Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
Better locks also increase the time to break them. More time == more chances to be disturbed and have to go away and also an incentive to move on to the next house, bike, etc. In the case of bicycles I also advice to lock them close to much better bikes with similar locks: chances are that the thief will invest those 30 seconds to break the lock of the better looking bike.
Many countries have very broad cybercrime laws - like prohibitions on "gaining unauthorised access to a computer system". And in some countries, even when you're in the right going to court can be a costly and time-consuming endeavour.
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
Based on my experience in this industry, every brand does this, has done this, and is currently building out a replacement for their current system that does this in a slightly different way.
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
This distinction (although I know it) has never made logical sense to me.
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.) But I have yet to ever see a 4WD that could be "switched" to FWD.
The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype. That means the extra wheels cannot be triggered seamlessly. A 4FW has distinct driving modes whereas an AWD uses clutches to bounce between modes as needed.
Bluey has a couple lines about this distinction. In Australia, even small children have opinions on 4WD v AWD.
> There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.)
AIUI, you lose energy because the power/torque has to go through an extra differential, transfer case, etc, before reaching the rear wheels.
Going from the engine through the transmission to the front wheels is already a 'fixed cost', but the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay if you don't need to.
>> the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay
True for a FWD v RWD car decisions, but in an AWD are not the rear differential and driveshaft still turning whenever the rear wheels are turning? Even the clutch packs should still be rotating even if disengaged. The fact that there is no power through them doesn't mean they aren't generating losses.
It depends. With conventional AWD (like all Subarus), you are correct that there is significant energy loss due to the AWD because there is a drivetrain to the rear wheels, even if it is not delivering power.
Many hybrids, however, have AWD and they work by having a second, small electric motor that powers the rear wheels only when needed. That means no physical drivetrain to the rear wheels, so no energy loss. That's why a hybrid Toyota RAV4 AWD gets about 15% better gas mileage than the smaller and lighter hybrid Subaru Crosstrek AWD.
The disadvantage of the electric motor approach is that it cannot deliver as much power to the rear wheels as a conventional physical AWD drivetrain can. That said, probably only an issue in deep mud or snow.
Well, no physical drivetrain to the front half of the car would make a difference. But even with electric motors in the rear there is a drivetrain between the wheel and the motor. If the idle rear electric motors are is still spinning then the total mass of spinning parts might well approach the mass of a Subaru drivetrain. Driveshafts are very light.
It sounds like the savings are more in construction costs than fuel savings.
^ this. 4wd is used on offroads and locks all wheels together, transfering equal power to all wheels. AWD varies power using different technologies, from a simple Haldex that transfers power back when front wheels slip to complex sensor controlled individual wheels. Some are front-biased (generally but not exclusively cheaper ones), some are rear-biased (mainly in sports cars) and some are true AWD, depending on the needs and expected pricing of the vehicle.
Not quite, no. It only locks all the wheels together if you also have axle lockers.
You might have something like a Series Landrover transfer box where in 4WD mode the front and rear axles are locked together and in 2WD mode only the rear axle is driven.
But does that make a Defender, RRC, or Disco with LT230 transfer box which has a lockable diff AWD or 4WD? The centre diff supplies power to both front and rear all the time, but can be locked in slippy conditions otherwise if one wheel spins *none* of the wheels get drive - the axle and centre diff will both spin.
Then what about the later Borg-Warner transfer box in later Range Rovers, where you still have a centre diff and epicyclic gearbox to set high and low range, but there's no diff lock - there's a massive viscous coupling that turns it into a ridiculously stiff LSD.
I doubt that there was ever a “legal” definition of AWD vs 4WD.
But in modern times, technology has most definitely blurred the distinction. Higher-end Jeeps also have a “full-time 4WD” that sounds an awful lot like an AWD system that can also do 4WD stuff.
So, eh, it’s probably not a good idea to argue too much about broad categories anymore. Individual systems must be compared
It's more of an industry wide thing:AWD means all wheel drive even when the vehicle has more than 4 wheels. So in the case of a vehicle with more than 4 wheels, 4 wheel drive would indicate four of the wheels are driven and the remainder are idlers. For instance 6x4 would indicate six wheels with four driven wheels.
