Cyberattack on vehicle breathalyzer company leaves drivers stranded in the US (techcrunch.com)

119 points by speckx 6 hours ago

syntheticnature 5 hours ago

I once helped someone get their car home after one of these was installed. Their license would not be returned until it was installed, but they weren't allowed to leave it on the lot. Someone else drove it there, and then I got to experience the breathalyzer to drive it home.

The interesting part is how bad the interlock was. First off, it can apparently randomly not work, so you get three tries. Worse yet, per the official documentation, apparently they can misdetect an ignition while driving at speed, and when that happens you have to pull over and blow within thirty seconds. Now, this is not something you can do while driving, as you have to look at the camera while you do it, on top of needing to have a deep breath. There's no motivation to improve this, because the customer is the legal system, not the person who has to have it installed

helterskelter 2 hours ago

I knew somebody with an interlock and if they were around too much car exhaust in a relatively enclosed space, the ethanol in the air would trip the detector apparently.

wildzzz 4 hours ago

Having to blow while you're already driving is supposed to be a feature. It's to dissuade people from successfully turning on their car, immediately drinking, and then driving.

AuryGlenz 3 hours ago

30 seconds seems a bit fast to force that though, no? There’s not always a safe place to pull over.

stronglikedan 3 hours ago

shimman 3 hours ago

Is this comment a joke or do you not understand how dangerous it is to ask a driver to blow into a breathalyzer while operating a vehicle?

All this seems to be is a company collecting corporate welfare while doing the bare minimum. Such companies should both be sanctioned and have their leadership investigated for potential fraud.

If you receive public dollars to function, the public should expect some modicum of sensibility and accountability.

KumaBear 3 hours ago

SilverElfin 5 hours ago

Isn’t there a proposed law to install these into every single new car?

sigmoid10 4 hours ago

Nothing specific yet, but the legal groundwork has been laid both in the US and in the EU. Starting in July, all new cars sold in the EU will need to be able to fit after-market alcohol interlocks. In the US, interlocks are already mandatory for convicted DUIers in most states, but new cars will also have to come with factory installed drunk driving prevention technology in the coming years. We just don't know how far that mandate will go eventually.

londons_explore an hour ago

pas 2 hours ago

clickety_clack 4 hours ago

Old cars sound better and better every year now.

nslsm 3 hours ago

kube-system 4 hours ago

There is no proposal to require these janky ass aftermarket units, nor require any type of interlock at all.

NHTSA was directed to write some guidelines/rules around the implementation of passive impairment detection as OEM features. They have yet to do so, probably because it is flaky technology.

My guess is that the final rule implementation will be similar to the distracted driver detection that is already in many new vehicles.

astura 4 hours ago

No, the 2021 infrastructure bill required automakers to install passive technology (passive meaning not requiring any specific actions from the driver) to prevent drunk driving by some future date. However, such technology doesn't really exist yet.

AuryGlenz 3 hours ago

bri3d 4 hours ago

Not really the same. There are proposals to require OEMs to install driver monitoring, but it’s usually IR camera based rather than blow in a tube fuel cell based. These systems are probably going to be a mess but the technology isn’t really comparable to DUI interlock devices and the unreliability of those systems is orthogonal.

profdevloper 2 hours ago

I was the DD for my friend's bachelor party and as we were leaving the bar, I saw this older gentleman struggling to start his vehicle. I had a hard time making out what he was telling me, but it looked like he had one of these devices on his car. Being the Good Samaritan that I am, I blew into the device, his car started, and he went happily on his way.

joachimma 2 hours ago

I assume you're joking, Either way. One morning when I took the bus to work the bus driver had repeated problems getting the bus to start due to the breathalyser. I heard him complain to the passenger behind him, about it malfunctioning. The passenger volunteered to test this theory, by also blowing into the device. The driver handed him the hose, the passenger gave it a go, the bus started, and the driver shrugged his shoulders, and off we went, only slightly delayed.

