Get in touch with technology with tex Stuff from dot com. Hey there, and welcome to tech Stuff. I'm Jonathan Strickland and joining me once again despite his incredibly busy schedule. Possibly the busiest man at how stuff works dot Com Ben Bowling, Oh gosh, hey, thank you for having me back, and uh good to talk to everyone here in tech Stuff. I do have to say I am, at best the second or third busiest man. Uh. The dubious privilege of the most busy probably goes to our super producer Noel Brown Knowles Knowles pretty darn busy. Matt Frederick also really busy. That's true. There's probably maybe five or six people that you could all claim are the most busy person at health stuff Works, and they would themselves be too exhausted to argue the point. But Ben, of course, one of the many shows that you are of is car Stuff. And when I asked you if you would be interested to come back onto tech stuff, and you didn't have the heart to tell me. No, I said what would you like to talk about? And you came up with a ton of different suggestions, which really just means that you're eventually going to cover all of them. But today we're specifically looking at one of the ones I thought was the most interesting, hacking a car. And the reason why I think it's really fitting that we do this is recently I did an episode with Shannon Morse and she is one of the hosts of Hack five, and she talks a lot about hacking and coding, including hacking electronics and and she said, one of the things you really wanted to get more into was the idea of hacking vehicles and uh. And so I thought, well, this is the perfect opportunity for us to expand on this because we introduced it with Shannon's interview, and now we can really dive into it and look into it. Now. The fact that we're talking about this means that we have to you confronts some kind of mythical versions of the car hacking lifestyle, because we we've all seen depictions of this in various like spy movies or television series. So Ben, uh, I know that we've got these great notes written down. I want to hear you actually read out the opening paragraph, all right, in your most dramatic kind of approach. Okay, the old inner world, Yes, okay, all right. Now, to be fair, Jonathan I when I was writing that, it hit me halfway through that I wondered who would which of us would this would fall to? Okay, so let's set the scene. Imagine that you're in an action film driving on a curving road along the side of a cliff, and suddenly the breaks don't work, the accelerator jams, and as you careem over the side of the road, a voice comes on over your radio saying you've made a powerful enemy, old friend. The familiar voice over your Bluetooth connection is no doubt making a pun. Just as your vehicle, now turned into a jet trap, hurdles into the abyss. This being a film, the car instantly explodes. I have a nice trip. That's not quite right, but you know that's I'm the master of the almost but not quite appropriate pun. Um. So yeah, this is this is something that I have actually seen in movies where, you know, the old version of this would just be someone's cut the brake line right. But now cars are way more complicated than they used to be, and so the question is could this actually happen? Could someone take control of your car this way? And it's a little complicated, and the answer kind of comes out to maybe, Yeah, what do you mean by hacking? Yeah, yeah, So you've got a great point in the notes. Cars are increasingly computerized. There are more and more electronic systems within cars today. So they used to be purely mechanical, right. You had an engine that you know, a transmission that would transmit the the reciprocal power of the engine into rotational force. But the tires, you had breakes, you had steering. It wasn't even power steering back in the day. These were all mechanical systems right down to the windows. Yeah, so you didn't have any sort of electronics. But that's not the case anymore. Yeah, those are Now a car is more like a series of interconnected digital networks and and they could have dozens of computers talking to each other, or we call these embedded systems often. And here's the thing, Jonathan, their proprietary. So that means that these systems are not just plug and play things you could stick into any car, a GM car and you know, a Toyota would have a different approach. Um, they're also not that smart. Yeah, as it turns out, the proprietary thing is both a good thing and a bad thing. Now often I say I don't like the proprietary approach because I want to have the choice as a consumer to be able to put together a system. However, I like, I don't want to be I don't want to be um, you know, beholden to one company's approach, which is why I love Apple's design. Don't get me wrong, but I'm not an Apple guy because Apple products tend to only work with other Apple products, or they they in their best implementation, they work with Apple products. And if you try and mix and match stuff, things start to fall apart pretty quickly, and I like to have more of an open approach. However, that being said, the experience I might have with that open approach may never get to as good a one as I would have if I just broke down and bought all the Apple stuff. But the other side of that is that with the proprietary approach, and we'll go into this more later in the pie cast, uh, it means that if you're trying to exploit the system, you can't take a one one approach, right. One size does not fit all, not a cookie cutter type thing, absolutely, uh, and it's not. I guess what we're seeing is that it's not as easy to you know hack uh multiple cars or control of multiple cars. That will see a couple exceptions that rule as it is to you know, bot net a bunch of computers right right. You can't. You can't build a virus that's going to affect the entire fleet of cars out there. But you could write a virus that exploits a particular vulnerability and an operating system, and then any computer using that unpatched version of the operating system would become vulnerable to that attack. So it is a little different. It's not the same as uh, hacking a computer. And keep in mind, hacking a computer is not the same as what you'll see in a movie, isn't it. It's not like it's not like that nineties film Hackers. We can't just reroute the encryption or or the or all all the different versions of hacking where they show it as a character like suddenly you're an avatar navigating through a maze and you actually encounter like floating skull and crossbones and oh no, that's the that's the firewall. I need to turn around, And that's not what hacking is like. It made so many people's first computer experience underwhelming. I've got oh, I've got something. This a little bit of a sidebar. Do you know that show The Strain? Yes, okay, have