alt Hacker NewsIt's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
Replies
I’m questioning the need for connected cars in the first place. Perhaps we could revisit that trend.
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees.
Is it so hard to just offer said hackers a boatload of cash to switch sides?
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!”
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
[dead]
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.