Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Dr.Caligari
May 5, 2005

"Here's a big, beautiful avatar for someone"

Why does this look like a kit car of an RX8?

Stolen from a FB friend, This beauty is broken down alongside the road a little outside of Cincinnati.

Adbot
ADBOT LOVES YOU

Disgruntled Bovine
Jul 5, 2010

What the heck is going on with the hood? Did they take off the hood itself and leave the liner in place?

Rhyno
Mar 22, 2003
Probation
Can't post for 10 years!

Disgruntled Bovine posted:

What the heck is going on with the hood? Did they take off the hood itself and leave the liner in place?

They cut the skin off.

Disgruntled Bovine
Jul 5, 2010

Rhyno posted:

They cut the skin off.

Oh that's a new one. How many JDM horsepower is that worth?

Rhyno
Mar 22, 2003
Probation
Can't post for 10 years!

Disgruntled Bovine posted:

Oh that's a new one. How many JDM horsepower is that worth?

INCALCULABLE.

DiggityDoink
Dec 9, 2007

Dr.Caligari posted:

Why does this look like a kit car of an RX8?

Stolen from a FB friend, This beauty is broken down alongside the road a little outside of Cincinnati.



dumped indeed

kastein
Aug 31, 2011

Moderator at http://www.ridgelineownersclub.com/forums/and soon to be mod of AI. MAKE AI GREAT AGAIN. Motronic for VP.

DiggityDoink posted:

dumped indeed

Do those loving tards not realize the builds they are emulating do that so they can easily check clearance from the underhood stuff to the hood ribbing, and will put a real hood back on after?

Oh wait, it is terrible scenester hellaflush fuckwittery, they don't realize poo poo, just straight up monkey see, monkey do. Bring on the steelies and spoilers on the back of FWD cars.

The Locator
Sep 12, 2004

Out here, everything hurts.





Well, lightening is the only good move I can see on that entire car, they just went about it in a really stupid way (and undoubtedly for entirely wrong reasons).

Fender Anarchist
May 20, 2009

Fender Anarchist

kastein posted:

Bring on the steelies and spoilers on the back of FWD cars.

fwd racecars still need wings to provide downforce/spoilers to prevent lift on the rear wheels to help prevent oversteerrerhajklgajkrguenbh;lkdnfgb

8ender
Sep 24, 2003

clown is watching you sleep

Enourmo posted:

fwd racecars still need wings to provide downforce/spoilers to prevent lift on the rear wheels to help prevent oversteerrerhajklgajkrguenbh;lkdnfgb

Olympic Mathlete
Feb 25, 2011

:h:


Dr.Caligari posted:

Why does this look like a kit car of an RX8?


Looks like they rattlecanned it black when it was originally red.

Powershift
Nov 23, 2009


something something can't offroad curbrash.

Lord Ludikrous
Jun 7, 2008

Enjoy your tea...

Found in Canterbury yesterday.

Panty Saluter
Jan 17, 2004

Making learning fun!

Ludicro posted:

Found in Canterbury yesterday.



True, just not in the way they were thinking :v:

davebo
Nov 15, 2006

Parallel lines do meet, but they do it incognito
College Slice
Yesterday in Maryland I saw an early 90's Buick Roadmaster with the license plate STBNWGN. I was trying to think if that means stabbin' wagon, like stabbing girls with his dick like sex, that's a thing, right? But in the window there was a Jesus is my Co-pilot sticker so I figured no way it was that. Well traffic was a mess so eventually I was stopped right behind him and the jesus is my co-pilot sticker had subtext beneath it that said "and we're cruisin' for pussy." Just a class act all the way.

Wolfsbane
Jul 29, 2009

What time is it, Eccles?

Enourmo posted:

fwd racecars still need wings to provide downforce/spoilers to prevent lift on the rear wheels to help prevent oversteerrerhajklgajkrguenbh;lkdnfgb




Yeah, OK, it's AWD. But still.

Technically amazingly impressive. Just a shame it looks so loving ugly.