you watched it? I haven't. It's on my list of things to watch, but I haven't watched it yet. All Right, this is the one with the virus that goes through the eye, right yeah, yeah, yeah, it's a it's sort of a paradipe. Yeah, adaptation to parasites science. But this is not really a spoiler because it's a side note here one of and I mean I say this with love because I've watched the show. One of the dumbest things that happens and that show is that there's a you know, there's a hacker lady character, and she's she's crazy in this This billionaire finds her and he wants to pay her an exorbitant amount of money to get this slow down the internet. It's like she's he says, we need you to slow down the internet, and she just goes how slow, Like she has the dial to the Internet on her a computer, like, well, let me just crank this down to three and now now everyone's working on a three speed as opposed to eleven. It's exactly that and that doesn't even work in a car, just for some perspective for people who want to know more examples, You've got a pretty good, pretty comprehensive list here of the various different things likely run by a computer in the average person's car today. Yeah, you've got a lot of different systems that are now electronic and no longer mechanical. So here's just some that could be connected to a microprocessor. Uh, the engine ignition, fuel injection, missions controls, that's a big one, breaking steering, transmission controls, collision avoidance systems, they definitely have microprocessors. Heating and air conditioning systems, navigation systems, communication systems, entertainment systems, safety and security systems. So that would include things like a safety system might be anything from again, collision avoidance, that kind of thing too. And security systems would be things like a car alarm or the safety system might be the way a dealership is able to track down a vehicle. Let's say that you have reported as stolen vehicle. Some dealerships, some car companies include systems that allow wherever you bought the car from to be able to find where that particular receiver is. Well, that receiver has to be able to connect and communicate through a system somehow, So that's you know, any time you talk about a system that communicates to the outside world, that's a potential invasion vector. That's where someone can get at your your car. Because a lot of car, like a lot of cars, we just look at them as closed systems, and a lot of them are. A lot of them are totally closed off, which means that your your invasion h vectors are limited. And we'll talk more about that in a bit, but at any rate, your typical car today has probably around one hundred micro processors, and it maybe more, and within the next few years that's going to double. We're gonna see twice. In fact, I am I imagine a lot of the cars that are coming out this year, especially the high end luxury cars that tend to feature these systems, before we see it rolled out to the general fleet, they probably already are around two hundred microprocessors. Uh. In fact, this this figure of a hundred microprocessors was in an article from two thousand eleven, So it may even be that your average car has two hundred by now, um and and five miles of wiring to connect all those systems are in the car. Yeah, that's one of my favorite statistics that you're pulled up and and before we go aiming further, now we we already i think did an okay job of saying that, uh, what you've see in hollywood's on what you've see in real life. But we should also say that hacking in the way that we're using it, which is a little bit more colloquial, hacking is not necessarily something that a fee would do to your car. Right. It's not necessarily an invasive technique to take over a system. Right. Hacking just means that you are using techniques to get a specific result, using a system that wasn't necessarily intended to get that result. So hackers can be of all shapes and sizes. They can have all different types of interest. It doesn't have to be a computer. You know, we've seen life hacks, this idea of you want to achieve a specific outcome, here's a cool way to do that. They're not always the most elegant approach. It's not always the cleanest or the simplest, but sometimes it's it's one that just works. That's the goal of the hacker is to find a way of making that outcome happen. So early computer programmers were called hackers because they were hacking together code to make something happen. And sure they might have used, you know, twice as many lines of code then we're what was strictly necessary, but they were just trying to get it done in the time. Well, hackers with cars might be hacking their own vehicles. It might not be in order to try and sabotage a vehicle, but rather to change the parameters that it can work within. So you might want to, I don't know, make remove any limiting factors and yeah, governors, things like that to to make your car um work with greater horsepower or more torque or moving a faster top speed. And there are a lot of systems that are in place to limit that kind of thing so that a car works within safety parameters, right, because once you get beyond that, you start to really test the strength of the vehicle and maybe that it can't hold up to greater speeds over a certain amount. And usually once you'll get as a car company that will dial that back to within a safe limit and say all right, well here's the maximum and it's well below that that real top limit, which same sort of thing we see with overclocking with microprocessors. So there are some car hackers who will go in and they'll reef flash the engine engine control unit or electronic control unit that's e c U, and they'll go in and they'll reflash it, which means that they will essentially start with a clean slate and and um change a few of the parameters can be really dangerous. By the way, Yeah, we're not we are officially not recommending that you do this, although it is interesting. Um and in some ways, I think there's a very positive note. Statistically speaking, the person most likely to hack your car is you. Yeah, that's the best news. But it can be really dangerous or at the very least, it can damage your vehicle to the point where you can't drive it anymore. Or you might do something where you're you're tweaking something in the e CU, thinking that you're going to squeeze another fifteen miles per hour out of the top speed, but turns out instead what you've done is have it honking forever and you can't stop it. Uh. And you know this sort of stuff obvious avoids, warranties. You know there are a lot of issues that if if things go wrong, you could be stuck with the bill period. There might not be any help for you. You might not be able to get it covered by insurance or