I'm not sure if this is preventable.

syntheticnature an hour ago

0xbadcafebee 4 hours ago

We need a software building code. This wouldn't be allowed to happen with non-software. The fact that anyone can build any product with software, make it work terribly, and when it fails impacts the lives of thousands (if not millions), needs to be stopped. We don't allow this kind of behavior with the electrical or building code. Hell, we don't even allow mattresses to be sold without adding fire resistance. The software that is critical to people's lives needs mandatory minimum specifications, failure resistance, testing, and approval. It is unacceptable to strand 150,000 people for weeks because a software company was lazy (just like it was unacceptable to strand millions when CrowdStrike shit the bed). In addition to approvals, there should be fines to ensure there are consequences to not complying.

knollimar 2 hours ago

It's great to assert "we need" but I implore you to consider the downsides first.

I work for an electrical contractor and I don't think being annoyed by shitty UI is nearly the same problem as electrical fires. Why govern the whole set of software with 1 set of rules?

Software isn't safety critical until it is, but we already have code to regulate software on electrical equipment, planes, etc. Why do you recommend software have a code? I'd much rather each individual thing that's safety critical have regulations around software in place than have to learn a 4000 page manual that changes every time you cross a jurisdiction, where enforcement varies, etc.

Software engineers can't even agree on best practices as is.

Imo, put the code around the safety critical thing (e.g. cars, planes, buildings). Restricting "critical" software will only get abused the way essential workers did during covid.

Also keep in mind the way buulding code gets enforced: you get an inspection upon completion or milestones. Software has a tendency to evolve and need maintenance or add features after; I don't want to trust this to a bureacrat. I don't like google or apple getting involved on "their platform" and I certainly don't want an incompetent government getting involved.

Before we have a software code, let's make and adopt some guidelines we can agree to. In construction, plenty of builders have their own sets of internal rules that are de facto codes. When one of those gets popular enough for life safety software, let's consider pushing for that.

M95D 14 minutes ago

I think a better ideea would be that software should not have disclaimers. Authors should assume full responsibility in court if their work misbehaves.

chasil 2 hours ago

The two long-term existing environments are Misra-C and ADA.

https://en.wikipedia.org/wiki/MISRA_C

https://en.wikipedia.org/wiki/Ada_(programming_language)

ADA is particularly strong in aviation.

https://www.adacore.com/industries/avionics

Rust would also be a contender, but it's "the new kid on the block."

MisterTea 16 minutes ago

Ada is a name, not an all cap abbreviation.

HeyLaughingBoy an hour ago

There are lots of "software building codes" IEC-62304, MISRA, DO-178C, etc. Problem is that the vast majority of software doesn't fit into those categories. And as you mention, since you can build any product with software, you would have to have categorization for any new standards to make sense.

bilsbie 40 minutes ago

That’s the wrong lesson. Rather we should control things we own and not them control us.

nathanaldensr 4 hours ago

I have no idea why you'd been downvoted. Everything you said is common sense. I guess this is a case of "it's hard to get a man to understand something if his paycheck depends upon him not understanding it."

pas an hour ago

EU has the NIS2 directive, the CRA (cybersecurity resiliency act), and a few sector specific ones (DORA for financial, MDR/IVDR for medical/diagnostical, and there's probably a bunch more)

these are slowly but surely pushing manufacturers/sellers/distributors to try to do the right things

it requires transparency about support period commitment, a bug tracker program, issuing updates (I guess in case there's a CVE), doing risk assessment during development, etc., and requirements kick in based on turnover (or headcount).

and it seems like the correct approach, these are already things good products come with

coryrc 2 hours ago

Or maybe it's "the NFPA doesn't need to prevent against your wires suddenly becoming aluminum because somebody discovered new math" like "DSA encryption has been broken" affects software.

