The Internet of criminal things

Posted Sep 24, 2015 14:09 UTC (Thu) by ibukanov (subscriber, #3942)
In reply to: The Internet of criminal things by petur
Parent article: The Internet of criminal things

> The problem with opening the firmware of the car is that security must be maintained.

Open does not imply that anybody can install it. What is essential is that third parties should be able to look at code and verify that the actual binary matches the code. The system can still use technical measures to limit who and what can be installed.

to post comments

The Internet of criminal things

Posted Sep 24, 2015 20:26 UTC (Thu) by marcH (subscriber, #57642) [Link] (33 responses)

Trusted and other secure boots are not incompatible with transparency and open-source; not at all. The GPLv3 would not even have been invented if that were the case.

The Internet of criminal things

Posted Sep 24, 2015 20:53 UTC (Thu) by raven667 (subscriber, #5198) [Link] (1 responses)

I'd go even further and say that Secure/Trusted boots don't need to be incompatible with owner modification. It's certainly easier to not bother with a mechanism for the eventual owner to modify the system, which is why owner modification should be legislatively required, so device makers can't skip out on this requirement. All you really need is local physical presence and maybe tamper evidence (so it's easy to see if the owner or the manufacturer is responsible if the software messes up), which are actually easier problems to solve than authorizing remote updates over the network.

The Internet of criminal things

Posted Sep 24, 2015 21:12 UTC (Thu) by marcH (subscriber, #57642) [Link]

> All you really need is local physical presence and maybe tamper evidence (so it's easy to see if the owner or the manufacturer is responsible if the software messes up), which are actually easier problems to solve than authorizing remote updates over the network.

Well said. Call this a "fuse", make a nice sentence around it with "voided warranty" in it, and that's it: you've made the whole issue simple enough for anyone to fully understand. Even lawmakers.

The Internet of criminal things

Posted Sep 25, 2015 8:48 UTC (Fri) by ibukanov (subscriber, #3942) [Link] (30 responses)

GPL v3 is harming the situation. As driving a tinkered car on a public road may harm others, I see no problems if installing a new firmwire is restricted to certified entities using a technical measure. Yet GPLv3 is not compatible with that as it requires that the user can install *any* modifications. In my ideal world any user should be able to check the code (either herself or with a help of third party) precisely because it affects the safety and any user can install *certified* changes.

The Internet of criminal things

Posted Sep 25, 2015 9:37 UTC (Fri) by dlang (guest, #313) [Link]

sorry to upset your understanding of the world, but GPLv2 or any other software license is not preventing people from driving 'tinkered cars' on the road.

Cars started out built by tinkerers and the "build your own car from scratch/scrap" has never completely vanished, let alone modifying existing vehicles.

Think about how locked down the game consoles are and how people create 'mod chips' that you press into contact with solder pads on the board to override functionality. The same sort of thing has been available for car computers from the earliest days.

ODB-II has actually greatly eased the car tinkerer's work because a lot of parameters can be accessed directly through a standard interface (which costs <$10 and works with cheap/free software on your smartphone/laptop)

Getting access to the source would just mean that the people doing the tinkering wouldn't be working blind and the result would be safer for everyone.

The Internet of criminal things

Posted Sep 25, 2015 17:18 UTC (Fri) by raven667 (subscriber, #5198) [Link]

I don't think that kind of issue calls for a technical solution. The technical controls should be agnostic to policy, the policy should be set by humans with laws enforced through audit and punishment. A person needs to be responsible, the machine is not a person and can't take responsibility. What do you do with working equipment that hard codes a particular policy when the law changes?

The Internet of criminal things

Posted Sep 26, 2015 13:51 UTC (Sat) by zack (subscriber, #7062) [Link] (20 responses)

> GPL v3 is harming the situation. As driving a tinkered car on a public road may harm others, I see no problems if installing a new firmwire is restricted to certified entities using a technical measure. Yet GPLv3 is not compatible with that as it requires that the user can install *any* modifications.