warranties, that kind of thing, and you'll have to walk somewhere to pay. Yeah. Yeah, So I've seen pictures of stuff like um uh, like the the pistons that you would find within an engine, just they're unrecognizable because they had been put through such speed and force that it beat them out of the shape that they were supposed to be in. So bad things can happen if you don't know what you're doing, and very few people really know what they're doing, and in order to get into work you often have to do stuff like tweak the fuel injection system, which you know, if you don't know your physics and chemistry, you're not going to get that mixed right and you could just end up making your vehicle undrivable. And there are people, of course, especially in the world of racing, who professionally tune cars and to a degree hack them. Sure, but keep in mind these are cars that are already built for racing. They have a much lower lifespan and they're only built to do one thing. Yeah, and you know, the real issue we're having here is something that's kind of you know, we didn't really mention this in the notes, but something that we see throughout the industry, which is that cars are getting so complicated with all these different electronic systems that even people who are experienced mechanics can encounter issues because you've got all these different proprietary systems, you've got all these different electronic subsystems within the car, and uh, you can't necessarily be an expert on everything all the time. So yeah, it's it's tough for everybody out there, like it's tough for professional mechanics now too. Yeah, that's a really good point. I'm glad you made it because this maybe is a little bit of a tangent for us. But it is very important to note that, just as you said, mechanics, especially mechanics who came up under what I guess we would call the old school, would ways now are increasingly finding that a higher number of repairs require shipping to the manufacturer, which is not what you want to hear when your car is broken down. Yeah, if you're looking at any vehicle post nineteen. It's got a lot of electronic systems in it, that's true, and some of those are mandated, right. Yeah. In fact, that was one of the reasons why the cars are the way they are is because you had states like California that had to put in emissions controls. I mean, we've all seen the pictures of Los Angeles and the haze, the pollution that hangs above the city, and so there were there was a lot of incentive to try and clean up the air as much as possible. Part of that was controlling the emissions made from vehicles. So emission control systems and emission detection systems became an important part of vehicles within that state, and once people started to develop onboard diagnostics systems to make sure that a car was working within the right legal limits of emissions, that rolled out to the rest of the United States and became a requirement for all vehicles. And so a lot of these were originally electronic systems that were designed to make a particular model of car safer than previous models, but because of their proved efficacy, they are now required in all vehicles, not just you know, the ones that they viewed it. So, uh, Scott and I talked about how that is also driving the average price of cars up. Yeah. Yeah, but they those those cars are getting more and more sophisticated, they also get more and more expensive. But it also means that, again, we have more and more systems that could potentially be exploited. And by potentially we mean that your car could be potentially exploited. By exploited, we mean that there is proven research, peer reviewed. These guys went to def Con. They're not just they're not just you know, like you and mean Jonathan hanging out in a garage and saying let's see what we can do. Yeah, they're not They're not feorizing, right, They have actually done some hacking to see how cars can be vulnerable to different types of attacks. And you've got a pair of hackers that that I think you want to talk about, right, Oh yeah, yeah yeah. These would be Miller and Valisc There two of the biggest names in the world of car hacking research. Charlie Miller Chris Valisac. I want to set this up for a quotation that maybe you could read, um Miller is a or was at one time a security engineer. Twitter valisc director of Security intelligence at a Seattle consultancy called IOActive or IOActive, but they they received an eighty thousand dollar grant from DARPA to research security vulnerabilities of cars. And I think in this context it's helpful to think of them as white hat hackers. Yeah, they were specifically hired to say, can you can you breach this cars systems and exploit it? Because we need to know if that's a possibility, and we need to know where the vulnerabilities are. That's definitely a white hat approach. Yes, So we've got We've got a quotation from a summary of their um groundbreaking two thousand eleven paper that if absolutely here we go, I made you do the first one. Previous research has shown that it is possible for an attacker to get remote code execution on the electronic control units ECU in automotive vehicles via various interfaces such as the Bluetooth interface and the telematics unit. This paper aims to expand on the ideas of what such an attacker could do to influence the behavior of the vehicle after that type of attack. So here's what they did. I know that's in some dry language, but they're talking about some frankly frightening stuff. They essentially they built the software tools to uh enable a Mac laptop, going back to Apple uh and and also back to Independence Day. Yeah, yes, you're going to explore way to technology. You need to use Apple computer in order to insert the code, right, Yeah, just reroute the encryptions. That's a little callback for everybody who listen to our previous series. Uh. Yeah. They plugged into the diagnostic port of the car, which again, um, there's an overwhelming chance, unless you're driving a classic car, that you have one of these. Yeah. And and this was one of those things that was mandated by law because it allows a very quick assessment of how a vehicle is performing. Yeah, and they they found because they are white hat, they presented their software and their findings. They want public and transparent with the two thousand thirteen def con, and they wanted other researchers in on this game to help find and fix the security flaws before hackers or you know, incredibly sophisticated car thieves got to them. Usually, like when we talk about malicious hackers, we often use the term crackers, as in people who cracked the security in order to exploit it. Ah, that's all right, you're putting me on the game here. You know, it's just one of those one of those terms I rarely bust out. But that