You seem to be talking about something different. The conversation is about vehicles with four wheels and the differences between 4WD and AWD in that context. Perhaps you're saying that there is no difference?
But 6x4 notation is handy when you have six wheels, sure.
I don't know, but both Gemini and Wikipedia in my primary language seem to agree that AWD refers to 4WD with a center decoupling mechanism to run front and back in an asynchronous manner, with emphasis on Wikipedia only that this is strictly American definition of it and both describe both style of systems in the rest of the world.
I'm guessing that maybe a distinction between offroad capable cars and non-capable cars is useful for liability reasons. Or something else.
I don't think most people here have it right. From my understanding the main difference is that 4WD can be manually turned off (meaning going to 2WD mode). AWD is always on.
Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.
Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.
The RAV4 dynamically engages the back wheels with no mechanical coupling to the front wheels. It uses a separate electric motor in the back. Toyota calls it AWD.
Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage as power is always going to all wheels.
4WD is a permanent thing, or at least always on when you engage it. The system locks all the wheels to the same spin speed.
I've thought through the "all tires rotate at the same speed" thing before and how it works mechanically (front differential, rear differential, transfer case) and I think in the "no differentials locked" condition the correct statement is: the sum of the front wheel speeds == the sum of the rear wheel speeds. So you can have your front wheels slip and the rear wheels can still get power, or you can have your rear wheels slip and the front wheels still get power, but if you have one wheel in the front and one wheel in the back that are slipping, you're hosed.
Re: the 3 locking mechanisms comment, in typical 4WD configurations the transfer case in 4H/4L is essentially locked (which is what makes the above sum front == sum rear condition). AWD transfer cases can be more flexible there; some essentially act as a 3rd differential and result in all four wheel speeds being essentially decoupled (for better or worse, easier to get stuck) while others actively control the front/back locking with clutches or hydraulics or whatever.
> Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
They mean someone who's extremely passionate about this could identify the car brand or exact model in question just by listening to the sound the lock makes from the posted video. You know, like the experts who can identify a wine by smelling it, or a violin just by listening to it.
I wouldn't know, and don't want to investigate. I try to stay generic, grammatically it's fine. I'm sure it can be grating to some but I'm not using this as a trigger word.
It seems ridiculous that there would be consumer demand to unlock a car from a phone in the first place. The tech crowd will just complain that it should be easier to do a better job securing web services. But what is the point of all this infrastructure and complexity? So you can be just a little bit more lazy. This sort of tech is both a vulnerability and a waste of human resources and ingenuity.
I have no utility for remote unlocking. Remote locking (and the status in the app) saves my bacon because I often forget to lock the doors and in my neighborhood people will go through your car looking for change. It's not a big deal but I've had them get blood and stuff on the seats :/
Remote start is huge where I live. When it's -10C and there's a foot of snow you have to dig out in the morning, you can start your car from the app and then start shovelling. The alternative is a hokey pokey of shovelling yourself a path to the car, getting in, starting it, getting out, resuming shovelling. Not the end of the world but it's very nice. Even if there's no snow it's nice to get the cabin above freezing while you're eating breakfast without putting your boots on.
I'm in Canada and was going to say this as well. Also, the nice thing about a phone vs. key fob for remote start is that with the phone you're less likely to accidentally remote start the car in your garage compared to a key fob. My parents always disabled remote start on their key fobs because they parked in a garage, but having the remote start option on your phone when parked outside at work, etc. is really convenient.
I have an Acura RDX with remote start on the keyfob and it is very difficult to accidentally do. You have to first lock the car from the fob, get back a response saying it’s indeed locked then hold the remote start button for several seconds before it will start. Any other inputs in between those two actions cancels out the remote start sequence. It also shuts off after a few minutes if you don’t get in and actually “start” the car just in case you did manage to accidentally trigger it.
shit remote start doesn't even have to require snow.
i'm in legit cold canada and being able to open my garage remotely and start my car means it's a lot easier to herd small kids into a warm, comfy carseat.
