Companies dont even give a shit about cybersecurity with their internal systems why would they dare put a cent into thinking about security for systems their customers use
Comment on Software update bricks some Jeep 4xe hybrids over the weekend
BombOmOm@lemmy.world 1 week ago
The power train (and other vital components) of a car should be air-gapped from the internet. It’s crazy car manufacturers are even able to brick a car like this.
Is your car going to get security updates 20 years from now? No. The power train should be air-gapped from the internet.
Nindelofocho@lemmy.world 1 week ago
andyburke@fedia.io 1 week ago
This just keeps happening until we decide our governments work for us and not for corporations.
Venator@lemmy.nz 1 week ago
unfortunately corporations decide what most people decide via control of media and social media …
ToastedRavioli@midwest.social 1 week ago
In most push to start modern cars, it isnt really one central computer like how cars used to be. You still have an ECU, like the computer that is relevant to the drivetrain. But then you also have one or two others separate units that have to have authority over the ECU by nature because of other things they do. Like if the unit that communicates with your key to say “its okay to allow you to use the car” doesnt have authority over operating your powertrain, then it would be much easier to steal your car (i.e. kia and hyundai from a certain period of time). In many cars it also monitors engine performance and can make live adjustments to the operation of the engine, prevent some catastrophic failures, etc.
So having some smarter computer aspect of your car rule your powertrain is a pretty good security and operational thing, even if it leads to the potential for inconveniences. Like if your electric key dies you could lose the ability to start your car, which would never happen with a physical key
That said, I think all updates for cars should be done at dealerships, and not be an over the internet type of thing
FordBeeblebrox@lemmy.world 1 week ago
My push to start has an RFID slot for the key so even if the fob battery dies it still will recognize and start, push to start may be convenient but I’m more worried about adding additional wires between ignition switch and battery/starter. I absolutely do not want my vehicle connected to the internet, I want gas brake and steering, OTA updates are just a terrible idea
FordBeeblebrox@lemmy.world 1 week ago
en.wikipedia.org/wiki/Gig_Car_Share
I worked for AAA during this program and literally every single weekend someone would take a car up into the mountains or down the coast and lose cell service…which would then brick the car and leave them stranded in the woods with a Prius they couldn’t even open to get inside. Add fires (thanks PG&E) and mudslides and it was a massive clusterfuck just getting a tow truck to them, which could take hours or days
kokesh@lemmy.world 1 week ago
Yeah, but how else would you be able to pay for power upgrades? I’m keeping my old cars for as long as possible.
rainwall@piefed.social 1 week ago
Apparently it was supposed to be. They have the core functions in a “can’t OTA” container, with less important functions like AV/etc in a “can OTA” model.
This update was pushed to the “can update” side and fucked the “can’t update” side, which is its own can of worms. Another can? Jeep pushed a silent, emergency update “to all Jeeps even those who have automatic updates disabled.”
So the issue is not that they have no security model, it’s that it clearly doesn’t work and they can and will push secret updates even when you decline all updates.
tal@lemmy.today 1 week ago
reddit.com/…/turn_offdisconnect_remote_access_to_…