is in fact one because because hacker does not necessarily mean malicious exactly, but it often has portrayed such in the media. It's a it's a because it's a shorthand way of saying, this person who wants to get access to your stuff, this is crucial, this kind of information. It's crucial because more and more cars have onboard WiFi networks, each of which is to a degree proprietary. Know, General Motors has on Star, Toyota's got Safety connect etcetera. Um. But of course they are not the only researchers in the game, and their methods, which we'll talk about in a little bit, are not the only options because if you recall earlier, ladies and gentlemen, we talked about an exception to the rule of multi car hacking. Yeah, so car dealerships. You know, I mentioned the idea of having those systems in place you to be able to track down a vehicle in case it's been stolen, and this is becoming a standard feature in a lot of automobiles. These days. In two thousand and ten, Omar Or Ramos Lopez, who was a former employee of an Austin card dealership, used the vehicle tracking system to get revenge. This is where we see a well intentioned system, which is, you know, designed to do one thing very well, can sometimes be put to misuse by someone who has ulterior motives. Reminds me of a lot of discussions I've had about the n s A. Your your your intentions may have been pure, but you've built a tool that humans use, and humans have some pretty base desires occasionally. So the system allowed the dealer to send wireless reminders about the linquent payments to customers and also allowed this particular ex employee to remotely hack the vehicles of nearly one people, which, uh the result of the hack was that their car horns started honking uncontrollably and disabled their the ignissions of their cars. So not only was their car honking and honking and honking, they could not you know, turn on the car. Wow. And that's that's weird because ordinarily those functions which are in that existing hardware are I imagine for people who are not paying their car payment or their leasing or something, or they have their car stolen, and that way, the car suddenly becomes inoperable and it's making a nuisance of itself, two things that you want if you have, say, police out there looking for your stolen vehicle. Yeah, that's a really good point. But Omar managed to hack the system. Of course, he did later get arrested ladies and gentlemen, which is how he knows his name. Yeah, and clearly it was a an ultimately unsuccessful attempt because he didn't get away clean. It was not a successful exploit. Now, in many of the cases that you'll here mentioned about car hacking in the news, there's this very important caveat the hackers needed some sort of physical access to the vehicle through its o b D the onboard diagnostic port. And you know that that makes sense. So Valsake and Miller plugging in the thing directly to a car or Omar using pre existing hardware on the car, so they have that access, and they have to have that to get there right well mostly okay, So generally speaking, that is the surest way to to be able to get access to a car subsystems is being able to plug physically into that car, which means they already have to have physical access to the inside of your car, and not to not to do a spoiler. But there's a point I think that you make later in the notes that it behooves us to bring up. Now, if you're gonna go through that much trouble, there's probably other stuff you can do to the person you're aiming at that that you know, you can save a lot of time and effort and not go to the trouble of getting access to their vehicle, plugging in secretly without them knowing about it, yes, and being redundant there, then inserting whatever malicious code you have and and changing all of their systems around and then leaving. That's a lot of that's a lot of trouble, whereas you could do something like, I don't know, disabled their their brake system, like physically disabled their brake system. Yeah, so uh yeah, there's certainly the possibility and the plausibility are two different things. But then the idea of getting at a car without physically plugging in is something that people are exploring because, as you mentioned, a lot of these have these these various communication systems that connect to the outside world. That's a possible point of intrusion. Now, it all depends on whether or not that system is connected to any other systems in the car. Now, if you're talking about safety system, it probably is at least on a diagnostic level, because it has to be able to send an alert to whatever agency is in charge of responding to those Right, So, if you have a vehicle has a safety system in it that can detect something wrong with your vehicle, send that message off to a security firm whatever it may be, like on Star is a great example. And then on Star response, Well, that that that connection, that wireless communication is a possible point of intrusion, and since it can at least diagnose problems and systems, it may give people the opportunity to mess with those systems. But this is a big there's a lot of big ifs. These are a lot of big gifts. But the research is there, you know. Yeah, So you have the research from the University of California and University of Washington hacking the controller area network or CAN of an unnamed late model car, and they were able to put in malicious commands through the cars satellite radio. So I assume they made the person listen to Robin Thick or something, right, I guess not it's two thousand eleven blurredlines wasn't around yet, but no, it was just him just that that's something that no one should have to endure except possibly Alan Thick. But yeah, So the idea was that they could sneak malicious commands and actually it's a satellite radio, WiFi or a CD containing the virus, which is interesting. I never would have thought that a sound system presumably that's what you're putting the CD into, or at least an entertainment system, that that would have any kind of access to other important systems within the car. But it may very well be that it's connected to that same network, and then once you have access to the network, you can start to try and get access to some of the more critical subsystems, things like power steering, which would be you know, catastrophic obviously potentially. So yeah. One of the one of the professors involved in some of these tests, a guy named Stefan Savage Uh, said that these wireless hacks still remain possible. Specifically said, the vulnerabilities that we found were the kind that existed on PCs in the early to mid nineteen hundreds when computers were first getting on the Internet. And uh, here's I think the strangest example that I've read so far, and maybe maybe readers and maybe you have a different one. Uh, what if you could take a car's tire pressure monitoring system and use that as a way to monitor the movements of a car? To me, that sounds like a sci fi writer was running out of ideas and season uh, you know six of an anthology show, right, yeah, yeah, and they said, let's make this next season six. But the researchers from Rutgers University and University South Carolina demonstrated in the possibility of this that's pretty incredible and it's and they use the wireless seeing signals sent out by the pressure monitoring system to to I guess, uh trace ping's on. Yeah. Well, let's talk about some of the other things that you could do potentially if you were able to access a car's computer systems, keeping in mind that most of these again are probably due to uh, physically connecting with the vehicle and inserting yeah, as opposed to you know, it's not like someone whipped out a giant remote control and suddenly suddenly they make your car feer left. But they could. We've mentioned honking the horn. Uh, that's certainly possible. Uh. There was one about the Toyota Prius and being able to slam its brakes when the car is already traveling at high speed, thus uh, potentially leading to a situation where the car gets out of control. At the very least, it's going to lead to a situation where the car is going to become a hazard to anyone who's traveling at that same rate of speed behind them. Uh. Then there's the killing the power steering. Anyone who's ever driven a vehicle without power steering or where the power steering has suddenly become uh inactive, knows that that is no Joe. I mean that you really don't know how much that power steering helps you until you try and drive a vehicle that does not have it. Um spoofing the GPS, So this would be a way of making a car appear someplace where it's not actually used a GPS spoofer for a while. Yeah, Um, I'm not proud of it. It was for a really dumb reason too. You want to know what it was. Okay, So when I say dumb reason, I'm not saying anything like, um, like illicit, or or or like salacious. I was using a GPS spoofer because I had downloaded an app that was a promotional app for a popular science fiction film, and part of it would give you achievements for checking in at certain physical locations. And some of those physical locations because of the particular film I'm talking about, we're located in San Francisco. I am not in San Francisco, but I wanted those achievements, and so by spoofing my GPS I could make it appear as if I were in San Francisco at the specific locations, check into those locations and get the achievements. It was Star Trek Star Trek, Yeah, it was the j J Abrams Star Trek reboot. It was actually Star Trek Into Darkness. To be specific. I think I finally achieved the rank of captain. My wife is an admiral, so that'll tell you. Isn't that against Star Trek code. Look, look, if Captain Kirk can cheat during the Kobe y Ashi Maru, then I can cheat in the check in sport. But anyway, spoofing GPS is that's a serious issue because let's say that the GPS is tied to again the car monitoring system. If if the car appears to be someplace that's not then any sort of response physical response sent from say on Star again is going to go to the wrong location. So that's a real thing. Then there's a falsifying speedometers and odometers. I mean it's falsifying an odometer that you can see lots of ress. Um. There's violently making the vehicle just jerk around not good um. And also they demonstrated that they can exploit both of Toyota and Affords self parking functions to hijack a vehicle steering, essentially turning it into a primitive kind of remote controlled vehicle. And you you can sort of see where that would come into play, because obviously if you have a parallel parking automated system, it has to be able to control the steering and breaking of the vehicle in order for that to work. So you just give it a new set of instructions. Yeah. Now, again this is all stuff that you know, you would have to have physical access to the vehicle first before you could have introduced these problems. So if you're really careful with the way your you know, your vehicle is like your your vehicle secure, then you don't need to worry about this so much. But yeah, that's that's a good point. And before this becomes too uh too scary for anybody, let's also keep in mind that when Miller and val Sec were demonstrating these things, especially to a couple of journalists, one of the guys was literally sitting in the car with his laptop plugged in running the code. So, uh, I guess if you see someone you don't know in the backseat of your co there might be some other questions you come up with before you actually get the car in motion, right, Yeah, so it's not it's the odds of you hopping into your two thousand ten preus or escape and then finding that the car is completely not under your control are very, very very low. Yeah. The the point that these hackers were making was that the vulnerabilities existed, and that the vulnerabilities could be addressed and sealed up so that it would no longer be a point of entry for a hacker. So it was you know, they didn't need for the demonstration to be practical, They just needed to show that, look, with enough work, you can do this, and presumably if you're really determined you could create, say a module that plugs into the onboard diagnostic system and has a wireless communication with a laptop, and then I don't have to be in the back seat anymore because I can just send those the communications straight through. But not that anyone's developed that, but rather that we need to address the vulnerabilities that would make such a thing possible. Yeah, exactly, And again just underlining that if something is controlled by a computer in your car, then another computer can be come involved and and anything from your power windows to your breaking that function could be hacked. We talked a little bit already about the the evolution of the e c U, right. Yeah. The whole point about these are these were systems made to make either cars safer or to have a smaller environmental impact, and that these were things that because they were because of their benefits, they ended up being required, you know, and you've got some you've got some great notes here about the can bus. Ultimately, what what Millar and valis act we're doing, is they're analyzing the can bus and they're they're using that kind of like their skeleton key or their highway. Now you can think of the can bus that's sort of its own little maniature network. Uh So think of it like, you know, think of the Internet in microcosm, except it's all within the context of a car. And the can is what pretty much allows various uh subsystems to be interconnected, and it can interconnect up to forty different systems for the different devices anyway, and information travels at about one megabit per second, which is, you know, compared to broadband speeds. Well in the United States, broadband is defined as four megabits per second, so it's really not that far behind, but it's it's uh more than sufficient for the kind of data that the vehicle tends to work in because it's not you know, it's not con scarned with everything. It's concerned with very specific systems like fuel injection or spedometer or that sort of stuff. So it's definitely sufficient for that kind of thing. But that is again, you know, anytime you have a system where data is traveling around, then there's the potential of exploiting it if you can get that point of entry. So when they were defcon they explained this sort of stuff. They also said that, uh, part of their process was to get these proprietary messages. One of the most base ways to think of it is speaking the language of the car, right, and so by learning some of those links, those phrases uh, in this tortured analogy I painted myself into UH, they can replay these on a device that's hooked up to the diagnostic connector ports, and then they can uh influence the breaking in the steering. And then as you said, they can also modify the existing firmware so that they can still have this signal interplay without having a guy in the back. Um. But to me, it's interesting that this is not more of a big deal externally with companies. You know, this seems like the kind of thing that could easily become alarmist, and I'm surprised that there hasn't already been more examination of it. I think part of it is that we're still in the early days right right now. It's in the hacker culture, it's something that's being discussed, and in car culture, where you have people who mod and tune their own cards. It's being discussed, but usually from the perspective of how can I make my car do something it was not meant to do? Yeah, without how can I over clock without falling apart right right from the hacker culture, it's more about what are the potential vulnerabilities and either how can I exploit them or how can I prevent them from being exploited companies, I mean, bringing attention to it is probably not something that most companies want to do. They want to sell cars, but a lot of them are definitely responding by saying, this is something we really are concerned about. We want to make sure that our our cars as as safe as possible. We take it very seriously. We want to make sure that it's not a trivial task to tap into one of these cars. So, yeah, exactly, And the statements of various companies, of course, for its is to take it very seriously. In other car companies are saying that there is a differentiation that needs to be made between hacking a car with physical access versus remote hacking, and uh, for many car companies, the focus is on preventing that kind of exploitation remotely. Well, yeah, because that's the one that is more likely to like, if it's a possible, that's the more likely vector because it's the one that requires less work on the part of the person who's trying to get access to the car. You know, if if I find out the only way that I'm going to be able to sabotage my enemies vehicle is if I get physical access to the inside of the vehicle, and then I have to be there for a couple of hours while I reflashed the engine control unit. That's not really that attractive to me. I mean, do you have any enemies that, like I was gonna say, I would wing man on that wing, but that would take all afternoon. See Ben, what I'm telling you now is that I didn't use this approach because I'm much more efficient. But at any rate, uh the Yeah, if you could get access remotely, then clearly that would be a big draw for potential hackers. Now, they also point out that it's usually a one on one kind of thing that the approaches we've seen so far, with the exception of exploiting the dealership system, which you know, again, then you have to get access to the dealership system, which is which is even more difficult at least presumably than an individual vehicle. But because these are one on one attacks, you would have to be targeted specifically. Now, if you own a really high end luxury vehicle. That might happen, right but the likelihood of having a vehicle stolen if it's a high end luxury vehicle is already increased. Right there. There are multiple there are multiple avenues that people will go through in order to get hold of that vehicle. Some of them might involve electronic hijacking, some of them might involve just getting physical access to the car and hot wiring the thing. I mean, it's you know, that's that's a risk to take with a high end luxury vehicle, and you usually will take uh, you know, you'll take steps to prevent that from happening, hopefully, you know, like possibly hiring a very large person to stand right next to the vehicle and uh and discourage people from getting too close. But um, yeah, because we're not getting this kind of car communication where the cars are constantly part of the larger Internet, then it's it's fairly it's fairly safe right now from the remote attacks. As cars get more and more Internet capable and Internet connected, then you have to sit there and say, all right, well, how is the car interacting with the Internet. Can that be identified from an external source? If it could be identified, can it also be exploited. And that's those are the questions that are really going to be important to answer. And I suspect we're going to see more and more cars get this sort of Internet connection. I mean, we're already seeing it with entertainment systems again, right, so you have cars that have entertainment systems that do connect either to the Internet via satellite or through the cellular network. You know, however it may be, um, that's again a potential point of entry, assuming that the subsystem is designed to communicate with other systems. One way to prevent this is to say, all right, well, which systems need to talk to each other and which ones totally don't need to talk to anything, And let's make sure that those are boxed away so that if someone gets access to them, the worst you're gonna get is they're making me listen to I don't know, modern country. That would drive me crazy. Yeah, you know, we could do an entirely different show on modern country versus classic country. Yeah, okay, like Hank Williams Sr. Brilliant man. But you know, okay, you're right, I'm not gonna go down. I have I have some questions for you as our resident tech expert UM and to ask to set up one of these questions. First, I have a have a short little anecdote here. In two thousand thirteen is reported by the Guardian, there was a scientist named Flavio Garcia, which name, which is a wonderful name. I