BMW - the car unlocks the doors when I approach and auto locks the doors when I move away from the car, so generally I never interact with 'locking' at all. Except when this doesn't work, for instance, if the boot is open because I'm getting shopping out, then I close the boot and walk away, quite often it will not lock at that point, perhaps because I moved away from the door but it didn't lock because the boot was open. The app is useful so that I can firstly check the car is locked, and secondly lock it.
I personally have no need to unlock remotely - maybe my wife might say 'hey I need to get something from your car' and I'm not around? But I've never needed that yet.
My wife's Hyundai has told me via the app 'hey you've left the car unlocked' and I've been able to lock it remotely. So definitely in favour of that feature.
> as for "I often forget to lock the doors"... why do you often forget to lock the doors?
Having just switched from an "old-school" car to one of these "keyless" types, I think the problem is actually self-reinforcing -- the keyless entry and start stuff means you interact with the key less and less so you're more likely to forget to interact with it to lock the car. I can't think of a time I forgot to lock my old school car and yet it's happened more than once with the newer car since I got it a few months ago.
I have an even harder time now since one of my cars automatically locks when I walk away while the other doesn't. I've been so spoiled by that functionality.
Luckily the other car will at least notify me if I leave it unlocked and can lock it through my phone. Would be nice if it just also auto-locked.
Only if you're like right next to the car. I prefer to remote start my car when I'm more than a few minute walk away from it so it actually has a chance to warm up or cool down. Starting it ten seconds before I get to the car is practically worthless.
Would I pay a monthly fee for this - no. Is it nice to make sure your car is locked if you forgot and to remote start your car in really hot / cold weather, yes.
Do you own a car? What’s more likely, misplacing your car keys, or misplacing your phone?
I’m not saying physical keys are not needed, but a nice digital solution is one of the things I really wish I had a Tesla. I wish the other car manufacturers would actually invest in good mobile experiences, they’re all such ass.
> What’s more likely, misplacing your car keys, or misplacing your phone?
good question. I don't know? There are three things I carry with me literally everywhere: phone, keys, and wallet. Any one of them missing in the morning means I have to hunt around the house to find them before I can leave for work. This would not change if I could unlock my car with my phone (I still need to be able to lock my front door and/or let myself in when I come home again, requiring keys)
There are also keyless solutions to your front door. The second time I had to call a locksmith in Shanghai I got pitched on a combination lock for my apartment door.
That's not to say they make sense. The total amount I spent on having the locksmith let me back in to my apartment that year was significantly less than the cost of putting in a combination lock.
In the western world, where labor is expensive and goods are cheap, you could put in 3 smart locks for the price of one call from a locksmith. I know, I’ve done both.
Physically unlocking with NFC could be done without all the security holes.
Modern cars already make it much more difficult to lock your keys in the car than in ye olden days.
And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff. It's not like that "did I lock it" check helps prevent a "someone smashed the window and grabbed something out of it" scenario anyway.
It can be useful if you lost the keys for $REASON while hiking or doing any activity and you can phone somebody else who has access to the API and ask them to unlock and remote start the car.
It doesn't happen that often, but it happens, and in the big scheme of things it's more likely to happen [1] that somebody stealing it via a vulnerability in the car maker web services.
Or at least as a car owner, this is my risk assessment exercise output.
[1] Yeah, I just pulled this off my ass, don't think there are trustworthy stats either in one direction or the other.
At least in the old days I could put my car keys into the wash and they'd still work fine. I could go to the local hardware store and get convenient duplicates for almost no money. Losing your car keys in the old days was a very easy situation to remedy.
Meanwhile, if I'm out in public and a bad update bricks my phone (or cell coverage is down?) I can no longer use my car. The idea that consumers would hope for more entrenchment into the phone ecosystem is absolutely baffling.
"Just don't lose them" isn't really a solution. Humans make mistakes and occasionally leave them in pockets, drop inside couch cushions, etc. Especially if kids are involved.
> What’s more likely, misplacing your car keys, or misplacing your phone?
Misplacing the phone actually. Car keys are either in someone's pocket/bag (then you talk to whoever used the car last) or in a set place in my home. The phone might be wherever I used it last.
