valasek

On the flip side, when Adobe fixes Valasek or Ormandy's bug, they're going to say that right away.

Didn't Uber just hire Chris Valasek and Charlie Miller (famous for the Jeep hack) a few months ago?

It isn't that apologetic: In hindsight, it's obvious to everyone that Valasek and Miller went too far.

If Chris Valasek or Tavis Ormandy say that (say) Adobe hasn't fixed their finding, everybody (including Adobe) will believe them.

In hindsight, it's obvious to everyone that Valasek and Miller went too far.

Miller and Valasek hacked into a car that was very far removed from what we consider modern automotive electronics.

> In hindsight, it's obvious to everyone that Valasek and Miller went too far.

This is how Charlie Miller and Chris Valasek were able to remotely compromise vehicles with a vulnerable infotainment system via a pwned femtocell.

If Charlie Miller and Chris Valasek hadn't gotten on stage in track suits to talk about car hacking, the same might be true of automotive, but now every consultancy wants a car-hacking practice.

> Miller and Valasek have been sharing their research with Chrysler for nearly nine months, enabling the company to quietly release a patch ahead of the Black Hat conference.

Regardless this attack is real or not, this exposure and assessments (just like Charlie Miller and Chris Valasek did for exposing the car hacks) raised good awareness of how vulnerable BMCs are and hopefully the baseboard hardware security and firmware security will be securer in the future when they evolve.

> To better simulate the experience of driving a vehicle while it’s being hijacked by an invisible, virtual force, Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch from Miller’s laptop in his house 10 miles west.

I was to lazy to search a direct quote, but here it is now: "Miller and Valasek represent the second act in a good-cop/bad-cop routine.

From the original 2015 article about the hack: "Miller and Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether.

“Academics have shown you can get remote code execution,” says Valasek, using hacker jargon for the ability to start running commands on a system.

> Chrysler says it’s also taken steps to block the digital attack Miller and Valasek demonstrated with “network-level security measures”—presumably security tools that detect and block the attack on Sprint’s network, the cellular carrier that connect Chrysler’s vehicles to the Internet.

Yes, Charlie Miller and Chris Valasek's stunt had relatively low risk, but the difference is that they were risking the lives of innocent people who had nothing to do with it.

Hopefully that'll change soon, before someone with less-benevolent motives follows in Miller's and Valasek's footsteps.

Miller and Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether.