It seems ridiculous that there would be consumer demand to unlock a car from a phone in the first place. The tech crowd will just complain that it should be easier to do a better job securing web services. But what is the point of all this infrastructure and complexity? So you can be just a little bit more lazy. This sort of tech is both a vulnerability and a waste of human resources and ingenuity.
Do you own a car? What’s more likely, misplacing your car keys, or misplacing your phone?
I’m not saying physical keys are not needed, but a nice digital solution is one of the things I really wish I had a Tesla. I wish the other car manufacturers would actually invest in good mobile experiences, they’re all such ass.
Physically unlocking with NFC could be done without all the security holes.
Modern cars already make it much more difficult to lock your keys in the car than in ye olden days.
And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff. It's not like that "did I lock it" check helps prevent a "someone smashed the window and grabbed something out of it" scenario anyway.
> What’s more likely, misplacing your car keys, or misplacing your phone?
good question. I don't know? There are three things I carry with me literally everywhere: phone, keys, and wallet. Any one of them missing in the morning means I have to hunt around the house to find them before I can leave for work. This would not change if I could unlock my car with my phone (I still need to be able to lock my front door and/or let myself in when I come home again, requiring keys)
There are also keyless solutions to your front door. The second time I had to call a locksmith in Shanghai I got pitched on a combination lock for my apartment door.
That's not to say they make sense. The total amount I spent on having the locksmith let me back in to my apartment that year was significantly less than the cost of putting in a combination lock.
In the western world, where labor is expensive and goods are cheap, you could put in 3 smart locks for the price of one call from a locksmith. I know, I’ve done both.
> What’s more likely, misplacing your car keys, or misplacing your phone?
Misplacing the phone actually. Car keys are either in someone's pocket/bag (then you talk to whoever used the car last) or in a set place in my home. The phone might be wherever I used it last.
The desire to connect every single thing to the Internet is a complete waste of resources in exchange for profound security issues and mild reliability risks. Use a key. It's the right tool for the job.
I'm not convinced it is even lazy to use a phone to unlock a car.
There are use cases: you want to give a family member some item. They're at work and in a meeting. Get them to remote unlock their car and place the item in it. But really I think it's an extension of remote start which is very necessary in cold climates.
its just more convenient, say im outside my home, theres something i need in the car, i can either go back inside to get the keys, or just open the car from the app (not to mention turning on heater / AC remotely)
you can argue that the security tradeoff is not worth it, but claiming the demand is not there is just silly
I think weex means loan vendors and carmakers would like your access to your car to be controlled by them not the driver -- so they can lock you out if you don't pay them every month.
It seems ridiculous to think that because we cannot create a technical facility to securely open the car, the consumers are called ridiculous. It is hackernews but this looks to me like enterprise compliance news.
Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
Better locks also increase the time to break them. More time == more chances to be disturbed and have to go away and also an incentive to move on to the next house, bike, etc. In the case of bicycles I also advice to lock them close to much better bikes with similar locks: chances are that the thief will invest those 30 seconds to break the lock of the better looking bike.
Many countries have very broad cybercrime laws - like prohibitions on "gaining unauthorised access to a computer system". And in some countries, even when you're in the right going to court can be a costly and time-consuming endeavour.
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
Based on my experience in this industry, every brand does this, has done this, and is currently building out a replacement for their current system that does this in a slightly different way.
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
This distinction (although I know it) has never made logical sense to me.
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.) But I have yet to ever see a 4WD that could be "switched" to FWD.
The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype. That means the extra wheels cannot be triggered seamlessly. A 4FW has distinct driving modes whereas an AWD uses clutches to bounce between modes as needed.
Bluey has a couple lines about this distinction. In Australia, even small children have opinions on 4WD v AWD.
It's more of an industry wide thing:AWD means all wheel drive even when the vehicle has more than 4 wheels. So in the case of a vehicle with more than 4 wheels, 4 wheel drive would indicate four of the wheels are driven and the remainder are idlers. For instance 6x4 would indicate six wheels with four driven wheels.
I don't know, but both Gemini and Wikipedia in my primary language seem to agree that AWD refers to 4WD with a center decoupling mechanism to run front and back in an asynchronous manner, with emphasis on Wikipedia only that this is strictly American definition of it and both describe both style of systems in the rest of the world.
I'm guessing that maybe a distinction between offroad capable cars and non-capable cars is useful for liability reasons. Or something else.
I don't think most people here have it right. From my understanding the main difference is that 4WD can be manually turned off (meaning going to 2WD mode). AWD is always on.
Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.
Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.
The RAV4 dynamically engages the back wheels with no mechanical coupling to the front wheels. It uses a separate electric motor in the back. Toyota calls it AWD.
Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage as power is always going to all wheels.
4WD is a permanent thing, or at least always on when you engage it. The system locks all the wheels to the same spin speed.
> Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
They mean someone who's extremely passionate about this could identify the car brand or exact model in question just by listening to the sound the lock makes from the posted video. You know, like the experts who can identify a wine by smelling it, or a violin just by listening to it.
I wouldn't know, and don't want to investigate. I try to stay generic, grammatically it's fine. I'm sure it can be grating to some but I'm not using this as a trigger word.
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Is there an online database for instructions on how to disconnect your car from the cloud?
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Usually the most practical thing to do is to remove the antenna. The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
In a few years, new cars probably won’t pass inspection or be allowed insurance if their internet access is disabled and not fixed by an authorized technician in a timely manner.
Most US states don't have a safety inspection. [1]
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
And in the UK you have to report every modification(including this one) to your insurer, or your insurance is null and void. The MOT(annual test) couldn't care any less about any of this or any modifications - as long as your car can pass a set of(very basic) tests, it's legal to use on the road.
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
Samsug definitely was (is) trying to slowly replace google. A lot of there stuff runs Tizen but yeah they now more about security than a car maker at least.
I do realise. That by itself is worrysome. But now car manufacturers tie legallly required functions like the enmergency buttons with bloated platforms of "convenience" functions that users can not disable completely.
Correct me if I'm wrong, but I think I've read somewhere that it can be a SIM-less phone that abuses emergency call flow in 3GPP. GSM specs have special accomodations for 911/112 type calls that don't require a SIM(that sometimes ironically lead to normal calls working fine and just emergency calls failing).
Yes, you don't (in most countries) need a SIM for 112/911, and even when you do have one, you are allowed to use other carriers for such calls, even when you ordinarily shouldn't be able to roam onto them.
The specs do have that, but I used to work at a major mobile telco which didn't implement that part of the spec. The argument was that people would use emergency calls to test phones without a SIM. That may well have changed, but you can't assume that the spec will always be implemented in the network.
I'm always confounded by how bad most car security seems to be. I've given this about 5 seconds of thinking, and wouldn't it be pretty simple to do a local app-car setup step that generated a private key stored in the app and stored the public key in the car, requiring all commands to be signed with the private key in order to be accepted? There's no reason why the car manufacturers server should even be allowed to send commands to the car just based on a user account anyway.
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
Your system is broken, FF has supported h265 on every OS for a long time now:
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
you would do yourself some good to learn to differentiate constructive criticism from this sort of mean vitriol. I have no doubt that this is the explanation for the downvotes. there is truly no need to be so abrasive. it only serves to detract from whatever good-faith intentions you had, if any.
“Thanks for the nice write-up. Gotta admit the video still irks me. Like, portrait to landscape mid-recording… Since it was only a minute, think re-recording would be well worth it.”
Toyota and its luxury brand, Lexus, use the ForgeRock Identity Platform (specifically OpenAM and OpenIDM) to manage customer identities and backend authentication for their connected car and telematics services.
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
Difference is that now you develop the hack once and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong. Picking a lock is work you have to do for every vehicle, plus it looks pretty sketchy.
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
> At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
Your comment just tells me that a modern 7 series BMW or a Cayenne is now prime candidate for a similar hack. Couple of weeks for motivated hackers and now they can steal a luxury car and ship it to Africa / Middle East ? Six digits payout for couple weeks of work + cost of LLM subscription.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
High end luxury car lifts to order are sometimes literally that- a target car is tracked and when parked and left for some short period it gets lifted up into a truck with a Faraday cage and driven away.
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
Now I am not sure if it makes any easier. I was aware of cars getting lifted and put into a shipping container in mere hours. My train of thought was that now you can remote unlock and remote start so that a threat actor can get in at night or even daylight and drive away. If you remove the owner's profile from the car through the API, you delay the response by some time while customer support + police get the necessary info to start tracking the car which is already in an aluminium lined container on a ship headed off to another continent.
For theft to order by crews of good field workers and yard mechanics there's no real need for them to worry about hacking / remote access of high end cars - they can just mechanically lift / tow and isolate and leave the nerd stuff as a problem for down the line.
One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.
In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.
Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.
Brown said everyone needed a better stereo in the 1990s. Factory radios were lousy. But the aftermarket stereos that people bought to replace the factory-issued ones could easily transfer from one car to the next. For example, if thieves steal the factory stereo from a Volkswagen Jetta, they're going to need a buyer with a Volkswagen Jetta, and all a thief can offer is the stereo the owner had to begin with.
The switch of car sound systems from a discrete unit that used a standard DIN form factor and connections to an integrated part of the dashboard from the mid '90s onward (and now into the complex "infotainment" system) kinda killed it as well. You can't just grad a single box out the dash and run. Does mean that car stereos are either un-upgradable, or require 3rd party kits to replace chunks of the facia nowadays though.
Exactly. Someone like the author isn't going to steal my car, so unless I'm targeted by a three letter agency it's not something worth worrying about.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Car thieves destroy undrivable cars and just sell parts and scrap metals.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
>only attempt if you know that you're doing, so as to avoid damaging it
If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Are door locks actually intended to deter professional thieves though? I thought they were intended to add enough friction to deter crimes of opportunity.
The lock on my front door merited a 15 minute video from the LockPickingLawyer. He could pick it, but it required some time and tools that the average lock picker wouldn't have available. 15 minutes has to be a record for him, but still it's only 15 minutes.
Daybreak blue (for defensive action) was for a long time a specific model selection, basically Sol 5.6. Later it became a toggle available for any 5.6 model. Last time I checked it wasn’t available for 6+.
Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
> Reconstructing the requests, we found that a lot of these APIs needed no authentication beyond the hardcoded API keys sitting in the JavaScript bundle.
I've heard so many horror stories starting like this.
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
I didn't find this hard to read or understand, though perhaps his writing style just aligns with my own and I do have experience in the methods being used.
What a ludicrous complaint. It's perfectly readable. What possible motivation does one have to broadly proclaim something is "badly" done from an armchair without a modicum of justification? And then follow it up with an AI-whine. It's roiling to me.
"there were no servlets (or resources) registered against paths that included the path traversal within them. [..] We were incredibly annoyed by this"
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
I do wish my new car (Volvo EV) had a physical key for practical reasons (having a place to put it and thus remember to bring it with me is an underrated feature of car ignitions) but I don't think there is anything that fundamentally makes it impossible for CANBus attacks to work against cars with proper keys.
I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
Up until recently most Isuzus were sold as Holdens. They don't sell passenger cars here because they don't make much of them anymore. At least for export.
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
Not if you take them (there are two security workers behind this) at their word:
In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerock
Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...
That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees.
Is it so hard to just offer said hackers a boatload of cash to switch sides?
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!”
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
Yeah, the problem isn't a dearth of technical security expertise, the problem is turning that technical expertise into meaningful organizational changes, which requires a rather different skillset (as far as I can tell: people-skills and managing/navigating bureaucracy). And, further, getting anything done is going to be a constant uphill battle in most organizations because, as you point out, paying for security doesn't [directly] contribute to quarterly revenue targets, and even worse, often times puts you in direct opposition with the people who do contribute [directly] to those targets.
More generally, the vast majority of companies consider IT to be a cost center which means cutting costs (and the corners along with them) and going with the cheapest bidder is just Standard Business Practice(TM).
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
It seems ridiculous that there would be consumer demand to unlock a car from a phone in the first place. The tech crowd will just complain that it should be easier to do a better job securing web services. But what is the point of all this infrastructure and complexity? So you can be just a little bit more lazy. This sort of tech is both a vulnerability and a waste of human resources and ingenuity.
Do you own a car? What’s more likely, misplacing your car keys, or misplacing your phone?
I’m not saying physical keys are not needed, but a nice digital solution is one of the things I really wish I had a Tesla. I wish the other car manufacturers would actually invest in good mobile experiences, they’re all such ass.
Physically unlocking with NFC could be done without all the security holes.
Modern cars already make it much more difficult to lock your keys in the car than in ye olden days.
And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff. It's not like that "did I lock it" check helps prevent a "someone smashed the window and grabbed something out of it" scenario anyway.
And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff.
It's completely unnecessary.
Modern cars automatically lock themselves when they sense there are no keys nearby, nobody in the seats, and the doors are closed for x minutes.
> What’s more likely, misplacing your car keys, or misplacing your phone?
good question. I don't know? There are three things I carry with me literally everywhere: phone, keys, and wallet. Any one of them missing in the morning means I have to hunt around the house to find them before I can leave for work. This would not change if I could unlock my car with my phone (I still need to be able to lock my front door and/or let myself in when I come home again, requiring keys)
There are also keyless solutions to your front door. The second time I had to call a locksmith in Shanghai I got pitched on a combination lock for my apartment door.
That's not to say they make sense. The total amount I spent on having the locksmith let me back in to my apartment that year was significantly less than the cost of putting in a combination lock.
In the western world, where labor is expensive and goods are cheap, you could put in 3 smart locks for the price of one call from a locksmith. I know, I’ve done both.
> What’s more likely, misplacing your car keys, or misplacing your phone?
Misplacing the phone actually. Car keys are either in someone's pocket/bag (then you talk to whoever used the car last) or in a set place in my home. The phone might be wherever I used it last.
I think my car key would be the thing in my pockets that I'm the least likely to misplace. It's only ever in like one of three places.
This appears to be the simplest and safest solution.
I’m unlikely to lose either. The keys have an AirTag. The phone show up on find my.
What’s more likely, misplacing your car keys, or misplacing your phone?
Are there cars that let you drive them without the key?
My car allows me to unlock it with a phone from the other side of the planet. But to actually drive, it requires the key to be inside.
unlock with nfc then ? He is pointing out the rediculousness of the design choice of using the web to unlock the car which is at arms reach
You’ve never walked away after parking, and then an hour later thought “oh shit did I lock the car?”
Seems like a real problem with actually addressing
Most modern cars automatically lock when you walk like 3 metres away from the car with keyfob. At least I assume it's most cars.
The desire to connect every single thing to the Internet is a complete waste of resources in exchange for profound security issues and mild reliability risks. Use a key. It's the right tool for the job.
I'm not convinced it is even lazy to use a phone to unlock a car.
There are use cases: you want to give a family member some item. They're at work and in a meeting. Get them to remote unlock their car and place the item in it. But really I think it's an extension of remote start which is very necessary in cold climates.
its just more convenient, say im outside my home, theres something i need in the car, i can either go back inside to get the keys, or just open the car from the app (not to mention turning on heater / AC remotely)
you can argue that the security tradeoff is not worth it, but claiming the demand is not there is just silly
I mean that is not what they argued, what they argued was
> So you can be just a little bit more lazy
Which:
> i can either go back inside to get the keys, or just open the car from the app
I think qualifies, personally. Your house might be way bigger than mine though
I still dont understand whats wrong with putting a key in a door to unlock it.
The problem is no one can control this remotely. Some people would prefer your access to the vehicle be conditional.
Most cars still have a physical lock hidden under the handle for emergencies, like opening the car when the battery is dead.
All remote unlock is doing is adding an unnecessary insecure remote layer on top of that for convenience.
I think weex means loan vendors and carmakers would like your access to your car to be controlled by them not the driver -- so they can lock you out if you don't pay them every month.
It seems ridiculous to think that because we cannot create a technical facility to securely open the car, the consumers are called ridiculous. It is hackernews but this looks to me like enterprise compliance news.
Repeat after me: exponential growth must be maintained at all cost
Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
Better locks also increase the time to break them. More time == more chances to be disturbed and have to go away and also an incentive to move on to the next house, bike, etc. In the case of bicycles I also advice to lock them close to much better bikes with similar locks: chances are that the thief will invest those 30 seconds to break the lock of the better looking bike.
Giving a high quality bike lock to your neighbors is a great gift idea!
This is probably less security theater and more not-getting-sued theater.
Sued for what? It's rather the manufacturer should be sued for selling insecure vehicles. And slapped by authorities too.
