Latest / BREAK/FIX the Motorsports & Vehicle Enthusiast Variety Show / Haunted Highways: Cybersecurity, Car Hacking, and the Ghosts in Our Machines

Transcript

Haunted Highways: Cybersecurity, Car Hacking, and the Ghosts in Our Machines · BREAK/FIX the Motorsports & Vehicle Enthusiast Variety Show

0:00
Grand Touring Motorsports started as a social group of car enthusiasts,
0:04
but we've expanded into all sorts of motorsports disciplines, and we
0:08
want to share our stories with you.
0:10
Years of racing, wrenching, and motorsports experience brings
0:13
together a top notch collection of knowledge and information
0:17
through our podcast, Brake Fix.
0:22
Many people will agree that moving public services to general availability is a
0:27
good idea and creates mass convenience.
0:29
But it also opens up new attack and data collection vectors in
0:33
places we had never expected.
0:35
Data systems that we take for granted each day as we move more and more connected
0:40
services and devices to the cloud.
0:42
This means as cybersecurity professionals, we must remain vigilant
0:46
about how we protect these tools, services, and even our automobiles.
0:50
Which have a direct correlation on protecting individuals,
0:53
families, and their privacy.
0:55
Did your Bluetooth earbud connected to your phone just
0:58
make your car open to an attack?
1:00
Welcome listeners to a spine chilling episode of the Tech
1:04
Transforms and Brake Fix podcast.
1:08
So what crossover.
1:10
This is the third and final episode in our three part series, where we're
1:13
exploring some of the spookier, creepier, and crazier sides of technology.
1:18
If you missed our previous episodes, we have linked to them in the show
1:22
notes, so be sure to check them out.
1:24
Today, we have a hauntingly important topic to discuss.
1:28
The intersection of cybersecurity, car hacking, And the Ghostbusters mission.
1:34
I'm Carolyn Ford, your host, and with me are the spook
1:38
busting co host Tracy Bannon.
1:40
Hi, Trace.
1:41
And we've got the one and only crew chief, Eric.
1:45
Hi, Carolyn.
1:46
It's good to be back on Tech Transforms.
1:48
Last time we saw you, we were talking EVs.
1:51
This is a great opportunity to continue that conversation.
1:54
Yeah, it is.
1:55
And have a better understanding of why cybersecurity is important,
1:59
why data protection is crucial to our everyday success.
2:02
That's what we're going to chat about on this special crossover episode.
2:06
So let's get going.
2:07
Eric, I'm going to kick off with the first question to you.
2:11
Sure.
2:11
Let's talk about ghosts in our cars.
2:14
What, if any, are the cyber security challenges in today's cars?
2:19
Are there any that you find particularly frightening?
2:22
So when you look at an automobile, everybody kind of thinks of it
2:25
as if it was an appliance, right?
2:27
It's like, well, I put my clothes in the washing machine.
2:29
I hit a button and they pop out and they're washed.
2:30
I get in my car, I turn the key.
2:32
It drives me the places I want to go.
2:35
But cars have been an evolution in engineering since the early 1900s,
2:40
even the late 1800s for that matter.
2:41
And up until the 2000s when computing technology got more powerful, like we
2:46
talked about on our first crossover episode in both of our season ones, where
2:51
there's these ML and AI computers inside, they're making decisions about how the
2:55
engine should run and this and that and how systems interact with one another.
2:58
As we brought in more creature comforts and made things more complicated, we've
3:02
actually opened vehicles up to being susceptible to vulnerabilities and attack.
3:07
As we get closer and closer to EVs having more and more market saturation.
3:12
We've introduced even more problems because we're even more dependent on
3:15
electrical systems and digital systems and over the air updates and all these kinds
3:18
of things that older cars just don't have.
3:20
And they're not susceptible to, for me, that's a scary reality.
3:24
And it actually has shied me away from buying the newest of the new
3:27
cars, even though there are some really exciting things out there,
3:30
because what am I opening myself up to if I buy a Ford Mach E or a
3:35
Tesla model three or something else?
3:36
Well, it depends if you are buying a U S made car from a traditional manufacturer.
3:41
They have come out and said, I think it was about six weeks ago.
3:44
They came out with a report that said, we're not Tesla.
3:48
We have components from hundreds of different distributors from hundreds
3:52
of different providers, and they were not created to go with one another.
3:57
Or if they were, they were not created under one umbrella.
4:00
So you're buying piece a knitting together with piece B, PC, PC.
4:05
The problem with that and the differentiation from Tesla is that
4:08
Tesla has created everything under an umbrella and told anybody who's
4:11
providing any part for them, what are the requirements and how are you going
4:15
to align to exactly what we need?
4:16
So there's a holistic aspect to a Tesla that I would assert.
4:20
Would make it more secure as opposed to less secure.
4:23
If I'm cobbling together or piecing together lots of pieces from different
4:27
organizations, I'm going to be able to get after many more holes.
4:30
That's a fair point, but disparate systems talking over a common bus over
4:35
a common language sharing information is a little bit different than a
4:38
proprietary system that someone has full access to over the air.
4:43
So when you compare a Tesla to a Porsche, yes.
4:45
Porsche's in bed through Volkswagen Audi group with Bosch and Bosch supplies a
4:49
lot of the, let's say, electromechanical parts that run the system in general
4:53
from engine sensors to the MFI, the multifunction interface that's running
4:58
your radio and all those kinds of things.
4:59
They talk over what's known as a CAN bus.
5:01
It's a backend electrical system that lets those disparate
5:04
systems talk to one another.
5:05
But Tesla, there's been reports and there's been investigations showing that.
5:09
They can turn on the cameras inside the car and see what you're doing.
5:12
They've been spying on people.
5:13
There's been all sorts of allegations that have been thrown out there.
