Jul 17 2014
If you’ve never watched the anime Ghost in the Shell(GITS) and you’re in security, you’re doing yourself a great disfavor. If nothing else, watch the Stand Alone Complex series as a primer of what we might expect from Anonymous in the future. I know my friend Josh Corman tries to sit down to watch it every year or two in order to refresh his memory and help him understand what might be coming down the pipeline from chaotic actors. And the authors of the manga/anime have a impressive understanding of what the future of hacking might bring in the long term. Probably a better idea than the FBI does at least.
Earlier this week the Guardian got a copy of an unclassified document the FBI had written up exploring the future of driverless vehicles and the dangers they pose to the future. Their big revelation is that driverless cars could let hackers do things they couldn’t do while driving a normal cars. In other words, since they wouldn’t have to actually be driving they could hack while the car drove itself. Which ignores the fact that it’s already pretty easy to get someone else to drive a car for you, presumably much better than a driverless car will be able to do for many years. If I’m going to commit a crime, I’d rather have someone I can trust at the wheel, rather than take my chances that the police might have a back door (pun intended) into my car’s operating system.
The Guardian story also hints that the FBI is concerned about driverless cars being hacked to be used as weapons. I have to admit that this is a concern; hacking a target’s car to accelerate at the wrong time or muck with the car’s GPS so that it thinks the road goes straight when it should follow the curve of the cliff wouldn’t be a massive logical stretch. Also doing the same to use a car to plow into a crowd or run over an individual is a possibility. However, both of these are things an unskilled operator could do with a real car by cutting the brake lines or driving the car themselves, then running from the scene of the crime.
I think it’ll be much more interesting when driverless cars start becoming common place and young hackers decide they don’t like the feature set and/or controls that are present in the car. It’s a logical extension to think that the same people who root phones and routers and televisions will eventually figure out how to re-image a car so that it has the software they want, to give the vehicle the capabilities they want. I know that the Ford Focus has a whole community built around customizing the software in the vehicle, so why will it be any different for driverless cars in the future.
The difference with the driverless car will be that I could strip out many if not all of the safety protocols that will be in place, as well as the limiters on the engine and braking systems. I want to pull off a robbery and use a driverless car for the get away? Okay, ignore all stoplights, step on the gas and don’t break for anything. You’d probably be able to rely on the safety features of other driverless cars to avoid you and you wouldn’t have to worry about the police issuing a kill signal to your car once they’ve read your license plate and other identifying codes. I’d still rather have an old fashioned car with an actual driver, but at some point those might be hard to get and using one would cause suspicion in and of itself.
On the point of a kill signal, I strongly believe this will be a requirement for driverless cars in the future. I’m actually surprised a law enforcement kill switch hasn’t already been legislated by the US government, though maybe they’re waiting to see how the public accepts smart phone kill signals first. Around the same time as the kill switch is being made mandatory, I expect to see laws passed to make rooting your car illegal. Which, of course, means only criminals will root their cars. Well, them and the thousands of gear heads who also like to hack the software and won’t know or care about the law.
The FBI hasn’t even scratched the surface of what they should be concerned with about driverless cars. Back to my initial point about Ghost in the Shell: think about what someone could do if they hacked into the kill switch system that’s going to be required by law. Want to cause massive chaos? Shut down every car in Las Angeles or Tokyo. Make the cars accelerate and shut down the breaks. Or simply change the maps the car’s GPS is using. There are a lot of these little chaos producing tricks used through out the GITS series, plus even more that could be adapted easily to the real world.
Many of these things will never happen. The laws will almost definitely be passed and you’ll have a kill switch in your new driverless car, but there’s little chance we’ll ever see a hack of the system on a massive scale. On the other hand, given the insecurity we’re just starting to identify in medical devices, the power grid and home networks, I’m not sure that any network that supports driverless cars will be much better secured. Which will make for a very interesting future.