GPLv3 vs "safety" restrictions is a false dichotomy, fueled a lot by anti-FOSS agendas within the automotive sector.

You can have both a license (e.g., GPLv3) that mandates the ability to install modified versions of some software, and regulations that say that a car with a modified, non "certified" software cannot be used to drive on public roads. That is pretty much the situation for hardware modification to cars (you can make some, but others, e.g. to boost car performances, will put your care out of compliance with regulations that are required to actually use the care on public roads). Why should be software modifications any difference?

We should really insist on this similarity, because doing so removes the car manufacturer arguments that they cannot adopt GPLv3 software due to potential liabilities problems.

The Internet of criminal things

Posted Sep 26, 2015 15:03 UTC (Sat) by marcH (subscriber, #57642) [Link] (1 responses)

> Why should be software modifications any difference?

Because software possibilities are infinite, because it's invisible, because massive replication (and copyright infringement when applicable) comes for "free", and probably others I can't think of right now.

I can hardly believe a free software advocate is wondering about differences between hardware and software... Is there a GPL for hardware somewhere?

The Internet of criminal things

Posted Sep 26, 2015 15:34 UTC (Sat) by zack (subscriber, #7062) [Link]

> I can hardly believe a free software advocate is wondering about differences between hardware and software... Is there a GPL for hardware somewhere?

That's a straw-man, right? :-) I'm (obviously, I thought) arguing there is no significant different in this specific context that would warrant a difference in regulatory treatment.

Cheers.

The Internet of criminal things

Posted Sep 26, 2015 15:35 UTC (Sat) by marcH (subscriber, #57642) [Link] (1 responses)

> GPLv3 vs "safety" restrictions is a false dichotomy, fueled a lot by anti-FOSS agendas within the automotive sector.

The GPLv2 is a pure software licence. The GPLv3 is a software+hardware licence. No surprise it's ruffling many more feathers.

As a citizen, I totally agree with the article's position that some systems should be absolutely required by law to be open-source so they become as visible and auditable than hardware is. With a serious and prolonged education effort, I think the rationale for safety and transparency can be understood and rallied to by voters - even the non-technical ones. This VW scandal is a good opportunity to push this agenda.

But if you want to lose it all, ask too much and never back down. I believe that extending this important battle, adding to it a GPLv3-like requirement to run your own modifications, *would* make it much less understandable by the public, dilute it, and like you wrote be met with fierce opposition from some industries. If some car or voting machines want to use the GPLv3 then great, just don't require it by law.

IMHO the difference of opinion and fragmentation between GPLv2 and GPLv3 is doing more harm to FOSS than most anti-FOSS advocates.

The Internet of criminal things

Posted Sep 26, 2015 15:52 UTC (Sat) by zack (subscriber, #7062) [Link]

> I believe that extending this important battle, adding to it a GPLv3-like requirement to run your own modifications, *would* make it much less understandable by the public, dilute it, and like you wrote be met with fierce opposition from some industries. If some car or voting machines want to use the GPLv3 then great, just don't require it by law.

I agree with you that the message about modifiability would be much more difficult to hold in public debates around car-related software transparency issues.

FWIW, I personally wasn't thinking of mandatory regulation that impose GPLv3-like clauses. I would be very happy with "only" mandating any free software license (which, as the article concludes, is probably nowhere near our current reach). But I did chime in on the specific issue of GPLv3 vs car-manufacturers-liability, because I maintain it's an entirely false dichotomy.

> IMHO the difference of opinion and fragmentation between GPLv2 and GPLv3 is doing more harm to FOSS than most anti-FOSS advocates.

That seems largely OT in this discussion, so I pass :)

The Internet of criminal things

Posted Sep 26, 2015 17:19 UTC (Sat) by ibukanov (subscriber, #3942) [Link] (6 responses)

> Why should be software modifications any difference?

