It's about time: open-source software for vehicles

[Nords]

I'm fascinated to see where car hacking will take us in the next 10 years:
OpenXC: Ford Launches an Open-Source Platform for In-Car Connectivity and Apps — SiliconFilter

The engineers & geeks at PriusChat.com have been scraping data buses and reverse-engineering the software of the car's ECUs for over a decade, and now it looks like Ford is about to formally embrace open-source software for the "infotainment" portion of the vehicle.

Quote:

What if the user-facing hardware and software was independent from any one vehicle, and could be purchased and installed by consumers as an aftermarket add-on? What if the infotainment hardware was more modular and user-upgradable, and perhaps most importantly, transferable from one vehicle to another? If it becomes widely adopted, every car would feature an OpenXC connection that is linked to the dashboard interface and audio system. Then, you could just buy extra hardware modules or software for your cars and plug it into the OpenXC connections just like you plug a USB device into your computer. Your wireless provider, for example, could offer a 3G module and if you want to switch to LTE, you just swap the modules out.

I just want to be able to plug in the latest gizmo without having to rewire an entire cable harness... and, hey, could I have those speakers connected wirelessly over my car router?

[arky]

That's what I want, a car radio/GPS/MP3 player.... etc., as reliable and safe as the Windows OS is !

[M Paquette]

Quote:

Originally Posted by arky That's what I want, a car radio/GPS/MP3 player.... etc., as reliable and safe as the Windows OS is !

Clippy: "Hi there! I see you're trying to use the brakes. Would you like to upgrade to Microsoft Brakes 2.0?"

[HFWR]

Nothing open-source about Windoze...

[Nords]

Quote:

Originally Posted by M Paquette Clippy: "Hi there! I see you're trying to use the brakes. Would you like to upgrade to Microsoft Brakes 2.0?"

OK, maybe just this once I'd like to pay extra for iOS LeopardCheetahPantherLion...

[rescueme]

Quote:

Originally Posted by Nords OK, maybe just this once I'd like to pay extra for iOS LeopardCheetahPantherLion...

And also use it as your vehicle's security system?

http://www.youtube.com/user/GEICO/featured

[explanade]

I haven't looked at cars in years but are these electronics competitive?

For instance, I'm sure they will look at ways to get Internet or at least things like Facebook and Twitter into cars.

But the GPS from car manufacturers, while nice to have it built-in and integrated to the dash, is a ripoff, usually requiring expensive premium packages, costing several thousand dollars.

You can get GPS devices which are more capable and easier to upgrade and customize for $100, maybe even less. Not to mention, smart phones have A-GPS, which is even better and have better searching for POIs than any car manufacturer GPS.

So I question whether the electronics from car makers will be any better than smart phones an tablets, which are always being upgraded every year. Plus, if you get a data package for your smart phone or tablet, are you going to also get data for the built-in car gadgets too?

Smarter thing for car makers is to make the built-in stereo and any screen integrate better with smart phones and tablets. Offer some good mounting options and USB ports, for instance. A lot of car makers started putting in Aux in jacks and USB ports to work better with iPods. These days, fewer people are interested in CDs or satellite radio in the car.

And of course they have to make money but the premium packages are just ridiculous. You have to pay several thousand to get a package which includes Bluetooth. Really?

[Nords]

Quote:

Originally Posted by explanade I haven't looked at cars in years but are these electronics competitive?

I think you're missing the whole point of the concept of open-source software for vehicles!!

[explanade]

I question whether the "infotainment" equipment on cars will deliver the price-performance that standalone devices will offer.

Software can only do so much.

For instance, there may be custom Android ROMs for 2-year old Android phones with single-core processors, to run the latest Android. But it's doubtful that software alone will improve the performance and overall experience.

[Midpack]

Quote:

Originally Posted by explanade I question whether the "infotainment" equipment on cars will deliver the price-performance that standalone devices will offer. Software can only do so much. For instance, there may be custom Android ROMs for 2-year old Android phones with single-core processors, to run the latest Android. But it's doubtful that software alone will improve the performance and overall experience.