5:16
So it's a closed system that's completely open because I can touch
5:21
every sensor, every camera, every piece of it versus in a Porsche.
5:25
It's harder to hack the motor than it is to hack the radio, right?
5:29
Because they aren't necessarily talking to one another.
5:31
So there's good and bad on both sides.
5:33
There are almost different attack issues or different threat
5:36
models that we're talking about.
5:37
If you have a holistic system and a nefarious actor gain access to that, do
5:41
they suddenly get access to everything?
5:43
Versus I believe what is a much more difficult to detect vector that comes
5:47
in through one of those components.
5:48
Yes.
5:49
We're talking about there's the over the air aspect to it.
5:52
Although other cars now, it's not just Tesla that has updates over the air.
5:55
There are other cars that are making updates over the air.
5:57
I would ask about whether you're serious on star, all of the other areas where
6:01
they can gain access to your car.
6:03
We have to think about many, many, many different attack vectors.
6:06
So I don't know if we can say that.
6:08
One is better than the other.
6:09
I think that the attack surfaces, the attack vectors are very, very different.
6:12
And so we have to start to think about as the end user, how do
6:15
I protect the owner of the car?
6:17
How do I protect them first and foremost from privacy invasions
6:21
and from nefarious actions?
6:23
So I want to protect them first and then figure out is over the
6:27
air, a good thing, a bad thing.
6:28
I always need to go into a mechanic.
6:29
Are they going to send me now a module that I plug in myself?
6:32
Like, what are those other alternatives?
6:34
If we were to isolate them from over the air updates, I want to
6:37
jump in our DeLorean and go back in time about eight years ago.
6:41
It was at either black hat or DEF CON.
6:44
They hacked the Jeep.
6:45
So you remember this.
6:46
Can one of you like talk us through exactly what happened?
6:48
Cause this is where I was like, Oh, this isn't just abstract.
6:53
Oh, we might be able to do this.
6:54
We might maybe this or that, like they hacked the Jeep.
6:58
They took it over.
6:59
So Eric, you want to walk us through exactly what happened?
7:02
I can speak intimately to this because I own one of these vehicles.
7:05
In today's day and age, you're talking eight years ago.
7:08
That was 3G wireless technology or cellular technology.
7:11
Now it's secure by obscurity.
7:13
So I don't have to worry about it as much.
7:14
But yes, they were able to hijack The cellular signal coming out of the
7:18
Jeep, which was used for over the air updates and a primitive system that
7:21
Chrysler had put together, and they were able to basically turn the car off.
7:26
It couldn't do too much as you weren't going in there and reprogramming or
7:29
remapping the engine or any of its fuel parameters or anything like that.
7:32
Those systems are protected.
7:33
That's a Bosch system in the Jeep.
7:35
So they weren't able to hack that, but because you've got the remote key fobs
7:39
and the remote start and the, you know, this and that, and all these wonderful
7:42
creature comforts that we've become used to, those things are susceptible.
7:46
So.
7:46
over the air, got in and were able to turn the Jeep off while it was running.
7:51
It's like, holy cow, you know, the equivalent of me hitting the ignition
7:54
button while going down the road.
7:56
So while they're driving down the road, the Jeep just got shut
7:59
off, just dead in the water.
8:00
Correct.
8:00
Which has its own ramifications, right?
8:03
Yeah.
8:03
So let's get back in the DeLorean and come back to the future.
8:06
They were able to just turn it off.
8:08
You said they couldn't do too much.
8:09
Theoretically, what can they do now?
8:12
Not too much.
8:12
And part of that is because, especially in the case of Chrysler, which at that
8:16
time was owned by Fiat, now part of the Stellantis Group, a mega merger that's
8:20
occurred over the last couple of years.
8:22
Luckily, unlike a Volkswagen system where the ECU that runs the
8:26
engine is unencrypted, the Chrysler systems are Fully disc encrypted.
8:31
So you can't actually hack into the transmission module, power train module,
8:35
or the ECU that controls the engine.
8:37
And that's why the hackers could only get so far, but that ignition button
8:40
being digital, not a physical key, they were able to circumvent that.
8:45
And turn the system off.
8:46
Yeah.
8:46
You could go in and mess with other settings through the Uconnect,
8:49
which is the MFI or multifunction interface that runs a radio, things
8:52
like that, because that's basically, let's call it an Android based
8:55
system that's running in the vehicle.
8:57
So there's ways to get into that.
8:59
You have to remember platforms like that were designed.
9:02
Not eight years ago, three years prior to that, because it takes three to
9:05
four years to get a car to market.
9:07
So what technology were they leveraging in 2013?
9:11
Well, it was 2010 technology.
9:13
So maybe not patched as we would be patching them today, or maybe not even
9:17
as sophisticated as they are today.
9:18
Although.
9:19
They're not designed to the same level as a smartphone.
9:21
They're designed to operate for 10 years without any trouble to be
9:25
trouble free and to be reliable.
9:26
So they're very simple embedded systems, which again, people aren't
9:29
thinking about how can I hack that?
9:31
Looking at some information, just throwing some data points out right
9:34
now, the average new car has over a hundred computers, a hundred little
9:39
modules, embedded pieces in it.
9:40
So a hundred of those things, millions of line of software code,
9:44
and they're all networked together.
9:45
But it falls into a couple of different categories.
9:47
So just putting this out there to help people wrap their brains around it.
9:50
Cause we are hopping over so many different nefarious areas.
9:53
You've got the things that you've talked about, the drive train, controlling the
9:56
fuel, the battery monitoring emissions.
9:58
So like one group, it's another category, which is about providing safety.
10:02
So this is the thing that's outside the car.
10:04
Automatic braking can be a part of that backup monitoring.
10:07
The third gets into the cool stuff, which is the fun stuff, the infotainment.
10:11
And I would say that this is probably an area that would be.
