Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
6 Questions to Ask While Buying a Connected Car
Newest First  |  Oldest First  |  Threaded View
Mcmoore08
50%
50%
Mcmoore08,
User Rank: Author
3/13/2019 | 3:55:06 PM
confidential info
Good posting here! This is especially true where someone thinks they are having a classified conversation and it is ok through the bluetooth within their car. Your car is NOT a SCIF.
szurier210
50%
50%
szurier210,
User Rank: Moderator
3/13/2019 | 12:58:17 PM
Re: IoT Devices
Just as follow-up, I have been shopping with my son for a new car over the past few days. I found the salespeople to be monumentally unware of the technology they are selling. I think Apple CarPlay is cool technology, though some may think the hard-wired USB connectivity is old school versus a wireless option. This is a major point: If you read the reviews, Apple and the car companies were going for safety first over convenience. So now with CarPlay there is a way to use Siri to ask for calls and verbally send texts without taking your eyes off the road. As a step toward a more automated experience that is huge. Some of the reviewers complained that they couldn't stream videos when their wives went into a store, but that's not a big deal. Others complained that Siri still can't read back emails. All in due time. For now, it's really great that CarPlay is basically a platform that you can update by simply updating your iPhone's iOS. I checked with Apple Support and they told me to also check with the dealer to see if there are any firmware updates on the car stereo from time to time. If anyone else has any other observations based on using a connected car, please share. I'm feeling like the public is very vulnerable so the more tips and insights we can offer people the better. 
bangbakat
50%
50%
bangbakat,
User Rank: Apprentice
3/9/2019 | 1:00:14 PM
Re: IoT Devices
very nice
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
3/8/2019 | 9:32:57 AM
Re: IoT Devices
I guess sometimes you never know the popularity something will have until it comes to pass. Otherwise, she would have lawyered up and protected that ubiquitous voice.
Munjero
100%
0%
Munjero,
User Rank: Apprentice
3/7/2019 | 1:05:01 PM
Re: IoT Devices
Voice of Siri:  no, not a lot of money, she had no idea that her voice was going to be used for Siri:  https://www.huffingtonpost.ca/2013/10/04/voice-siri_n_4043134.html

 
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/5/2019 | 3:10:38 PM
IoT Devices
Another consideration - my 2014 Honda CRV has a built in GPS navigation system, easy to use and extremely helpful.  Yes questions about it of course but my wife's NEW 2018 CRV has gone to the IPhone for the global positioning service and it's not easy to setup either.  We live with the voice of Siri now.  But now we have an external internet device directly connected to the internals of the car, another entry point through the phone which raises a new family concerns - the phone itself, as always - the interface to the car (physical cable but wireless through the phone) and any external vulnerabilities through GPS ----- which is why I like the 2014 better.  Besides Siri is a bitch and my old car has a nice pleasant lady.  She probably talks to me too on the POS system at Kroger and in hosted meeting rooms too.  (Who is, by the way, this elusive female voice?  She has to make a ton of money).


When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...
CVE-2021-25173
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denial of service (crash, exit, or restart).
CVE-2021-25174
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart).
CVE-2021-25175
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A NULL pointer dereference exists when rendering malformed .DXF and .DWG files. This can allow attackers to cause a crash, potentially enabling a denial of service attack (Crash, Exit, or Restart). This is issue 1 of 3.