Hardware tinkering is localized and hardware bugs are easy to spot after some reasonable amount of testing that can be done by a person. With modern complex software this is just not the case. A small change that is "an obvious improvement" can easily lead to a disaster that can only be spotted after very through testing. So why a user should be able to install any patch and drive on a public road without paying first for such extensive testing?

The Internet of criminal things

Posted Sep 26, 2015 17:40 UTC (Sat) by marcH (subscriber, #57642) [Link]

> So why a user should be able to install any patch and drive on a public road without paying first for such extensive testing?

... as well as thorough code reviews and every usual (and costly) software QA practice.

Software... "what could possibly go wrong?" https://www.ima.umn.edu/~arnold/disasters/ariane.html

And of course when you wrote "install any patch" I assume you meant "download any patch from any random place without even looking at it and then install it".

Anyway it's good software licences don't conflate these two different issues: transparency and certification, so they can be debated and regulated independently. Oh, wait...

The Internet of criminal things

Posted Sep 26, 2015 18:07 UTC (Sat) by zack (subscriber, #7062) [Link] (2 responses)

> So why a user should be able to install any patch and drive on a public road without paying first for such extensive testing?

S/he should not; or at least not necessarily. Public regulation on embedded car software can certainly decide that *any* software change (for the reasons you discussed) require approval before the car is allows to be on the road again. That would not get in the way of the user ability to install modified software on his/her car, as required by licenses such as GPLv3. Simply, by doing so, they accept the risk (or the certainty, depending on what the law says) that the car can no longer --- before some official seal of approval --- be used in the streets.

The Internet of criminal things

Posted Sep 26, 2015 18:28 UTC (Sat) by raven667 (subscriber, #5198) [Link] (1 responses)

As I think about this thread it seems there is some underlying assumption that regulation, audit, policing, government and democracy in general are unable to solve these kinds of problems sufficiently so that we need technical measures enforced by corporations to solve them for us instead. It used to be a joke that closed, proprietary, unmodifiable software is like a car with the hood welded shut, which was meant to be a bad thing, now people are literally advocating for pulling out the welding torches. How odd.

The Internet of criminal things

Posted Sep 26, 2015 21:43 UTC (Sat) by mathstuf (subscriber, #69389) [Link]

People always did complain that those car analogies weren't that useful. I guess now we're seeing why.

It's interesting; I've been thinking about converting my old Jeep to be electric and writing my own control software. Though, I'll be locking it down so only I can update the firmware, so I guess that's OK? ;)

The Internet of criminal things

Posted Sep 26, 2015 18:19 UTC (Sat) by raven667 (subscriber, #5198) [Link] (1 responses)

As was already pointed out in another sub-thread, the ability to modify and the certification for use of public infrastructure are two different things that should be kept separate from a regulatory perspective. Right now the concept already exists of modification that make a car no longer street-legal, why should software be treated any differently than hardware, when the ultimate effect is the same? Also, if I do modify software and it doesn't cause any problems, is there really enough reason for the state to spend resources mandating draconian security systems to prevent modification by the owner. The public interest in my car ends with safety on the public roads and pollution of the public air, beyond that what I do is my business, especially on private property.

I'm strongly for security and systems defending themselves from unauthorized remote modification, but the owner should always technically authorized to modify, even to the point of dropping warranty support or regulatory compliance.

The Internet of criminal things

Posted Sep 26, 2015 19:46 UTC (Sat) by marcH (subscriber, #57642) [Link]

> why should software be treated any differently than hardware, when the ultimate effect is the same?

It probably shouldn't at a high, conceptual level, however software's completely different nature on so many levels calls for different solutions. As just one example: the VW cheat would never have lasted that long without software. In fact it probably would not even have been deployed in the first place.

See other sub threads for more.