I agree with you but...just as people have been plunking down $2000 for built-in "nav" systems when they could get a great GPS with free lifetime map updates for less than $200. It's hard to know what consumers will do given another bell or whistle...

My $150 Garmin GPS is still going strong after 6 years. If it ever quits working, I'll buy another without hesitation.

[explanade]

I wonder what the take-up of OnStar is, when people have to actually start paying every month for it.

An Internet-connected device built into your car would require another mobile data contract. For the tens of millions of people who already have smart phones, this would not fly.

Remember the first cell phones were installed with dedicated antennas? Some car makers actually offered cell phones as options, with built-in antennas and hands-free setups. It changed quickly to people buying these smaller, lighter phones which could be used everywhere.

The electronics in car is old by the time they debut in a car, as it takes some time to build and source all the parts.

[Midpack]

Quote:

Originally Posted by explanade I wonder what the take-up of OnStar is, when people have to actually start paying every month for it.

I'm surprised it's this high, once cell phones became (almost) ubiquitous.

Quote:

GM says that about half of all drivers renew OnStar after the service expires. Of those, about 60 percent renew for a second year. The automaker hopes that insurance discounts will help some drivers justify the extra OnStar cost.

[ERD50]

I love the idea of open-sourcing the software in all kinds of products. Obviously, mfgs would be hesitant to do this where there are safety issues, but off the top of my head, here are a few things I would re-program if I could access the code:

KEY UNLOCK/LOCK ACTION: In one of my cars, turning the key CCW and returning it twice within ~ 2 seconds unlocks ALL the doors. That's handy, but a pain when I get in one of my other cars, do this, and then realize, 'nope, not this car, where's that unlock button?'.

CAR RADIO ACTION ON TURNING IGNITION OFF: I've been in a few cars where the radio does not shut off UNTIL you open the door. That is such a nice touch when you want to turn the car off, but catch the last bit of news or the end of a song or interview. Turn off, get your keys out of the ignition, and you are ready to go when you are done listening.

FUEL GAUGES: As I understand it, all the fuel gauge readings go through a look-up table, since fuel tanks are almost always oddly shaped to fit around other components. So '1/4 full' is usually not a 1/4 depth of fuel. It seems like 'empty' and '1/4 full' means all sorts of things in different cars. I'd like to get all the cars meaning the same thing on 1/4 and E, and when the low fuel light comes on. Most new cars have DTE readings now, so maybe this is not such a big deal (can I trust that DTE? I dunno).

WW intermittent operation: Again, every car seems to operate differently.

Cruise control: The only CC I like is my Volvo, every other car I've driven has more buttons than necessary (and still shares functions on a single button?), and poorly laid out. Turn ON, then SET, but the SET is the same as some other button (decel, resume?)? I would de-activate the "resume" button for myself. I don't like it. I don't like the fact that I might fumble, hit that button, and suddenly my car is accelerating to some previously set speed.

In the Volvo, I leave CC ON ALL the time (and it stays ON after the car is turned OFF/ON), and I simply use the UP/DOWN buttons to adjust speed. The first tap of the UP button will SET the speed where you are. Tap DOWN to lower your speed. Holding the DOWN will cancel after a while (speed setting below the min), or I might just tap the brakes. Two buttons does everything for me, and the responses make sense for those buttons. Resume is difficult to hit accidently, but I'd still rather have it de-activated.

TVs/stereos are the next thing I'd like to have Open-Sourced (some people have done this for popular music players). I don't agree with the way most of these things handle volume and channel changes. I could probably get a learning remote or fancy programmable one and maybe create these functions. I don't usually want MUTE, I want "lower the volume a whole bunch" (my 30 year old NAD receiver has this - a button that drops volume 20db). And that LAST button could cycle through maybe the last 5 stations instead of just one? On and on.

-ERD50

[explanade]

I think dealers can program things like windows and car locks, remotes.

Can't imagine they'd be too happy to allow customers to bypass them and configure their car directly.

[frank]

When did windows os become reliable? I would like to see them introduce free software for the cars complete systems checks so that you could plug your computer to it and check for faults and repair codes instead of paying the dealer one hundred dollars to do it every time you pull in the door with a warning light or whatever, and that's before they fix anything.

[ERD50]

Quote:

Originally Posted by explanade I think dealers can program things like windows and car locks, remotes. Can't imagine they'd be too happy to allow customers to bypass them and configure their car directly.

Our 2011 Honda CRV has some user configurable settings for how the door locks and a few other things work. I haven't changed anything yet, need to look at the manual again and see if anything would fit our needs better.

Quote:

Originally Posted by frank When did windows os become reliable? I would like to see them introduce free software for the cars complete systems checks so that you could plug your computer to it and check for faults and repair codes instead of paying the dealer one hundred dollars to do it every time you pull in the door with a warning light or whatever, and that's before they fix anything.

Agreed. You can buy a code reading device that works with all cars, but it would be great if you could just plug into a USB port and get all that and more on your laptop.

-ERD50

[devans0]

Quote:

Originally Posted by M Paquette Clippy: "Hi there! I see you're trying to use the brakes. Would you like to upgrade to Microsoft Brakes 2.0?"

A whole take on to the "Blue Screen of Death".

I'm still jealous of DW's key in her purse, and the doors open, the car starts. I want a house key that does that too.

[flyfishnevada]

Wait, cars used to be open source. You could fix em yourself, take out one radio and put in another, etc. Then everything got all complicated and you could hardly change out the CD player without another $200 in extra stuff to make it fit and work with your car, if you could even do it at all. Now were making it simple again. Seems like there ought to be a step in there we could have eliminated.

[sengsational]

Hopefully this isn't too long for this forum, but I found it interesting:

Quote:

ut since they are separate issues. So that's all of our update stuff. Now in the news. There was a truly horrifying revelation which occurred recently. This is some security researchers at UC San Diego and also University of Washington have recently delivered a report. I mean, so recently I don't have it yet. But they did release some news about their results hacking car control systems. And the only way I can do this justice is to read this story, which was covered many places, and in this instance it's from the BBC. The News.BBC.com says: "An investigation by security researchers found the systems to be 'fragile'" - that is, the control systems in cars - "to be fragile and easily subverted. The researchers showed how to kill a car engine remotely, turn off the brakes so the car would not stop, and make instruments give false readings. Despite their success, the team said it would be hard for malicious attackers to reproduce their work." So I want to make sure that everybody heard that. But this is - my concern is what this foretells. And we'll talk about that once I'm through reading this story: "The team of researchers, led by Professor Stefan Savage from the University of California-San Diego and Tadayoshi Kohno from the University of Washington, set out to see what resilience cars had to an attack on their control systems. 'Our findings suggest that, unfortunately, the answer is "little,"' wrote the researchers from the Center for Automotive Embedded Systems Security. The researchers concentrated their attacks on the electronic control units (ECUs) scattered throughout modern vehicles which oversee the workings of many car components. It is thought that modern vehicles have about 100 megabytes of binary code spread across up to 70 ECUs." So 100 meg of code scattered across as many as 70 different electronic control units. "Individual control units typically oversee one subsystem. But ECUs communicate, so that many different systems can be controlled as the situation demands. For instance, in a crash, seat belts may be pre-tensioned, doors unlocked, and air bags deployed." So there's a reason for these systems to intercommunicate is the point they're making. "The attackers created software called Car Shark to monitor communications between the ECUs and insert fake packets of data to carry out attacks. The team got at the ECUs via the communications ports fitted as standard on most cars that enable mechanics to gather data about a vehicle before they begin servicing or repair work. The researchers mounted a series of attacks against a stationary and moving vehicle to see how much of the car could fall under their control. "'We are able to forcibly and completely disengage the brakes while driving, making it difficult for the driver to stop,' wrote the researchers. 'Conversely, we are able to forcibly activate the brakes, lurching the driver forward and causing the car to stop suddenly.' In one attack, the team transformed the instrument panel into a clock that counted down to zero from 60 seconds. In the final seconds the horn honks; and, as zero is reached, the car engine shuts off, and the doors are locked. "They found that almost every system in the car, including engine, brakes, heating and cooling, lights, instrument panel, radio and locks was vulnerable. The team concluded that car control software was 'fragile' and easy to subvert. In some cases simply sending malformed packets of data, rather than specific control code, was enough to trigger a response. "The team are presenting a paper on their results at the IEEE symposium on Security and Privacy in California on 19 May," which is the day before we're recording this, is yesterday, or Wednesday, because we're recording this episode on Thursday this week because, as you know, Paul and I swapped... LEO: Yeah, which is very kind of you, thank you. And I should say very kind of Elaine. I apologize to Elaine, our transcriptionist, who has to work twice as fast today. Sorry. STEVE: Oh, yeah. So they said, "'Cars benefit from the fact that they are (hopefully)'" - and they put "hopefully" in their paragraph - "'not connected to the Internet (yet), and currently are not able to be remotely accessed,' said Rik Fergson, a security analyst at Trend Micro. 'So in order to carry out a successful attack you would already need to have physical access' - you would currently need to have physical access - 'to the vehicle, as a break-in or as a mechanic seem the two most likely scenarios today. As cars and everything else in life, up to and including even pacemakers or refrigerators, become steadily more connected and externally accessible, research such as this should be taken increasingly seriously by manufacturers,' he added. "'This represents an opportunity to head off a problem before it starts, in the not-too-distant future, as it may result in a real risk to life.'" Which is why I felt it was really important to share this. I mean, our listeners already know how terrifying this news is because we are, I mean, there's this tremendous drive to add features to our technology. And you can, I mean, we know that there's XM radio now in autos that is sending data to - so that we're able to listen in our cars. There's beginning to be technology that lets you check on your car. I know there's some web-based stuff that allows you to have some sort of interface with your car in some situations. So unfortunately, I mean, I just - I hope that the people who are building these systems are listening to Security Now!, and they're being insistent enough with their management about the kind of safeguards that need to be put in place. It's already dispiriting to learn that it's possible to have, I mean, we know the problems that Toyota has been having with their brakes. And presumably this is buggy code. But here we see that it's possible for, in a research environment, for just accessing through the access ports that mechanics use, that it's possible to deliberately cause a car's brakes to be disengaged so that the foot pedal no longer engages the calipers on the