Linux turns the crank on code for cars

Linux's quest to become the default operating system for motor vehicles has taken a step closer to reality, with the Linux Foundation releasing downloads of code from its Automotive Grade Linux project. The project, announced here, is described as being built on Tizen IVI, adding “key applications developed in HTML5 and …

[bazza]

Tizen

It's basically Samsung's Tizen. And we all know how popular that is...

I can't help but feel that we're sleepwalking into another bunch of unnecessary security woes, just like has happened with the Internet of Things. Nor is that thought aimed solely at automotive grade linux.

The last thing any of us want is a flat battery caused by some bitcoin mining malware that's found its way onto the infotainment system in our cars. It's happening to our thermostats, smartTVs, set top boxes, fridges, etc. Why would our cars be immune?

Also a car system would be a rich target for cryptolocker type malware; "You wanna drive this car then you're gonna have to pay". That kind of threat doesn't work so well for, say, a set top box; we'd just throw it away. But we won't throw away our car just like that.

So if the car industry wants to pick up this then they're going to have to get smart with continual updates, software security expertise, all the expensive things necessary to keep an Internet connected system safe these days. They're not used to providing that level of support for software.

[Anonymous Coward]

Re: Tizen

>But we won't throw away our car just like that.

Nope. We'll probably just reinstall the code.

[bazza]

Re: Tizen

"Nope. We'll probably just reinstall the code."

Yeah right, like a busy parent is going to be happy doing that instead of taking the kids to school. Plus their paired mobile gets a good going over too.

Regardless of whether or not an infotainment hack could get as far as the engine management doesn't really matter, it's still going to really piss off people.

There's also a worrying clue in its name: INFOtainment. These things display information like fuel economy and so forth which they're getting from the engine management. Which means that there's a data connection from the engine management to the infotainment system. And that too can be hacked (unless it's a one way link). So a hacked infotainment system could easily be a hackers gateway to the engine management.

[John Brown (no body)]

Re: Tizen

"I can't help but feel that we're sleepwalking into another bunch of unnecessary security woes"

I couldn't agree more. WTF are they thinking building the sort of mission critical stuff required to run a car on top of bloated web browser engines? It 's not as if we are going to be wanting a huge app store full of fart apps and twitface apps knocked out by every teenage kid in their bedroom.

I'd be much more impressed if they built a new custom, pared down middle level to sit on a hardened kernel that would require actual programmers to develop for instead of wannabees who string black boxs together with a bit of java(script) code and think they are programmers.

[nematoad]

With added Google?

If it's got anything to do with Google then I'm glad that my Mini is of the old school and relies on conventional instruments to tell me whats going on.

Using a proprietary application in a Linux based OS is not the way to go. OpenStreetMap might be a better way of finding out where you are.

The thought of Google tracking me, knowing what I'm doing and attempting to shove adverts down my throat whilst I'm driving just turns me off the whole idea.

[itzman]

Re: With added Google?

Indeed. It was bad enough 20 years ago when ALL the instruments went to zero on a rented Ford Mondeo. Apparently loose earth to the panel...

having a dashboard with a single point of failure..

[KjetilS]

Re: With added Google?

Where does it say anything about Google?

[smudge]

Re: With added Google?

Immediately before the word "Maps" in the final paragraph.

[Neil Alexander]

"key applications developed in HTML5 and JavaScript"

Am I the only one who hears alarm bells ringing?

[ocratato]

Re: "key applications developed in HTML5 and JavaScript"

You are not alone.

JavaScript might be OK for some random web page that no one really cares about, but for something requiring a reasonably robust implementation, not so much. While I don't think we need aerospace quality, I want a bit something a bit better than a web page in my car.

For this to work it will also need some way of getting software updates FOR THE LIFE OF THE CAR. This does not mean I need to buy a new car every time a new version of the OS is released.

[regadpellagru]

Re: "key applications developed in HTML5 and JavaScript"

"For this to work it will also need some way of getting software updates FOR THE LIFE OF THE CAR. This does not mean I need to buy a new car every time a new version of the OS is released."

Agree in the principle, but you used the undefined term "LIFE OF THE CAR", which, depending on company's business model can go anywhere between 5 and 20 years.

So this update for life would prove trivial to achieve for, say, f***ing Peugeot but quite more expensive for, say, Toyota or Kia (with their 7 years waranty, which is not even meant to cover the lifetime).

End of the day, that would biaise the market IMO, so to me, the conclusion is a level of automation in the car that would require an elaborated OS (windows/linux vs. Vxworks type of micro-kernel) is a bad idea.

[Frankee Llonnygog]

Finally a chance tp drive from the command line

indicate -s left -n 4

turn -d left

accelerate -t 5 -f 4

Bugger - what's the syntax for 'stop'?

