It was only old-fashioned detective work that forced Volkswagen to admit to the existence of its ‘defeat device’. And that should worry us all.
For anyone interested in what is laughingly known as “corporate responsibility”, the Volkswagen emissions-fraud scandal is a gift that keeps on giving. Apart from the company’s Nazi past, its high status in German life, its hitherto exalted reputation for technical excellence and quality control, and its peculiarly dysfunctional governance, there is also the shock to consumers of discovering that while its vehicles are made from steel and composite materials, they are actually controlled by software. We are already close to the point where that software may be more valuable than all the physical materials that make up the vehicle, and, if Apple and Google have their way, that imbalance is set to grow.
Volkswagen’s chicanery was discovered by good, old-fashioned analogue detective work. An independent outfit called the International Council on Clean Transportation got hold of some Volkswagens powered by the company’s EA 189 “clean” diesel engine, stuffed some chemical analysis kit in the boot, hooked a pipe up to the vehicles’ exhausts and drove the cars from San Diego to Seattle, collecting and analysing samples as they went. The discrepancy between the actual performance and the emissions recorded in official laboratory tests was what triggered the scandal.
So how did Volkswagen pull it off? Simple: it inserted what programmers would call a “neat hack” into the engine-control unit (ECU) of its cars. The ECU is a purpose-designed computer that controls the engine. (All cars have them nowadays: analogue motoring is so yesterday, don’t you know.) Since 2009, VW’s ECUs have been running software that monitors movements of the steering wheel and pedals.
From that data, the computer was able to detect when the car was being tested for emissions in a lab, at which point it turned on its pollution controls. The result was that – in the lab – the cars ran squeaky clean. But the moment they left the controlled environment, the controls were switched off, leaving VW free to pollute at will. Accordingly, VW’s Jetta was emitting 15 to 35 times as much nitrogen oxide on the road as the allowable limit. And the Passat was emitting five to 20 times as much.
Nitrogen oxides are bad for your health. There is scientific evidence linking short-term exposures, ranging from 30 minutes to 24 hours, with adverse effects including airway inflammation in healthy people, increased respiratory symptoms in people with asthma, increased visits to emergency departments and increased hospital admissions for respiratory problems. And we now know that not only were more than 500,000 VW cars discharging these noxious fumes in the US, but 2.8m were doing so in Germany and 1.2m in the UK.
So if you drive a VW, Audi, Skoda or Seat diesel car powered by the EA 189 engine you may be an unwitting accessory to this act, because cars with those marques may also have been hacked. And it will be interesting to see if, in due course, your vehicle excise duty is adjusted to take account of your actual emissions.
So here we have an intriguing modern development: a hack in a piece of software that has an impact, possibly devastating, on the health and wellbeing of thousands of people. It’s an example of a computer program making a tangible impact on the real, physical world. For while computers are digital entities, human beings are definitely analogue – and in that sense the Volkswagen scandal provides an instructive glimpse into our collective future.
Given that the scam was digital in origin, why did we have to rely on analogue methods to detect it? After all, the VW hack was so blatant that it would have been picked up by any sharp programmer who had inspected the code. The problem was that no such independent, tech-savvy inspection was done, because the ECU software is proprietary. It’s effectively a trade secret: VW wants to protect the special sauce that controls its engines. So as far as the outside world is concerned, the cheating software is a black box.
I’ve got nothing against proprietary software: as the eponymous heroine says of chemistry in The Prime of Miss Jean Brodie: “For those who like that sort of thing, that is the sort of thing they like.” But when, as in the VW case, software has the potential or the power to have an adverse effect on human life or wellbeing, then we have to hold it to a different standard. In particular, we have to ensure that computer code with that kind of potential has to be open to independent inspection.
There’s a saying in the open source community that “given enough eyeballs, all bugs are shallow”. The corollary is that all malicious hacks are likewise detectable. The VW scandal is a wake-up call not just for the car industry, but for us all.
Source:https://www.theguardian.com/
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