ashwinnair99 5 hours ago

The fragility of putting ignition control behind a third party cloud service was always going to end like this. Someone had to find out the hard way.

ghastmaster 2 hours ago

I am an Intoxalock user right now. My device was due for calibration three days after the onset of this breach. I called the mechanic that does the calibration and they said they could not access the Intoxalock system. My device said I was overdue. I still drove it for 2 days. Intoxalock did a partial fix and the service center was able to extend the period for my calibration for another 10 days, but still couldn't calibrate it. I need to schedule that calibration now. It was a minor inconvenience for me.

hedora 5 hours ago

We need to legally mandate a single physical switch that disables all vehicles radios, and a second that factory resets everything but the odometer and vehicle fault logs / black box.

bri3d 5 hours ago

Irrelevant to this issue - the devices didn’t get bricked over the air, but rather they have a “calibration” time lock which must be reset at a service center and the service centers are ransomwared.

bilekas 5 hours ago

That's an extremely attractive attack surface. How about we just have keys to turn on the engine?

uxp100 4 hours ago

Well, in this case because drunks keep murdering people.

bilekas 3 hours ago

kube-system 4 hours ago

> a single physical switch that disables all vehicles radios

Disabling all of them would have silly consequences, and wouldn't be compatible with other safety regulations.

mvdtnz 2 hours ago

I feel like a lot of you are commenting without reading the article. Vehicles are not being remotely disabled.

The computer systems which perform the calibration on the device (usually done at a mechanic or auto electrician) are under attack. The vehicle will get locked out of this calibration is not performed monthly. There is no remote attack on the vehicle.

Yizahi 4 hours ago

Good old "let's fire QA guys and give testing to the everyone else". It never fails to entertain. "The happy path checks all green, lets deploy!" :) .

chasil 2 hours ago

Is there any indication that the source of the attack was Iran?

stevemadere 42 minutes ago

Given Pete Hegseth’s history, this could be a huge national security issue.

anonymousiam 2 hours ago

Imagine if an attack like this could disable ALL vehicles, and not just the ones fit with the breathalyzer socket. It could happen soon:

https://carcoachreports.substack.com/p/government-kill-switc...

mvdtnz 2 hours ago

If you search for Intoxalock on r/DUI you'll see this company has been notorious for a long time. They are regarded as the worst interlock provider by a very wide margin for various issues around reliability and service quality.

Arubis 2 hours ago

Now let's add an externally-controlled backdoor to everything else, too, and that'll work out great.

nekusar 6 hours ago

I guarantee that basically nothing will come out of this.

People dont willingly put these alcohol breathalyzer interlocks on their vehicles. They're 100% court mandated, as a punishment for, usually, drunk driving.

This country is so hell-bent on making criminals' lives worse and worse as a never-ending punishment. So what 150k people cant use their cars. 'They did something wrong and deserve it', is the usual motto in the USA.

Now, lets have a discussion about software liability....

Someone1234 5 hours ago

And there is nearly no oversight on how much these private companies are allowed to charge those 150K people for something that is court mandated. These interlocks can exceed $100/month for some of the poorest people in society.

Unfortunately the US public has no interest in this issue. They have a dual morality where lawbreaking is wrong, but profiting off of criminals and the poor isn't. So mandatory prison labor, expensive monitoring, for-profit probation services, and for-profit jails are fine.

Literally if you don't pay or play, you go to jail. But it was a plea so you "volunteered" (to not go to jail).

ghastmaster 2 hours ago

In Kentucky there are approved vendors of these devices by the government. I do not know for certain, but I assume if they had outrageous pricing, they would no longer be approved.

Someone1234 4 minutes ago

AngryData an hour ago

astura 4 hours ago

Your insurance is going up more than $100/month if you get a DUI.

Someone1234 4 hours ago

lesuorac 5 hours ago

> So what 150k people cant use their cars. 'They did something wrong and deserve it', is the usual motto in the USA.