Many countries have very broad cybercrime laws - like prohibitions on "gaining unauthorised access to a computer system". And in some countries, even when you're in the right going to court can be a costly and time-consuming endeavour.
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
Humanity has a long tradition of shooting the messenger.
And the message.
But the practice is far too commonly to sue the discloser rather than the manufacturer of the software.
That’s what you get for posting shit like this under your real name for the sake of “portfolio”
I miss the web being less career focused and more crazy
Based on my experience in this industry, every brand does this, has done this, and is currently building out a replacement for their current system that does this in a slightly different way.
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
I was trying to figure out which make/model, based off of "I bought a new four wheel drive/SUV from them", specifically the "four wheel drive" part.
I'm assuming he means AWD.
This distinction (although I know it) has never made logical sense to me.
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
4WD: Distribution of power to the wheels is static. AWD: Distribution is dynamic.
4WD vehicles are often part-time 4WD, meaning they can be switched between 4WD and RWD or FWD.
AWD vehicles are full-time AWD because part-time AWD is unnecessary given that the drivetrain delivers power where it's most needed.
There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.) But I have yet to ever see a 4WD that could be "switched" to FWD.
The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype. That means the extra wheels cannot be triggered seamlessly. A 4FW has distinct driving modes whereas an AWD uses clutches to bounce between modes as needed.
Bluey has a couple lines about this distinction. In Australia, even small children have opinions on 4WD v AWD.
It's more of an industry wide thing:AWD means all wheel drive even when the vehicle has more than 4 wheels. So in the case of a vehicle with more than 4 wheels, 4 wheel drive would indicate four of the wheels are driven and the remainder are idlers. For instance 6x4 would indicate six wheels with four driven wheels.
https://en.wikipedia.org/wiki/Six-wheel_drive
So nwheels x n driven wheels.
4wd - locking transfer case in the middle. Best for off road.
AWD - clutch packs. Best for nasty conditions on road, IMHO.
What’s the distinction?
I don't know, but both Gemini and Wikipedia in my primary language seem to agree that AWD refers to 4WD with a center decoupling mechanism to run front and back in an asynchronous manner, with emphasis on Wikipedia only that this is strictly American definition of it and both describe both style of systems in the rest of the world.
I'm guessing that maybe a distinction between offroad capable cars and non-capable cars is useful for liability reasons. Or something else.
I don't think most people here have it right. From my understanding the main difference is that 4WD can be manually turned off (meaning going to 2WD mode). AWD is always on.
Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.
Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.
The RAV4 dynamically engages the back wheels with no mechanical coupling to the front wheels. It uses a separate electric motor in the back. Toyota calls it AWD.
AWD is an automatic 4 wheel drive when required.
Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage as power is always going to all wheels.
4WD is a permanent thing, or at least always on when you engage it. The system locks all the wheels to the same spin speed.
I don't think that's universally true
Indeed. Marketing ruins all definitions.
AWD is for on-road use. Each tire rotates at its own speed.
4WD is for off-road use. All tires rotate at the same speed.
That's incorrect. To have "All tires rotate at the same speed." you need 3 locking mechanism, which very few vehicles do.
At this point, the distinction is gone, because car bards marketing.
(AI lies)
Clutch pack vs transfer case.
Country differences (the writer seems to be Australian), plus some subtle technical differences few people know or care about.
Suffice to say, in British parlance any vehicle with four driven wheels can be called a "4×4"
My first guess was a RAV4 as well from that description
I am more concerned with the use of automatic video blurring of the text outputs on the computer.
> Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
What does this mean?
They mean someone who's extremely passionate about this could identify the car brand or exact model in question just by listening to the sound the lock makes from the posted video. You know, like the experts who can identify a wine by smelling it, or a violin just by listening to it.
Or a car brand by the door mirror shape.
he*
I wouldn't know, and don't want to investigate. I try to stay generic, grammatically it's fine. I'm sure it can be grating to some but I'm not using this as a trigger word.
Toyota also uses flutter for their infotainment
Sicko here. Here's a Toyota door unlock beep. https://www.youtube.com/watch?v=yVdQd9UjAzA
Why its been disclosed and patched....
Yeah they also did a video on YouTube about how they used Flutter in the RAV 4, and the first code snippet he posted... `dartExecutor`. lol
hah. protip... it's not a 2022 rav4. the bonnet gives it away
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Evil.
Is there an online database for instructions on how to disconnect your car from the cloud?
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Somebody make this happen.
Usually the most practical thing to do is to remove the antenna. The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
Unless that also causes it to never enter sleep mode and keep searching for a signal and drain your battery
In a few years, new cars probably won’t pass inspection or be allowed insurance if their internet access is disabled and not fixed by an authorized technician in a timely manner.
Most US states don't have a safety inspection. [1]
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
[1] https://en.wikipedia.org/wiki/Vehicle_inspection_in_the_Unit...
[2] https://legiscan.com/LA/text/HB1085/2026
And in the UK you have to report every modification(including this one) to your insurer, or your insurance is null and void. The MOT(annual test) couldn't care any less about any of this or any modifications - as long as your car can pass a set of(very basic) tests, it's legal to use on the road.
They already are worse.
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
Samsug definitely was (is) trying to slowly replace google. A lot of there stuff runs Tizen but yeah they now more about security than a car maker at least.
> will soon
You realise that in the EU cars have a SIM in, and an emergency button? This is since 2018, see: 112 eCall regulation.
I do realise. That by itself is worrysome. But now car manufacturers tie legallly required functions like the enmergency buttons with bloated platforms of "convenience" functions that users can not disable completely.
Correct me if I'm wrong, but I think I've read somewhere that it can be a SIM-less phone that abuses emergency call flow in 3GPP. GSM specs have special accomodations for 911/112 type calls that don't require a SIM(that sometimes ironically lead to normal calls working fine and just emergency calls failing).
Yes, you don't (in most countries) need a SIM for 112/911, and even when you do have one, you are allowed to use other carriers for such calls, even when you ordinarily shouldn't be able to roam onto them.
The specs do have that, but I used to work at a major mobile telco which didn't implement that part of the spec. The argument was that people would use emergency calls to test phones without a SIM. That may well have changed, but you can't assume that the spec will always be implemented in the network.
I'm always confounded by how bad most car security seems to be. I've given this about 5 seconds of thinking, and wouldn't it be pretty simple to do a local app-car setup step that generated a private key stored in the app and stored the public key in the car, requiring all commands to be signed with the private key in order to be accepted? There's no reason why the car manufacturers server should even be allowed to send commands to the car just based on a user account anyway.
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
Hah not only same message from me but exact same year too, end of the GMT800 and the TJ. Probably other stuff I’m forgetting.
Why 2006 specifically?
The follow up/linked article at the bottom is worth a read too as it's the 'world-wide' part of it. Definitely a great read from both Sam and Shubs
https://samcurry.net/forgerock?ref=shubs.io
I think automaker failed security the moment its cars connected to the internet
GM was doing this 25 years ago.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
They had other issues. SQLI, XSS and XSRF were rampant in those days.
Warning: The video in the article contains VERY loud bleeps.
Hi - I've fixed this and uploaded a replacement video with less loud beeps. Sorry about that.
I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
H265 plays fine in firefox for me! No special extensions, just linux
Your system is broken, FF has supported h265 on every OS for a long time now:
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
>Android from Firefox 137 using hardware only.
https://developer.mozilla.org/en-US/docs/Web/Media/Guides/Fo...
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
> Using a 20 year old codec for 2.5% would be insane.
Surprisingly, in my experience h264 produces higher quality (better VMAF) for the same bitrate.
My theory is all the codec-optimisation attention went to h264 because of the crazy licensing situation of h265
The crazy licensing situation is only relevant to nerds, pretty much any chip you care about has hardware h265 decode.
You probably used the wrong settings. Netflix said "AV1 streaming sessions achieve VMAF scores that are 4.3 points higher than AVC and 0.9 points higher than HEVC sessions" 9 months ago: https://netflixtechblog.com/av1-now-powering-30-of-netflix-s...
huh. plays fine for me in firefox stable on linux, and with no extensions in firefox. Do you mean OS extensions?
Plays fine for me in Firefox on Windows.
God.. Nice write-up, horrible video.. "oh let's go from portrait to landscape in the middle of the recording!".
It's a one minute video, would it have been so hard to redo it.