Google's Find Device and Apple's similar service mean that you can always determine where your cellphone is. If someone sets a bag on top of my keys, or something similar, the only way to find them is to physically search until I luck out and find them.
So, while I misplace my phone more often, I also find it with less difficulty.
> Google's Find Device and Apple's similar service mean that you can always determine where your cellphone is.
Hmm? As in which room? What if it accidentally slid under the bed sheets, or someone put a piece of clothing over it, and it's on silent? True stories.
> Do you own a car? What’s more likely, misplacing your car keys, or misplacing your phone?
I do own a car. Keys in home are always in exact same spot. Phone can we literally anywhere, good I have smartwatch and I can trigger "locate my phone" that way.
I just don't get the idea of unlocking car though app via internet. Neither I get the "keyless entry" (meaning I do not even need to touch the key fob to unlock car) and "start button" (well if you place key in ignition switch then you will not lose it!)
The security drawback is not worth, fixing non-existing problem in the first place.
My wife and I were in her Hyundai Ioniq 6 a couple of months ago, and we both got out of the car. One of our dogs was in the back seat and jumped into the front.
Unfortunately Hyundai decided, in their wisdom, to put the door lock button (to lock all doors) in the console between the front seats. Exactly where Sally stepped when she came from the back.
Both my wife's keys and phone were still in the car.
30 minutes later, a local mechanic showed up. He gently pried the front door open with something like a whoopie cushion, and was able to poke the door lock button and open everything. It took him about 5 minutes.
Hyundai Canada can, of course, open the doors remotely, but when I called them they refused to and only offered to call CAA (the Canadian version of AAA, and the people Hyundia sub-contracts their roadside assistance to). I guess that makes sense considering the liability of remotely unlocking for someone whose identity they can't verify.
Wife has an Ioniq 9, and she shared her digital key with me via Google Wallet. Look into that as an option for next time, I'd assume Apple has a similar implementation.
That said, the digital key is much more finicky/failure prone than my Tesla's implementation, and has a backup keycard I keep in my wallet (but have never had to use). Generally, rebooting the phone fixes it for some amount of time, until it stops working again with no indication until I try to unlock her car.
"What’s more likely, misplacing your car keys, or misplacing your phone?"
…And what about the many other things one misplaces about the house? For instance, Wireless mice, TV and various other remote controls, etc.
I just cannot understand why the tech crowd hasn't developed a much-needed Missing Objects protocol.
Think of this. When you lose an object you immediately go to a big button that's hidden and securely bolted down (so you can never lose it) then press it. Like your fob key and car, it activates all these easily-lost items and they start beeping madly so you can find them. Lose the mouse in the couch somewhere and the 'couch' starts beeping. Voilà, one found mouse.
It's crazy that a simple concept like this doesn't exist in practice.
My Onn Google TV box (that cost like $39.99) has a beeping find my remote feature which links to Google Home so I can just say "hey Google find my keys".
Owned a car for 30 years. Have misplaced keys but always had a spare. What's more likely to be stolen, your car keys or your phone? Your question and my question are both facile.
Yes, lots of cars (particularly relatively new ones) allow Phone-As-Key, either via UWB (so the phone can stay in your pocket) or NFC (so the phone has to be placed on an NFC reader).
I’ve used it more often than I’d expect. Mostly just in situations where I take my key out of my pocket then forget it when I run back to the car. Beach, gym, skiing, etc. Or, if my wife drove us and I’m the one running out to grab something.
Clearly, not a critical use case but it is handy.
Remote locking and remote start are much more useful.
There are use cases: you want to give a family member some item. They're at work and in a meeting. Get them to remote unlock their car and place the item in it. But really I think it's an extension of remote start which is very necessary in cold climates.
That's a pretty big stretch to me, especially since key fobs can usually unlock a door from across the parking lot without even leaving the building.
I live in a cold climate. Remote start isn't even necessary much less very necessary. I start the car, then clean off all the snow and leave. Running the engine isn't going to remove a foot of snow off the windshield and it definitely won't off the roof or hood.
Regardless remote starters do not need the web or a phone, they existed in the 1990s.
> remote start which is very necessary in cold climates
Not just necessary, but very necessary? I understand it's convenient, but I think you've overstated it a bit. You can always start your car and then go back in the house for a few.
We used (until Subaru said 'fuck you, pay us') the mobile access so that I could unlock my family member's vehicle when I rode along with them or remote start it ahead of them while we're out and about. It's nice to be able to get back into the car and sit and wait without having to grab the key out of their purse.
They hook a lot of people now with the first couple years free, then spin around and go for a $150+ a year whammy. We gave up.
I had a 2007 Chevy HHR. It had remote start/unlock. When I lived in Denver, I used the remote start during winter to warm the car up before getting in.
Also, there was something sticky with the door lock. If I used the key instead of the fob, sometimes the anti-theft system would not disarm and the only way I found to disarm it was to use the fob to turn that alarm off. Grrrr. Fobs lasted about 3 years and cost $100 to replace/reprogram.
My current car (a Miata) has a key only to unlock the door in the event of a dead battery. It has a pushbutton instead of the traditional ignition key, so the key is pretty useless outside of a dead battery.
I think weex means loan vendors and carmakers would like your access to your car to be controlled by them not the driver -- so they can lock you out if you don't pay them every month.
It seems ridiculous to think that because we cannot create a technical facility to securely open the car, the consumers are called ridiculous. It is hackernews but this looks to me like enterprise compliance news.
Enterprise compliance confuses people. The problems are all simple in principle, but there are so many of them and they cost so much that nearly no enterprise seems to be able to manage the basics. It'd say the more HN comment here is one who misunderstands that complex problems cannot be solved by technical solutions alone.
The desire to connect every single thing to the Internet is a complete waste of resources in exchange for profound security issues and mild reliability risks. Use a key. It's the right tool for the job.
I'm not convinced it is even lazy to use a phone to unlock a car.
Not sure the reliability risks are that mild in this case. Phones can run out of battery. I would not want to be locked out of my car in the winter because I ran out of batteries and looking at my car which both can charge it and save me from the elements.
its just more convenient, say im outside my home, theres something i need in the car, i can either go back inside to get the keys, or just open the car from the app (not to mention turning on heater / AC remotely)
you can argue that the security tradeoff is not worth it, but claiming the demand is not there is just silly
You can uncharitably call basically any consumer device that improves daily life in the last century as letting people "be a little more lazy".
Should we get rid of washing machines, dryers, Cuisinarts, in-sink disposals, etc too? They've even killed and injured people all so people could do slightly less work.
Humans love convenience, our entire modern life is oriented around technology created to serve those motivations. An extra way to unlock something with a single point of failure is unsurprisingly going to appeal to that same instinct.
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Is there an online database for instructions on how to disconnect your car from the cloud?
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Usually the most practical thing to do is to remove the antenna. The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
> The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
I read comments that this may still not be ideal, as when you take it a dealer service (especially during the warranty period), all the collected data is cached locally and may eventually get uploaded to the proverbial mothership at that time. If you can/could tell it to stop collecting generally, then there's nothing to upload, antenna or not.
Not sure how valid this thinking is, but it is worth considering as a 'threat model'.
The seems to be recent proof that smart TVs actually do this caching. If a shitty TV from walmart does it you can safely bet it is implemented in your 50K car.
In a few years, new cars probably won’t pass inspection or be allowed insurance if their internet access is disabled and not fixed by an authorized technician in a timely manner.
Most US states don't have a safety inspection. [1]
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
And in the UK you have to report every modification(including this one) to your insurer, or your insurance is null and void. The MOT(annual test) couldn't care any less about any of this or any modifications - as long as your car can pass a set of(very basic) tests, it's legal to use on the road.
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
Samsug definitely was (is) trying to slowly replace google. A lot of there stuff runs Tizen but yeah they now more about security than a car maker at least.
I do realise. That by itself is worrysome. But now car manufacturers tie legallly required functions like the enmergency buttons with bloated platforms of "convenience" functions that users can not disable completely.