The Internet of criminal things

Posted Sep 27, 2015 1:49 UTC (Sun) by dlang (guest, #313) [Link] (8 responses)

since we are talking about cars, I want to point out that you can build a car completely from scratch and drive the result on the public roads, even in california,

Yes, there are aspects of the result that get measured to see if they are in complance, but far fewer than you are thinking. Outside of California the emissions requirements are significantly easier to comply with.

When you modify vehicles, you run into more restrictions than if you build from scratch for recent vehicles, but if you work on slightly older vehicles you pretty quickly get into 'anything goes' territory where the restrictions are more things like height of bumpers and lights than anything related to the engine or emissions.

The Internet of criminal things

Posted Sep 27, 2015 2:24 UTC (Sun) by pizza (subscriber, #46) [Link] (3 responses)

> When you modify vehicles, you run into more restrictions than if you build from scratch for recent vehicles, but if you work on slightly older vehicles you pretty quickly get into 'anything goes' territory where the restrictions are more things like height of bumpers and lights than anything related to the engine or emissions.

Generally speaking a modified car has to meet all applicable regulations in effect at the time the car was manufactured. There are some exceptions (eg seatbelts required for all occupants) but you can get away with a lot more with an older car as a result. (In general though, vehicles spewing smoke and other noxiousness are due more to poor maintenance than modifications..)

If you build your own, there are all sorts of exceptions to the regs that auto manufacturers have to comply with, but the exact details vary wildly depending on your location.

The Internet of criminal things

Posted Sep 29, 2015 20:37 UTC (Tue) by mathstuf (subscriber, #69389) [Link] (2 responses)

My parents have a 1929 Chrysler at home. I don't think it needs seatbelts by law. Similar thing with Wranglers and older Jeeps: the doors were optional and therefore can't be required by law to be on when on the road (IIRC, there are some states which restrict such things).

The Internet of criminal things

Posted Sep 29, 2015 22:07 UTC (Tue) by pizza (subscriber, #46) [Link] (1 responses)

Here in Florida, if the driver, front passenger(s) or any children in the vehicle are not belted in, the driver will get a ticket. There are only three exceptions granted -- medical necessity, newspaper delivery, and garbage pickup.

Doors are another matter; it really depends on the state and locale, and the type of road you're on -- they're often required for interstates and other limited-access highways, but perfectly okay on local roads, as long as the vehicle still has proper mirrors.

The Internet of criminal things

Posted Oct 1, 2015 11:27 UTC (Thu) by Wol (subscriber, #4433) [Link]

In the UK, I think for the most part the car has to be "road legal as of regs when it was made". As for seatbelts, they must be worn if fitted (and I believe rules recently changed to say that children cannot be carried in vehicles without seatbelts). But seeing as REAR seatbelts were required by law to be an option as far back as the 1960s, it's a very old car that cannot be retrofitted with manufacturer-approved original design seatbelts.

The main purpose of the MOT (the mandatory annual road-worthiness test) is mostly to make sure that the car is up to those original specs - checking that the brakes are functional, the engine is running efficiently, the structure isn't rusty, etc etc.

Cheers,
Wol

The great smog attack of 1943

Posted Sep 27, 2015 3:58 UTC (Sun) by pr1268 (guest, #24648) [Link] (3 responses)

Interesting... I would suspect it's a regulatory and compliance nightmare to get a homebuilt car certified, not just in Calif. but anywhere in the USA.

As I understand it, the ultra-strict emissions regulations on vehicles in Calif. have their genesis in what people thought was a noxious gas attack (presumably from the Japanese) in WWII. Turned out to be exhaust-created smog. Ain't nothin' like a little wartime terror to tighten regulations a bit... ;-)

Also, correct me if I'm wrong, but doesn't someone moving to Calif. (from elsewhere in the USA) have to get their car modified/retrofitted for Calif. emissions? And, curious, what about older cars? (In many states, Vehicles older than 1968 model year need not be tested, because that's when initial exhaust standards were implemented, IIRC.)

