BMW - No Joy: GPS is a SPOF

SPOF: Single Point of Failure. The failure modes of GPS are pretty fascinating, which is why you cannot trust it to get you home alive, not unless you are in the US army and have access to the military GPS channels. Even then, you can't trust them past the opening salvo of a war that involves non-conventional armaments.

The Bristol Traffic Project is not anti-car, but we are anti unscientific approaches to the traffic issues of our city. Therefore it was with some sadness that one member of the team was forced to issue a complaint about a recent advert. For anyone else who fears that SatNav is not something that should be relied on, consider complaining to the Advertising Standards Authority. There is no need to go to such detail, a more succint summary would be "If GPS is so reliable, how come come someone nearly drove their BMW off a cliff last summer? (Apologies for the citation style, but it was needed for the ASA complaint form). Plain text only.

TomTom: Schoolchildren can slow you down

Continuing our question to Brizzleize the rest of Europe, a quick look at TomTom, Amsterdam-based makers of SatNav toys for cars.

This is their office, near the train station and and tram halt

Next to the parked bikes and the pedestrians

And round the corner from the flat rate 1-euro stop/go bus service.

This company is a little part of Bristol, in disguise. How so?, people ask.

Take a look at their marketing blurb.

Their business model is built around selling satellite navigation tools to car drivers. With new cars building it in, and a lot of old cars already fitted with existing models, TomTom need to sell boxes to the hold-outs, those people who drive around with a 1993 A-Z in the glove compartment, they need to convince everyone with an existing TomTom to upgrade. Yet the rate-of-obsolescence of old products is determined mainly by the rate-of-change of road infrastructure: new roads, new road restrictions. Predictable and generally manageable by people who can upgrade every fiew years -no easy way to switch to a subscription model for timely updates on one-way systems.

As for drivers who don't even have SatNav, maybe they don't believe they need it.

TomTom need to come up with a way to convince everyone they need SatNav; they need something to fear. What have they come up with: schoolchildren. As in "schoolchildren or shopping crowds can slow you down. "

To ensure that you can drive across the city at the fastest speed the city allows, even if there are schoolchildren around, you need a new TomTom device, one with a subscription to "TomTom IQ Routes", that knows about traffic. Presumably, then, it laughs at you if you want to go up to the lake district on a Friday evening in summer, or shakes its virtual head if you try to bring up any route on a Saturday in July and August that involves the M5 motorway bridge over the Avon. Implementation details aside, however, the key point is that this company, based in Amsterdam, whose staff appear to walk, cycle, bus, train or tram into work, are selling products to our city's drivers that claim to help navigate them away from peak pedestrian schoolkid densities on their journeys. Which is clearly a little bit of Bristol, lurking in the centre of Amsterdam.

One question though. If it does aim to steer you away from schoolkids walking around, what does it do when you ask it for a route on that morning school run?

Tampering with Speed Limiters

Some researchers up in Leeds have published a study of GPS-speed limiting cars.

The central cycling groups are in favour of it -because the idea of cars not speeding appeals- and the "unionists" -the Association of British Drivers and their anti-speed-camera allies are against it.

Bristol Traffic leaves it up to individual contributors to have their own opinions. But this one, the Computer Scientist in the group, is against it on software engineering grounds:

It is one thing to have SatNav give you hints as to where to drive -hints you should consider but not follow blindly, another to be relying on GPS and accurate mapping data to control your vehicle

The Leeds study took volunteers and explored how voluntary and mandatory speed limiting worked, then interviewed various people to see what they felt of the idea. What they did not attempt to do was impose speed limiting systems on unwilling participants, people who wanted to drive fast. Doing so would not only show how acceptable the idea was to the country at large, it would show how willing people were to subvert the system. A realistic study would therefore instrument a city's taxi/minicab fleet (I can think of a city), or all drivers convicted of speeding coming off a driving ban.

As it is, the closest we have to speed limiting infrastructure we have today are the tachographs in lorries, that monitor speed and working hours. Which is why Ross Anderson's wonderful book Security Engineering has a section on subverting tachographs, right between Banking and ATM security and locking down Nuclear Command and Control Systems so that high-energy physics events only take place with senior management approval.

Trying to limit vehicle speeds from an bit of in-car electronics and GPS is as workable as the film companies trying to restrict DVD players to specific regions so they can charge price differentials on different continents (result: multiregion players cost a 10 pound premium). It's as workable as the games console companies trying to stop you hacking into the controller so you can play downloaded games burned onto your own disks. Results: modified firmware chips are widely available. These consoles are not easy to hack, either; it took someone at MIT three weeks to 0wn the Xbox. If there is money to be made from subverting something in your possession, be it a games console, a DVD player or a tachograph, then someone will do it. And if the hack is a software one, then it usually scales well. Only one person will need access to the Scanning/Tunelling Electron Microscope, the rest just pay for the results and some modified firmware.

Imagine that three years from now, every car comes fitted with mandatory speed-limiters driven by GPS. How would you attack it?

Attack one: lie about your location. Civilian GPS isn't secure; it isn't signed and anyone could generate spoof satellites. An in -car pocket GPS Jammer would generate signals telling the satnav unit that you were in France or Germany and could drive as fast as you like. This is a good attack as when the jammer is off: it doesn't show. When the speed limiter is checked in the MOT, all would appear well.

Attack two: firmware hacking. All embedded computers with upgradeable software can be subverted with new firmware. There may be some checks on the firmware -that it is digitally signed by someone trusted-; these need to be subverted first. If you can roll back to the legit firmware during the MOT tests, nobody will know.

Attack three: hardware patching. The common games console attack. Shows up in a physical audit.

Attack four: don't update the maps. Assume that every year, speed limits come down. There is no benefit, then, in updating your maps. Snap the link to the GSM modem, or refuse to pay the 10 pounds/year for updates. If the MOT checks that you are up to date, someone needs to record the previous year's update, and after the MOT, you replay the older map into the SatNav.

Attack five, and this is the fun one: generate fake maps. Create one that says the max speed for the country is 120 mph. Install it in your own machine, sell it to others. At this point the security experts are going to say "ah but our system will only download signed maps from a trusted provider". Which may be true, but rests on certain assumptions about the security of things like HTTPS, those web sites with the green bar in the browser window, which tell you that that bank site really is who they say they are, and not some russian Phishing site. On the same day that the UK government published their paper on SatNav-based speed control, a group of Dutch hackers published a lovely paper on how to subvert HTTPS by creating a fake certification authority. It's a fairly complex paper and hard to understand, the good news being none of us need to know the details. What is important is that people like Ben Laurie, key developer of the OpenSSL stack and Apache SSL module is scared. Because right now, this week, we can't trust HTTPS sites to be who they say they are. There are very serious implications for the web for this, but they would also impact things like satnav based GPS. If I could make a fake map that removed all speed limits from cars sold after 2012, how much would it be worth?

If SatNav-based-speed limiting is flawed, what to do? Well, why not charge a bit of road tax based on peak vehicle speed? Or just speed limit all cars to 100 miles an hour, more than enough for UK overtakes and driving -and to get you to the French Alps when needed- but removing demand for big-engined cars that waste petrol at normal speeds. Or rely on the ANPR-instrumented motorways to catch speeding cars, and similar infrastructure in-city. Because you are going to need such cameras up to keep an eye on the older cars, the cars from the rest of europe, and to detect people who have just paid for my high-speed map of the country. There are lots of options that don't rely on tamper-proof hardware being embedded in cars with tamper-proof maps and reliable GPS constellation data received in real-time. It would be one of those things like biometric ID cards: a expensive way to not solve the underlying problems.