Correct me if I'm wrong, but I think I've read somewhere that it can be a SIM-less phone that abuses emergency call flow in 3GPP. GSM specs have special accomodations for 911/112 type calls that don't require a SIM(that sometimes ironically lead to normal calls working fine and just emergency calls failing).
Yes, you don't (in most countries) need a SIM for 112/911, and even when you do have one, you are allowed to use other carriers for such calls, even when you ordinarily shouldn't be able to roam onto them.
The specs do have that, but I used to work at a major mobile telco which didn't implement that part of the spec. The argument was that people would use emergency calls to test phones without a SIM. That may well have changed, but you can't assume that the spec will always be implemented in the network.
I'm always confounded by how bad most car security seems to be. I've given this about 5 seconds of thinking, and wouldn't it be pretty simple to do a local app-car setup step that generated a private key stored in the app and stored the public key in the car, requiring all commands to be signed with the private key in order to be accepted? There's no reason why the car manufacturers server should even be allowed to send commands to the car just based on a user account anyway.
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
That's more my personal estimation than a Number Backed By Science (tm) but here are my reasons:
1. Enough computer control for reasonable efficiency
2. Largely independent computers
3. No centralized infotainment that controls the entire car (you can swap the radio)
4. Still lots of knobs and dials, no touchscreens
5. Enough computers to get pretty good diagnostics if/when something goes wrong
6. Most of them have lock clickers, maybe trunk, almost nothing else
7. Engines are older, built "heavily" and don't suffer from too much boost / high bearing load
I think the last one is a big one that the closer a car gets to say 2020ish the more you really have to look at how it was built to know what you're getting. It's great to have a two-stage oil pump to reduce pumping losses when an engine doesn't REALLY need 60psi of oil pressure at all times. But GM 6.2L V8s are grenading all over the place to save less than 1mpg and over 100kmi at say 18mpg vs 17mpg that's 5555 gallons of gas vs 5882 gallons or 350 gallons. Even at $5/gallon that's only $1750 in gas vs $10-$20k for a new engine and I can't imagine it's net-reduced emissions as there's absolutely a bunch of emissions encapsulated in that at least $10k price. This is just one example.
BTW I'm not advocating for any policy or that anyone should be forced to do anything. I'm just personally more excited about keeping older (fuel injected, computer controlled, efficient) cars running well than I am about spending a bunch of money on a new car that's got a lot of engine "innovation" in it where all the kinks haven't been worked out yet.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
I've pondered how "secure" the old OnStar system was. It was apparently just some level of in-band signalling/modem communication on top of AMPS (or CDMA).
I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.
Toyota and its luxury brand, Lexus, use the ForgeRock Identity Platform (specifically OpenAM and OpenIDM) to manage customer identities and backend authentication for their connected car and telematics services.
why is it named X brand? i kept re-reading thinking that it’s tesla? maybe. if the author wanted to avoid naming the brand couldn’t he have used something like “a manufcaturer” instead?
I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
Your system is broken, FF has supported h265 on every OS for a long time now:
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
you would do yourself some good to learn to differentiate constructive criticism from this sort of mean vitriol. I have no doubt that this is the explanation for the downvotes. there is truly no need to be so abrasive. it only serves to detract from whatever good-faith intentions you had, if any.
“Thanks for the nice write-up. Gotta admit the video still irks me. Like, portrait to landscape mid-recording… Since it was only a minute, think re-recording would be well worth it.”
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
>only attempt if you know that you're doing, so as to avoid damaging it
If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Are door locks actually intended to deter professional thieves though? I thought they were intended to add enough friction to deter crimes of opportunity.
I think they are meant to comply with the requirement of some insurer that the house must be able to be locked. That's it. The professional thieves in the US don't even bother picking the lock, they break down the door and are in.
The lock on my front door merited a 15 minute video from the LockPickingLawyer. He could pick it, but it required some time and tools that the average lock picker wouldn't have available. 15 minutes has to be a record for him, but still it's only 15 minutes.
I bought myself an Autel key programmer and boy was it funny to add in my own keys arbitrarily with no authentication to my own car.
