AAH #736 - Does More Tech Equal More Hacks?

Speaker 1: Out online.

Speaker 2: After Hours is brought to you by bridge Stone Tires Solutions for your journey.

Speaker 3: Everyone, thanks for joining us this afternoon. Yes, I know

that the tariffs are a big situation that we're all thinking about, but we're going to start the show by talking about something else that have huge implications for automobility in general, and that issue is cybersecurity. So joining me

to talk to Jason Masker, who's the director of Solutions Architecture at Upstream. He has been on the show before.

I'm joined by Jeff Gilbert of WWJ nine fifty, the automotive reporter and the president of the North American Car, Truck and Utility of the Year Awards. Thank you, thank you,

and our old friend Brett Smith, who is automotive researcher.

Speaker 4: The Luxe the Luxe absolutely thank you.

Speaker 3: So so Jason, you guys have done your twenty twenty five Global Automotive Cybersecurity Report. Give us the headlines.

Speaker 5: Yeah, so the headline.

Speaker 6: I mean, I was on the show last year talking about then it was kind of the inflection point where we saw now fifty percent of these attacks having wide impact.

We're talking thousands, millions of vehicles and that's up to sixty percent now, So continuing that trend, and the big thing we were focused on this year is minding the cyber gap because the direction that these are headed, we're seeing that gap in the market where it's been the engagement mostly focused around regulation are one fifty five in some of our initiatives, but the impact of these is much greater operationally financially.

Speaker 5: Potential for impact there.

Speaker 3: Okay, let me ask you, so does an individual driver, individual car owner need to worry at all about cyber attacks?

Speaker 7: So?

Speaker 6: I think it shows up more to individuals when we have things that impact our relationships with our vehicles or relationships and procuring.

Speaker 5: You know, we saw last year.

Speaker 6: The impact to the dealerships from sort of a shared supplier there and that impact on sales. Right, So maybe

if you were buying a car during that time, I know I talked to a few that were. You know,

you're suddenly dealing with reams of paperwork and things to get that done. You know, as an individual, I don't

know that there's much to me. There's not really a

way to be more cyberly diligent about a driver car, But I think it impacts us all it's you know, these things are you know, systemic to our society and every everything that you know a large impact is going to impact us in different ways.

Speaker 4: What are we seeing in terms of incidents? I mean,

we're seeing in real life a lot of ransomware things of that nature. Is that what you're seeing or you're

also seeing you know, breaking in to get people's personal data, which of course could affect us, you know, if they find your car Loan data and your social security number of things like that. Are those the kinds of things

we're saying?

Speaker 6: Yeah, absolutely, So we have a lot of convenience functions like that. That's good to mention. You know, you have

ebs ev chargers. There's a convenience factor there and having

your financial information readily available to pull up and charge.

So obviously we're concerned as individuals, just like we are with our relationships with with all companies when our personal data is impacted. But we've seen, you know, we tracked

about it's over four hundred attacks and the number might seem small, but we're looking at a very very focused industry of mobility when we're talking about that number, and the ransomware is exactly what we're seeing we're over one hundred of those attacks. We're actually mobility focused ransomware, and

we saw impacts like there was there was an incident.

I try not to not to shame any individual organizations when I speak about these things. There was an incident,

you know, impacting trucking is essentially the logging facility right where you got to log your miles. You can drive

so much, you got to rest so much. And this

was an impact on those systems, and not only the shuffle of okay, can we still do paperwork? Is that

still an option to kind of keep the trucks rolling down the road. But we saw that impact and then

the realization that these systems are actually sitting in the truck now on the canvas, and the potential of the short jump from there. So we are very focused on

the thread actors and their motivations. They are mostly black hat,

so they are driven by financial and in the case of some of these, we do have information some of these ransoms, at least portions of them, we're paid and that kind of just goes into funding the next round in the next set that we have to worry about.

Speaker 1: Jason. They're driven by financial, but I also hear often

they're driven by political or other entities trying to change the US or European Are you seeing differences in the way those financial driven versus political driven hacks are coming.

Speaker 6: Well, I think if you're on the receiving end, it doesn't matter. If it's financially driven, there's at least options,

and we see some pay ransoms, some don't. But if

you're dealing with that what we call a activist right or it's more of a political motivation, you know, the challenge there is they may not care at all, They just want to see it all burned down.

Speaker 1: So do you see that increasing Well.

Speaker 6: Certainly, certainly we see the impact and you can you know, you can correlate the attacks to big motions politically or the tensions that's out there, the wars where these these are.

You know, there's a rise in activity certainly around them.

Speaker 3: But is is this is this cross industry? This isn't

specifically automotive.

Speaker 5: Yeah, so for the.

Speaker 6: Act of as it does tend to be across industry.

You know, they're they're out there attacking banks and talking certainly outside of the industry too. I think that's the

concern we have in the United States for the mobility or where it where we're more focused on this gap and just trying to raise awareness about it is I say it's driven by regulation and mentioned our one fifty five.

Well that's over in Europe, right, So we mostly see that because we're all international and organizations here are concerned about sales over there as well. So if you want

to enter a market like Japan, or you want to enter the the European Union, you have to comply. But

here we don't have anything really driving that compliance. So

when you think about it from an activist perspective, some of this is critical infrastructure and they're paying attention to things like we all saw, you know, the impact of a really cold winterer on EV's in Chicago, right, and that wasn't anything anyone doing anything malicious, that was just okay.

We got to think about how these things can be systematic and really shut down the city and cause some implication there. So who's responsibility does it become to make

sure that doesn't happen? And I think you know, for

most of us, you just want your organization to be as diligent as possible and make sure there wasn't something that could have been prevented. And that's really the gap

we're seeing is we got to get out of this mode of regulation driving us and look at that more as ten stakes. Good things to look at, even if

so regulation doesn't apply. Here might be a good guideline

for what we're doing. Here a good place to start.

But to your point, seeing these ransomware actors become aware of the impact of the mobility space and move into it, We've also got to bring the conversations that our IT piers are having and be speaking a little bit the same language. So you're seeing us do things like reference

might where our one fifty five might be better for all the mobility on board stuff that we're doing and have some better classification. We also want to make sure

we're mapping it into things that our IT piers understand, so that we are mapping to those overall organizational that are much better understood to understand and make sure we're dealing with the risks in the same way.

Speaker 4: How often do these people actually get caught and prosecuted Because we see headlines all the time so and so hit by a ransomware attack, but we will very rarely see headlines and I'm sure police would pat themselves on the back when they were doing a purp walk with somebody who has actually been arrested. It seems like this

is a very low risk crime because you don't see a lot of people getting caught and getting prosecuted.

Speaker 6: Yeah, And what you're touching on is another piece that we see where the majority of these attacks are carried out across great distances, across continents. So when you see that,

I definitely see more. You'll see the federal government issue,

you know, indictments. But when you read into the list

of names and who they are and where they are, they're listing a bunch of people citizens of another country across continent, right, there's not any actual way to.

Speaker 5: Go around them and get them. So this is definitely

a concern.

Speaker 1: Yeah, Jeff, Just to be clear, you're not suggesting this as a career path.

Speaker 4: I am not suggesting it as a career path. But

I would be suggesting somebody to be smart enough to try to figure out how to prosecute these people and how to make deals with the countries that they're in.

Although I'm suspecting that whatever these countries are probably aren't eager to make deals with us because for some reason it's in their interest to protect these people.

Speaker 6: Yeah, I mean that the I think there's a big interest in making sure we.

Speaker 5: Know like that.

Speaker 6: It is a focus, right, they want they want to prevent that. Politically, there may be things, you know, back

and forth to try to have countries police more of their own.

Speaker 3: Uh.

Speaker 5: But where you see the friction is obviously where the problem lies.

Speaker 6: Right, we know we're not goingning, that not everybody is getting along, and that there's not full cooperation there.

Speaker 3: Getting getting back to the to the individual. Now, you

guys discovered that there's there's more hacking going on at charging stations. Now that's you know, increasing number of vehicles

that are evs. People are plugging in and there's communication

going on and and as you mentioned earlier, you know financial information can be taken. Is now that that can

affect the individuals?

Speaker 4: Right?

Speaker 3: Is that a responsibility of the provider of the charging facility to somehow protect against cyber attacks or.

Speaker 1: Is it.

Speaker 3: The vehicle manufacturer who should have countermeasures in place to protect the data?

Speaker 1: Garry, If I could to expand on that, because it's a very complex relationship there, maybe it'd be good if you could take a step back and describe all of the different interactions to get to it and come to this point. Yeah.

Speaker 6: So, I mean evis are actually fascinating for this reason, right, because this whole ecosystem around it and a lot of things that are driving the features actually create new surface areas of exposure. So when you think about things like supercharging, right,

that's great, But in order to enable that, there's actually a data communication between the vehicle and the charger to negotiate and know, okay, this is how fast I can charge without blowing up your batteries. So there's the there's

additional surface area there. And to you, you know, to

your point, you do have different entities and it's a little bit of a shared responsibility. And I want to

say that we do see you know, these organizations, all of them being mindful in different ways. What you want

to realize is your financial exposure in those situations.

Speaker 5: You know, typically what.

Speaker 6: We see with a data leak is there's a lot of things that occur afterward. I'm sure everybody's gotten letters

in the mail right that, Oh, by the way, you're this insurance provider who this happened, and they'll offer you, you know, free coverage of you know, protecting your identity for a year or something like. Well, all those things

cost money, and all those are things that you then have to go and spend after the fact. So I

think the point is, you know, when you're evaluating risk in your business, if you're setting up a bunch of ev charts, if you're found to be the responsible party, or the finger starts to point out, well, you could have taken some mitigations you weren't really monitoring. That's that's

our point with the cyber gap, right, is there there's a big gap here in the way we're managing this risk and the potential impact versus really what's driving the activity right now is just oh, we're going to enter this market now, we need to make this compliance.

Speaker 5: So quite a gap.

Speaker 6: There when you're thinking about how we should be approaching it.

Speaker 3: Yeah, I mean, the thing I wonder about is is that, you know, it seems like every other day Microsoft is sending me a security patch of some sort or another. Right,

I mean, you don't do anything and you're getting that, and I'm just you know, and nowadays cars basically being so digitally defined that it seems that that ought to be part and parcel of the vehicle purchase itself.

Speaker 6: Yeah, this that is an interesting problem in the case of updates, because you're right, we definitely don't see updates for the vehicles nearly as often as say your phone or Microsoft, right. And the reality is they're using libraries,

they're using you know, software that has a lot of those same vulnerabilities come into them. The challenge we have

in the auto is just talking to manufacture the other day about this is you know, especially for the ones that have been around, the way the system evolved was very much you know, there's a lot of responsibility put on the supplier. They may be responsible for the software

that's actually running on their ECU and and asked to provide the updates for that, right. So then when you

have these challenges of you know, trying to go and pull those updates after the product is shipped, it creates an interesting situation. So they're aware of this and this

is changing, and it may be a different scenario from a you know, born evy startup than it is for a manufacturer. That's that's kind of evolved through the supply

chain in a different way.

Speaker 1: Right.

Speaker 6: But Yeah, to your to your point, you know, gone, there are the days that you can be okay with a supplier providing an ECU a component, and then those teams kind of get wound down once the product is shipping because you know, you go to apply the security pad or you say hey, we need to update this, and you've disbanded.

Speaker 5: The team, you know.

Speaker 6: So it's it's changing absolutely the ways that these that manufacturers that everybody has to has to look at it. Ultimately,

you want a good understanding of your exposure, be that from supplier components, from software you're writing yourself, you know, to to make sure you have a good handle on everything that could have an impact.

Speaker 5: At the end of the day, it's your product.

Speaker 3: You were mentioning surfaces before, so the surfaces are basically places where the bad guys can get in, right.

Speaker 6: Yeah, yeah, so we look at that, you know, taking it back to the to the EV we look at a surface areas. Okay, now you have vehicles and charge

is communicating, so now there's potential that you know, a malicious charger could do something to a bunch of different vehicles or the other way around. Maybe a vehicle is

spreading malicious you know, impacting a bunch of chargers everyone they visit, right, So every we talk about this a good way to understand, you know, the different ways you could be impacted or the different places in the ecosystem that they could target.