Terrible Robot
Jul 2, 2010

FRIED CHICKEN
Slippery Tilde

davebo posted:

Yesterday in Maryland I saw an early 90's Buick Roadmaster with the license plate STBNWGN. I was trying to think if that means stabbin' wagon, like stabbing girls with his dick like sex, that's a thing, right? But in the window there was a Jesus is my Co-pilot sticker so I figured no way it was that. Well traffic was a mess so eventually I was stopped right behind him and the jesus is my co-pilot sticker had subtext beneath it that said "and we're cruisin' for pussy." Just a class act all the way.

Hahaha that dude owns.

Olympic Mathlete
Feb 25, 2011

:h:


davebo posted:

Yesterday in Maryland I saw an early 90's Buick Roadmaster with the license plate STBNWGN. I was trying to think if that means stabbin' wagon, like stabbing girls with his dick like sex, that's a thing, right? But in the window there was a Jesus is my Co-pilot sticker so I figured no way it was that. Well traffic was a mess so eventually I was stopped right behind him and the jesus is my co-pilot sticker had subtext beneath it that said "and we're cruisin' for pussy." Just a class act all the way.

As above, this dude is funny. "oh hey he loves Jesus as much as I do ................waiiiiiiiiiiiiiiiiit a minute!"

Jesus was blatantly gay though, hung around with dudes, was friends with whores, turned water into wine. Probably a very good wingman though.

BlackMK4
Aug 23, 2006

wat.
Megamarm

Terrible Robot posted:

Hahaha that dude owns.

My exact thoughts, too. :lol:

Tashan Dorrsett
Apr 10, 2015

by Deplorable exmarx

davebo posted:

Yesterday in Maryland I saw an early 90's Buick Roadmaster with the license plate STBNWGN. I was trying to think if that means stabbin' wagon, like stabbing girls with his dick like sex, that's a thing, right? But in the window there was a Jesus is my Co-pilot sticker so I figured no way it was that. Well traffic was a mess so eventually I was stopped right behind him and the jesus is my co-pilot sticker had subtext beneath it that said "and we're cruisin' for pussy." Just a class act all the way.

are you questioning the ROAD MASTER???

Itzena
Aug 2, 2006

Nothing will improve the way things currently are.
Slime TrainerS

kastein posted:

It's when someone ruins the poo poo out of a car by hellaflush slamming it, or ruins the poo poo out of a truck by turning it into a giant monument to their shrunken manhood, that I get annoyed.
Also from the car show at the weekend:




And...this:


Paint was purple with a flip, which is clearly why the Tron-lines are blue. :downs:

Apparently there's an Austin Allegro Owner's Club:


1st Edition ADandD
Aug 31, 2009

Itzena posted:

Also from the car show at the weekend:


Apparently there's an Austin Allegro Owner's Club:




They even look ashamed.

Slavvy
Dec 11, 2012

I thought the princess had terminally faulty suspension that nobody makes replacement parts for anymore? I mean, I'm not discounting that it got there on the back of a truck but that doesn't explain why it isn't crouched on a dramatic lean like the brotruck above.

mustard_tiger
Nov 8, 2010

Powershift posted:

something something can't offroad curbrash.



His tire is on backwards as well.

Riot Carol Danvers
Jul 30, 2004

It's super dumb, but I can't stop myself. This is just kind of how I do things.

mustard_tiger posted:

His tire is on backwards as well.

Holy poo poo

kastein
Aug 31, 2011

Moderator at http://www.ridgelineownersclub.com/forums/and soon to be mod of AI. MAKE AI GREAT AGAIN. Motronic for VP.
http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

Laugh at Chrysler now. Then look at your new car with any sort of 2-way radio link to any sort of computer with upgradeable firmware that also touches your vehicle's main data buses and realize it's probably just as vulnerable and it's only a matter of time.

As an embedded systems engineer this is incredibly unsettling to me and I'm actually very Luddite about it. No wireless connections to anything that controls the brakes, steering, or throttle, period, on my cars. You know why? Because if contractors built houses how software developers build software, the first woodpecker, raccoon, or chimpanzee that came along would destroy civilization. Hell, I'm sure my own embedded systems firmware is vulnerable too, I'm only human. And that's why I steadfastly refuse to put any sort of a wireless data link in them that can receive any kind of command or request. Transmit only, and only for telemetry purposes while testing a new design.

