, which is really the same options you have today if your car died on a railroad track or other unsafe location.

We live in an imperfect world, we can and will deal with the failures, i'm not losing any sleep over this "vulnerability"

Security quotes of the week

Posted Sep 11, 2015 22:39 UTC (Fri) by PaXTeam (guest, #24616) [Link] (2 responses)

the difference between 'can stop' and 'can be made to stop' is analogous to what distinguishes random crashes from successful exploits.

Security quotes of the week

Posted Sep 12, 2015 1:40 UTC (Sat) by dlang (guest, #313) [Link] (1 responses)

In this case the car is made to stop by making it think there are things in it's way.

start throwing beachballs around and you will see a lot of people stopping

put something more substantial out there (including people) and the cars will remain stopped.

so you can stop traffic today, and even trick people into making panic stops.

If you are throwing lasers around, instead of targeting the self-driving car's sensor, target the manned car's drivers's eyes and you will have at least as bad a result.

Security quotes of the week

Posted Sep 12, 2015 8:34 UTC (Sat) by PaXTeam (guest, #24616) [Link]

a physical beach ball is very different from a projected one. i bet 1. you can't create any, 2. make people stop by them. the whole point of the thought exercise is that humans are able to make intelligent decisions (ok, with exceptions, such as you keep demonstrating it time and again :) while machines are not. today it's tricking them into stopping at arbitrary places and times, tomorrow it'll be tricking them into sudden evasive maneuvers 'to save a life' (and potentially kill others as a result).

Security quotes of the week

Posted Sep 12, 2015 22:41 UTC (Sat) by barryascott (subscriber, #80640) [Link]

If i can force your car to stop it makes it easier to rob you or worse crimes.

Barry

Security quotes of the week

Posted Sep 15, 2015 10:24 UTC (Tue) by jezuch (subscriber, #52988) [Link]

> Or they could overwhelm it with so many spurious signals that the car would not move at all for fear of hitting phantom obstacles.

Or, possibly, make some real obstacles "disappear"? Like, making the car believe that there is a highway with no speed limit going through a wall?