It seems ridiculous that there would be consumer demand to unlock a car from a phone in the first place. The tech crowd will just complain that it should be easier to do a better job securing web services. But what is the point of all this infrastructure and complexity? So you can be just a little bit more lazy. This sort of tech is both a vulnerability and a waste of human resources and ingenuity.
Would I pay a monthly fee for this - no. Is it nice to make sure your car is locked if you forgot and to remote start your car in really hot / cold weather, yes.
Many car brands do this.<p>Mazda charges $10-15/month for their remote unlock/start app.<p><a href="https://mymazda.com/MyMazda/mazdaConnectedServices.action" rel="nofollow">https://mymazda.com/MyMazda/mazdaConnectedServices.action</a>
Do you own a car? What’s more likely, misplacing your car keys, or misplacing your phone?<p>I’m not saying physical keys are not needed, but a nice digital solution is one of the things I really wish I had a Tesla. I wish the other car manufacturers would actually invest in good mobile experiences, they’re all such ass.
> What’s more likely, misplacing your car keys, or misplacing your phone?<p>good question. I don't know? There are three things I carry with me literally everywhere: phone, keys, and wallet. Any one of them missing in the morning means I have to hunt around the house to find them before I can leave for work. This would not change if I could unlock my car with my phone (I still need to be able to lock my front door and/or let myself in when I come home again, requiring keys)
Physically unlocking with NFC could be done without all the security holes.<p>Modern cars already make it much more difficult to lock your keys in the car than in ye olden days.<p>And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff. It's not like that "did I lock it" check helps prevent a "someone smashed the window and grabbed something out of it" scenario anyway.
<i>And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff.</i><p>It's completely unnecessary.<p>Modern cars automatically lock themselves when they sense there are no keys nearby, nobody in the seats, and the doors are closed for <i>x</i> minutes.
> What’s more likely, misplacing your car keys, or misplacing your phone?<p>Misplacing the phone actually. Car keys are either in someone's pocket/bag (then you talk to whoever used the car last) or in a set place in my home. The phone might be wherever I used it last.
BYD has NFC unlock, can be paired to your phone or you
R smart watch. Very good quality cars, much higher spec, better price etc than a tesla
I think my car key would be the thing in my pockets that I'm the least likely to misplace. It's only ever in like one of three places.
> Do you own a car? What’s more likely, misplacing your car keys, or misplacing your phone?<p>I do own a car. Keys in home are always in exact same spot. Phone can we literally anywhere, good I have smartwatch and I can trigger "locate my phone" that way.<p>I just don't get the idea of unlocking car though app via internet. Neither I get the "keyless entry" (meaning I do not even need to touch the key fob to unlock car) and "start button" (well if you place key in ignition switch then you will not lose it!)<p>The security drawback is not worth, fixing non-existing problem in the first place.
<i>"What’s more likely, misplacing your car keys, or misplacing your phone?"</i><p>…And what about the many other things one misplaces about the house? For instance, Wireless mice, TV and various other remote controls, etc.<p>I just cannot understand why the tech crowd hasn't developed a much-needed <i>Missing Objects</i> protocol.<p>Think of this. When you lose an object you immediately go to a big button that's hidden and securely bolted down (so you can never lose it) then press it. Like your fob key and car, it activates all these easily-lost items and they start beeping madly so you can find them. Lose the mouse in the couch somewhere and the 'couch' starts beeping. Voilà, one found mouse.<p>It's crazy that a simple concept like this doesn't exist in practice.
Owned a car for 30 years. Have misplaced keys but always had a spare. What's more likely to be stolen, your car keys or your phone? Your question and my question are both facile.
I’m unlikely to lose either. The keys have an AirTag. The phone show up on find my.
Running out of battery on my phone.
unlock with nfc then ? He is pointing out the rediculousness of the design choice of using the web to unlock the car which is at arms reach
<i>What’s more likely, misplacing your car keys, or misplacing your phone?</i><p>Are there cars that let you drive them without the key?<p>My car allows me to unlock it with a phone from the other side of the planet. But to actually drive, it requires the key to be inside.
The desire to connect every single thing to the Internet is a complete waste of resources in exchange for profound security issues and mild reliability risks. Use a key. It's the right tool for the job.<p>I'm not convinced it is even lazy to use a phone to unlock a car.
There are use cases: you want to give a family member some item. They're at work and in a meeting. Get them to remote unlock their car and place the item in it. But really I think it's an extension of remote start which is very necessary in cold climates.
We used (until Subaru said 'fuck you, pay us') the mobile access so that I could unlock my family member's vehicle when I rode along with them or remote start it ahead of them while we're out and about. It's nice to be able to get back into the car and sit and wait without having to grab the key out of their purse.<p>They hook a lot of people now with the first couple years free, then spin around and go for a $150+ a year whammy. We gave up.
I still dont understand whats wrong with putting a key in a door to unlock it.
I had a 2007 Chevy HHR. It had remote start/unlock. When I lived in Denver, I used the remote start during winter to warm the car up before getting in.<p>Also, there was something sticky with the door lock. If I used the key instead of the fob, sometimes the anti-theft system would not disarm and the only way I found to disarm it was to use the fob to turn that alarm off. Grrrr. Fobs lasted about 3 years and cost $100 to replace/reprogram.<p>My current car (a Miata) has a key only to unlock the door in the event of a dead battery. It has a pushbutton instead of the traditional ignition key, so the key is pretty useless outside of a dead battery.
The problem is no one can control this remotely. Some people would prefer your access to the vehicle be conditional.
At that point: why do you even need to leave the house? You can use VR goggles for everything.
It seems ridiculous to think that because we cannot create a technical facility to securely open the car, the consumers are called ridiculous. It is hackernews but this looks to me like enterprise compliance news.
its just more convenient, say im outside my home, theres something i need in the car, i can either go back inside to get the keys, or just open the car from the app (not to mention turning on heater / AC remotely)<p>you can argue that the security tradeoff is not worth it, but claiming the demand is not there is just silly
I mean that is not what they argued, what they argued was<p>> So you can be just a little bit more lazy<p>Which:<p>> i can either go back inside to get the keys, or just open the car from the app<p>I think qualifies, personally. Your house might be way bigger than mine though
Repeat after me: exponential growth must be maintained at all cost
Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.<p>White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: <a href="https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022_toyota_rav4_4dr-suv_limited_d_oem_1_815.jpg" rel="nofollow">https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...</a><p>Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
Better locks also increase the time to break them. More time == more chances to be disturbed and have to go away and also an incentive to move on to the next house, bike, etc. In the case of bicycles I also advice to lock them close to much better bikes with similar locks: chances are that the thief will invest those 30 seconds to break the lock of the better looking bike.
This is probably less security theater and more not-getting-sued theater.
I was trying to figure out which make/model, based off of "I bought a new four wheel drive/SUV from them", specifically the "four wheel drive" part.<p>I'm assuming he means AWD.
This distinction (although I know it) has never made logical sense to me.<p>I only have four wheels. If all the wheels are driving, and I only have four wheels, then...<p>Again, I <i>do</i> know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
4WD: Distribution of power to the wheels is static. AWD: Distribution is dynamic.<p>4WD vehicles are often part-time 4WD, meaning they can be switched between 4WD and RWD or FWD.<p>AWD vehicles are full-time AWD because part-time AWD is unnecessary given that the drivetrain delivers power where it's most needed.
There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.) But I have yet to ever see a 4WD that could be "switched" to FWD.<p>The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype. That means the extra wheels cannot be triggered seamlessly. A 4FW has distinct driving modes whereas an AWD uses clutches to bounce between modes as needed.<p>Bluey has a couple lines about this distinction. In Australia, even small children have opinions on 4WD v AWD.
> <i>There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.)</i><p>AIUI, you lose energy because the power/torque has to go through an extra differential, transfer case, <i>etc</i>, before reaching the rear wheels.<p>Going from the engine through the transmission to the front wheels is already a 'fixed cost', but the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay if you don't need to.
>> the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay<p>True for a FWD v RWD car decisions, but in an AWD are not the rear differential and driveshaft still turning whenever the rear wheels are turning? Even the clutch packs should still be rotating even if disengaged. The fact that there is no power through them doesn't mean they aren't generating losses.
It depends. With conventional AWD (like all Subarus), you are correct that there is significant energy loss due to the AWD because there is a drivetrain to the rear wheels, even if it is not delivering power.
Many hybrids, however, have AWD and they work by having a second, small electric motor that powers the rear wheels only when needed. That means no physical drivetrain to the rear wheels, so no energy loss. That's why a hybrid Toyota RAV4 AWD gets about 15% better gas mileage than the smaller and lighter hybrid Subaru Crosstrek AWD.
The disadvantage of the electric motor approach is that it cannot deliver as much power to the rear wheels as a conventional physical AWD drivetrain can. That said, probably only an issue in deep mud or snow.
Well, no physical drivetrain to the front half of the car would make a difference. But even with electric motors in the rear there is a drivetrain between the wheel and the motor. If the idle rear electric motors are is still spinning then the total mass of spinning parts might well approach the mass of a Subaru drivetrain. Driveshafts are very light.<p>It sounds like the savings are more in construction costs than fuel savings.
It's more of an industry wide thing:AWD means all wheel drive even when the vehicle has more than 4 wheels. So in the case of a vehicle with more than 4 wheels, 4 wheel drive would indicate four of the wheels are driven and the remainder are idlers. For instance 6x4 would indicate six wheels with four driven wheels.<p><a href="https://en.wikipedia.org/wiki/Six-wheel_drive" rel="nofollow">https://en.wikipedia.org/wiki/Six-wheel_drive</a><p>So nwheels x n driven wheels.
4wd - locking transfer case in the middle. Best for off road.<p>AWD - clutch packs. Best for nasty conditions on road, IMHO.
What’s the distinction?
I don't know, but both Gemini and Wikipedia in my primary language seem to agree that AWD refers to 4WD with a center decoupling mechanism to run front and back in an asynchronous manner, with emphasis on Wikipedia only that this is strictly American definition of it and both describe both style of systems in the rest of the world.<p>I'm guessing that maybe a distinction between offroad capable cars and non-capable cars is useful for liability reasons. Or something else.
I don't think most people here have it right. From my understanding the main difference is that 4WD can be manually turned off (meaning going to 2WD mode). AWD is always on.<p>Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.<p>Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.
AWD is an automatic 4 wheel drive when required.<p>Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage as power is always going to all wheels.<p>4WD is a permanent thing, or at least always on when you engage it. The system locks all the wheels to the same spin speed.
AWD is for on-road use. Each tire rotates at its own speed.<p>4WD is for off-road use. All tires rotate at the same speed.
That's incorrect. To have "All tires rotate at the same speed." you need 3 locking mechanism, which very few vehicles do.<p>At this point, the distinction is gone, because car bards marketing.<p>(AI lies)
Clutch pack vs transfer case.
Country differences (the writer seems to be Australian), plus some subtle technical differences few people know or care about.<p>Suffice to say, in British parlance any vehicle with four driven wheels can be called a "4×4"
My first guess was a RAV4 as well from that description
I am more concerned with the use of automatic video blurring of the text outputs on the computer.
> Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.<p>What does this mean?
They mean someone who's extremely passionate about this could identify the car brand or exact model in question just by listening to the sound the lock makes from the posted video. You know, like the experts who can identify a wine by smelling it, or a violin just by listening to it.
Toyota also uses flutter for their infotainment
Sicko here. Here's a Toyota door unlock beep. <a href="https://www.youtube.com/watch?v=yVdQd9UjAzA" rel="nofollow">https://www.youtube.com/watch?v=yVdQd9UjAzA</a>
Yeah they also did a video on YouTube about how they used Flutter in the RAV 4, and the first code snippet he posted... `dartExecutor`. lol
Why its been disclosed and patched....
hah. protip... it's not a 2022 rav4. the bonnet gives it away
[dead]
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.<p>You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.<p>Evil.
Is there an online database for instructions on how to disconnect your car from the cloud?<p>I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.<p>Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.<p>Somebody make this happen.
Usually the most practical thing to do is to remove the antenna. The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
> <i>The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.</i><p>I read comments that this may still not be ideal, as when you take it a dealer service (especially during the warranty period), all the collected data is cached locally and may eventually get uploaded to the proverbial mothership at that time. If you can/could tell it to stop collecting generally, then there's nothing to upload, antenna or not.<p>Not sure how valid this thinking is, but it is worth considering as a 'threat model'.
Unless that also causes it to never enter sleep mode and keep searching for a signal and drain your battery
In a few years, new cars probably won’t pass inspection or be allowed insurance if their internet access is disabled and not fixed by an authorized technician in a timely manner.
Most US states don't have a safety inspection. [1]<p>The trend might even be moving <i>away</i> from some types of inspections.<p>For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]<p>[1] <a href="https://en.wikipedia.org/wiki/Vehicle_inspection_in_the_United_States" rel="nofollow">https://en.wikipedia.org/wiki/Vehicle_inspection_in_the_Unit...</a><p>[2] <a href="https://legiscan.com/LA/text/HB1085/2026" rel="nofollow">https://legiscan.com/LA/text/HB1085/2026</a>
And in the UK you have to report every modification(including this one) to your insurer, or your insurance is null and void. The MOT(annual test) couldn't care any less about any of this or any modifications - as long as your car can pass a set of(very basic) tests, it's legal to use on the road.
They already are worse.<p>Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.<p>Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
> will soon<p>You realise that in the EU cars have a SIM in, and an emergency button? This is since 2018, see: 112 eCall regulation.
I do realise. That by itself is worrysome. But now car manufacturers tie legallly required functions like the enmergency buttons with bloated platforms of "convenience" functions that users can not disable completely.
Correct me if I'm wrong, but I think I've read somewhere that it can be a SIM-less phone that abuses emergency call flow in 3GPP. GSM specs have special accomodations for 911/112 type calls that don't require a SIM(that sometimes ironically lead to normal calls working fine and just emergency calls failing).
Yes, you don't (in most countries) need a SIM for 112/911, and even when you do have one, you are allowed to use other carriers for such calls, even when you ordinarily shouldn't be able to roam onto them.
The specs do have that, but I used to work at a major mobile telco which didn't implement that part of the spec. The argument was that people would use emergency calls to test phones without a SIM. That may well have changed, but you can't assume that the spec will always be implemented in the network.
I'm always confounded by how bad most car security seems to be. I've given this about 5 seconds of thinking, and wouldn't it be pretty simple to do a local app-car setup step that generated a private key stored in the app and stored the public key in the car, requiring all commands to be signed with the private key in order to be accepted? There's no reason why the car manufacturers server should even be allowed to send commands to the car just based on a user account anyway.
The fact that cars can be controlled over the net at all is itself absurd. Especially in today’s cybersecurity scenario..
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.<p>I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
The follow up/linked article at the bottom is worth a read too as it's the 'world-wide' part of it. Definitely a great read from both Sam and Shubs<p><a href="https://samcurry.net/forgerock?ref=shubs.io" rel="nofollow">https://samcurry.net/forgerock?ref=shubs.io</a>
I think automaker failed security the moment its cars connected to the internet
[dead]
GM was doing this 25 years ago.<p>It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.<p>They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.<p>Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
I've pondered how "secure" the old OnStar system was. It was apparently just some level of in-band signalling/modem communication on top of AMPS (or CDMA).<p>I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we <i>do</i> have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.
They had other issues. SQLI, XSS and XSRF were rampant in those days.
Toyota and its luxury brand, Lexus, use the ForgeRock Identity Platform (specifically OpenAM and OpenIDM) to manage customer identities and backend authentication for their connected car and telematics services.
Any guesses to what brand the two cars are in the garage? They look like Nissan.
Warning: The video in the article contains VERY loud bleeps.
I love a good old fashioned hacker story in the morning :)
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.<p>Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
>only attempt if you know that you're doing, so as to avoid damaging it<p>If you mess with your front door lock, make sure to do it with the door <i>open</i>, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.<p>Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Are door locks actually intended to deter professional thieves though? I thought they were intended to add enough friction to deter crimes of opportunity.
> <i>nicest (and second most expensive) place I have lived at had the worst locks</i><p>Did it have an alarm system?
The lock on my front door merited a 15 minute video from the LockPickingLawyer. He could pick it, but it required some time and tools that the average lock picker wouldn't have available. 15 minutes has to be a record for him, but still it's <i>only 15 minutes</i>.
I bought myself an Autel key programmer and boy was it funny to add in my own keys arbitrarily with no authentication to my own car.<p>No wonder the ratbag kids these days are running around with them - they're only like $400 on Aliexpress and Temu. The world of "all keys lost" shenanigans is a wild one. There's cat-and-mouse games between Autel and automakers and users trying to "block" certain regions and users from leveraging the all-keys-lost features to try to cut down on auto theft, but where there's a will, there's a way, and Autel's just running a shitty Android app on an Android 8 tablet...
This is a Rav4
I drive a 1999 Mitsubishi Eclipse GS-T Turbo ... sweet car.
Nice car, but personally the 3000GT is the one for me :)
I do miss my Starion, but not the fines.
Those things are cool, wife had one when I met her (non turbo). It's a shame they stopped making them.
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
Difference is that now you develop the hack once and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong. Picking a lock is work you have to do for every vehicle, plus it looks pretty sketchy.<p>Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
Your comment just tells me that a modern 7 series BMW or a Cayenne is now prime candidate for a similar hack. Couple of weeks for motivated hackers and now they can steal a luxury car and ship it to Africa / Middle East ? Six digits payout for couple weeks of work + cost of LLM subscription.<p>Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.<p>If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this<p>0 - <a href="https://samcurry.net/hacking-subaru" rel="nofollow">https://samcurry.net/hacking-subaru</a>
High end luxury car lifts to order are sometimes <i>literally</i> that- a target car is tracked and when parked and left for some short period it gets lifted up into a truck with a Faraday cage and driven away.<p>Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
Now I am not sure if it makes any easier. I was aware of cars getting lifted and put into a shipping container in mere hours. My train of thought was that now you can remote unlock and remote start so that a threat actor can get in at night or even daylight and drive away. If you remove the owner's profile from the car through the API, you delay the response by some time while customer support + police get the necessary info to start tracking the car which is already in an aluminium lined container on a ship headed off to another continent.
For theft to order by crews of good field workers and yard mechanics there's no real need for them to worry about hacking / remote access of high end cars - they can just mechanically lift / tow and isolate and leave the nerd stuff as a problem for down the line.<p>One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.<p>In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.
Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.
<p><pre><code> Brown said everyone needed a better stereo in the 1990s. Factory radios were lousy. But the aftermarket stereos that people bought to replace the factory-issued ones could easily transfer from one car to the next. For example, if thieves steal the factory stereo from a Volkswagen Jetta, they're going to need a buyer with a Volkswagen Jetta, and all a thief can offer is the stereo the owner had to begin with.
</code></pre>
<a href="https://www.npr.org/2009/03/24/101998015/car-stereo-theft-a-dying-crime" rel="nofollow">https://www.npr.org/2009/03/24/101998015/car-stereo-theft-a-...</a><p>Factory stereos got good (and complicated). Aftermarkets got cheap.
The switch of car sound systems from a discrete unit that used a standard DIN form factor and connections to an integrated part of the dashboard from the mid '90s onward (and now into the complex "infotainment" system) kinda killed it as well. You can't just grad a single box out the dash and run. Does mean that car stereos are either un-upgradable, or require 3rd party kits to replace chunks of the facia nowadays though.
Exactly. Someone like the author isn't going to steal my car, so unless I'm targeted by a three letter agency it's not something worth worrying about.<p>I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Car thieves destroy undrivable cars and just sell parts and scrap metals.<p>The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
> Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car?<p>"tesla relay attack"
I mean, it's probably possible, but it's well above the "just have to outrun the bear" bar: Towing it and/or just buying a car for yourself.
Tesla? They aren't exactly known for their security. [0]<p>[0] <a href="https://www.wired.com/story/tesla-ultra-wideband-radio-relay-attacks/" rel="nofollow">https://www.wired.com/story/tesla-ultra-wideband-radio-relay...</a>
> Also take a look at how easily a professional could gain access to your home if they wanted to.<p>Or an amateur with a mallet, a key blank, a file, and an o-ring.<p><a href="https://en.wikipedia.org/wiki/Lock_bumping" rel="nofollow">https://en.wikipedia.org/wiki/Lock_bumping</a>
> Reconstructing the requests, we found that a lot of these APIs needed no authentication beyond the hardcoded API keys sitting in the JavaScript bundle.<p>I've heard so many horror stories starting like this.
Somebody’s going to get themselves hauled off to jail in a car from another manufacturer to make sure they’re locked on the way. Australia has zero tolerance for this.
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
The whole post is so badly written and explained. At least it wasn't AI generated I guess
I didn't find this hard to read or understand, though perhaps his writing style just aligns with my own and I do have experience in the methods being used.
What a ludicrous complaint. It's perfectly readable. What possible motivation does one have to broadly proclaim something is "badly" done from an armchair without a modicum of justification? And then follow it up with an AI-whine. It's roiling to me.
Manufacturer is not disclosed, but the car in video is RAV4. Lol
"there were no servlets (or resources) registered against paths that included the path traversal within them. [..] We were incredibly annoyed by this"<p>That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
Admin password/credentials compiled into a JavaScript SPA bundle, freely accesible to the internet. Twice. Classic rookie mistake.
The byline says “security researcher”, but I didn’t find any mention of disclosure to the platform security team in the blog post. What gives?
Why GPT-5.6? Was this done before the release of GPT-6, or is there some difference in restrictions between the two?
