Bonum Certa Men Certa

The Car Drives You -- Part IV -- Today's Cars Come With Up to 3,000 Chips and Security Isn't of Concern

Consulting firm Deloitte Touche Tohmatsu Limited estimates that as of 2017, some 40% of the cost of a new car can be attributed to semiconductor-based electronic systems, a cost doubling since 2007. It estimates this total will approach 50% by 2030. The company further predicts that each new car today has about $600 worth of semiconductors packed into it, consisting of up to 3,000 chips of all types.
Further, internal and external vehicle communications have exploded in the past decade. In 2008, there were an estimated 2,500 data signals being exchanged among the ECUs in a luxury car. Volvo’s Antinyan says that today more than 7,000 external signals connect the 120 ECUs in Volvo vehicles, and the number of internal vehicle signals being exchanged are two orders of magnitude greater. Consulting firm McKinsey & Company estimates this information can easily surpass 25 gigabytes of data an hour.
Article from 2021 (IEEE)



Summary: The concept of software freedom inside cars has become a distant fantasy; the cars that are being manufactured nowadays disregard security and embrace unnecessary complexity

ABOUT a week ago we started this series. We looked at a consultation right here in the UK -- a misguided bit of text which characterises modifying one's own car as "tampering". Shades of "sideloading" in the context of software...



Demonising those who exercise control over a device they bought?

We then looked at what Toyota had begun doing, published Part I about the issue, and then -- several days later -- expanded in Part II and in last night's Part III. We've meanwhile, in parallel, studied just what amount of computing had crept into today's cars (gradually over the years). The data isn't entirely secret, but there are not many publications about it; more importantly, there seems to be no public debate about software freedom in that context. We wish to change that.

"The data isn't entirely secret, but there are not many publications about it; more importantly, there seems to be no public debate about software freedom in that context."Last week we wrote that in today's cars there's "not just a computer onboard but several"; a person contacted us to say "not just a computer onboard but many"...

OK, but just how many exactly? Obviously that depends on the car, but there are many overlaps across models and brands.

I am not clueless about today's cars; I did drive in the past and a decade ago I went to a car agency (that was the last time). Even in 2011 things were already starting to look grim. It was a Toyota agency.

"Most car fanatics I know consider the car a single system and ignore the many microcontrollers," an associate noted a week ago. "I have the feeling that on top of that most of the information is proprietary..."

Certainly, in my experience, the media does not inform people about the situation; I only realised how big an issue it was when supply chain woes caused price spikes and critical shortages; it was getting too hard to get all the bits to assemble new cars [1, 2].

So we decided to study a number authoritative pages about the number of processors and the nature of the tasks they perform. I already knew about the "micro" (processors) ones, which aren't exactly new and are installed at the ends/edges, but was not sure how they qualify with respect to "computer" (the components and their complexity may vary in definition).

As our associate put it, "there are many microcontrollers, I guess based on activities, and at least two full computers." There are publications[PDF] and full articles about it (not necessarily new). As our associate explained, "another site, with a comment going to a dead MIT link, suggests 50 to 70 "Electronic Control Units" in cars as of ten years ago."

That's the last time I went to a car agency. It has certainly increased a lot since then.

"That's even older" than this ("More Auto Computers Means More Complicated, Costly and Longer Repairs" according to this article from 2016), the associated noted, quoting various bits. This page says "high-end cars have as many as 100, and they’re accompanied by 60 to 100 different electronic sensors..."

And these parts are controlled by computers: "Engine control, Exhaust control, Heating/cooling, Fuel pump, Water pump, Transmission, Power steering, Brakes, Traction control, Airbags, Collison warning, Parking assist, Backup monitoring, Door and trunk locks, Power windows, Climate control, Power seats, Wipers, Charging system, Interior lighting, Brake lights, turn signals, Headlamps/daytime running lamps, Navigation, Car audio, and GPS..."

And "add side- and rear-view mirrors to that long list above," our associate noted.

"There are security/safety implications, as we covered earlier this year (in summer)..."Remember that these are all proprietary, some go decades back, but now they get connected to the Internet and more (e.g. Bluetooth connectivity with another device, which may be compromised). So some are connected less directly to the Net, e.g. their local (car) mother ship, which is in turn controlled by a bigger mother ship (vendor/government/cracker).

There are security/safety implications, as we covered earlier this year (in summer), and articles like "How a Hacker Could Hijack Your Car While You Drive" (Tom's Guide) that deal with the main question.

"It's largely ignored because, as mentioned, car fans see the vehicle as a physical object still when in reality most of it is software," our associate said. "Yes, all proprietary and restricted so as to lock out independent repair shops and mechanics. There was a lot of attention to this about 10 years ago in the various security conferences. Then a burst of information as some of the embargoes were lifted. I presume the quietness on that front means that more of the researchers are under NDAs again. Shmoocon, DefCon, and BlackHat usually have automative tracks."

We hope the conversation will be resumed and extended to the Free software world. We need to do more to highlight the dangers and tackle the problem.

"General-purpose computing is niche nowadays," our associate said, "and that niche has been shrinjing. The multinationals also appear to be aiming to eliminate it eventually. UEFI, TPM, DRM etc..."

"We hope the conversation will be resumed and extended to the Free software world. We need to do more to highlight the dangers and tackle the problem."Well, almost nobody covers these issues, so it's a vacuum we can fill in the coming weeks/months. We invite groups like the FSF (even SFC and OSI) to do the same.

More than a decade ago we still saw people saying that software was eating the world (citing famous old words), but nowadays people talk about "apps" and "clown computing" and all sorts of other nonsense. Not too long ago an article entitled "How Software Is Eating the Car" was published in IEEE Spectrum. To quote: "Predictions of lost global vehicle production caused by the ongoing semiconductor shortage continue to rise. In January, analysts forecast that 1.5 million fewer vehicles would be produced as a result of the shortage; by April that number had steadily climbed to more than 2.7 million units, and by May, to more than 4.1 million units. The semiconductor shortage has underscored not only the fragility of the automotive supply chain, but placed an intense spotlight on the auto industry’s reliance on the dozens of concealed computers embedded throughout vehicles today."

Get ready for some numbers that are more recent: "The company further predicts that each new car today has about $600 worth of semiconductors packed into it, consisting of up to 3,000 chips of all types."

"The IEEE article above speaks of "7,000 external signals", "120 ECUs" and so on. They say "Electronic Control Unit" (as euphemism for a computer)."Up to 3,000.

As our associated noted, "security has to be part of the design process, but it hasn't been, thus we end up with not just CAN but with everything integrated with it."

The IEEE article above speaks of "7,000 external signals", "120 ECUs" and so on. They say "Electronic Control Unit" (as euphemism for a computer).

In the next part we'll continue this discussion. One growing concern is, the lobbyists of car-making giants are trying to pass new laws mandating all sorts of things which eventually take "old" or "dumb" cars off the road (even if some manufacturers produce new alternatives that opt out of this whole mess).

Recent Techrights' Posts

Links 04/10/2023: "Looney Tunables" FUD and Kevin McCarthy Ousted
Links for the day
Windows Defender Flags Tor Browser as “Trojan Horse” Malware
Reprinted with permission from Ryan Farmer
Sensationalist Clickbait Called 'Looney Tunables' to Badmouth Linux (It's Not Even Linux)
FUD attack
Links 04/10/2023: Murena 2 with /e/OS and More
Links for the day
Links 04/10/2023: KDE Promo Sprint and More
Links for the day
Clown Computing Means Security/Data Breaches, Not Just the Outsourcing Itself (They Get Cracked, Too!)
Reprinted with permission from Ryan Farmer
Over at Tux Machines...
yesterday's posts
mp3HD: Another Patent Trolls' Patent Trap That Failed
Reprinted with permission from Ryan Farmer
IRC Proceedings: Tuesday, October 03, 2023
IRC logs for Tuesday, October 03, 2023
"Modern" Computing Sucks and Harms Computer Users
Reprinted with permission from Ryan Farmer
Red Windows
Red Hat is not into Free software
Richard Stallman Giving Talks in the Czech Republic and Germany This Week (Tomorrow's Talk is "Artificial Intelligence vs Language Models")
This past weekend he gave two talks in the Czech Republic
Companies Faking the True Number of Layoffs With Return-to-Office Mandates and Forced Relocation
we estimate that Microsoft cut about 30,000 so far this year, having cut many more jobs last year
Links 03/10/2023: Cellphones (Mobile Phones) Banned in Classrooms in England
Links for the day
Greener Pastures for Free Software Users
This coming week we'll publish many articles about GNU/Linux and technical means of/for user empowerment
IRC Proceedings: Monday, October 02, 2023
IRC logs for Monday, October 02, 2023
Google News, Which We Call Gulag Noise, is Following the New York Times Into the Digital Graveyard
It merely gives an illusion of volume and instead of giving readers more stuff to read it wastes people's time
Daily Bulletins Coming Soon (Hopefully as Early as Next Week)
Today we finish testing IRC logs and their upload to Gemini, not just to IPFS
Over at Tux Machines...
yesterday's posts
Software Freedom is the Future and Microsoft is the Biggest Obstacle
GNU/Linux, at its roots, was all about Software Freedom
Links 02/10/2023: NUC, GTK Themes, and More
Links for the day
New Union Syndicale Articles About the European Patent Office
We'll probably get back to regularly writing about the EPO in the near future
If WordPress Knows Well Enough to Self-Host Its Podcast, Why Can't GNU/Linux Shows Do the Same?
For those who want videos and podcasts, here are today's latest additions from other sites
Richard Stallman Can Outlive Many of His Prominent Haters
M.J.G. tried hard to take our Web site offline, based on lies and repeated threats
The GNU/Linux Revolution Ain't Here. Look at Brazil, Russia, India, China, and South Africa (BRICS) Instead.
The revolution won't be televised
Chaffbot Effect: Microsoft Bing Falls to Lowest Share in Two Years (Amid Loads of Bing Layoffs This Year)
Press outlets mostly failed to report that Bing is collapsing
Forget VSCode (Microsoft's Proprietary Spyware), Use KATE Instead
KATE is great
Sometimes It's Time to Reboot
No, not Android. KDE.
GNU/Linux Distributions as "Appliances" and DRM Platforms (the Case of ChromeOS and SteamOS)
Is this what we envisioned in the 1980s and 90s?
Fulfilling the Site's Full Potential
We remain devoted to the aforementioned goal of posting more original material
Over at Tux Machines...
2 days' worth
Upcoming Talk by Dr. Richard Stallman: Large Language Models Are Not Artificial Intelligence
LLMs aren't truly intelligent and cannot quite grasp what they spew out
GulagTube is a Burning Platform (Exit YouTube, Invidious Won't Save Us From Google/Alphabet in the Long Run)
Alphabet Agency (Google) sees the future of video as a "skinnerbox" (running Android) that indoctrinates you like TikTok does
Microsoft's Demise in the Global News Cycle is Rather Telling
It should be noted that Microsoft is, in general, no longer prominent or dominant in news headlines
Gemini Migration and Backup Capsule (Archive)
At the end we'll end up with something a lot better than before and latency should be massively reduced
Links 01/10/2023: Science, Education, and pro-Russia Slovakia Leadership
Links for the day
IRC Proceedings: Sunday, October 01, 2023
IRC logs for Sunday, October 01, 2023