Speaker 4: Now we've been talking about ransomware things of that nature.

But yeah, a few years ago, there was that famous demonstration on how hackers were able to take control I think it was of a jeep. Have you seen any

attempts of that kind lately, because all we've seen on that were demonstrations, But have you seen attempts to do that in the real world.

Speaker 6: Yeah, what we have seen on the part of the threat actors is a definite increase awareness that there's vulnerability there.

The canvas is a very interesting part of this whole problem because it is actually insecure by design. It has

to do with right to repair, it has to do with a lot of other sort of interests in this ecosystem, right, And that's why we see auto theft with people are able to get in through a tail light and sort of unlock and start this kind of stuff happening. Is

so thieves are more aware of that. Right from a

just physical theft perspective, we're seeing that same interest on the part and we know, again you have a system that's insecure by design. This is sort of a green

field of now that they're here. Another thing from the

report that comes to mind is that when you combine the things targeting the infotainment system, targeting APIs, and you know, you take those two I think there was a third one, a more minor one in there combined and it's ninety percent of where we're seeing these attacks start to now focus and target. That's new as well, and it's that

reality of Okay, once we're in the enfotainment, once we're in something with an interface to that canvas, that there's a lot more potential there.

Speaker 1: Jeff mentioned the historic jeep takeover that was one guy or a couple of guys.

Speaker 3: Charlie Vlassic, How.

Speaker 1: Has it changed in terms of that model Now I hear jen Ai and talking about how Jenna has changed cybersecurity both from an attack and a prevention point.

Speaker 6: Yeah, Jenny, So, Jenny I is absolutely impacting all around, you know, from an attack perspective, jen Ai makes it easier to sort of mix and match things that have happened in the past into something where encountering. They call

this fuzzing or you know, you're you're trying a bunch of different things to see how you can get certainly sped up that process. Jennai is also being used on

the defense, and one way we're using this in our what we call our ability focused or vehicle security operation centers.

This is where you have the security analysts and they're sort of looking at alerts and investigating and is this something we need to take action or not? Is that

you know, now GENAI is able to make their lives sort of much easier because when you're investigating an incident, so you know, you could have a series of dead batteries and you know, just totally fail dvs and you trace that back and it could be very difficult from an analyst just looking through all the data, all the telemetry, what was happening everywhere to make the connection that all of these stopped at the same EV charger and we have a problem there, something's happening here that's you know, impacting.

Speaker 5: Each of these evs.

Speaker 6: But with GENI and the ll MS, you can kind of just ask the question and it can very quickly get through all of that data and bring back the response.

You know, something that if you think, you think about the way you look at data, looking across spreadsheets and sort of like the all the data points, you might never see it, so it's certainly helping to find those.

Speaker 1: So there's always this vision of a hacker and basement somewhere, the hooded the guy. What is it like to be

a defender? What's that? What? How do you? How does

your organization work?

Speaker 5: Yes, I have much a sweatshirt.

Speaker 1: Well hooded sweatshirts. Are they upstairs instead of the basement?

Speaker 6: You know, what's the They have an office, you know when you go down to the Security practitioner conferences def con or we have Urkhan here in Michigan. You probably

can't tell the difference. So they they fortunately we have

some of them on the good side, but we do.

You know, there's a human element of monitoring, not all you know, certainly we use automation and AI whenever possible.

So if you see something and it's obvious what to do, lock out this user, lock out this, you know, threat actor.

You can take that automated action. But the security asks

are really there for the alerts that are raised something suspicious going on here. To dig into that deeper layer

take a look. So they're the ones following the tracks,

you know, with sort of the putting their threat actor hat on and thinking, Okay, here's what I would try to do. Does this look like somebody trying to do

that right now? Or is this maybe you know, we

have false positives as well, where things are happening in development with test cars and things like that that you know might show up as something the farius, but it's just a developer working on the next version.

Speaker 1: Now.

Speaker 3: One of the things that is becoming more important in the auto industry today is the whole over the air update.

Does an Ota provide another surface for bad guys to send things in?

Speaker 6: I mean we've definitely seen some activity around that as well. Yeah,

I mean, so what you have is, you know, different than years ago when everything was mechanical and it was sort of immutable. You know, this part works this way

and it doesn't really change. Now you have a software

element and affects all kinds of things on the vehicle.

I saw this with my son, you know, I taught my son how to drive a newer vehicle and then he gets in an older one that he bought, and you know how the everything's dry by wire now and it does a nice smooth acceleration when you do. So

he was using the gas pedal like a light switch, right, and he gets in this older I'm like, yeah that, you know.

Speaker 5: You got to kind of look.

Speaker 6: So think about how or you've got vehicles with the different drive modes, right that you can go on to a different train and drives entirely different.

Speaker 5: So think about all of that.

Speaker 6: And now you're on that canvas and you can kind of make all those little pieces of software and each ECU those are the things that affect all of that that we're seeing in these features. So it is a

totally different world from that perspective. And yeah, certainly you

want to make sure it's your software running on your vehicle that you created, and you will have different We also monitor, you know, some of the less you know, some other what we call threat actors, but a different category that we also track are actually enthusiasts.

Speaker 5: This is just the go fast.

Speaker 6: Community, right that wants to get on and and see what kind of tweaks they can make to that.

Speaker 3: J Well, I mean so, I mean, but if if someone were to add something to an OTA, would would that be that they were able to like snag it out of the error as it were, or would this be something that they would have to be doing from the facility where it's being sent from.

Speaker 6: Yeah, so for OTA, we'd get concerned about if they can get in the middle of that, right, or if they can somehow spoof the the server that the that the update should be coming from. But it's not the

OEM server. It's actually they're providing the payload that then

comes down to the vehicle and.

Speaker 3: We hey, look that's an ominous word, isn't it.

Speaker 6: Yeah, but that would just be the update itself, right.

But yeah, so there's you know, there's different methods that they would use to try to do that, and that's that's just why it's so important to monitor these things.

So one of the things that that these security operation centers are monitoring are all those OTA updates going out the DTCs and things that might come up when those go down. What is a DTC a diagnostic trouble code?

So simple for you and me is when the check engine, you know, there's thousands of codes beneath that that actually will tell the diagnostic history, you know, more of what's what's failing.

Speaker 1: But Jason, you talked a lot about monitoring. You've got

to watch, you've got to is there proactive things that you're doing and beyond obviously monitoring is proactive, but what are the proactive actions?

Speaker 6: Yeah, so we I mean a couple of different fronts we focus on that. One is just monitoring everything that's

going on real time. So at upstream reprotect over thirty

million connected vehicles. When we say that, what does that mean?

That means we're looking at the telemetry coming up from the vehicle, We're looking at over the air updates going down to the vehicles, and we're watching all those things and we're running the AI and mL models over those that will raise to the top anomalies for the security analysts to look at something that's unusual out of the norm, that this doesn't look the same, or maybe there's something happening all in one geography that's kind of unusual.

Speaker 5: Why would that be happening?

Speaker 6: It's the same vehicle everywhere, right, and that raises a lot of actionable, actionable alerts. The other piece is we

get into the what we call thread intelligence. And there's

a lot of you know, thread intelligence you can gather out of out there. But what you want to be

doing is understanding you know, the complete supply chain, your bill of materials. We have the software bill of materials

now right because these are all composed of different software components as well, and once you understand those, you can do some of the automated threat mapping to see that Okay, this vulnerability was just published. Well it's on some software library.

Nobody knows that's part of your product yet. So if

you can map it and know about it right away as soon as it's public, it's a very good thing because it takes them actually some time to go and then target you. And we're also out there on what

we call the deep web another fun term, right, but that would just be log in gated you know, forums and things where you actually got to go create a user to go participate in these discussions, so it's not going to get.

Speaker 5: Scraped by a Google or a WebCrawler.

Speaker 6: So we have people sitting in those forums and then the dark web, where people will actually go and say, hey, I will hack your car if you pay me, or I will you know, give you a theft tool if you send money my way, or I can do this or that in more of those to see like if something goes up for sale. Okay, should probably know how

this is impacting. But the goal of that whole motion

is to actually get way in front of it. So

as soon as you know there's something vulnerable that's part of your whole software bill of materials, you're working to mitigate that well before somebody has what we'd call like a jail break, like for your phone, right for your for your actual product or EV charger vehicle.

Speaker 3: Okay, So companies hire you to do this, I mean, this isn't something that you guys are just doing.

Speaker 6: Yeah, yeah, we work with you know, many of the large OEMs have us engaged on this, so we'll actually go out and monitor that and help to monitor that for them. We've got the people in the forums and

and things like that, all different languages. You don't want

to just be looking at the English ones. You want

to look at the Russian in themander as well.

Speaker 5: But yeah, that's that's.

Speaker 6: One of the certain Then the other is a platform that actually does the monitoring of more the real time of the active vehicles on the road as well as those security analyst services to monitor that.

Speaker 4: So as a driver, I'll take it back to your first question as a driver, as a car owner, what do I do? I mean, you said there shouldn't be

a huge worry, but what are the safe things that an individual should couldn't do to try to keep their vehicle cyber safe for lack of a better word.

Speaker 6: You know, unfortunately, there's not a lot of granularity to what you could do there. I was talking to my

dad was talking to me about you know, what do you do and this type of stuff? Right, and I

had mentioned an incident we're talking about data leaking out.

One of those individuals we talked about the researchers just did something where He's like, I just thoughted, check into my mom's car, and well, now I can see where every one of these vehicles is located, you know that manufacturer and all over California or whatever. So you know,

my dad goes, wait, they the location of my car?

Like I never thought about that. I'm like, well, do

you have an app that you used to start and stop and open your car?

Speaker 5: Did you link that with your vehicle?

Speaker 1: You know?

Speaker 6: Does it tell you where you're parked? So that information

is that we don't always correlate we use these things, right, we don't always correlate. That means that the location of

my vehicle is sitting somewhere right, So certainly you could turn it off. You know, most most mostly have a

way you could turn all that stuff off, and you can, you can turn off the app but that that's usually the trade off, right, Do we want this rich ecosystem with these features and everything that are these like creature comforts that.

Speaker 3: Are very convenient to have, but it may be not so convenient at the end of the day.

Speaker 1: Do you I think the alternative is a seventy two duster?

Speaker 5: I had a seventy four duster.

Speaker 4: No, it's not a good alternative, I'll tell you that.

Speaker 6: And that's where I think as as people producing these products and these features, you know, you put a lot of effort into something like that. You want to see

it get used, right, So that's that's where the onus kind of comes on the manufacturers and the you know, the operators just to say, like we want to give people that that confidence this is not going to be a problem.

Speaker 3: Well, there should be stickers on, you know, protected by upstream vehbles. So because I because you know, is apparently

nothing you can do to protect your vehicle and unless there are guys like that. So one quick thing.

Speaker 7: We had some questions from the audience real quick, and if you can repeat what I say because I'm not linked up so no one can hear me.

Speaker 3: Right now, that's what you think.

Speaker 7: People are want to ask Jason what types of modern cars are most vulnerable to hacks? In reading between the lines,

I think people want to know what cars types of cars, not naming names, but is there tech that cars have that you might want to avoid?

Speaker 3: Okay, So so a question from the audience is is there tech on vehicles that people might want to avoid having so as not to be hacked.

Speaker 5: I think that that ship may have sailed.

Speaker 6: I'm struggled to think of a new vehicle there that you can still get a transistor radio in, right, But you know there as a That's that's why it's very difficult as a as a consumer to really mitigate the impact.

I may mentioned that before. You certainly have the option

all of them. I think give you the option to

turn off the connected vehicle features of your vehicle if you don't, if you don't need them and you don't want to worry about it. That's that that would certainly

be an option but we really see I mean it's it's very difficult to say, oh, go with you know the shiniest new ev startup, or go with all the technology is different, and we are seeing it it all be impacted.

Speaker 5: With these threat actors.

Speaker 1: So urban legendari is don't use your key fab in a public place. Is that a simple one because.

Speaker 4: Your key fob and a can i'n't want to know if that really is or.

