jducoeur

Just came across an article on Ars Technica (yes, I'm behind): The intelligent intersection could banish traffic lights forever. It's neat stuff: basically, a researcher has designed a traffic-control system for autonomous vehicles, and demonstrated that by using such technology we could enormously reduce how often you have to stop at intersections -- not only speeding up travel times, but improving fuel efficiency quite a bit.

All of which is great, but my Security Architect senses are pinging here. This is postulating an external server that talks to the cars on the road and tells them what to do. That is absolutely terrifying if you understand the typical state of Internet-of-Things security.

But let's put a positive spin on this. This system is at least 1-2 decades from deployment as described (since it assumes only autonomous vehicles on the road). We might be able to head off disaster by figuring out the obvious hacks in advance, so they can be designed around.

So here's the challenge: name ways that a hacker could abuse this system, and/or ways to ameliorate those weaknesses.

I'll start with a few obvious ones:

• Base story: I (the hacker) send out signals spoofing the controller for traffic intersection T, allowing me to cause nightmarish havoc. Possible solution: traffic controllers are listed in some well-known registry, signed with public keys, so that their signals can be authenticated to prevent spoofing.
• Assuming the above hacking isn't prevented: I time the signals sent to the cars, telling them all to hit the intersection at the same moment. Crash! Solution: as a belt-and-suspenders thing, cars must not completely trust the signal controllers. Their autonomous checks have to override those signals, to prevent crashes.
• Reverse of the previous: I send out signals telling all the cars, in all directions, that the intersection is currently blocked by opposing traffic. The entire city quickly devolves into gridlock. Solution: good question. I got nothing.

What else? I'm sure we can come up with more nightmarish scenarios, and possible solutions.

Yes, this may seem like overkill to think about now, but history says that, if you don't design the system around abuses, you will hurt forevermore. Security isn't something you add later: it should be baked into the designs from the get-go. (Which is why it accounts for a large fraction of Querki's architecture, despite the fact that we only have a couple hundred users yet...)

Today in "boneheaded corporate moves", we have Verizon.

My mother has triple-play (Internet/phone/TV) service from Verizon; as such, her primary email address is currently through verizon.net, as you'd expect. She also has a Gmail address, that I nudged her into.

She got a letter yesterday, announcing that Verizon is terminating its email service. She has three weeks to decide whether to transition entirely to a third-party service, or switch to AOL.

AOL.

Even Mom, who is, shall we say, not the most tech-savvy member of the family, had the reaction of, "Isn't AOL -- bad?". I've told her to just switch everything to her Gmail account: while Google may not be my favorite company in the world, this is yet more proof that getting your email through your ISP is just a bad plan.

But still -- AOL? Really? I mean, yes, they want to justify their ownership of the stupid company, but that's one of the most poisoned brands in the history of tech. Pushing all of their ISP customers over to it seems like a recipe to lose a lot of customers, with no obvious benefit.

Anybody have any insights into this apparently-foolish move?

For the past week or two, Chrome has become surprisingly unstable -- it's been crashing on me about once a day. Weirdly, it is usually when I'm not using it that it crashes: typically, I wake my computer from idle and find that Chrome has gone splat.

Anybody else seeing anything like this? I'm mystified about where the problem is.

(And man, it is wonderful to know that DW now supports Markdown. Hadn't even occurred to me until they mentioned it in today's update. The custom entry URL thing is pretty neat, too...)

• The phone in my pocket gives a distinctive "bing", which tells me it's Facebook;


• I glance at my watch, and about a second later it vibrates and shows me the beginning of the message, so I can see who it's from and how much I care;


• If it looks interesting and I'm not in the middle of something, I flip over to the open Facebook tab in Chrome, which has just popped open the message for me to read and respond to (with the real keyboard).


• If I'm too distracted at the moment, I'll get an email in a little while, which serves as a reminder to get back to this conversation.

On Monday (June 20th, 2016), Francisco Partners and Elliott Management announced they have signed a definitive agreement to acquire the Dell Software Group. This transaction includes Dell’s Systems and Information Management (SIM), Security, and Advanced Analytics business units.