10:14
Highly hackable because this is getting into cellular services and wifi
10:18
connectivity and wifi hotspots being provided by the car itself, you know?
10:21
And another is getting after the need to communicate between all of those.
10:25
So there's kind of that fourth area of having that network inside
10:29
the car as a data center, right?
10:31
With all of the connectivity between it.
10:33
So there's just so many opportunities to hack into it.
10:37
Well, it's a nefarious actors dream world, right?
10:40
To your point, even if we think about things that are not related to the car,
10:44
if we think about simple things like that button remote, whatever that button
10:48
remote is too, you remember about eight or 10 years ago, people were driving
10:52
around and they were searching out, you know, other people's wifi so they
10:55
could get to their wifi or searching out their RFI, searching out whatever they
10:58
could, searching out their Bluetooth.
11:00
That's still happening, but now we're not driving by a house or
11:03
going into an apartment building to try and get signal right to hijack
11:08
somebody signal and ride piggyback.
11:10
Now we're thinking about what can we do nefariously with that car.
11:13
If you think about the bad actors who want to hack into a car.
11:16
They're not doing that simply to steal your data.
11:19
We're talking about life and limb when it comes to hacking into a car.
11:24
You're 100 percent right because of what could be done, especially on these
11:28
newer interconnected platforms in EVs where everything is controlled by, even
11:32
though there's individual subprocessors doing things, it's one mega mainframe
11:36
inside of that Tesla or that Mach E or that Porsche Taycan or whatever it is.
11:40
It's not like the old days where, say circa mid 2000s.
11:44
Engines were still separate from infotainment.
11:47
Infotainment was still separate from what they called the convenience or comfort
11:50
package, which was the alarm system and a lot of other features of the car.
11:53
Now they're all fully integrated because you joke about even cars in the nineties.
11:57
It had eight different computers in that Cadillac to run
12:00
these different components.
12:01
Now it's one mega computer that can do all of it.
12:04
By consolidating, you've made it easier to interact with those systems like
12:08
we've been talking about here, but more importantly, I am so happy you brought
12:12
up these additional attack vectors.
12:14
We have to stretch people's understanding a little bit here, and it's not
12:18
something that we're imagining.
12:19
We're trying to put FUD into the universe.
12:21
It's real.
12:21
And I'm so happy that General Motors and Ford through their
12:24
Lincoln division stopped it.
12:26
Putting in wireless hubs in their cars because adding internet access, so you
12:32
can plug in your laptop on the go and your passengers can do all this kind of stuff.
12:36
Oh my goodness.
12:37
Talk about opening the floodgates at that point.
12:39
I mean, low E Bluetooth is bad enough, let alone the wifi that
12:44
they were adding in these cars.
12:45
So you don't see that feature anymore.
12:47
No, but it was fun a couple of years ago to be driving down the highway.
12:50
And it's usually my husband driving and me tapping away at the light and
12:55
connecting to wait, Oh, can I connect?
12:57
Can I connect?
12:59
I don't know why that's so bad.
13:00
Sorry.
13:00
It sounds good to me.
13:03
It's sort of like turning up the wick on your home internet and then broadcasting
13:07
to everybody on the planet that your Wi Fi is wide open with no password.
13:10
Right, drive down the highway and I connect to you.
13:13
And you're in the car beside me and I'm connecting to your car.
13:16
I'm not connecting to my car.
13:17
That's great, but I can get that to my hotspot.
13:20
So I don't need my car to do it for me.
13:22
So you're using my internet.
13:23
What do I care?
13:24
If your home was infiltrated, it's the same way.
13:26
Your house has just been hacked.
13:27
Somebody's using your internet.
13:29
But think about this.
13:30
Now, if the cars are talking to one another, or you've got a nefarious
13:33
person in the passenger seat of that Uber, he just downloads a
13:36
virus onto your car, and you're a brick in the middle of the beltway.
13:39
There we go.
13:40
Now we're getting spooky.
13:41
Eric, I read an article that you wrote.
13:44
To be honest, I didn't follow it entirely, but the gist of it was...
13:49
Don't connect your iPhone to rental cars.
13:52
Tracy's like, yes, why would you do that?
13:55
I get a rental car every week, every week.
13:58
I get a different rental car because for one day a week, I traveled either
14:01
to DC or to New York, get a car.
14:03
When I get in, I can see all of those other passengers who have synced and
14:08
allowed their contacts to be downloaded.
14:11
So when you connect your phone, wonderful to Apple play, let's
14:14
say I'm now opening the door.
14:17
For it to use all, now I love to use Apple play so I can get a
14:21
bigger display of what I'm doing.
14:22
Yeah.
14:22
I don't allow it to touch my contacts.
14:24
I don't allow it to sync any of my prior calls.
14:27
So can you do that?
14:28
Like when you connect, you can say only do my nav system.
14:31
Well, depending on the version of Apple play.
14:34
Yes.
14:35
And I also only use the cable.
14:36
Most of us aren't that sophisticated.
14:38
I mean, we need to be able to just say, yep, connect.
14:41
But we have to be.
14:42
So I like what Tracy said, that she only uses a cable.
14:45
I'm old school like that too.
14:46
Turn off that Bluetooth.
14:48
You're less susceptible, even if it's low E Bluetooth, all that kind of stuff.
14:51
But there's another piece to this.
14:52
Not only is it contacts, it's your GPS history.
14:55
And one of the things that will pick up is that simple little word home.
15:00
And think about this, a rental car is not designed differently
15:03
than your passenger vehicle.
15:04
It starts life as a passenger vehicle.
15:05
So the way General Motors or Volkswagen or Toyota is building them is.
15:10
For the convenience of that lone driver or that family to say, yeah,
15:14
I'm going to sync up my phone.
15:15
I'm going to use the nav system.
15:16
I'm going to use all these creature comforts that are specific to you, but
15:20
in a rental car, it's public information.
15:22
So now how many homes are listed in there?
15:25
And if I was somebody nefarious and go, well, let me go to the
15:27
last person that's closest to me.
15:29
That's home.
15:30
Now I can figure out where you live.
15:32
Case your house.
15:33
I'm in a rental car, which is nondescript doesn't belong to me.
15:35
Anyways, if you trace my tag, it goes back to Hertz or enterprise or whoever.
15:39
Like you can really snowball this stuff.
15:41
If you're not careful.
15:43
What if I delete my phone?
15:45
When I turn the car back in, like I say, disconnect.
15:48
It still has my data.
15:49
Disconnect is one thing, but you have to purge the system.
15:53
And so that data is cached there from the last time it synced with your phone.
15:57
So you have to be very careful of that.
15:58
But there's another piece that people forget.
16:00
Oh, I got rid of my car.
16:01
I traded it at a dealership or I gave it to, you know, Salvation
16:04
Army and it went to the junk.
16:05
That one's a good one.
16:06
The junkyard.
16:07
Well, guess what people that are pulling head units, whether it's me, that I
16:11
need a spare one for my Jeep, because I got to replace it, or if it's the
16:14
junkyard, that wants to resell it, that data is still written on the device.
16:18
If it hasn't been purged.
16:20
So the minute that simple system fires up, I now have access to all your
16:23
contacts and where you live and everything else that was added to the vehicle.
16:26
This is the reason that my husband is ops to my dev.
16:30
This is why he doesn't throw away hard drives.
16:33
After they're demagnetized and degausses them, then there are some things
16:37
that he does to take pieces apart so that people cannot capitalize on it.
16:40
Because if you even think that you have erased your hard drive and throw
16:44
a hard drive out, you put it out in the curb for the trashman to take
16:47
away if your district does that, or if you take it to the local collection,
16:51
people can get after the data that is there, the things that have been saved.
16:55
So it's the same mental model.
16:57
Don't leave an electronic trace behind.
17:00
Yep.
17:00
And if you are going to have anything that is made a public, how can
17:04
you reduce that and anonymize it?
17:06
Don't click home.
17:08
You could type in your address, but never in a rental car, go into
17:12
your apps, go into your navigation app and click home because you have
17:16
now to your point just broadcast.
17:18
Exactly where you live short of the fact that we don't use
17:22
hard drives and cars anymore.
17:23
There are still some disk space systems out there, some
17:25
legacy stuff floating around.
17:27
Everything's on chips.
17:28
We know that forensics has gotten very sophisticated these days, and
17:32
the data can be reconstructed with careful consideration and tooling.
17:37
So short of hitting the car with an EMP to basically wipe out every chip that's
17:41
on it, you have to be very, very careful.
17:44
I would say this.
17:45
If I was going to get rid of a car, I would probably have none.
17:49
I'm not going to say a burner phone, but a dummy phone that I would re sync, purge,
17:53
re sync, try to do a multiple rewrite because I can't zeroize the system.
17:57
That's on my personal vehicle.
17:59
But on a rental car, my recommendation to everybody is do not sync your phone
18:03
to the car, especially over Bluetooth.
18:05
But okay to use the cable.
18:07
Use a cable.
18:07
Now, here's the other thing.
18:08
I'm probably even more old school than Tracy in this case.
18:11
I travel with a physical GPS.
18:13
I have my own private Garmin.
18:15
I have all my stuff saved on there.
18:16
Plug it into the cigarette lighter.
18:17
The car doesn't know anything about anything.
18:20
Not only that, I don't want to pay the money that Hertz charges, you
18:22
know, the rental fee for a GPS.
18:24
I like being offline because those systems are designed to work without cellular.
18:29
They're designed to communicate one way with the satellites in the
18:33
sky and say, here's where I am, here's where you're looking to go.
18:36
End of story.
18:37
And they work here, they work in Europe, they work everywhere.
18:40
And I don't have to be tied to my phone and making all that work.
18:43
Now I know people are going, Oh, well, I want to get my music
18:46
and I want to get my podcast.
18:47
And I can't listen to you if I'm not connected to the car within reason, right?
18:52
So you can, you just made me think that I need to get down to our
18:55
basement as a full size of our house.
18:56
And it is filled with way too much hardware, but I know that there's a box
19:00
that has our tampons and our garments.
19:02
I hadn't thought about that one.
19:03
I really liked that idea of simply taking that because.
19:06
I just need to know where to turn in a city that I haven't been in before.
19:10
For me, that's all that I need to know.
19:12
Now I'm not going back to MapQuest and printing it out though.
19:15
Most of us aren't going to do that.
19:16
Like you're just making me tired all over.
19:18
Just hearing this, I'm going to give you the same argument.
19:20
You guys have heard this a million times.
19:22
It makes me cringe.
19:23
Well, I have nothing to hide.
19:25
Nobody's gonna.
19:26
Who would care where I've been or my data or blah, blah, blah.
19:30
I'm hearing this from my family because we're just ordinary people.
19:33
Like who cares?
19:34
Okay, I'll give you a prime example here.
19:36
I wrote another article a couple of years ago, specifically for my mother
19:39
in law, who we had this exact argument.
19:41
And I said, I'm going to take something as simple as your license plate number.
19:46
Show you, I can get all sorts of information about you, even though
19:48
the D M V is supposed to protect us and all this kind of stuff.
19:51
So I reverse engineered through an ad.
19:53
I actually saw in TrueCar using their system as an automated evaluator for
19:58
selling the car and trading in and what should I get, like Kelley Blue Book value
20:01
for the vehicle And I worked backwards from there and the information it gave
20:04
me about the vehicle, then I was able to take that and reverse engineer it
20:08
into another public access database.
20:09
And finally end up in places of public record saying, Well, this is where
20:12
you live and this is that, and this is other information and blah, blah, blah.