Cliff notes from the article:
- about 471k vulnerable vehicles just from this one Uconnect vulnerability
- used nothing more than a lovely pay as you go Sprint mobile phone with 3g data service and a laptop plus some custom software
- can control the steering wheel in reverse! Probably in forward too but they haven't figured it out yet.
- can disable the brakes at will (or engage them at will. Or both, taking you completely out of control while letting the attacker do whatever they want with the brakes.)
- can control the throttle
- can control the transmission
- can control the wipers, entertainment system, dashboard, probably the windows and door locks, basically anything on the CAN bus (which is everything, in a modern car)

I can't stress how loving bad this is, and how absolutely unsurprised I am to read everything in this article. It has not been a matter of if, but when. I'm sure all the other automakers software is just as vulnerable.

But for right now, if you drive a 2013 or later Chrysler product with Uconnect, and haven't updated its entertainment system firmware, someone who has figured out the vulnerability can just connect remotely to your car, via the internet, from anywhere on the planet, track your location, and at the most inopportune time, lock the doors, disable the windows, play ICP at full volume while displaying hello.jpg on your infotainment display, lock the washer fluid pump on, disable the wipers, turn the exterior lights off, lock the transmission in gear, disable the brakes, and command full throttle. They probably can disable the steering, too. Hope you wanted to die today.

The best part? Chrysler is doing the best they can to fix it, they've already released a patch, but not only is it unlikely that more than a tiny percentage of vehicles have been updated... and by releasing the patch, they have given any hacker who can copy the existing firmware off the Uconnect system (or find a previous update image, which shouldn't be hard) all the info they need to compare the vulnerable version to the patched version, which usually makes the section of code that was fixed blatantly obvious and simplifies exploiting the 95+% of cars that have not and probably will not be patched, for years.

We as an industry are not ready for this, not even close, and are diving headfirst into it anyways. I just hope no one dies because of it. In the meantime I refuse to have anything to do with a vehicle with these kinds of controls and any sort of wireless interface to a system that shares a network connection with the safety critical controls.

Here's how this ends, if some dude in his basement wants to kill you today:
https://www.youtube.com/watch?v=gu1ke8bHclA
I hated that movie. I hated how inaccurate it was technically (because I am a sperg) since you couldn't commandeer a car remotely, period. And now I pretty much hate the loving auto industry for making that a reality without thinking things through.

Jesus, what a mess.

kastein fucked around with this message at 15:54 on Jul 21, 2015

Scruff McGruff
Feb 13, 2007

Jesus, kid, you're almost a detective. All you need now is a gun, a gut, and three ex-wives.

kastein posted:

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

Laugh at Chrysler now. Then look at your new car with any sort of 2-way radio link to any sort of computer with upgradeable firmware that also touches your vehicle's main data buses and realize it's probably just as vulnerable and it's only a matter of time.

Here's how this ends, if some dude in his basement wants to kill you today:
https://www.youtube.com/watch?v=gu1ke8bHclA
I hated that movie. I hated how inaccurate it was technically (because I am a sperg) since you couldn't commandeer a car remotely, period. And now I pretty much hate the loving auto industry for making that a reality without thinking things through.

Jesus, what a mess.

It was only a matter of time...
https://www.youtube.com/watch?v=OLYo5tMylQM&t=134s

Panty Saluter
Jan 17, 2004

Making learning fun!
The steering is what kills me (so to speak). So basically a lot of modern cars just have video game controllers that send commands to a remote electric steering box through the ECU? :psyduck:

xzzy
Mar 5, 2009

Panty Saluter posted:

The steering is what kills me (so to speak). So basically a lot of modern cars just have video game controllers that send commands to a remote electric steering box through the ECU? :psyduck:

Yep, lane assist and auto parallel parking have basically forced the situation. They still have a mechanical link to the steering box as a failsafe but the electronics can be all "um gently caress you I'm the one in control here."

Proof of concept exploits of this stuff started hitting youtube a year or two ago, it's only a matter of time before it actually gets used to kill someone.

Panty Saluter
Jan 17, 2004

Making learning fun!
...and because a wireless two way link saves 0.15 USD per vehicle, we'll never see a return to hardwired connection until at least a few people die unnecessarily and legislation is enacted.

CommieGIR
Aug 22, 2006

The blue glow is a feature, not a bug


Pillbug

kastein posted:

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

Laugh at Chrysler now. Then look at your new car with any sort of 2-way radio link to any sort of computer with upgradeable firmware that also touches your vehicle's main data buses and realize it's probably just as vulnerable and it's only a matter of time.

As an embedded systems engineer this is incredibly unsettling to me and I'm actually very Luddite about it. No wireless connections to anything that controls the brakes, steering, or throttle, period, on my cars. You know why? Because if contractors built houses how software developers build software, the first woodpecker, raccoon, or chimpanzee that came along would destroy civilization. Hell, I'm sure my own embedded systems firmware is vulnerable too, I'm only human. And that's why I steadfastly refuse to put any sort of a wireless data link in them that can receive any kind of command or request. Transmit only, and only for telemetry purposes while testing a new design.

Cliff notes from the article:
- about 471k vulnerable vehicles just from this one Uconnect vulnerability
- used nothing more than a lovely pay as you go Sprint mobile phone with 3g data service and a laptop plus some custom software
- can control the steering wheel in reverse! Probably in forward too but they haven't figured it out yet.
- can disable the brakes at will (or engage them at will. Or both, taking you completely out of control while letting the attacker do whatever they want with the brakes.)
- can control the throttle
- can control the transmission
- can control the wipers, entertainment system, dashboard, probably the windows and door locks, basically anything on the CAN bus (which is everything, in a modern car)

I can't stress how loving bad this is, and how absolutely unsurprised I am to read everything in this article. It has not been a matter of if, but when. I'm sure all the other automakers software is just as vulnerable.

But for right now, if you drive a 2013 or later Chrysler product with Uconnect, and haven't updated its entertainment system firmware, someone who has figured out the vulnerability can just connect remotely to your car, via the internet, from anywhere on the planet, track your location, and at the most inopportune time, lock the doors, disable the windows, play ICP at full volume while displaying hello.jpg on your infotainment display, lock the washer fluid pump on, disable the wipers, turn the exterior lights off, lock the transmission in gear, disable the brakes, and command full throttle. They probably can disable the steering, too. Hope you wanted to die today.

The best part? Chrysler is doing the best they can to fix it, they've already released a patch, but not only is it unlikely that more than a tiny percentage of vehicles have been updated... and by releasing the patch, they have given any hacker who can copy the existing firmware off the Uconnect system (or find a previous update image, which shouldn't be hard) all the info they need to compare the vulnerable version to the patched version, which usually makes the section of code that was fixed blatantly obvious and simplifies exploiting the 95+% of cars that have not and probably will not be patched, for years.

We as an industry are not ready for this, not even close, and are diving headfirst into it anyways. I just hope no one dies because of it. In the meantime I refuse to have anything to do with a vehicle with these kinds of controls and any sort of wireless interface to a system that shares a network connection with the safety critical controls.

Here's how this ends, if some dude in his basement wants to kill you today:
https://www.youtube.com/watch?v=gu1ke8bHclA
I hated that movie. I hated how inaccurate it was technically (because I am a sperg) since you couldn't commandeer a car remotely, period. And now I pretty much hate the loving auto industry for making that a reality without thinking things through.

Jesus, what a mess.

I'm trying to figure out if they even have a basic firewall for the device.

wayfinder
Jul 7, 2003

xzzy posted:

Yep, lane assist and auto parallel parking have basically forced the situation. They still have a mechanical link to the steering box as a failsafe but the electronics can be all "um gently caress you I'm the one in control here."

Proof of concept exploits of this stuff started hitting youtube a year or two ago, it's only a matter of time before it actually gets used to kill someone.

