I've been putting off writing this one because it kept me up later than I'd like to admit, but here goes. If you haven't read the Wired piece from yesterday about the Jeep hack, go read it first, this post will still be here when you get back. Andy Greenberg volunteered to drive a Jeep Cherokee down the highway in St. Louis while two researchers, Charlie Miller and Chris Valasek, sat on a couch miles away and took the thing over through its Uconnect entertainment system. Air conditioning blasting on max, radio switching stations on its own, wipers going for no reason, and then, the part that actually made my stomach drop, they cut the transmission while he was doing 70 on the interstate.
They did all of this over the cellular network the Uconnect system uses to phone home. Not local wifi, not something that needed physical access to the car first. They found the Jeep because it happened to be reachable on the same Sprint network the entertainment system talks to, and from there it was apparently just a matter of finding vulnerable vehicles and reaching in from wherever they felt like sitting.
I've been half joking for years that I keep buying old cars on purpose, and this is exactly why. My daily driver is a 2004 Civic with a tape deck adapter duct taped to the dash so I can plug my phone into it. It has never once been connected to the internet and it never will be, because it physically cannot be. I used to think that made me a little bit of a luddite about this stuff. Today I feel weirdly vindicated about it, and also a little smug, which I know isn't a great look but there it is.
The part that actually bugs me
Researchers finding a vulnerability isn't the surprising part. Thats what security research is for, and cars have been getting more "connected" for a few years now, so eventually somebody was going to demonstrate just how bad the downside of that convenience can get. What actually bugs me is how predictable the whole thing feels in hindsight. You bolt a cellular modem onto a two ton object that can kill people, you wire that modem into systems that control the brakes and the transmission because it's convenient for remote diagnostics or whatever, and you apparently don't spend a ton of time asking what happens if someone gets into that modem who isn't supposed to be there. Miller and Valasek have reportedly been trying to get Chrysler's attention about this stuff for close to a year before Wired ran the story. That's the detail that sticks with me more than the highway footage does.
I don't think the answer is "never put a computer in a car," obviously that ship sailed a decade ago and isn't turning around. But there's a difference between a computer that controls your seat warmers and a computer that's one bad software update away from touching your brakes, and it feels like the auto industry has been treating those as the same category of problem, which they very much are not.
Separately, and I promise this is related even though it doesn't sound like it: Apple reported earnings yesterday too, and the stock took a real hit today on soft guidance around China, even with iPhone sales coming in strong for the quarter. Everyone's going to write about that today so I won't bother rehashing the numbers. But it's a good reminder that the tech industry's two biggest stories of the week are basically the same story from different angles: companies moving incredibly fast on hardware that used to be simple and is now full of software, and the market (or in the Jeep's case, actual physical safety) eventually catching up to ask whether anyone slowed down to check the seams.
Anyway. If you've got a newer car with one of these always on cellular systems, I'd be curious whether you've gotten any kind of notice from the manufacturer about this yet. I'm guessing not, but I also wouldn't be shocked if that changes fast. Ill believe "the fix is already rolling out" when I see it and not a minute before.