> We need a better way of disabling this physically - by removing the 4G/LTE connectivity in cars.
> ...
> It's absolute madness that we have cars companies that generally don't know a ton about software building technology that's generally insecure, will not be updated and mass producing it at scale and being used by 10000s (or even 100000s) of people worldwide.
This! This a thousand times!
Last year I bought a new car, and one of my main deal-breaker criteria was the presence of an LTE modem. I don't want an internet-connected computer-on-wheels built by a company that has no idea how to build secure software and that doesn't have an engineering culture that's compatible with security. There's a too-large chance that they'll mess up and someone would ransom my car for a bitcoin (in the best-case hacking scenario).
It was tricky to figure out what cars had network connections, since the salespeople don't understand the technology, just the sales pitches. The questions that worked best for me were "Does this car have connected features such as remote door unlocking available?" followed by "If I want those features after I buy the car, will I have to take it back to get something installed?" Some cars, like Subarus ship without the connected car features, but the dealership can enable them remotely once you sign up for the monthly charges. That means their cars have an always-on LTE modem.
IMHO, it's going to take at least ten years for 1) car companies to learn the hard way how to develop secure software* and 2) develop a reliable and safe self-driving car that works in my climate. I figured now was the time to buy one of the "last good" cars that I could drive until this stuff is sorted out.
Turns out the one I got has a Android center console that's rootable through a well-known method, but at least I have to manually connect to a Wifi network for that to happen. And, frankly, who does that?
* IIRC, Microsoft took a similar path, first having comically insecure software, to taking security seriously, to actually getting good at it.
> ...
> It's absolute madness that we have cars companies that generally don't know a ton about software building technology that's generally insecure, will not be updated and mass producing it at scale and being used by 10000s (or even 100000s) of people worldwide.
This! This a thousand times!
Last year I bought a new car, and one of my main deal-breaker criteria was the presence of an LTE modem. I don't want an internet-connected computer-on-wheels built by a company that has no idea how to build secure software and that doesn't have an engineering culture that's compatible with security. There's a too-large chance that they'll mess up and someone would ransom my car for a bitcoin (in the best-case hacking scenario).
It was tricky to figure out what cars had network connections, since the salespeople don't understand the technology, just the sales pitches. The questions that worked best for me were "Does this car have connected features such as remote door unlocking available?" followed by "If I want those features after I buy the car, will I have to take it back to get something installed?" Some cars, like Subarus ship without the connected car features, but the dealership can enable them remotely once you sign up for the monthly charges. That means their cars have an always-on LTE modem.
IMHO, it's going to take at least ten years for 1) car companies to learn the hard way how to develop secure software* and 2) develop a reliable and safe self-driving car that works in my climate. I figured now was the time to buy one of the "last good" cars that I could drive until this stuff is sorted out.
Turns out the one I got has a Android center console that's rootable through a well-known method, but at least I have to manually connect to a Wifi network for that to happen. And, frankly, who does that?
* IIRC, Microsoft took a similar path, first having comically insecure software, to taking security seriously, to actually getting good at it.