I had first assumed he was a name scientist. But he had an academic paper that he had written with several colleagues revealing the secret codes used to start luxury cars out He's Bentley's and so on. And the judge in the case, uh, there was there was a suppression case right right, Uh to suppress the paper rights some car companies wanted to us, and the judge ultimately ruled that it should be suppressed. I think specifically this was the parent company of Volkswagen, and the idea here was um. The the idea was that the scientists, by publishing this paper were endangering you know, hundreds of thousands of car owners minimum and and even even if you don't consider it a danger immediately, let's say that it inspires the companies to do a recall, or that all those customers go out to have this system changed. That's a real monetary impact. Either to the owners or the car companies or both to both most likely and uh what they found in the course of the investigation was that Garcia's team was deriving these codes but by cracking the algorithms there. They used complex mathematical models to check the software behind in the code. But here's the thing, man, the code, they the process they were using in their conclusion and stuff like that, we're in some pieces they were available and since two thousand nine. So what my question is with this, with this dilemma, and I think it is, um, where where would you fall? Like professionally, what's the idea here? Is this a case? Where is this a case where security trump's transparency or I think so? I think my my general philosophy and these matters, and this goes to all sorts of all types of white hat hacking. My general philosophy is that it is the responsible thing to do is to alert whatever governing body, whether that's a country, a company, uh, some some specific programmers, whatever, whoever is responsible for the hacked system, to let them know what the vulnerability is and to say, here is how I exploited thatulnerability. You need to address this. I think that's the responsible thing to do. It's also fair too, I think to say that there is a vulnerability, that you found a vulnerability, not to say what the vulnerability is necessarily or how you exploited it, but that one does exist because then it creates the incentive on the part of the the person in charge to actually address the problem and fix it. I see, So go straight to the source, not to USA Today or something. Yeah, I mean, go to the source first, and then give the source enough time to sit there and at least evaluate what you have said, and then go to the press and say, all right, here's the deal. There's there's this problem and if it's not addressed, then this is what could happen. This is the potential outcome. Uh. And that was you know, like the heart bleed bug is a great example. You know, this is one of those things where when you discover it, you kind of, I think, have the responsibility to let people know, hey, there's this problem. Here, here's how how exploited it, here's what needs to happen, and then reveal it to everybody because the potential impact is so great. But you don't actually unveil how step by step to exploit the vulnerability that is irresponsible as well, and that goes from white hat hacking to black hack hacking in my mind. So I've seen this over and over again in the in the computer world, where an operating system comes out and someone or an operate system that's been out forever, someone discovers that there's a vulnerability, and generally speaking, what they do is they alert the operating system, uh, you know, developer, and then after a set amount of time, will say, all right, we found a vulnerability. Here's what the vulnerability does. I'm not going to tell you how to do it, but here's what happens if someone exploits it and this company needs to fix it, and that again puts that social pressure on the company. Yeah, I see what you're seeing, and I think that's I think that's a decent compromise. But between the two principles and it sounds pretty ethical. And now we go to Now we go to the question that might be on everybody's mind. Uh so, wait, guys, Jonathan Ben, will my car be hacked? Probably not, that's true. There's no silver bullet hack. As we've said, and with the exception of that dealer fleet. Um, you know, as you as you point out Uh, someone would have to the whomever would do this to you would have to have a lot of time on their hands, a heck of a lot of book smarts, right, and a lot of motivation, a lot of They would have to have it out for you specific must have done something really awful to that person, kill their father and gave up fencing. Let's let's just look at the the plots for taking one through three. You've done something on those plots against Liam Neeson, and he has the reason to hack your car now, right. The truth of it is, it's just incredibly inconvenient to do so. And if we look at I love that you said, taken. But because if you look at all the stuff we've said now, for something like this to have to happen, honestly, those would be like action movie problems that most people, uh hopefully don't have. Yeah, it's the same sort of thing like if you if you are flying back on Christmas and you have to go to Naca Tomi Plaza, you're probably not gonna relive die hard. You know, it's just it's it's an action movie thing, not a real life thing. But uh, you know, it's certainly one of the things that awareness is good because we're getting into a more uh you know, the trend of of computers and electronic systems getting getting more advanced in cars is not going to reverse, it's going to continue, it's gonna evolve, and we're getting closer and closer to autonomous cars. Clearly, when you get to a system where the car itself is taken over, then at least the idea of the possibility of hacking becomes more realistic to people. Keep in mind, the systems we talked about, they can affect a manually controlled car. We're not suggesting that if you have your hands on the wheel you can prevent this from happening. But I think once you get to the point where you no longer have to have your hands on the wheel that you're on one of those Google cars that can that doesn't even have a wheel, the mindset is that, oh, computer is controlling this. Someone could get control of the computer. It just seems like it's more possible in that model, even though even though it may not necessarily be more possible, But as we get these cars that communicate more and more with the outside world, then clearly that's something for us to keep in mind. And uh. It also drives home a point that Scott Benjamin and I made in our Autonomous Cars episode. We talked about how early implementations all imagine that the autonomous car was going to be part of a larger autonomous system. Right, You're gonna