Edit: raining downvotes, well fuck me, I guess you all prefer sloppy shit.
you would do yourself some good to learn to differentiate constructive criticism from this sort of mean vitriol. I have no doubt that this is the explanation for the downvotes. there is truly no need to be so abrasive. it only serves to detract from whatever good-faith intentions you had, if any.
Your description of the video describes the quality of your post very well, which is why you are being downvoted.
Toyota and its luxury brand, Lexus, use the ForgeRock Identity Platform (specifically OpenAM and OpenIDM) to manage customer identities and backend authentication for their connected car and telematics services.
I love a good old fashioned hacker story in the morning :)
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
Difference is that now you develop the hack once and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong. Picking a lock is work you have to do for every vehicle, plus it looks pretty sketchy.
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
>>and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong
I don't see any indication here that's the case - opening the doors is very different than being able to start the engine and drive off.
From the last paragraph:
At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
well you clearly didn't read the article...
> At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
Your comment just tells me that a modern 7 series BMW or a Cayenne is now prime candidate for a similar hack. Couple of weeks for motivated hackers and now they can steal a luxury car and ship it to Africa / Middle East ? Six digits payout for couple weeks of work + cost of LLM subscription.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
0 - https://samcurry.net/hacking-subaru
High end luxury car lifts to order are sometimes literally that- a target car is tracked and when parked and left for some short period it gets lifted up into a truck with a Faraday cage and driven away.
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
Now I am not sure if it makes any easier. I was aware of cars getting lifted and put into a shipping container in mere hours. My train of thought was that now you can remote unlock and remote start so that a threat actor can get in at night or even daylight and drive away. If you remove the owner's profile from the car through the API, you delay the response by some time while customer support + police get the necessary info to start tracking the car which is already in an aluminium lined container on a ship headed off to another continent.
For theft to order by crews of good field workers and yard mechanics there's no real need for them to worry about hacking / remote access of high end cars - they can just mechanically lift / tow and isolate and leave the nerd stuff as a problem for down the line.
One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.
In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.
Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.
Factory stereos got good (and complicated). Aftermarkets got cheap.
The switch of car sound systems from a discrete unit that used a standard DIN form factor and connections to an integrated part of the dashboard from the mid '90s onward (and now into the complex "infotainment" system) kinda killed it as well. You can't just grad a single box out the dash and run. Does mean that car stereos are either un-upgradable, or require 3rd party kits to replace chunks of the facia nowadays though.
Exactly. Someone like the author isn't going to steal my car, so unless I'm targeted by a three letter agency it's not something worth worrying about.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Car thieves destroy undrivable cars and just sell parts and scrap metals.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
> Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car?
"tesla relay attack"
I mean, it's probably possible, but it's well above the "just have to outrun the bear" bar: Towing it and/or just buying a car for yourself.
Tesla? They aren't exactly known for their security. [0]
[0] https://www.wired.com/story/tesla-ultra-wideband-radio-relay...
> If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Read that part.
PIN mode only protects against driving, not entering.
Which then allows you to move the vehicle (not start it), as you have physical access. As in the article I linked to.
You don't need access to move a vehicle, you can lift it up and move it. Like when you park in a place you shouldn't.
> Also take a look at how easily a professional could gain access to your home if they wanted to.
Or an amateur with a mallet, a key blank, a file, and an o-ring.
https://en.wikipedia.org/wiki/Lock_bumping
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
>only attempt if you know that you're doing, so as to avoid damaging it
If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Looks like we are doomed then.
Are door locks actually intended to deter professional thieves though? I thought they were intended to add enough friction to deter crimes of opportunity.
> nicest (and second most expensive) place I have lived at had the worst locks
Did it have an alarm system?
The lock on my front door merited a 15 minute video from the LockPickingLawyer. He could pick it, but it required some time and tools that the average lock picker wouldn't have available. 15 minutes has to be a record for him, but still it's only 15 minutes.
This is a Rav4
I drive a 1999 Mitsubishi Eclipse GS-T Turbo ... sweet car.
Nice car, but personally the 3000GT is the one for me :)
I do miss my Starion, but not the fines.
Those things are cool, wife had one when I met her (non turbo). It's a shame they stopped making them.
Why GPT-5.6? Was this done before the release of GPT-6, or is there some difference in restrictions between the two?
Daybreak blue (for defensive action) was for a long time a specific model selection, basically Sol 5.6. Later it became a toggle available for any 5.6 model. Last time I checked it wasn’t available for 6+.
Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
> Reconstructing the requests, we found that a lot of these APIs needed no authentication beyond the hardcoded API keys sitting in the JavaScript bundle.
I've heard so many horror stories starting like this.
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
> Why is he protecting the car company
He is not protecting the a car company. He is protecting himself.
Both can be true.
The whole post is so badly written and explained. At least it wasn't AI generated I guess
I didn't find this hard to read or understand, though perhaps his writing style just aligns with my own and I do have experience in the methods being used.
What a ludicrous complaint. It's perfectly readable. What possible motivation does one have to broadly proclaim something is "badly" done from an armchair without a modicum of justification? And then follow it up with an AI-whine. It's roiling to me.
No more than your comment, right? Look there's another comment about the title: https://news.ycombinator.com/item?id=50419520
Manufacturer is not disclosed, but the car in video is RAV4. Lol
"there were no servlets (or resources) registered against paths that included the path traversal within them. [..] We were incredibly annoyed by this"
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
The byline says “security researcher”, but I didn’t find any mention of disclosure to the platform security team in the blog post. What gives?
The companion blog post from Sam Curry says the issues were reported and fixed within hours.
Admin password/credentials compiled into a JavaScript SPA bundle, freely accesible to the internet. Twice. Classic rookie mistake.
I knew it was going to be Toyota as soon as I saw the title, their software from top to bottom is a total clown show.
Recently rented a Mitsubishi. Not so sure about that.
I'm glad I bought a Corolla LE that does NOT have remote start. I still have to insert the key to start the engine. So much more secure.
I do wish my new car (Volvo EV) had a physical key for practical reasons (having a place to put it and thus remember to bring it with me is an underrated feature of car ignitions) but I don't think there is anything that fundamentally makes it impossible for CANBus attacks to work against cars with proper keys.
I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?
Can anybody guess what automaker?
LLM seems to think it’s Toyota/Lexus based on an open source alternative client[1] documenting the same APIs that appear in the blog post.
A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.
[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...
Looks like the XA50 AFAICT
Definitely XA50. My sister bought one last week, time to find the sim card....
Yes the car in the video looks like an RX350
RAV4 is always in the top 10 of most stolen cars [1]. Maybe this is why.
[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...
Isuzu is my guess? They might be tied to https://whg-telematics.com.au (my guess at the redacted URL if it is even partially real in the post).
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
Up until recently most Isuzus were sold as Holdens. They don't sell passenger cars here because they don't make much of them anymore. At least for export.
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
Why should we?
Because its fun?
From reputation alone, I would not be surprised if it were Kia/Hyundai.
https://en.wikipedia.org/wiki/Kia_Challenge
And this, kids, is why we're not getting a "connected" car.
Hyundai
Not if you take them (there are two security workers behind this) at their word:
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerockCombined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...
That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
On the non-Australian side (the Sam Curry blog)
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).Defamation/legal risk, even if such legal actions will be spurious
The color scheme on the admin panel suggests Toyota.
Imagine what K.A.R.R could do with that.
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
I’m questioning the need for connected cars in the first place. Perhaps we could revisit that trend.
Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.
Maybe a Slate truck is of interest
considering cybercab and waymo . That trend is going nowhere
Makes perfect sense for fully-automated vehicles that aren’t privately owned. Everything else, I think there’s an argument to be made.
Not that I expect the argument to go anywhere.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees.
Is it so hard to just offer said hackers a boatload of cash to switch sides?
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!”
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
Yeah, the problem isn't a dearth of technical security expertise, the problem is turning that technical expertise into meaningful organizational changes, which requires a rather different skillset (as far as I can tell: people-skills and managing/navigating bureaucracy). And, further, getting anything done is going to be a constant uphill battle in most organizations because, as you point out, paying for security doesn't [directly] contribute to quarterly revenue targets, and even worse, often times puts you in direct opposition with the people who do contribute [directly] to those targets.
More generally, the vast majority of companies consider IT to be a cost center which means cutting costs (and the corners along with them) and going with the cheapest bidder is just Standard Business Practice(TM).
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
Ear raping beep in the video, why the fuck would anyone ever do this? Just mute the fucking part instead of whatever the fuck this is...