Maybe I'm in the wrong here, but I do find it pretty fair that people that can't responsible use a vehicle aren't allowed to use a vehicle. You don't see me flying airplanes for hire ...

> Now, lets have a discussion about software liability....

You're welcome to demand that the software you use provide a warranty. For some reason government agencies which actually would have the ability to demand this seem to not care. It does seem extremely negligent to allow people who can't use cars responsibly to use cars with provided software without a warranty.

jasonlotito 5 hours ago

> Maybe I'm in the wrong here, but I do find it pretty fair that people that can't responsible use a vehicle aren't allowed to use a vehicle.

Except they are allowed to use a vehicle. This issue isn't that they aren't allowed to use their vehicles. The danger is the disruption in what they are allowed to do and software/hardware failing. This is dangerous not only for them, but others as well.

And to be clear, this is specifically about people who are allowed to drive with a breathalyzer. So, "aren't allowed to use a vehicle" makes no sense. They are allowed to drive with certain conditions. Just like you and me.

nekusar 4 hours ago

chromacity 5 hours ago

> This country is so hell-bent on making criminals' lives worse and worse as a never-ending punishment.

Interlock devices are typically mandated for 6-12 months if it's your first DUI. In California, you will be mandated to use it for three years after your fourth (!) DUI. DUI laws in many parts of the US are ridiculously permissive and your criticism is pretty off-base.

AngryData 4 hours ago

Because the DUI laws aren't designed to protect people, they are designed to extract money out of citizens for the courts and their buddies providing 3rd party services. Someone blows exactly the limit that is within the error range of the breathalyzer? Still get charged just as hard for a DUI because that is literally thousands of dollars the court will receive. Oh sure if you got $10K to drop on a lawyer it will go away easily, but for anyone that has a public defender they are shit out of luck. Defending yourself in court with a public defender is just increasing the risk and liability because if they lose the case they now have to pay thousands of dollars more for court costs, which pushes people to taking shitty plea deals.

Oh sure there are plenty of people who are guilty and have a problem, they get caught too, but the courts want money so they aren't just going after the problem, they are charging any and every person possible. Some people get charged DUIs for annoying a cop or being tired, and even if their blood work comes up clean, do they drop the case? No. They just argue they were high on some other drug that they didn't test for.

chromacity an hour ago

stronglikedan 3 hours ago

>> This country is so hell-bent on making criminals' lives worse and worse as a never-ending punishment.

> your criticism is pretty off-base

In my experience, and the experience of my friends, that criticism was spot-fucking-on. Once you get into the system, you'll be lucky to ever truly get out. Every step is designed to keep you paying into the system in perpetuity unless you walk a very, very thin tightrope. Anyone that thinks we rehab our criminals is pretty off-base.

benatkin 5 hours ago

The comment you're replying to isn't disagreeing with the sentences but with the additional hassle on top of the sentence. Do you think that additional ad-hoc punishment is justified? Where would you draw the line?

If the people of the country were more constitution minded, they would want a punishment that fits the crime, and no additional punishment on top of it. So I share this gripe, even though I consider DUI a very serious crime (including those who do it and don't get caught).

SauciestGNU 4 hours ago

astura 4 hours ago

bombcar 5 hours ago

"Plea deals" have an interesting caveat that I didn't know - you can agree to punishments that the government couldn't impose as part of a plea deal.

So if the punishment for driving drunk is 3 years in prison, you may be able to avoid it by accepting a plea deal that infringes on your third amendment rights.

This can even occur in a civil case.

chuckadams 5 hours ago

I'm pretty sure even a plea bargain can't result in soldiers being quartered in your home.

bombcar 5 hours ago

toast0 4 hours ago

nemomarx 5 hours ago

I'm generally against long term punishments for crimes like this, but operating a dangerous machine like a car is a serious matter. A breathalyzer is a reasonable compromise compared to just taking away your license, right?

dghlsakjg 5 hours ago

More effective, too.