[Anonymous Coward]

Re: Finally a chance tp drive from the command line

> Bugger - what's the syntax for 'stop'?

$ apropos stop

[dotdavid]

Re: Finally a chance tp drive from the command line

> Bugger - what's the syntax for 'stop'?

$ break

[Anonymous Coward]

Re: Finally a chance tp drive from the command line

>Bugger - what's the syntax for 'stop'?

#halt

Hang on. Why are you shutting down?

[James Boag]

Look on the bright side guys, for several years now i've been getting my old bangers fixed for the cost of the parts, as every time i go to my auto repair man, He's got issues with his computers, I don't charge him labour and he don't charge me. And if the cars themselves get even more complex that's even more people need your skills in a barter like way, last set of wheels cost me £600 and lasted 14 months with no repair bill, + £100 back from the scrap yard, lets see it the new £400 sporty model does as well, As for javascript in my dash board, fine if i put it their on a raspberry pi, but i'm not trusting anyone elses !

[Ross K]

Huh? Ransomware?

"Also a car system would be a rich target for cryptolocker type malware; "You wanna drive this car then you're gonna have to pay". That kind of threat doesn't work so well for, say, a set top box; we'd just throw it away. But we won't throw away our car just like that."

The beardy types will be spluttering their coffee all over their terminals at the thought of ransomware on linux.

From what I can make out though, the plan is for linux to control the non-essential stuff like nav, climate control, bluetooth - not the stuff that's critical to making a car move. Unless I read TFA wrong I don't see any mention of a car's ECU running linux?

Tesla have been doing this for a while now so linux in a car is hardly earth-shattering news.

And I won't mention Apple CarPlay.

[Nick Ryan]

Re: Huh? Ransomware?

Exactly. Industrial control systems and monitoring systems have been done for a long time and don't have to be directly connected in unsafe ways at all. The key is having a standard, or at the very least, tightly defined interface between the two systems that is only usable for the information that is required.

In the past I've dealt with industrial systems that are linked by a serial cable which, while running standard-ish protocols over the link and using standard comms libraries at each end is pretty damn secure. While in theory it may have been possible for somebody to somehow overload the remote serial link and handling software and exploit it somehow (more likely at the higher application level) but given the simplicity of the communication structures it was definitely secure enough. Anybody going to that trouble to exploit such a link would have found it much easier to just walk over to the control system itself. Even at the control system, there were physical limits and safety protocols implemented at the electromechanical level, not overrideable in software. Similar levels of isolation are currently and will be built into automotive systems.

[bazza]

Re: Huh? Ransomware?

"Tesla have been doing this for a while now so linux in a car is hardly earth-shattering news.

And I won't mention Apple CarPlay."

There's nothing wrong with Linux as such, just like there's nothing wrong with QNX (which is what Apple Airplay runs on). They're OSes much like any other OS; they're pretty good.

The trouble starts when you put a network connection in and run a bunch of poorly written and oh so very exploitable apps on top. Then you need an automatic update system, staff to look for and fix problems across all versions of the software, and so on. That's a very expensive thing to do.

Plus it's not like the mobile industry where you can get away with dropping support for year old models. People will be expecting the support to last as long as it does for the rest of the car. That's really expensive.

The economic impact is potentially quite high. Say some script kiddie found a way to stop all Fords working and actually did so. In a country like the USA that means half the work force aren't going to work that day. That kind of thing shows up in GDP figures really quickly.

"The beardy types will be spluttering their coffee all over their terminals at the thought of ransomware on linux."

Well, there is already ransomware for Android, and that's Linux isn't it?!

"From what I can make out though, the plan is for linux to control the non-essential stuff like nav, climate control, bluetooth - not the stuff that's critical to making a car move. Unless I read TFA wrong I don't see any mention of a car's ECU running linux?"

Well, if the infotainment system is displaying data like fuel economy that has to come from the ECU. Which means there's a data connection between the two. That may be a path for an attack on the ECU.

[Ross K]

Re: Huh? Ransomware?

You've got a great imagination - I'll give you that.

Well, there is already ransomware for Android, and that's Linux isn't it?!

Ah yes, Simplocker - downloaded from fake Google Play sites and removable with a factory reset.

Oh do please explain to me how you see users installing untrusted apps to a car computer that's NOT running Android with access to fake Google Play sites. I would love to benefit from your knowledge in this area..

[Anonymous Coward]

Not the first time!

We had Linux in the car before - remember empeg?

I had them in for a talk, and it was quite fun to have it play music while it was also compiling something :)

[Gannettt]

This is the year of Linux on the desktop in the automobile!

[Steen Larsen]

BMW has Linux in cars

Yes, Linux in cars is last years news. Last year BMW announced that an infotainment head unit running a GENIVI (www.genivi.org) based Linux OS was going into production.