Daybreak blue (for defensive action) was for a long time a specific model selection, basically Sol 5.6. Later it became a toggle available for any 5.6 model. Last time I checked it wasn’t available for 6+.<p>Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
I knew it was going to be Toyota as soon as I saw the title, their software from top to bottom is a total clown show.
I'm glad I bought a Corolla LE that does NOT have remote start. I still have to insert the key to start the engine. So much more secure.
I do wish my new car (Volvo EV) had a physical key for practical reasons (having a place to put it and thus remember to bring it with me is an underrated feature of car ignitions) but I don't think there is anything that fundamentally makes it impossible for CANBus attacks to work against cars with proper keys.<p>I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car <i>easier</i>, since I believe that is how older cars worked?
Can anybody guess what automaker?
LLM seems to think it’s Toyota/Lexus based on an open source alternative client[1] documenting the same APIs that appear in the blog post.<p>A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.<p>[1] <a href="https://github.com/ide/lexy/blob/main/docs/vehicle-status-and-control.md?utm_source=chatgpt.com" rel="nofollow">https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...</a>
I received an email from Toyota asking me to connect to a newly-purchased vehicle in their app. I hadn't actually purchased a Toyota, but I went ahead and installed the app to see what it would do, and I ended up having full access to someone's car. I could see the car's location, lock/unlock it, and even start the engine remotely. I did try to contact Toyota about the issue through various channels and never got a response.<p>If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.
Looks like the XA50 AFAICT
Yes the car in the video looks like an RX350
Isuzu is my guess? They might be tied to <a href="https://whg-telematics.com.au" rel="nofollow">https://whg-telematics.com.au</a> (my guess at the redacted URL if it is even partially real in the post).
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
Up until recently most Isuzus were sold as Holdens. They don't sell passenger cars here because they don't make much of them anymore. At least for export.<p>The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.<p>Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
[flagged]
Why should we?
From reputation alone, I would not be surprised if it were Kia/Hyundai.<p><a href="https://en.wikipedia.org/wiki/Kia_Challenge" rel="nofollow">https://en.wikipedia.org/wiki/Kia_Challenge</a>
And this, kids, is why we're not getting a "connected" car.
Hyundai
Not if you take them (there are two security workers behind this) at their word:<p><pre><code> In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
</code></pre>
<i>Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access</i> (November 7, 2026) - By Shubham Shah and Sam Curry - <a href="https://samcurry.net/forgerock" rel="nofollow">https://samcurry.net/forgerock</a>
Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.<p>Why would they be so circumspect? Presumably the automaker has fixed this by now.
It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. <a href="https://www.autocar.co.uk/car-news/new-cars/range-rover-thefts" rel="nofollow">https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...</a>
That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.<p>Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
On the non-Australian side (the Sam Curry blog)<p><pre><code> After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.
</code></pre>
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).
Defamation/legal risk, even if such legal actions will be spurious
[flagged]
The color scheme on the admin panel suggests Toyota.
Imagine what K.A.R.R could do with that.
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.<p>IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.<p>I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.<p>It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
I’m questioning the need for connected cars in the first place. Perhaps we could revisit that trend.
Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features.<p>The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem.<p>You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
considering cybercab and waymo . That trend is going nowhere
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:<p>- Never hard-code credentials (especially in front-end exposed code)<p>- Never share credentials between environments (especially between prod and non-prod)<p>And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees.<p>Is it so hard to just offer said hackers a boatload of cash to switch sides?
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the <i>last</i> guy didn’t pay his O2 sensor bill!”<p>Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?<p>Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer<p>I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.<p>But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
Yeah, the problem isn't a dearth of technical security expertise, the problem is turning that technical expertise into meaningful organizational changes, which requires a rather different skillset (as far as I can tell: people-skills and managing/navigating bureaucracy). And, further, getting anything done is going to be a constant uphill battle in most organizations because, as you point out, paying for security doesn't [directly] contribute to quarterly revenue targets, and even worse, often times puts you in direct opposition with the people who <i>do</i> contribute [directly] to those targets.
More generally, the vast majority of companies consider IT to be a cost center which means cutting costs (and the corners along with them) and going with the cheapest bidder is just Standard Business Practice(TM).<p>Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: <i>even when the nightmare scenario happens</i> the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
[dead]
[dead]
[flagged]
Ear raping beep in the video, why the fuck would anyone ever do this? Just mute the fucking part instead of whatever the fuck this is...