20:15
And here you go, here's a full report on you.
20:17
And it took me maybe an hour to figure all that stuff out.
20:20
I'm not doing that every day.
20:21
It's not my job to be that ethical hacker, but there's people out
20:25
there that are doing this and it's something as simple as that six or
20:28
eight digit license plate number can give you access to all sorts of.
20:32
Okay.
20:32
So to Carolyn's point, because we are doing like this wonderful
20:35
whack a mole firing across the universe of all of these nefarious
20:38
things that can happen with a car.
20:40
What you're talking about, Eric, is another kind of social engineering,
20:43
leveraging a license plate to be able to find out more about somebody.
20:47
But Carolyn, it depends on what the goal of the nefarious actor is.
20:51
What if I had a crush on a beautiful woman that I met at the Dubliner in DC?
20:56
I might want to find out more about her.
20:57
I may want to find out where she lives, where she's been
20:59
traveling, follow her habits.
21:01
I probably might do that through a car.
21:03
It's going to be less traceable than trying to follow your phone.
21:06
So what, what am I after?
21:08
Maybe I am after getting into some of your financial information and I
21:12
want a social engineer to get there.
21:14
How much can I get from your contacts?
21:16
Maybe you have saved your bank information as a phone contact.
21:20
A lot of people do that.
21:21
It depends on what that nefarious actor The thing I'm most scared
21:25
about is actually the bad guys want to take control of the physical car,
21:29
you know, accelerate it or stop it.
21:30
Right.
21:31
As opposed to damaging my privacy.
21:33
We're not seeing a lot of that yet.
21:34
We're not seeing a lot of that yet.
21:36
Are we seeing it at all?
21:37
I believe we're going to see bits of that on the horizon.
21:39
Wait, wait, wait.
21:40
Have we actually seen this in real life?
21:42
As we go deeper into what's known as fly by wire, where you have electronic
21:46
throttle control, electronic braking, electronic steering assist, all these
21:50
kinds of things, where you add the word electronic as a convenience rather than
21:54
mechanical or hydraulic, you suddenly open the world up to more issues.
21:58
So you know which car isn't hackable?
22:00
The car with hydraulic power steering, hydraulic brakes, and
22:03
you run the throttle by a cable.
22:05
You can't hack that.
22:07
So what you've just said is, I need a 1967 Mustang convertible.
22:12
Yep, that's what you just said.
22:13
Or a 1985 Fox Body Mustang is still going to be in that same boat.
22:18
I have to look.
22:19
I actually have an 88 Mercedes and that was right at the cusp when they
22:23
started to add in a lot of electronics.
22:25
So I have to look and see.
22:26
I have never bothered to check because it's just a summer ice cream car.
22:30
Luckily your Mercedes is pre OBD2.
22:33
So it'll be an OBD 1 car.
22:35
OBD 2 was introduced in 1993, and that's where the floodgates really opened up.
22:40
That's where they realized the potential of systems.
22:42
They could integrate the CAN bus system.
22:43
All that OBD 1 is still sort of like pins in the old computer boards,
22:48
where you lose one pin and nothing works, but you can easily trace that
22:52
electrical gremlin, the systems are still way more electromechanical.
22:56
Then they are digital, like in the later cars in the, in
22:59
the mid nineties and beyond.
23:01
This is also why when you go to admissions these days, any car older than 1993,
23:06
doesn't go to admissions anymore because they don't have a way to test it.
23:08
There's no way to read it with a computer.
23:10
That's another thing you plug in your car, at least in the DC area, every two
23:14
years into a government computer system that they're reading all sorts of data.
23:18
You don't know what they're even pulling down.
23:20
And I don't want to get into that, but it's a real thing that's happening.
23:22
But let's add another tangent on this just to scare the bejesus out of Carolyn.
23:28
Now there are insurance companies and that are offering to you a
23:31
little plug and you put it in.
23:33
And it's a way that they're capturing your driving information, not saying
23:37
that ways or Google maps or other things are not capturing how fast
23:41
you're going and where you're going to.
23:44
But it's capturing your driving and what they're doing is you
23:48
are actually approving them.
23:49
You're giving them access to that data so that they will lower your
23:53
rate because you prove to them that you're driving under a certain,
23:57
you know, under certain thresholds.
23:58
I'm always at the speed limit or below.
24:00
I haven't been in any kind of fender benders.
24:02
The car hasn't had any jolts.
24:04
So in those cases.
24:06
You're actually approving somebody to get into your Wheaties and
24:10
to know all your business.
24:11
Yes.
24:11
So Allstate and Progressive were doing that for a while.
24:14
It was a dongle you actually plugged into the OBD2 port that
24:18
would then transmit data back.
24:20
And I was always like, yeah, I'll pass.
24:21
Thank you very much.
24:22
Correct.
24:23
That's where I was.
24:23
And I didn't even want it for my kids.
24:25
I'm like, I want to know how fast they're driving, but I really don't want anybody.
24:28
And our family's Wheaties.
24:30
So everybody out of my data pool.
24:32
And one of the funniest stories, and this will be included in our show
24:34
notes, actually comes from a racetrack experience with one of our previous
24:37
guests, Andy Pilgrim, and it's hilarious.
24:39
He's test driving for a magazine, one of the brand new Corvettes and he's on track.
24:43
And OnStar keeps calling him saying, sir, we see that you've been in an accident.
24:48
And he's like, no, I'm fine.
24:50
I'm, you know, I'm on a racetrack and he'll hang up on him and then they'll
24:52
call back and they keep calling back.
24:54
And they're like, sir, it says the car is upside down.
24:56
He's like, no, I'm on a racetrack.
24:57
And you can see all the GoPros that he's out there testing this new Corvette.
25:01
And he's so funny about it.
25:03
And so nice about it, but they're like, just stop calling me for
25:06
the next hour, because the car is.