I think it's entirely probable that this has already been successfully used in assassinations, and they just looked like car crashes. :tinfoil:

Panty Saluter
Jan 17, 2004

Making learning fun!

wayfinder posted:

I think it's entirely probable that this has already been successfully used in assassinations, and they just looked like car crashes. :tinfoil:

https://en.wikipedia.org/wiki/Michael_Hastings_%28journalist%29 :tinfoil:

Finger Prince
Jan 5, 2007


OK so I'm pretty ignorant about this kind of thing, but I do have a bit of experience with the overall architecture in similar types of thing. But really, hindsight and all that, why not simply have the car computer check it's software/firmware files every start, and if they've changed, put a prompt on the screen asking the user to confirm the change with by entering a code. Then set your service infrastructure up so that the user should never see that prompt, it will only come up at a dealer when they do an update, and only they have the code. If the user sees the "your [hosted app] has been updated, enter service code to confirm update", there's something wrong, and it won't allow the update until they take it to the dealer to sort it out.
Yes there's still gaps in this plan where a hacker could take advantage of systemic complacency, but it can work.

kastein
Aug 31, 2011

Moderator at http://www.ridgelineownersclub.com/forums/and soon to be mod of AI. MAKE AI GREAT AGAIN. Motronic for VP.

Panty Saluter posted:

...and because a wireless two way link saves 0.15 USD per vehicle, we'll never see a return to hardwired connection until at least a few people die unnecessarily and legislation is enacted.

That doesn't actually make sense and you're confusing two things, but I agree.

The wireless link is from the car to the auto maker (and whoever else finds its IP address and knows the vulnerability because security through obscurity is great guys), the hardwired connection is from the steering wheel to the steering box. The problem is, the wireless link allows an attacker to remotely break into the entertainment system, which is on the same wired CAN bus network as the important car stuff. The entertainment system doesn't know how to control that stuff, so they probably thought everything was fine, but they left it vulnerable to a bug that allows specially crafted code to rewrite the firmware on the entertainment system, so presto, now it can send those commands and force the steering system to do things via the same wired control network your steering wheel would normally use.

I can get more into detail if you want, CAN bus network stuff and vehicle wiring/control systems is what I do for a living. To confuse matters more, what most auto enthusiasts think of as "hardwired" vs networked is not too clear, because wires are wires right? There's a huge difference between network wiring and dedicated, single-purpose signal wires that can only do certain things. A network is far more flexible and this is a double edged sword, it is also far more dangerous because its functionality is determined by firmware and it's far harder to conclusively verify that it can only do what you wanted.

This all is why I put my foot down and refused to budge on our transmission control unit design. To accidentally (or maliciously) be shifted out of certain critical gears once the operator puts it in them requires four separate computer modules to independently determine it's safe to do so in a specific sequence, as well as three physical power bus interlocks which keep the gearshift unit and transmission control unit from receiving power until those four computers as well as the operator all agree that shifting is the right thing to do.

I do not like computers being able to decide if I live or die.

e:

There are a few ways to avoid this problem.
One is to be incredibly rigorous about your software development for these systems, specifically the one that has the wireless link to the outside world. I'd like to see hackers get pre-release "play with this" QA/beta tester access to vehicles, including full source code auditing once it's been verified they can be trusted, with large bounties paid for bugs found. Giving a hacker six figures to break your poo poo is still far, far cheaper than any sort of a recall campaign to keep your buyers from abruptly dying if 4chan doesn't like their bumper sticker.

Another is to keep your powertrain/steering/braking systems entirely separate from your entertainment and body control systems. This is probably what I would do.

A third is what wayfinder alluded to, keep one control module in between the two that acts as somewhat of a firewall. I would consider this if option 2 isn't acceptable. This module would be very, very carefully validated to not contain any vulnerabilities, and would only pass specific commands and data back and forth, possibly content checking it in the process to prevent a malformed command from making it across the gap. I would like to see this sort of module have firmware storage that is physically protected by a read-only switch or shorting jumper that can only be disabled (allowing firmware updates) via physical access, at a dealer.