An interlock prevents you from driving drunk. Suspending a license pretty frequently does nothing.

kube-system 4 hours ago

ghastmaster 2 hours ago

I have a friend who would like to do it voluntarily, however, just having one on the vehicle increases your insurance cost.

dylan604 5 hours ago

> People dont willingly put these alcohol breathalyzer interlocks on their vehicles

N=1, but I know of one case where the defendant was offered a lock on their car or an ankle alcohol monitor. Of course they were going to choose the car lock.

applfanboysbgon 5 hours ago

If I offer you the choice to give me your wallet or else be stabbed, I don't believe it would be appropriate to describe this as "willingly" giving me your wallet.

sumeno 5 hours ago

dmitrygr an hour ago

zoklet-enjoyer 5 hours ago

I like to not share roads with drunks

calgoo 5 hours ago

Well, one could remove their licenses instead, however the US is built around the car, and not being able to use one almost becomes a social credit, in that you can not function in the country without a car.

doubled112 5 hours ago

irishcoffee 5 hours ago

jMyles 5 hours ago

I have no problem sharing the roads with drunks. It's the cars that scare me.

tosti 5 hours ago

bri3d 5 hours ago

The issue here is not an OTA thing, for what it’s worth. That is to say, it’s not that these devices phoned home directly and a cloud server is down; rather, these devices require periodic “calibration” (due to a combination of regulation, legitimate technical need, and grift) at a service center and the service centers are out of commission, presumably due to ransomware.

jeffbee 5 hours ago

The issue here has nothing to do with the device and everything to do with the fact that car-brained America is so cowardly and broken that they will do some Rube Goldberg stunt before they even consider taking cars away from alcoholics.

bluGill 5 hours ago

Nobody in human rights would allow that. Take away the car and people cannot live.

The above is sadly serious. It is almost impossible to find a job and a house you can afford in walking distance of each other, demanding there be things like grocery shopping as well make it not feasible for most people. Taking away someone's car is cruel and usual punishment that cannot be accepted.

cesarb 4 hours ago

> Take away the car and people cannot live. [...] It is almost impossible to find a job and a house you can afford in walking distance of each other,

As a Brazilian, that statement feels bizarre. Yeah, my job and my home are not in walking distance of each other. I simply take the bus. Sure, some jobs are not within reach of the bus (or the ferry, or the metro, or the light tram, etc), and some jobs need a car (for instance, it would be hard for a HVAC technician to take all their equipment on a bus), but saying it's "almost impossible" to find a job?

> demanding there be things like grocery shopping as well make it not feasible for most people.

That also sounds bizarre to my ears. Most places I've known have small grocery shopping places on nearly every corner. You just have to walk.

array_key_first 21 minutes ago

showerst 4 hours ago

inkcapmushroom an hour ago

kube-system 4 hours ago

philipwhiuk 5 hours ago

> It is almost impossible to find a job and a house you can afford in walking distance of each other, demanding there be things like grocery shopping as well make it not feasible for most people

This is exactly what the parent meant by designing the country in a 'car-brained' fashion. It's not true in many/most other countries.

rootusrootus 4 hours ago

rootusrootus 5 hours ago

It's actually an easy problem to solve, some places have done it with great success. You can't effectively stop DUI by taking the car away. The problem is the drinking. You make someone test every morning and if they've been drinking they get the slammer for the day. You don't need to take away their transportation.

jeffbee 5 hours ago

That seems fair, yet even less likely to happen in America.

rootusrootus 4 hours ago

c22 5 hours ago

Wouldn't it be better to take the alcohol away?

ativzzz an hour ago

The US tried this in 1920 and rolled it back a decade later - https://en.wikipedia.org/wiki/Prohibition_in_the_United_Stat...

rootusrootus 29 minutes ago

volkl48 2 hours ago

We tried that once. It caused a lot of other problems.

rootusrootus 29 minutes ago

nathanaldensr 4 hours ago

LOL, exactly! The underlying problem is people's addiction to drugs, not all the symptoms that come from those addictions.

longislandguido 3 hours ago

People need cars to get to work.