The great smog attack of 1943

Posted Sep 27, 2015 5:33 UTC (Sun) by raven667 (subscriber, #5198) [Link] (2 responses)

> Also, correct me if I'm wrong, but doesn't someone moving to Calif. (from elsewhere in the USA) have to get their car modified/retrofitted for Calif. emissions

In practice all cars made for sale in the US are designed to meet California emissions standards as that is more cost effective than designing separate models for the California market.

The great smog attack of 1943

Posted Sep 27, 2015 5:56 UTC (Sun) by dlang (guest, #313) [Link] (1 responses)

unless this has changed in the last couple of years, it is not the case. when you look at cars and aftermarket equipment, you will find some that are 50 state legal, but the majority of things are not (I don't remember if it's 49 or 48 state legal that covers the rest of the country except for where California regulations are in effect)

The basic design in the same, but there are a handful of expensive add-ons, not all of them technical components (warranties by the manufactueres for the first X years after sale for example)

The great smog attack of 1943

Posted Sep 27, 2015 6:13 UTC (Sun) by sfeam (subscriber, #2841) [Link]

Your summary is out of date. There are currently 12+ states that have adopted the CA standards, and the entire US is doing so next year. Hence the broohaha with VW not being able to meet the 2016 standards. Wikepedia US emission standards

The Internet of criminal things

Posted Oct 2, 2015 9:08 UTC (Fri) by oldtomas (guest, #72579) [Link] (6 responses)

> As driving a tinkered car on a public road may harm others [...]

This is one of the often-cited "limitations" or "problems" with GPLV3.

It is a red herring, IMHO. In a state of right (I'm assuming that here) infraction is the user's responsibility. The manufacturer should make it possible for you to comply with the law; it's not his job to *force* you to (although in the more technical realm we're seeing things slide in this direction, alas).

That's why your standard kitchen knife doesn't come with an "anti-murder device" and why you can install extra "firmware" in your brains (e.g. alcohol) and then drive. It's expected from you to know you're supposed to not do it, and perhaps, when you get caught doing it nevertheless, you have to face some consequences. We might agree on changing that, but until then this often-quoted argument is, and will stay a red herring.

The Internet of criminal things

Posted Oct 2, 2015 11:22 UTC (Fri) by tao (subscriber, #17563) [Link] (5 responses)

I think I can safely say that most people, even the ones who would be able to install alternative firmware in their car, won't know how to write software for it. They'll be downloading software from someone else. Considering how careful (i.e. not at all) the mainstream are about where and what they download, I suspect that the risk is rather high that people will download malware.

I would certainly love to have access to the firmware of all devices I own. To be able to fix the small things that annoy me in my camera, TV, gaming console, etc. I'm sure I'd love to have the firmware to my car too. And I would perhaps even dare to try to hack it. But I sure as hell wouldn't trust random hacks downloaded from the net.

The amount of people who install stuff like "Make your computer 10% faster!" software is rather worrying. Imagine the amount of people willing to install "Make your car consume 10% less petrol!". Now, further imagine having such cars driving on the same road you're driving on.

A knife is sharp -- most people know that. Alcohol is a drug -- most people know that. Firmware for your car *might* be malware -- hardly anyone will know that, nor will they believe warnings; if people did believe warnings about malware there'd be far less viruses, trojans, botnets, scammers, etc.

So, allowing the users access to all source code for all devices they own -- absolutely.
Allowing them to freely install it? I'm not so sure in all cases -- in some cases it should require recertification, in other cases void warranties (in most cases both) and insurances.

I suspect that the "ohhhh, upgrading my BMW to a firmware I got online that says that it gives 10% higher top speed" crowd would be fairly small if it voided their insurance (well, perhaps except for the traffic insurance, which is to pay for the damage you *cause*).