Speaker 5: What about the cars without keys now?

Speaker 1: Right?

Speaker 5: So we just saw some attacks on that where without a key.

Speaker 6: And based on basically like a bin or something or a license plate or something that you can just walk down the mall parking lot and see. You know, if

the system itself has has these vulnerabilities or just oversights, attackers have been able to create themselves those digital keys, right.

So yeah, certainly anywhere, and the key fobs are have certainly matured. You know, we saw where you know, the

last few years, some of those manufacturers that didn't create those new secure keys and things like that really took a beating this past So.

Speaker 5: I think they're all aware of it.

Speaker 6: They're all up leveling that we're seeing adoption on the you know that hey, this is going to be you don't want to be in the next congressional hearing.

Speaker 3: About So I think what I hear you saying is seventy four dusters what you want? So all right, Jason,

ask your director of solutions architecture, upstream cybersecurity expert. Scared

the hell out of all of us. Thanks for coming.

Speaker 5: Well, happy to be here.

Speaker 3: Okay, quick break here more good sponsor Bridgestone, and we'll be.

Speaker 2: Back making the life full of memory, one road trip at a time. That's what really matters.

Speaker 3: Reached down weather peak tires.

Speaker 2: But the seventy thousand mile womened warranty.

Speaker 3: Bred and we are back, all right. So, as I

said at the top, although I could do a quiz of what happened on this date.

Speaker 1: No, yeah, okay.

Speaker 3: It's a pretty hard one. I don't even think John

would get this one. So this this, this is pretty hard, okay.

So on March twenty seventh, nineteen forty seven, this car company began. I told you it was a hard one.

Speaker 1: I was gonna obviously, that's just after the war. I say,

this was the first Ford to be or something.

Speaker 3: No, no, no, that's easy.

Speaker 5: I have no idea.

Speaker 3: So it was Nanjing Automotive. Yes, you don't know, see,

became part of it.

Speaker 4: I had a forty eight one before he had that Duster.

Speaker 3: Became part of SAIC in two thousand and seven. Now,

the interesting part about why people should be well aware about Nanjing is that it is the company that operates MG, the one hundred year old British mark, which is obviously no longer.

Speaker 4: I actually rode in a Chinese MG. Really and we

went on vacation in Australia. Our uber driver had an

MG and I'm expecting this little sports car.

Speaker 1: How do we get into it?

Speaker 4: Well, no, it's a mid sized suv and it looked like they copied a mid sized MAS does what It kind of reminded me of, yeah, and I'm talking, well, it's a Chinese car. I didn't even realize it, but

you know, felt like a you know, mid sized mas To suv.

Speaker 3: Last year it sold over seven hundred thousand cars. So

there you haven't all right. On April third, two thousand

and one, twelve one am Washington Time, the twenty five percent auto tariffs are going to go into effect. These

are tariffs on all vehicles that are imported to the United States. Cox Automotive yesterday before this was announced, had

a briefing and suggested that car prices as a result of just the Canadian and Mexican tariffs could raise prices up to six thousand dollars for American buyers, and that again Cox was suggesting that this would basically take twenty thousand units a day out of production and would mean about thirty percent of all production. What do you guys

make of this.

Speaker 4: Well, you know, a lot of numbers are being thrown about, including how many one hundred billion dollars a year we're going to get in revenue from the tariffs. I would

take all of these numbers on both sides with a large brain of salt, because at the end of the day, normally the worst case in best case scenarios don't happen.

We still have to remember there is a marketplace that sets prices of vehicles, and if carmakers price vehicles too high, people will not buy them. So we're certainly going to

see hits to carmaker's bottom lines. We're certainly going to

see some vehicles go up in price. Perhaps you know,

somebody who's buying a fully loaded F one fifty forward will look and go, oh, I can sneak a price increase here to offset where I can't put a price increase on the Mustang Mokee. So you're seeing car companies

look at all of these different things on how to deal with it, and there are so many levels to these.

You're looking and seeing, Okay, there are tariffs based on content of the vehicle goal So we're just going to have to see how this all plays out. I don't

think we can automatically say oh, yeah, immediately, sticker prices are going up x amount.

Speaker 1: There were two comments yesterday that I thought were really fascinating, maybe by the same person. One was, you can see

prices going down already, and we're going to make one hundred billion dollars a year in revenue. Somehow those don't

line up in the real world, and I think that the challenge becomes to your point exactly, Jeff, we just don't know how this is going to work. Companies are

have some flexibility, not a lot, but some of the flexibility to move things around. Consumers will decide a lot

of this. Are you willing to pay that price? What

companies are going to say, I'm going to put my product out there and take a big hit on it for a couple of months, a couple of years because I've got to do this and I'll move forward. I

just think it's it's not easy being an auto company right now. But you know what, they're pretty good at

being in tough situations. And I think they'll respond smartly,

most of them, and I think they'll be challenged by.

Speaker 4: One area that has not been discussed is compact vehicles.

None of those are made in the United States anymore.

Will it be worth it for and the margins are thin?

Will it be worth it to bring a Corolla over if you're going to eat up all of your profit and tariffs. Maybe Toyota does that as a loss leader.

Maybe Hyundai doesn't do it with the Alantra because they have less of a margin. Again, these are all decisions

that are being made right now. Or do you say, Okay,

I'm going to wait and see. You know, in a

couple of years we may have a government with a different viewpoint.

Speaker 3: So well, you know, I mean to the to the point of cars that are inexpensive. So I look to

see with relatively expense, Well, I look at see the five least expensive vehicles that you can buy today are and these range from the Nissan Versa S, which is at twenty one hundred thirty dollars, to the Nissan CenTra S, which is twenty two seven point thirty Okay. In between

are the Handai Venue S, the Chevy Tracks LS, and the Kiyasoul LX. None of these vehicles are built in

the United States, Okay. And the thing that I wonder

about is is that, Okay, we know that the average transaction price of vehicles now is forty eight thousand plus and that many people are priced out of the market.

Speaker 5: Period.

Speaker 3: Doesn't this say, Okay, these small cars may not be worth it for these companies, and therefore we're going to price even more people out of the mird.