25:08
Fine, right?
25:09
But all the G sensors, all the motions, all the suspension information
25:13
was being sent to OnStar and they were getting a false positive
25:16
that this car had been in a wreck.
25:17
Think about that.
25:18
Then suddenly the cops show up or they're chasing you or, you know,
25:22
again, somebody is being dispatched.
25:23
What if we get to a place where Big Brother's like, no, you're going too fast.
25:27
We're going to shut you down.
25:28
It's on the horizon.
25:29
And think about that.
25:30
He was on track at 150 miles an hour testing this Corvette
25:34
and they shut him down.
25:35
And now he loses brakes.
25:36
He loses everything because the car is off.
25:38
That's a dangerous situation to be in.
25:40
But nowadays, to your point, Tracy, they've integrated a lot of that stuff
25:44
into the cars directly from the factory.
25:45
And there was a report.
25:46
I mean, it's hot within the last couple of weeks.
25:48
They came from all places in Mozilla that I didn't expect from.
25:51
It's not one of my normal venues to grab automotive information, but they
25:55
approached it from the cybersecurity perspective to talk about all the data
25:58
that's being collected in the car that you're unaware of, your braking points,
26:01
how long you're braking, you know, how you're steering, how fast you're going.
26:05
All those kinds of things are now being recorded in the more modern
26:07
vehicles, especially these EVs, but the part that got scary, and I'm going
26:11
to read this right from the article.
26:12
It says they can collect deep personal data, such as sexual activity.
26:18
What?
26:18
Immigration status, race, facial expressions, weight, health, and genetic
26:23
information while you're driving.
26:25
Wait, how?
26:26
Do you guys believe that?
26:27
I do.
26:28
Yeah.
26:29
Yeah.
26:29
How?
26:30
I believe it.
26:30
Well, every time you put a camera somewhere, you have
26:33
the optical facial recognition software that can be manipulated.
26:36
Immediately.
26:37
Even if you're streaming it.
26:37
Remotely back to a data center somewhere in the cloud, you
26:41
know, that data can be processed.
26:43
The weight and the health and that information is as simple as the digital
26:46
wristwatches that everybody's wearing.
26:48
They can put those sensors in the seats.
26:50
Think about it when you got in a car and if you put a heavy grocery bag on the
26:53
passenger seat and it starts barking at you that you need to plug the seatbelt
26:57
in and all that because of the airbag system, those sensors are already there.
27:01
I was driving a car last week and I thought I was
27:03
paying pretty good attention.
27:05
But I had on all of the collision avoidance, we call those nannies.
27:08
Yeah, well, you need to pull over, you need to get a cup of coffee.
27:11
You need to pull over driver alert signal.
27:13
So that type of thing, how is that being captured?
27:16
How is that going to be used?
27:17
Right?
27:17
There's a lot of information that's being captured about your.
27:20
Behaviors by that car and we need to understand what the
27:24
manufacturers are doing with it.
27:25
Does it stay within the car or is there a possibility of
27:28
that data being propagated out?
27:30
Is it reporting that data back to Hertz or Enterprise?
27:33
So why do they want all this data?
27:36
I have ideas.
27:37
You tell me Tracy, why do they want it?
27:39
Well, the optimist says, looking for trends to help keep us healthy,
27:45
the pessimist says control.
27:48
And the engineer in the room wants to collect data to build a better
27:51
mousetrap, because if I think about it from a motorsports perspective, Control.
27:55
Well, it's not necessarily control, it's evolution.
27:57
I don't want to control the vehicle.
27:59
What I want to know is stopping distances.
28:01
For an example, how much pressure is being applied?
28:03
How fast is the car slowing down?
28:05
Looking at the driving habits.
28:06
This is no different than analyzing a race car's driver's performance.
28:10
They're getting real world data from the car.
28:12
So to Tracy's point, to make things better for us.
28:15
So where my mind went was.
28:17
Data is the new oil, all that data is just building more advanced.
28:22
It's used to feed the AI engine that we can, there's all kinds of scary that
28:26
we can talk about on another episode.
28:29
That's where I think, and probably one of the prime
28:31
reasons that they want this data.
28:33
And that's where I track it back to.
28:35
I just use the word control, Eric.
28:37
Yeah.
28:37
As an engineer, I want to collect everything that I can at all times.
28:40
And.
28:41
As somebody who's been around the block for a while, I also know that data privacy
28:45
is of utmost importance, especially the work that I do with government.
28:49
So that has allowed me personally to be a little bit more
28:51
balanced about what I collect.
28:53
I'm going to send us down a different avenue for a minute and just get
28:56
your thoughts on the infrastructure bill that includes a little bit of
29:01
breathalyzer on the horizon for the U.
29:03
S.
29:04
Have you been following this?
29:05
Yeah, I've actually met different companies that have engineered those
29:09
systems, how they're integrated into the computers, how they work.
29:12
We're actually supposed to have one of them on the show to take a deeper dive
29:14
into how that technology really works.
29:16
And to your point, it's going to be integrated into the HVAC systems,
29:20
almost stealthily on a lot of cars.
29:23
I know GM is a big proponent and bringing those systems into their
29:27
vehicles in the future, but it's going to become standard issue.
29:29
Like.
29:30
Power windows and remote locks and things like that, where you're not even
29:33
going to be able to drive and operate a vehicle if it senses that you're
29:37
in any way inebriated or under the influence, I'm kind of okay with that.
29:43
And it really just.
29:45
Works for alcohol until, and this is an extreme, it becomes an issue of maybe
29:51
violence or a theft or a desperation where you're like, I have to get home.
29:55
So now I stole my neighbor's car because it's older, you know, even,
29:58
you know, those kinds of things.
29:59
Like, you could extrapolate all sorts of use cases from this, but the
30:02
immediate reaction is if you can't drive home, you're going to get angry.
30:06
And does that become violent?
30:07
Does it become physical?
30:08
Does it just become Call an Uber.
30:10
Well, yeah, but you put someone behind the, in a car drunk.
30:13
Now, all of a sudden, I mean, that car is a, ultimately a weapon.
30:17
Oh, a hundred percent, but here's where it ends up going.
30:19
So it calls an Uber for you and you have to wait for the Uber to show up.
30:22
That same technology was proposed by Tesla for automatic maintenance refreshes.
30:28
So it senses that your tires are getting lower, that you need brakes
30:31
and it calls home to the dealership.
30:33
Like right on the cost of a pair and a height for 51.
30:36
I kid you not.
30:37
Like that's what we are.
30:39
Oh my gosh.
30:39
We are, we are the pessimist among me says, yes, we are.
30:42
The optimist among me says this is amazing advances for humanity.
30:46
So don't get me wrong.
30:48
I love cars.
30:49
I've been around cars since I was a kid and their evolution is amazing.
30:54
They are just pieces of art.
30:56
They're pieces of complex engineering.
30:58
There's a lot that goes into a car and a lot of people that make a car
31:01
successful, whether it's the most fabulous hyper car, or the most.
31:04
Economical small car on the road.
31:06
There's a lot of thought engineering and time and effort that goes into that.
31:09
So I don't want to shun people.
31:10
It's like, Oh, we should go back to horses and buggies.
31:12
That's what you're really saying.
31:13
Cause that's the safest thing.
31:14
No, it's not true.
31:15
The point is like anything else, whether it's a laptop or a tablet or a smartphone
31:19
or any other digital device is to just.
31:21
Do your due diligence, be aware, be vigilant of what you're connecting
31:25
to, how you're connecting to and how you're interacting with these platforms.
31:28
And in the old days, cars were not at the forefront of the attack surface.
31:32
And now as we become more and more digital, we are introducing them
31:37
into a very complex and open world.
31:40
To that point, you guys, with all the data that these cars are collecting.
31:43
What kind of security is in place in the cars?
31:47
Like, is it kind of an afterthought?
31:48
We can do all this advanced stuff with the cars.
31:51
Why can't we bake some security into to protect people like me?
31:55
And Tracy, correct me if I'm wrong, cars are not considered
31:58
right now, an end point device.
31:59
It's not like you're going to throw a normal antivirus on
32:01
there or something like that.
32:02
Some sort of tenable or even something like Dynatrace.
32:05
You're not doing application performance monitoring on a vehicle.
32:08
Yet.
32:08
So what we have to do is focus back on the data centers, making sure that
32:12
they're secure, making sure that the lines of communication are encrypted
32:16
from end to end, making sure that good development practices are put in place
32:20
when a software patch is put out.
32:22
We don't wanna render a car useless, obviously, they goes
32:24
through strenuous q and a on cars compared to a lot of other software.
32:27
We voice stuff on people as beta.
32:29
Tying up the loose ends at the control center, making sure that Toyota and
32:33
General Motors and Tesla, they're doing their due diligence to keep not only their
32:38
customers, but the passengers, the fallout of the customer, whether it's family,
32:43
friends, the Uber driver, whatever it is.
32:45
Making sure that they're safe, they're doing everything they can to ensure
32:49
that that end point device is secure.
32:52
They have been hyper focused on keeping us safe from a physical perspective.
32:56
Now we're talking about extending that into the cyber realm.
32:59
And that is a change, right?
33:01
They have been creating good software and they have strong software practices
33:06
that were not necessarily focused on the cybersecurity of the software.
33:10
It was the efficiency and effectiveness and reliability of the software.
33:14
Those are important things, but we have to add in that additional domain now.
33:18
And so to your point, doesn't matter who it is, they need
33:21
to be thinking about this.
33:22
It opens up a world though, of older cars, just like people have older
33:26
routers and there are patches that people are not thinking about it.
33:29
They've stopped being updated.
33:30
And 2018 was last time that particular wireless router was supported.
33:35
Those things are still hackable.
33:36
So we're going to have some interesting in between times where
33:40
we've got decades of technology.
33:42
We're going to have years of different kinds of automobiles that are going to
33:46
have different types of susceptibility.
33:48
The most important thing for us as the end user, right?
33:51
As the car owner or the rider in a car, the passenger in a car is thinking about.
33:56
What you're giving the car permission to do.
33:59
What are ways that that car is getting data about you without your permission?
34:03
So if you're thinking about those two things, what am
34:05
I giving it permission for?
34:06
Am I syncing my phone over the air?
34:09
Am I providing codes?
34:10
Am I doing anything else?
34:12
Or is it collecting information about me?
34:14
Multiple different cars to Eric's point, collect information about you
34:18
in a host of different ways and the newer the car, the more you see that
34:23
the car is a little data center.
34:24
That oftentimes is connected to a big data center.
34:27
And what does that communication look like?
34:29
And how is that data being leveraged?
34:30
It's as almost almost as though we need a.
34:34
Mm.
34:34
A car data Bill of Rights.
34:36
I like that.
34:37
That's really good.
34:38
So again, we could go down so many different rabbit holes on this.
34:41
There's more to explore on this particular topic, but I think basically
34:45
at the end of this is just be careful what you do and what you sync with.
34:48
Let's leave our listeners with some just basic tips.
34:52
So number one tip is if you're going to hook up to a rental car, use a cable.
34:57
Which I always carry a cable with me anyway, because I'm too technically inept
35:01
most of the time to make the connection.
35:04
So I always know that the cable is going to work.
35:06
I'm glad to know I've been doing like safe hygiene there.
35:09
What else?
35:10
Whether you're synced or not, don't hit the home capability within your phone.
35:15
I do that almost every day.
35:17
So don't tell it to take you home.