The Internet of criminal things

Posted Oct 2, 2015 13:54 UTC (Fri) by raven667 (subscriber, #5198) [Link] (3 responses)

I think you are probably wrong here in your estimate of how widespread car owners messing up their ECU is and will be, and we can use currently existing reality to make that estimate. You already drive on a road where people "chip" their cars with dodgy ECU software for decades now, the small number of people who are really interested in modifying their cars in this way already do so, leaving the firmware open to the owner isn't introducing any new risks. I don't see any new factor that is going to substantially change peoples feelings about messing up their cars, a small number of "tuners" will do so while the vast majority will be unwilling to take the risk, people take their cars more seriously than their computers, I don't think you can broadly generalize the likelihood of downloading malware from computer malware to cars the way you seem to be doing.

The Internet of criminal things

Posted Oct 2, 2015 16:10 UTC (Fri) by BlueLightning (subscriber, #38978) [Link]

I think the ultimate counter-argument to this is that you can already trivially put whatever liquid you like into your fuel tank (or even worse, the oil filler on top of the engine or indeed the brake or steering fluid reservoir), and somehow most of us still manage not to pour things in there that put our cars or indeed our lives at risk, and nobody is clamouring for padlocks or security caps to be fitted. (Yes, I'm aware that some cars have internalised or removed some of these filler caps, I don't think I would buy such a vehicle.)

Sure, that's not nearly as complicated or perhaps as subtle as modifying code in the ECU - but that's part of the point - it's trivially easy to do the wrong thing here and yet most people don't even have the inclination to try something they shouldn't.

The Internet of criminal things

Posted Oct 4, 2015 7:16 UTC (Sun) by marcH (subscriber, #57642) [Link] (1 responses)

> leaving the firmware open to the owner isn't introducing any new risks.

... while trying to close it could reduce risks. Worst case it will make little difference.

> a small number of "tuners" will do so while the vast majority will be unwilling to take the risk, people take their cars more seriously than their computers,

As a member of this vast majority I very much welcome an easy, convenient, "secure boot like" way to easily prove any random officer that I did not "jailbreak/root" my car and have no responsibility whatsoever in its abnormal level of emission/risk/etc. and that it was all Volkswagen's fault.

Since car manufacturers ironically wish the same thing, it will happen more and more. Get over it.

And once again: absolutely nothing here incompatible with open-source and transparency.

The Internet of criminal things

Posted Oct 5, 2015 1:35 UTC (Mon) by raven667 (subscriber, #5198) [Link]

> Since car manufacturers ironically wish the same thing, it will happen more and more. Get over it.

This seems incredibly short sighted to me, if you don't bake ownership control in at the beginning, like was done with Secure Boot, you will end up where the manufacturers have always wanted, where it is only possible to get service of any kind at an authorized shop where that manufacturer can take a cut of the revenue (maybe all of the profit).

> As a member of this vast majority I very much welcome an easy, convenient, "secure boot like" way to easily prove any random officer that I did not "jailbreak/root" my car and have no responsibility whatsoever in its abnormal level of emission/risk/etc. and that it was all Volkswagen's fault.

That is a massive red herring and completely confused, in no way to you have to take extreme technical measures to lock the owner out of modifying their own car for the courts to be able to figure out where liability lies when something goes wrong. There are hundreds, maybe thousands of years of precedent on how liability works when a person purchases a good made by someone else, this is not fundamentally different just because computers are involved.

The Internet of criminal things

Posted Oct 3, 2015 8:25 UTC (Sat) by oldtomas (guest, #72579) [Link]

> The amount of people who install stuff like "Make your computer 10% faster!" [...]

At first blush, yes. But if law states that it's illegal to drive a car with a non-certified software on public roads, you better not get caught (and there are means to check that -- a strong cryptographic hash...).

And as BlueLightning stated, it'd be trivial to put one, two squirts of nitromethane (DISCLAIMER: I don't really know how that'd work out in practice [1] ;-) into your diesel tank, and still pretty few people do that. Why?

[1] Besides, correctly spelling "nitromethane" might get you in hot water after 9/11