have the the super Highway of the future, and that was going to be the infrastructure, and the cars were going to be largely passive and receive direction from the outside world. Well, in that world, you could definitely imagine a system that takes advantage of that and sends conflicting commands to the cars that are going down the road. But as we've seen this technology mature, it turns out that it's all being self contained in the vehicle. It's not dependent upon the environment outside the vehicle, which means it's harder to get at that system so that we benefit from that. So, um, I think that because we didn't go in this world where all the cars have to talk to each other, and we discovered no, they don't really need to talk to each other. If they have the sensors to detect each other, that's enough. They don't actually have to have two way communication. Well, then you start cutting down on those vectors we were talking about. So just the way the technology is matured, which I don't think has anything necessarily to do with security, benefits us in a security way. I see what you're saying. And to be completely candid, we know that we are on the course of a very very swift evolution, not revolution, because the progress made in automotive science, in uh just electronic communication means that the cars children born today drive are going to be radically different. They might not be driving. Yeah, they That's That's where I'm getting at, man, they may just not be driving. Henrik Kristensen over at Georgia Tech made the prediction on one of my episodes of forward thinking that children born today will never have to drive a car because the cars of their generation will all be like, at least a car that you you could buy a car once they reached the driving age that does all the driving for you and uh and it's that's one of those things that's going to require a lot of changes, not just in technology but in policies. Um And there are a lot of important questions that you have to answer personally. I think that most technologies are going to be able to behave more responsibly than people do. But that's because you know, I have a lot of faith in the reaction time of a computer compared to the reaction time of a human being. I've seen I mean, look, I've played those games and those computer bots that they cheat. Man, they are cheap. They juggle you. It's terrible. But anyway, um, yeah, I mean this this is one of those things that I'm glad you brought it up. I'm glad that this was a discussion we could have because, uh, it's it's certainly an area that people are getting more and more interested in, and there's so little information that the average person has access to, and and we've seen so much in the hacking world as far as computers go, that it could very quickly escalate into a fear, uncertainty, and doubt. Uh you know, chaos, right, Because you look and see the kinds of exploits people have made with like credit card systems, you think, well, what if we apply that same sort of exploit system with a car that the results could be devastating. Yeah, there was already a huge stink that was raised when we in the United States there's this mandate that's going to require every car to have the equivalent of a black box like you would see on a plane, right, just captures all the data. And there was this huge stink raised about it when it hit the news. Uh, so much of a huge stink that people forgot to do their research and find out that the vast majority of US cars have had those very number of years. So it's I think you're right, uh, if you're in the uncertainty, because we have such a dichotomy and when we contemplate the future, it's dystopic or it's utopian, you know, utopic, Yeah, yeah, exactly. We we tend to see things in the the extreme ends of the spectrum, and the truth is we're going to live somewhere in the middle and if if we're lucky, it's gonna be leaning heavier on the utopia side than the dystopia. And if we're not observant and responsive, it'll definitely be on the second one to dystopia rather than utopia. But um, yeah, I think I think it's good to to just you know, keep in mind that there are electronic systems in your car. Electronic systems can fail just like any other system. Uh, they can be sabotaged with the right amount of um of vim and vigor and elbow grease. But it's probably it's more likely than not it's never gonna happen to you, like, far more likely than not um, at least in the current iteration of the wave vehicles work. Uh, You're much more likely to encounter something that would be a problem, like a driver cutting you off in traffic, which happens all the time and could lead to really disastrous results, then you ever would be with someone hacking your car. Uh. So I'm glad we could talk of out it. Uh. It's really an interesting topic. Ben People can find your work all over the darn place. With how stuff works. You are a host of car stuff. Along with Scott Benjamin, you are a host of stuff they don't want you to know. Along with Matt Frederick, you are one of the many hosts of brain stuff. I am also occasionally on brain stuff. Are you doing what the stuff? We're both on what the stuff? Uh? I don't even know what shows I host anymore, so I have to ask you which ones you do? Have I missed any you will know? We're I think those are most of the food science Oh, food stuff stuff your food stuff? Okay, now, folks on got another another final little tangent. If you have not watched the How Stuff Works Food Stuff episodes, you have got to do that, and you need to do them in order because there's the narratives from one episode to the next, so it does actually progress. And you will also see occasionally other people from How Stuff Works pop up. Joe McCormick, who is one of the hosts of Forward Thinking podcast and also one of the writers for Forward Thinking. He pops up in a recent episode and they are informative and they really exercise the comedic chops of Mr Ben Boland and Ms Kristen Conger, both of whom are brilliant improvisers. So you've got to treat yourself and go check out the Food Stuff So it's they're fantastic. Wow, that's high. That's high. It's I'm buttering you up so that you put me on the show. I want to be on an episode, but I'll have to come up with whatever the topic will be. But anyway, guys, check out those shows. Remember you can get in touch with tech stuff. Let's know, any suggestions you might have for future episodes. Maybe there's another guest that you want to have back. Maybe maybe you're thinking, Hey, we gotta have Ben back on the show as soon as possible. Let me know. Send me an email. My address is tech Stuff at how stuff works dot com, or you can drop me a line on Facebook, Twitter, or Tumblr. The handle it all three is tech stuff H s W. And I'll talk to you again, really soon