Speaker 1: I think it's reasonable to assume that very few companies are making money off of small cars. May make a

little bit, but there how much did you say the average transit or the average cost a fee of fee for the care iff would be tw I mean, I'm sorry for vehicle dollar count account didn't Cocks? Didn't Cox

say it would add up to six thousands?

Speaker 4: Yeah, that's that's an average that takes it.

Speaker 3: But it was like three to six thousand dollars, and they're basically saying that that's that's what it would be a people who are talking about EV's being up as high as twelve thousand dollars. So the Mustang Mocki which

you mentioned earlier, is built in Mexico. It's not built

in Dearborn, right, and so that would be.

Speaker 4: And that's why I said, they have very little margin to raise price there because of the marketplace. So do

they find a way to add to that profit by putting a few more dollars on the cost of a vehicle that people are willing to buy? That's why I

mentioned a pickup.

Speaker 1: I've done it forever. Yep.

Speaker 3: So let me ask you you know so, so the argument from the administration seems to be that, okay, they'll just build them here, Okay. Warren Brown, who's been on

the show, who is an automotive analyst, basically says, you know, there's there's very little excess capacity sitting around in the United States right now, meaning there are you know, very few plants that are not operating at eighty percent or greater.

How long does it take to set up a manufacturing plant to build vehicles?

Speaker 1: So if we go back to when we were young.

There was a vehicle export restraints. Japan basically seventy four

through eighty two eighty three just dominated this market, moved in this market, took an enormous amount of profit out built.

Speaker 3: And I weren't born then, By the way.

Speaker 4: I saw, I knew you back then you were you bought that seventy four duster.

Speaker 1: Knew by the way, wow, you are old. So as

you saw the vehicle export restraints limit the amount of vehicles Japan could import into the US. You saw the

Japanese build a lot of plants. It took seven to

ten years to get to some kind of volume. Could

that happen faster? Yeah? Maybe, but it's not easy and

it's incredibly expensive.

Speaker 4: And here is the other question. I mean, let's talk

real world.

Speaker 1: You just had.

Speaker 4: General Motors put a lot of money into a Canadian plant to build more pickup trucks that they need. I mean,

are they going to want to say, Okay, I put all this money in here, we'll just flush it, we'll close it and we'll you know, make Orient into a pickup truck plant instead of an EV plant. And then

you know you're spending that much money for the plant here, and then possibly you have another administration who feels differently in a few years, because we've seen the pendulum go back and forth. So I think there's going to be

a lot of talking about investments, talking about how American we are doing what they can. But in the reality

we all talk about this with emissions and things like this, it's a long lead industry and things don't happen overnight.

Speaker 1: Although not entirely, but teriffs tend to stay because the next president makes the revenue. Soh we've got this great

streat one hundred billion dollars a year as right here it's going to be. So sometimes if those tariffs stay

through this presidency, and he said the air permanent forevers, the next president, whomever that might be, is at attempting to say, you know, that's pretty good revenue. I don't

know if I want to give that up.

Speaker 4: Let me throw this question to you, because you're almost as old enough to buy a seventy four Plymouth Duster new and you remember, I mean that's seventy four. Duster

was not a very good vehicle. Seventy four in many

ways was one of the low points of the auto industry.

And part of that is because throughout the fifties and sixties we had protectionism. We had the market to ourselves.

The Detroit Three, the Big three back then, didn't have much in the way of foreign competition, so there was no incentive to make their vehicles better. I mean, could

could that be a downpoint of tariffs if we wall off the market again in twenty years, are we going to be seeing vehicles with less innovation because there's less competition?

Speaker 1: Okay?

Speaker 3: But were we walled off or was it just that the world was busy rebuilding itself or it.

Speaker 4: Was busy it was building and it was an a potensial wall, but the wall was still there.

Speaker 1: We did put a wall up with the vehicle restraints.

Speaker 3: Yeah, but that's when when people started buying many Japanese cars because they discovered that they were more fuel efficient and gasoline was very expensive at the time.

Speaker 4: But the bottom line is there wasn't competition, whether the wall was intentionally built or just happened. Because Europe and

Japan were rebuilding after the war, we still didn't have much in the way of competition. That may be different

here because the foreign competitors build vehicles here. So there

may still be that competition, but that that's still a worry that if you don't have to, you don't get better.

Speaker 1: And that is certainly something watching this industry for decades, you worry about. If there isn't that threat, why get better?

Why make that investment? And we've seen it before, Well

we see it again. I know John argues that you've

got ten years maybe for that tariff to really work.

By the end that ten years, you better have gotten better.

It's hard to say looking backwards that they will get a lot better. They will get a little better, maybe

take that time to get better. But I think it's

a real concern that you become more of an island than you were before.

Speaker 3: Well, you know, this gets back to the you know, Jason was talking earlier about selling it to different markets and if you know, we suddenly say, okay, twenty five percent tariffs on vehicles coming from Germany, Italy, Spain, you know, everywhere. Right,

So what's the likelihood that the Europeans are not going to simply say, you know you're doing this to us, We're going to do it to you, and and therefore it will no longer be a global auto industry. As

we've known it, and that there will be islands, and that as a result of that, you know, if the if the EU and the Chinese maintain their environmental regulations and we just basically go, yeah, you know, carb except you know, exemption forget about it. You know, it's all

going to be the same. You know that those those

you know, Biden plans gone. You know, we saw that

Stilantis announce that they're going to start building the HEMI again.

So I think in a country where you know, you have serious environmental regulations, hemis aren't going to be so interesting.

Therefore here they will be interesting.

Speaker 5: But the rest of the world.

Speaker 4: But you're starting to see that even without the tariffs, I mean, General Motors used to be a global company, even opal in Europe. Well you know, they're other than

a few boutique products pretty much out of Europe China, they were a big player, and now they've kind of throttled back a bit. They're redoing things. So you know,

we're starting to see this retrenchment. Even if you look

at Stilantis Fiat Chrysler. When they were first formed, they

were trying to sell you know, rebadge Chrysler three hundreds in Europe and things like that. Well, now they're pretty

much the European brands have Europe. The American brands have

the US and will sell Jeep everywhere. So you know,

you're you're seeing that retrenchment even before the tariffs.