The real issue with limiting how people can update the firmware is that it will only make things worse. No one has their firmware updated at the dealer, ever, unless it stops driving. Wireless updates are a great idea for that but they also enable this sort of hack in the first place. There is no such thing as a free lunch.

kastein fucked around with this message at 16:29 on Jul 21, 2015

CommieGIR
Aug 22, 2006

The blue glow is a feature, not a bug


Pillbug

Linedance posted:

OK so I'm pretty ignorant about this kind of thing, but I do have a bit of experience with the overall architecture in similar types of thing. But really, hindsight and all that, why not simply have the car computer check it's software/firmware files every start, and if they've changed, put a prompt on the screen asking the user to confirm the change with by entering a code. Then set your service infrastructure up so that the user should never see that prompt, it will only come up at a dealer when they do an update, and only they have the code. If the user sees the "your [hosted app] has been updated, enter service code to confirm update", there's something wrong, and it won't allow the update until they take it to the dealer to sort it out.
Yes there's still gaps in this plan where a hacker could take advantage of systemic complacency, but it can work.


kastein posted:

That doesn't actually make sense and you're confusing two things, but I agree.

The wireless link is from the car to the auto maker (and whoever else finds its IP address and knows the vulnerability because security through obscurity is great guys), the hardwired connection is from the steering wheel to the steering box. The problem is, the wireless link allows an attacker to remotely break into the entertainment system, which is on the same wired CAN bus network as the important car stuff. The entertainment system doesn't know how to control that stuff, so they probably thought everything was fine, but they left it vulnerable to a bug that allows specially crafted code to rewrite the firmware on the entertainment system, so presto, now it can send those commands and force the steering system to do things via the same wired control network your steering wheel would normally use.

I can get more into detail if you want, CAN bus network stuff and vehicle wiring/control systems is what I do for a living. To confuse matters more, what most auto enthusiasts think of as "hardwired" vs networked is not too clear, because wires are wires right? There's a huge difference between network wiring and dedicated, single-purpose signal wires that can only do certain things. A network is far more flexible and this is a double edged sword, it is also far more dangerous because its functionality is determined by firmware and it's far harder to conclusively verify that it can only do what you wanted.

This all is why I put my foot down and refused to budge on our transmission control unit design. To accidentally (or maliciously) be shifted out of certain critical gears once the operator puts it in them requires four separate computer modules to independently determine it's safe to do so in a specific sequence, as well as three physical power bus interlocks which keep the gearshift unit and transmission control unit from receiving power until those four computers as well as the operator all agree that shifting is the right thing to do.

I do not like computers being able to decide if I live or die.

I feel like something like this needs two factor authentication and a basic firewall with privileges given to the driver. Say the company wants to connect to the vehicle, they should be required to call the user and the user should be able to randomly generate a pin that the user themselves must give to the company to allow them to connect, barring that a firewall with a randomly generated pass code that is given to the driver at purchase and the driver can change at will.

FAT32 SHAMER
Aug 16, 2012



Further reasons why buying older, manual transmission cars are the way to go :toot:

Panty Saluter
Jan 17, 2004

Making learning fun!

kastein posted:

That doesn't actually make sense and you're confusing two things, but I agree.

The wireless link is from the car to the auto maker (and whoever else finds its IP address and knows the vulnerability because security through obscurity is great guys), the hardwired connection is from the steering wheel to the steering box.

Oh, that makes more sense :v: I feel a little better knowing there's a hardwired connection for the controls in the car. Not that wires never fail but I feel like you get better odds.

I assume the wireless connection is there strictly for ICE? Or do the manufacturers use it as well to keep from having to physically connect to a vehicle or diagnostics or updates?

Tusen Takk posted:

Further reasons why buying older, manual transmission cars are the way to go :toot:

No poo poo, I've never been happier to drive a rattly old bucket of bolts (which I liked anyway).

Galler
Jan 28, 2008



Neat, they are supposed to be at DEF Con this year. Maybe I'll go to that talk.

Adbot
ADBOT LOVES YOU

Nodoze
Aug 17, 2006

If it's only for a night I can live without you

Tusen Takk posted:

Further reasons why buying older, manual transmission cars are the way to go :toot:

Yep, that won't ever change

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply