Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Submission + - Horse_ebooks Is Human After All (newyorker.com)

An anonymous reader writes: Two of the more intriguing memes of recent times are to be revealed in New York today. @Horse_ebooks and Pronunciation Book have been running for the past several years, both have the hallmarks of automation, chugging along anonymously and churning out disjointed bits of text in a very spam-like fashion, but neither is as it appears.

Comment Re:High risk (Score 4, Insightful) 390

Because we all know that if the researchers quietly tell the auto manufacturers they will fix the issues and make sure everything gets updated. Our upstanding auto manufacturers would certainly not try to bury issue and sue the reporters out of existence!

As a security researcher you should be used to companies trying to deny, bury and ignore reports instead of correct them.

Seriously, the only way to get a company to fix a flaw is when the pr nightmare becomes so great that it is cheaper to fix the problem than deny it.

Yes and I also know about technically minded people denying that problems are real issues too (See libvte vulnerability). DARPA has known about these issues for a while now and apparently the issues are a lot more real and scary than most people realize. We're talking about the ability for a hacker to do something to your car simply by playing a song over your iPod or on a CD. Or a program being injected the next time you get an oil change because the service center's computer had been hacked remotely.

And we're not talking about ego maniac hackers sitting in their basements causing a few cars to honk their horn because they think it will be funny, we're talking about terrorists and countries writing a song that one day everyone plays one day and we have 1 million 60mph 2 ton missles with families in them flying up the road all the same time. That will be a very bad day. But that's ok, because we tried to tell the auto manufacturers and they just didn't listen, so its their fault right?

What these researchers are doing here is treating this vulnerability as if its any other vulnerability, which its not. Human life is at stake, not your email or bank account password. Yes, they do recognize the dangers, but they don't seem to realize that they should be changing their approach accordingly. For instance, they do their tests out in the open on public roads and put someone behind the wheel who doesn't know what is going to happen. You don't really need to do that to demonstrate that there is a problem.

Comment High risk (Score 4, Insightful) 390

"The duo plans to release their findings and the attack software they developed at the hacker conference Defcon in Las Vegas next month–the better, they say, to help other researchers find and fix the auto industry's security problems"

As a security researcher who believes in the spirit of the open release of vulnerabilities, I feel that this is irresponsible behavior on the part of these security researchers. We're not talking about releasing a vulnerability that will compromise someone's e-mail. We're talking about a high risk vulnerability that could cost some random person their life. These two gentleman should take a deep breath before releasing this information to the computer industry first rather than the auto industry. The auto industry may not have a tradition of attending these types of conferences and so by releasing the information at Def-con you're giving the wrong people a head start. Sure, the auto industry already knows about these problems, but you have to try to give them the benefit of the doubt when you confront them about the problems that they will try to fix it.

Slashdot Top Deals

Congratulations! You are the one-millionth user to log into our system. If there's anything special we can do for you, anything at all, don't hesitate to ask!

Working...