Speaker 3: So you think it will become an island nation.

Speaker 1: I've been told often by a good friend, we already are an island nation when it comes to technology and product.

Where else do you sell full sized pickups? Where else

do you not drive fuel efficient cars? So yes, we

will become more. So look to your point earlier, it's early.

We don't know what's going to happen. There are going

to be some real positive changes, reactions by the car companies.

The consumers are going to have to figure this out.

There's a lot of things that are going to happen.

But yes, anytime you put up terrafalls, you become more isolated, you become more of an island. That may be okay,

I mean we are.

Speaker 3: Already okay, But to your point of the consumers are going to have to figure this out. I mean, what

is it that you think? Okay? So, just briefly, so

GM sources Silverado's and Sierras from Mexico and Canada, the Equinox and GMC train, Blazer and Blazer EV from Mexico. Okay,

all of these twenty five percent tariff right Stilantis, the Jeep, Compass, Wagon Eer s Ram Heavy Duty from Mexico, pacifica on Dodge Charger Daytona from Canada.

Speaker 1: With the tariff, they're going to have to settle for less or pay more.

Speaker 3: Ford, Maverick, Broncos Sport, and mach E And you know, going back to the issue of General Motors retooling in Canada, Ford is retooling Oakville Assembly for the Ford Super Duty and it's supposed to be opening in twenty six. Does

this mean that they suddenly say, nope, we're not going to be able to spend money.

Speaker 4: Ford has been very quick to change production plans on evs, so who knows.

Speaker 3: Well, I remember Oakville was going to be their big and then they're like, that's gonna work out. Let's put

in the super Duty now, like, let's put in nothing.

I mean it's yeah, but I mean.

Speaker 4: Realize Canada has been shrinking for years as an auto market because it's been so expensive. So you know, you

have that as a backdrop. Sergio Marcioni used to complain

about that all the time. Other other carmaker leaders who

are a little more diplomatic didn't say anything, but he used to always complain about how much it costs to build in Canada, so that that could be an issue as well. And when you're talking about GM, don't forget

how many important vehicles made in South Korea.

Speaker 1: Jerry, I'm getting tired of tariffs. Did anything happened?

Speaker 7: Right?

Speaker 1: Interesting?

Speaker 4: All right?

Speaker 3: So Rivian has spun off a company.

Speaker 4: Called also.

Speaker 1: R. J.

Speaker 3: Scringe told tech Crunch quote, there's a seat, and there's two wheels, there's a screen, and there are a few computers and a battery. Now here's a clue. A few

years back, Rivian hired a guy named Chris u from bicycle maker Specialized. Chris You was the former chief product

and technology officer it Specialized, and he is now the Rivian VP of Future Programs, and he will become the president of Also. Sounds to me like they're making an

e bike. What do you guys think?

Speaker 4: I remember what was it twenty years ago or so? Leiahcoca,

in retirement, came to Detroit to plug an e bike company.

Maybe he was a little ahead of his time, you know, right before the pandemic, if you recall, everybody was talking about new mobilities, scooters, e bikes, things of that nature, and then it, you know, kind of died down during the pandemic, and now it's it's coming up again. I

I don't know. I mean, I know people who have

e bikes and love them, but I don't know how big a market it is.

Speaker 1: The mobility hype cycle has officially started again.

Speaker 3: The micromobility, mic.

Speaker 1: Mobility hype cycle.

Speaker 3: All right, So I looked into this source called et cycle alone. I'm sure common reading among you guys, but

it was new to me. And according to it, last year,

one point seven million e bikes came from over eight hundred different factories or trading companies, about ninety percent of which were from mainland China, with the others coming from Taiwan, Vietnam, South Korea, Germany in a handful of other countries.

Speaker 1: And Rivian doesn't strike me as a low cost producer.

You know, all of the things that you look at in Knee Bike, if you do the ee bike rentals, Lime or others, they're pretty low cost. Interesting don't know

if there's a real market for hir end Ee bikes.

Could be, and there's a lot of interesting opportunities in other markets. I'm not sure it's a US big hit.

Speaker 4: What's the name of the Honda product that's in a suitcase?

Yeah that you canto? Yeah, you know, God bless them

if people buy him. And you know, I'm American, so

other markets that I'm not as familiar with maybe very much into it. It may not be as much for

America for the US as for other markets.

Speaker 3: Well, they did announce that they didn't they'd launched their first vehicle here in twenty twenty six and go to other markets as well. Again, this might be, you know,

a geographical play. So maybe if you're in San Francisco

or you know, because they have all those hills and so you don't want to ride your normal bike. You

want the e bike to be able to brut you up and down those hills.

Speaker 4: But I don't want to be in that traffic either on any kind.

Speaker 1: Of We do scooters as well, scooters I don't.

Speaker 4: Know, but not actually announced what they're making.

Speaker 3: No, and you know, but again I mean, if you hire this guy from a bicycle company, because at first I was thinking, wow, is it going to be the return of the segue, you know, because think about it, what.

Speaker 1: Was the Renault TwinGo or whatever.

Speaker 3: The road that's a that's a quadricycle, I know.

Speaker 1: But just that kind of small you know, you can see again, not in this region, we're proving that we want bigger, not necessarily more efficient, which is fine. But

other countries there's interesting markets. The question is why would

they compete with all those low cost manufacturers. What's the

what's the secret sauce form?

Speaker 4: It's a good question.

Speaker 1: Also.

Speaker 3: The other good question that I sort of have is is that all those this will be a standalone company that's being funded by Rivian and a an investor.

Speaker 4: Well, here here's the thought. And I don't know if

this is two off the wall. Of course, Rivian is

all about the great outdoors, off roading things of that nature.

Are they going to make electric assists mountain bikes because that would be logical. You know, you take your R

one T pick up out into the woods with your fun bike in the back. You take it out and

you go on the trails. You don't know, haven't heard?

Speaker 1: I got a business transition where the profit margin is on that, but.

Speaker 3: Brett wants to buy one. He's the outdoor guys here.

Speaker 1: Took my hits on the mountain bike. I'm done all right.