SilverElfin 5 hours ago

If “car brained” means recognizing how great cars are for improving our lives, by letting us get to places quickly, then I don’t see anything cowardly or broken about it. Just seems rational.

genthree an hour ago

I once read a claim that once you remove the distance that exists between places because of cars (large set-backs, unusable "green space", wide freeways including the medians and buffer around them, giant parking lots, et c.) cars are only an improvement for most car owners for day to day travel before a city adjusts to widespread car ownership, and adds all that stuff. Add in the time you spend working just to pay for the car (depreciation, fuel, insurance) and it's not a great deal at all. After that, it's only consistently a benefit if you can afford a driver. For most, it's a wash with bicycling, if not worse (in the hypothetical world that hadn't bloated way apart to account for tons of cars) except now you also need to schedule separate time to work out to stay healthy.

This seemed implausible, so I ran the numbers for my situation at the time that involved car costs and a commute distance that were both below median for my city, plus well above-median household income.

Sure enough! It worked out just the way they claimed, if only barely. For the median worker in my city though, it was very true.

rootusrootus 26 minutes ago

jeffbee 4 hours ago

If by "quickly" you mean reaching a far-away destination in much more time and with higher variance in arrival time than it would have taken if the origin and destination had been sensibly placed closer together, then sure.

mrlonglong 4 hours ago

Why do people drink drive?

wildzzz 4 hours ago

Either they are alcoholics who can't control themselves or simply just think they are still under control of their ability to drive despite being impaired. Many people just don't know what 0.08 BAC feels like. In college, I got the opportunity to blow on a breathalyzer (not because I was arrested) and found that despite not feeling drunk, I was over the 0.08 limit.

tristor 3 hours ago

The 0.08 BAC limit also has no basis in reality for what impairment is. It's a political reality, not a scientific one. MADD and other organizations lobbied to make this a legal limit across the US and many other jurisdictions around the world followed suit.

That's not to say that anyone should drive after drinking, but the basic reality is that impairment is often individual, and cannot be directly measured by blood alcohol content. Many people are impaired with a lower BAC than 0.08, and in many states you can now be charged and convicted of DUI even if your BAC is not beyond the legal threshold on the basis of purely circumstantial evidence.

There's no good answer here, because we need cut and dried evidence in our legal system to prevent abuses, but there's not really good ways to do that. Separately, the leading cause of accidents is no longer drunk driving in most parts of the West, it's inattentive driving due to cellphone/electronics usage while operating a vehicle. Younger generations don't drink as much as older generations, to the point that zero-percent alcohol spirits and NA beer are now becoming broad markets and it's dramatically affecting bar/pub culture, but younger generations nearly as a rule are addicted to their smartphones.

iso1631 2 hours ago

MSFT_Edging 4 hours ago

Addiction, mental illness, a defacto requirement to drive to get around low-density towns where walking is often extremely dangerous due to lack of sidewalks and fast roads.

Alcohol abuse has been around about as long as we've been human. We've just constructed a society where Alcohol abuse is far more likely to pick up collateral damage.

vkou 2 hours ago

We've also become a lot better at distilling high-proof alcohol, and at making it cheap enough that most people have the budget to get absolutely wasted on the regular.

Most people don't do that, but the option is there for anyone looking to make their life and the lives of people around them significantly worse.

AngryData an hour ago

bitwank 4 hours ago

There are no beds in most bars and nightclubs.

kube-system 4 hours ago

Alcohol inhibits people's decision making skills

vkou 2 hours ago

Because they are drunk and want to get home.

Or because they are drunk and want to go somewhere.

That's all there is to it.