Thoughts on over the air updates

[rlc177]

Ryan at tundras.com forums created a pretty good Thread on the Tundra MM updates. https://www.tundras.com/threads/off...ad-unit-update-details-updated-4-4-24.139030/

Some issues with the way Toyota handles updates from my perspective:

Toyota only releases info about what updates exist and what's fixed via TSB's until these hit the NHSTA website its not possible for average owner to get access to this info.

2022's shipped with version 1020, but an ota update was released that updated the version to 1040 in June 2022, later a 1050 version was released for only the 2023 models (Feb 2023). In Aug 2023, new trucks began shipping with version 2050. Toyota eventually rolled this out to all years via OTA but only after a March 2024 TSB. New trucks are shipping with a 2170 version that is unreleased, It adds a nifty feature for carplay users.

The main problem is that if you had a 2022 with the original 1040 version and you had these issues that were KNOWN and ADDRESSED even the dealers were in the DARK until the TSB was released in March 2024.

Toyota keeps the service people in the dark about what issues are known and seems to "sit" on fixes for months and months before its available.

While I understand the reason not to push out updates until things are tested, people with known issues that go to the dealer the dealer should be able to get the newest update on for the user and explain that maybe its not tested yet.

*updated with more accurate version numbers after reviewing my notes*

 

[Hilux]

I must be old school I just use my phone and put it in the dash in front of the tachometer.

 

[chaseydog]

OTA should not be a thing in cars. I work in software security and cars are a nightmare security wise. If something needs to be updated, it should be done via the dealer and not over a broadcasting insecure connection.

I don't think most people realize that anybody with a phone and 2 hours on YouTube can start messing around with pretty much any new car being sold right now. Why do you think car theft has seen such an increase lately. Everything needs to be ''smart'' or ''connected'' but always at the cost of security.

To my understanding the vehicle thefts are primarily due to the ease with which criminals can scan and duplicate the key fob code, which is why I keep mine in Farady pouches. This is a separate issue from OTA updates. I haven't read of any successful hacks on OTA updates, but may have missed reporting on that. Can you cite some sources that show otherwise.

 

[Beninbeta]

This thread is definitely interesting and there are fair arguments on both sides. Technology give us cool features and convenience, but everything comes with a price. Anything with connection to the internet or any kind of connection could be manipulated by someone. This is a fact.

All that being said, these are the times we live in, and this is what most people want, more tech, features and convenience. So from my perspective, it's the manufacturers that are in the toughest spot. They have to ensure that they have top notch software and cybersecurity teams. If you work in Cybersecurity, I hope your staying up to date or even better, ahead of the curve in that regard, not going the other direction and falling behind. All of of these things cost a lot of money by the way and that is reflected in the prices of our new vehicles. So if we want tech, we need be willing to pay for it.

Are the older car makers good at software and security today? They are getting better, but this is why you are seeing one platform shared across all vehicles now. It simplifies costs and software and that part is very good. However, they continue to show that they need more investment in these areas.

The best solution is to start considering which features really need to be part of apps and tied to software vs those that should not be accessible by the infotainment system. Anything that is tied to driving or operation of the vehicle should really be in one air-gapped system, with infotainment being separated and connected for streaming, updates to phone sync tech and the like. Where the real issue is now is we need apps for remote start and we can see error messages and vehicle info in our apps. Once you open those systems to over the air updates and sending info through the cellular connection you have greatly expanded the liability from attacks.

The rub is car makers need subscriptions to help pay for the ongoing costs of these services which is why they are bundled together. So we really need the best cybersecurity, software devs, and UI/UX designers at these companies to ensure we are as protected as we can be.

On another note, normal everyday people should not be learning Linux commands, unlocking bootloaders to any software on devices they own or otherwise messing with the software that comes with those devices as they have no idea what they are doing and don't really need to learn those things. If you want to mess around with things you find on XDA developers, you really should look at the second word in there developers. Have I messed around with this in the past yes, and because of that I would say only those that have a decent understanding of software should be doing anything like that. Also it's a great way to void your warranty if you break something and don't know how to fix it.

 

[Dusdaddy]

Security will always be an issue no matter what. Whether the vehicle gets OTAs or not, it can be stolen. We want convenience so we deal with it but I really don't have much of a problem with it. It's a truck and I have insurance. I do everything within reason to secure it but I don't worry about it being hacked. Besides, at 150K miles and rusty, I'd wish they'd just steal it so I can get a new one......

 

[Dusdaddy]

I only had one vehicle stolen. My '84 CJ7 in Oceanside, CA. Stolen while I was overseas. Got back and got a call from a wrecking yard saying it was sitting there waiting on me. Still have that Jeep.