Speaker 3: So because we have to do this, I think on every show we need to talk about Tesla. So in February,

Tesla's European deliveries fell behind Volkswagen and BMW. Your over

year sales decline of forty four percent in the EU, Norway, Switchelan in the UK. It's market share six point nine percent,

lowess than five years in Europe. Here it is still

dominant in evs, but it's going down. Is this the

politics of Elon Musk or is this the cars are getting sort of long in the tooth and.

Speaker 4: People would have to be either or so you're seizing it's both well, I I. You talked about the Cox

Automotive call yesterday. They talked about this at length on

that call. In that peak, Tesla was probably twenty twenty

twenty one in that era. They've been slowly declining since

because they have more competition. They still have the line

and share of the EV market in the US. Then

you add the fact that the vehicles are getting older, You add the fact that, you know, some of the other evs out there are quite nice, they're very competitive and may even cost a little bit less than Tesla.

And then you get the controversy with Elon Musk. Cox

mentioned that I can't remember the exact amount, but listings on auto Trader of used Tesla's for sale are up significantly.

Speaker 1: My friends that listened to you a couple of weeks ago, and you described Gary friends too. Okay, but you described

the Knew medal, why coming out and how people were saving up for that or they said, tell him that EV buyers don't like it when the CEO aligns with the fascism. It's a little strong. Well, that's that's what

they said. I you know, it's tough when you get

that kind of when you're trying to sell to a liberal market EV buyers and mostly liberal some tech buyers, and the CEO kind of takes a left and you know, supports right right. Good point, good point. I'm going back

towards the cameras here. It's it's hard to argue that

that isn't greatly affecting sales.

Speaker 3: You know, I thought another interesting that Cox mentioned yesterday, and they said, because the supercharger network is no longer exclusive to Tesla. That that's turning a lot of people

off that otherwise would buy a Tesla.

Speaker 4: Well, it's I think what they meant, that's not necessarily a reason to buy a because it's the only vehicle that can access that market, So you have other choices.

At least it's what they.

Speaker 3: Used to be special. So you would say, hey, if

I have at Tesla and I've got this thing, I'm.

Speaker 4: Here, you can't you can't plug in here.

Speaker 3: Right And now you know, wait a minute, there's that Ford, there's that Hyundai, there's that fill in the blank. They're

all in line to get this uh, this this juice, and so you know, it's it's no longer a benefit that is part of the part of the purchase.

Speaker 4: You know, what I find interesting is I wonder how much Elon Musk cares. Has he become so into his

new thing that he doesn't even worry about Tesla as much anymore? Is there going to be some sort of

bored friction there? You know, it'll be interesting to see

how that plays out. And I'm not going to make

any personal comment. I'm a reporter.

Speaker 5: I cover things.

Speaker 4: I'm not going to comment on whether what he's doing is good or what he's doing is bad. But is

it something that is getting the attention to the board of directors, who for years have been his biggest supporters.

Are they going to say, hey, maybe we should make Tesla more about Tesla and less about Elon.

Speaker 1: It's fair to be neutral on this an observer, but it's also pretty reasonable to say, hey, look, you've said these things, believe you're doing these things, and more so talking about with European with his actions about the European German market that seems to be directly affecting our sales.

You're free to say what you want, but we've got to figure out how to deal with the sales part. Well.

Speaker 4: Would Ford Sportive directors stand for Jim Farley making tons of political type statements? I mean, an ordinary company, the

CEO would be told you're either going to be CEO here or.

Speaker 1: I know company, and they're he In some ways he deserves that differential treatment. He has created something really unique,

really important. But again, at some point as a board

you've got to say, hey, dude, wait a second, you could be killing us.

Speaker 4: But the problem comes when you really think about it.

No matter what you do to a Tesla, if you don't like Elon Musk, You're not going to hurt Elon Musk.

You're going to hurt some poor person who gets laid off from Tesla because their sales are down, Somebody who works in a factory, somebody who works in an office.

Speaker 1: See.

Speaker 3: But if you buy, if you buy a Chevy Equinox EV or a Blazer EV or a Cilerado EV, you're employing someone.

Speaker 4: That's true, you are doing that. And getting back to

the thing we weren't going to talk about anymore, tariffs.

Tesla again again has the you know, most American content of any vehicle.

Speaker 3: Yeah, so you need not worry.

Speaker 4: But what I find funny is a Facebook a friend of mine just posted a person who's liberal and I have liberal and conservative friends that he got rid of his Tesla and bought a Lucid, which is good, But I mean, you know Lucid, You've got the Saudi Wealth Fund that owns there. So are their political implications there

wherever you are.

Speaker 1: They're going to be.

Speaker 3: Grande Arizona. They're doing they're doing it good.

Speaker 4: But I mean, you can pick politics apart with any and this is the thing.

Speaker 3: This this industry is by its very nature global, and and you know, and I think it's it's sort of sad that it seems to me that we're seeing this, you know, retraction from the global nature of.

Speaker 1: But we're seeing that in almost every aspect of life, everything is becoming more nationalistic more in the last decade. Absolutely.

Speaker 3: No, Yeah, it's like an old crabby guy.

Speaker 4: All right.

Speaker 3: We had to end the show there with your your sad comment about the world I'm floating on itself. Yeah,

and all.

Speaker 4: Right, I'll end up with something happy. Todase vehicles are

much better than my seventy four Plymouth Dust.

Speaker 1: And there's and there's open markets to credit for.

Speaker 3: That that new cars are better than the seventy four Duster.

Speaker 4: Most used cars to there better than the seventy four Duster.

Speaker 1: See.

Speaker 3: The thing of it is is that there will be very few people who will remember an analog to your seventy four Duster, but you'll remember that car forever. Yes,

So with that, we want to thank Plymouth for having made just seventy four. And we'll see you all next

week there.

Speaker 2: I'll online after hours. It's brought to you by Bridge

Stone tires Solutions for your journey

Dodge Charger

Dacia Duster

Ford Mustang

Toyota Corolla

Chevrolet Silverado

Chevrolet Equinox

Chevrolet Blazer EV

Chrysler Pacifica

Jeep Compass

Ford Broncos Sport

Ford Maverick

Ford Super

Renault Twingo

About this episode

Original notes