35:19
Put in your address, especially if it's your own car.
35:22
That's one thing.
35:22
But if it's especially if it's a rental, don't do it there.
35:25
Google prompted me to do that.
35:27
Like, they want you to like, what are your favorites?
35:29
And what do you want to name them?
35:30
You know, so it's convenient.
35:32
It is it is, as we said before, take just a moment.
35:36
It doesn't have to be a science fair project.
35:38
Take a moment to understand your car.
35:41
What are the capabilities of your car?
35:43
Do you have an old school CD player, right?
35:46
Six stack CD player, or do you have a digital display?
35:49
That's going to give you a little bit of an indicator of where you are
35:52
on the automation scale, where you are in the computerization scale.
35:55
I'm sure that Eric has resources that he can share with us to
35:59
kind of help us figure out.
36:00
I've got a, a 1998.
36:02
I've got a 1988, I've got a 2008.
36:05
I've got a 2018.
36:06
Where are you on that growth spectrum of connectivity.
36:09
At the end of the day, don't approve the sending of your data
36:13
without thinking about it first.
36:15
Just don't allow it to be taken from you without you approving it.
36:19
Eric, what do you think?
36:20
The best place to start is by reading your vehicle's owner's manual because
36:23
there are steps in there on how to sync, how to unsync, how to purge,
36:27
how to clear data, and it's gonna be different for every vehicle.
36:30
Families of vehicles will share similar setups and configurations because like
36:34
Tracy talked about, they're getting components from certain manufacturers.
36:37
All these radios and Toyotas are made by Pioneer.
36:39
Well, Pioneer is going to have a certain way to purge the data.
36:42
Read that owner's manual because we're not going to be able to answer, well, I have
36:45
a 19, whatever Porsche, how do I do it?
36:48
Read the owner's manual.
36:49
That's going to be your gospel in terms of how to take those steps.
36:52
You might learn something else along the way, but start with And if you Are
36:56
getting a rental car and you find that I need to connect or pull data, pull
37:00
the owner's manual out of the glove box.
37:01
It's still there and learn the quick steps.
37:04
It should only take about 20 seconds to go in and purge your phone.
37:07
Don't worry about everybody else's at least purge yours.
37:09
I just got a rental car and there was no owner's manual.
37:13
You can look them up online.
37:14
You can look them up online.
37:16
That's true.
37:17
You can, if you're in a place where there's connectivity, it just so happens
37:20
that I was kind of, I was in a dead zone.
37:22
I was in the middle of a national park and there was no, like, I
37:26
couldn't search engine anything.
37:27
I couldn't ask some generative AI for help.
37:31
If you're in a jam like that, when you return it to Hertz or Enterprise
37:34
or Alamo or wherever you borrowed it from, talk to one of the clerks
37:37
there before you hand over the keys.
37:39
Hopefully you have some extra time.
37:41
If you're pressed to go to the airport or something like that, it might be
37:43
a little challenging, but say, Hey, can you help me remove this data from
37:47
the car, can you help me purge it or make sure that they take care of it?
37:50
Again, we've all picked up rental cars before going, wow, there's
37:53
a lot of data on this system.
37:54
We've got to continue this conversation another day, because
37:57
we're just going to keep going at it.
37:58
I hope that we have served our Halloween purpose in scaring
38:02
the bejesus out of people.
38:03
Eric, I got to ask you this question.
38:05
Wouldn't it be fun to have this conversation and have two
38:09
additional guests if they were still around Tom and Ray Mariazzi,
38:12
Dip and Tap, the Tackle Brothers.
38:14
Can you imagine having this with the Car Talk guys?
38:18
I loved that show.
38:19
You guys loved it.
38:20
They were so funny.
38:22
And honest and authentic and entertaining.
38:25
That's right.
38:25
Yeah.
38:26
And hopefully we have hit maybe five to 10 percent of their
38:29
amazingness with today's podcast.
38:31
If you want some more of that amazingness, you can always hop over to break fix
38:35
podcast, where our goal is to capture the living history of Folks throughout
38:39
the autosphere, whether it's engineers, designers, pro drivers, and everything in
38:43
between, you can learn about deep dives in technology, like we're talking about
38:46
today, or you can get some inspiring stories about how you could find a job
38:50
in the automotive industry as well.
38:51
So our catalog is huge, it's deep, and you will find something interesting,
38:55
whether you're interested in cars or not.
38:57
Thank you, Eric, for taking time to share your insights with
39:00
us to give us a truly scary.
39:03
Halloween episode, you and Tracy both did a great job of just making me
39:07
tired and scared and just like, Ugh, I just want everything done for me.
39:12
I need people is what I need, but thank you listeners for joining tech
39:17
transforms, break, fix crossover today, happy Halloween, and we will talk
39:23
to you next week on tech transforms.
39:25
Bye.
39:26
Thanks guys.
39:27
And we're out.
39:33
We hope you enjoyed another awesome episode of Brake Fix Podcast brought
39:37
to you by Grand Touring Motorsports.
39:39
If you'd like to be a guest on the show or get involved, be sure
39:42
to follow us on all social media platforms at Grand Touring Motorsports.
39:46
And if you'd like to learn more about the content of this episode,
39:49
be sure to check out the follow on article at gtmotorsports.
39:53
org.
39:54
We remain a commercial free and no annual fees organization through
39:58
our sponsors, but also through the generous support of our fans,
40:02
families, and friends through Patreon.
40:05
For as little as 2.
40:07
50 a month, you can get access to more behind the scenes action, additional
40:11
Pit Stop minisodes, and other VIP goodies, as well as keeping our team
40:15
of creators Fed on their strict diet of fig Newtons, gummy bears, and monster.
40:21
So consider signing up for Patreon today at www.
40:25
patreon.
40:25
com forward slash GT motorsports, and remember without you, none
40:29
of this would be possible.