disks. LEO: So that's a hack. But we should emphasize, you need physical access to that port. You have to get in the car and reprogram it. STEVE: Well, we should emphasize what we know, which is that the researchers did have physical access. So, yes. I don't want to scare anyone away from driving. LEO: Nobody's going to be pointing something at you, a ray gun, a portable dog killer at you, brake killer at you as you drive by. You have to get in the car. That access port's usually right under the steering wheel on all modern cars. And they have to plug into it. At least that's the hack that they were doing. STEVE: Yes. And so the concern, again, I don't want to over-alarm anyone. But Leo, we know where these things go. I mean, it's funny because as I'm reading about them talking about a malformed packet, it's like, wow, that's what we had with routers 10 years ago. LEO: It's software. Software is hackable, often. STEVE: Yes. And unfortunately, when we hear that there's a hundred megabytes of code, it's like, okay, I'm going to keep my current car running as long as I can. Just, you know, because I like the old, the nine-year-old technology I have in it. LEO: You have a pre- what is the date that these things became common? It's been a while. STEVE: Well, yes, it is. I mean, I have a 2001 car. So it's nine years old. LEO: And it doesn't have the port. STEVE: Oh, yeah, I think it does. LEO: Yeah, I think '98 is when they started putting those ports in. STEVE: I think it does. I mean, I think that's what they check. But... LEO: '96, yeah. STEVE: But again, what happens is, as we've seen before, it's like, oh, these ports are nice. These ECUs are handy. LEO: Right. STEVE: Let's put them in the seat belt. Let's put them, like, 70 of them apparently scattered around now in many cars, all little nodes. I mean, it's like the Borg, little nodes communicating with each other. And it's like, oh. Again, I wish there weren't - okay. First of all, what would be the motivation? It's difficult to see the motivation. And motivation does matter because we know that people are hacking, that bad guys hidden through anonymity on the Internet are hacking people's computers to get their credit card numbers and identity and authentication information in order to, ultimately, somehow, to make money, to steal money, or send spam or something. So I hope there isn't motivation for this kind of auto hacking. Frankly, Leo, it wouldn't surprise me to learn that it's possible today because that's the way these things are. The level of complexity that these vehicles have obviously now achieved to me makes them seem, as these researchers said, extremely fragile. And that's just not good news. LEO: Right. STEVE: So we'll hold our breath. As we've seen also, it takes motivation. And so we'll hope there isn't nefarious motivation. LEO: This will be something on "Law and Order." I mean, it's a way to murder somebody. STEVE: Yes. Yes. LEO: But, I mean, remember "North by Northwest"? They got Cary Grant drunk, and they disconnected his brakes, and they sent him down a road. So that was 50 years ago. I mean, they had to cut the brake or let the brake fluid out. But if you have physical access to a car you can make it dangerous. STEVE: Well, yes, you can do anything, yes. LEO: And that's true in hacking, too, that a lot of times we hear about exploits that require physical access to the computer. My philosophy has always been, if somebody has physical access, you're screwed. STEVE: And my point is, physical today, nonphysical tomorrow. LEO: Right. Because it's software. STEVE: Well, and because there's, I mean, there's a tremendous desire for connectivity. I mean... LEO: That's the issue. Because right now you can't get into a car remotely because it's not online, it's not, I mean... STEVE: Well, we hear about OnStar and, you know, oh, sir, we know you've been in an accident. We're going to deploy the 9/11. LEO: Well, I talked with Ford about this, as a matter of fact, CEO Alan Mulally of Ford about this, and they make very sure to separate the entertainment computer from the car computer, and that there is not merely a firewall, but they're not connected systems. STEVE: Good, good, good, good, good. LEO: So because of that; right? You don't, if you're going to open connectivity, and boy, they really are increasing it, you cannot allow that connected computer to speak to the car computer. That would be dangerous. STEVE: Yeah. Well, and we heard, same good intention with the high-security government networks that were going to be not connected to the Internet. But they ended up somehow being connected to the Internet. And that's caused problems. LEO: Of course, somebody's pointing out, yeah, pointing out that the OnStar system can disable the car. The OnStar operator can disable the car. That would seem to me... STEVE: That's what I'm saying, Leo. LEO: ...kind of an issue. I don't know how, and I think there are rules about can they do it when it's running, et cetera, et cetera. STEVE: I know, I know. And where did they get their security certificates? Who signed them? And has that been spoofed? I mean, you put together a blended attack, and it's like, oh, boy, this stuff relies on infrastructure that the designers assume is robust. And then elsewhere the security community goes, oh, that's not quite as strong as we thought it was. And then somebody with the motivation - again, it takes motivation. And I just don't want to have any motivation. But, unfortunately, this is, I mean, I hate being right about this kind of thing.

quote]ut, oh, it's really - this really deeply creeps me out.

LEO: Yeah. You've got a good point.

STEVE: Yeah. Now, Google and WiFi.

[explanade]

Simple solution is not to pay for any kind of data for the "entertainment computer" in a car.

Or not buy a car with the "entertainment computer" in the first place. If it's built-in, it probably won't run unless the transmission is in Park or Neutral, like built-in GPS devices.

That is why people are going to text while they drive or check their emails on their smart phones.