No wonder the ratbag kids these days are running around with them - they're only like $400 on Aliexpress and Temu. The world of "all keys lost" shenanigans is a wild one. There's cat-and-mouse games between Autel and automakers and users trying to "block" certain regions and users from leveraging the all-keys-lost features to try to cut down on auto theft, but where there's a will, there's a way, and Autel's just running a shitty Android app on an Android 8 tablet...
I miss my DSMs. I had a couple of 1st gens but always wanted a 2nd gen. When I looked at prices a few years ago I decided I'll never own one unless I have a large exit. I'm only interested in a GSX and prices have gone up way too much.
Daybreak blue (for defensive action) was for a long time a specific model selection, basically Sol 5.6. Later it became a toggle available for any 5.6 model. Last time I checked it wasn’t available for 6+.
Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
Vehicles with factory remote start still require the key to drive the car. None of the "remote start over the internet" vulnerabilities found to date allow anyone to drive the car.
I do wish my new car (Volvo EV) had a physical key for practical reasons (having a place to put it and thus remember to bring it with me is an underrated feature of car ignitions) but I don't think there is anything that fundamentally makes it impossible for CANBus attacks to work against cars with proper keys.
I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
I think it's because it critically was missing context. So you're constantly trying to frame and reconcile it while reading. When first reading I thought there was actually a car brand named X -- and it doesn't seem out of the question.
But it makes the content seem awkward and clunky. So a reader going in with the correct context has a very different experience.
I didn't find this hard to read or understand, though perhaps his writing style just aligns with my own and I do have experience in the methods being used.
What a ludicrous complaint. It's perfectly readable. What possible motivation does one have to broadly proclaim something is "badly" done from an armchair without a modicum of justification? And then follow it up with an AI-whine. It's roiling to me.
> Reconstructing the requests, we found that a lot of these APIs needed no authentication beyond the hardcoded API keys sitting in the JavaScript bundle.
I've heard so many horror stories starting like this.
"there were no servlets (or resources) registered against paths that included the path traversal within them. [..] We were incredibly annoyed by this"
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
The authors do this kind of stunt hacking all the time, they look at shit that has no security contact, no bugbounty, and they hack them without permission for clout
Somebody’s going to get themselves hauled off to jail in a car from another manufacturer to make sure they’re locked on the way. Australia has zero tolerance for this.
All this talk about door locks makes me laugh. A door lock on a car can only ever be as secure a the window inches above it. No matter how high tech your lock, any idiot with a rock can get inside within seconds.
Car ignitions, actually starting a car a driving it away, are a totally different thing.
I received an email from Toyota asking me to connect to a newly-purchased vehicle in their app. I hadn't actually purchased a Toyota, but I went ahead and installed the app to see what it would do, and I ended up having full access to someone's car. I could see the car's location, lock/unlock it, and even start the engine remotely. I did try to contact Toyota about the issue through various channels and never got a response.
If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.
Almost certainly not. For one, this hack only unlocks the car, it doesn't start it or allow it to actually drive. The reason they're stolen frequently is the same reason the Camry and Accord used to be the top stolen vehicles ~20 years ago: they're best-selling vehicles and thus the parts from them are relatively valuable and have a worldwide market.
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
Up until recently most Isuzus were sold as Holdens. They don't sell passenger cars here because they don't make much of them anymore. At least for export.
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
Is there literally no market for a single lineup of "non-bling" cars as far as IT goes? I haven't met a single person, even non-geeks, who like this shit. Ok, some might like a big screen for navigation. But they don't like the system powering it becoming obsolete 3 years later.
I do understand that selling your customers' data is lucrative, but of all the car makers, not a single one thinks there's a market for an alternative?!! I don't understand.
I'm also slightly worried about HN's "solution": buy cars old enough not to be enshittified. Sure, I get the instinct, but there's a limit on how long that'll work. Much better would be to be politically engaged and work for a better future where this shit is illegal.
Not if you take them (there are two security workers behind this) at their word:
In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerock
Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...
That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.
Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees.
Is it so hard to just offer said hackers a boatload of cash to switch sides?
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!”
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
Yeah, the problem isn't a dearth of technical security expertise, the problem is turning that technical expertise into meaningful organizational changes, which requires a rather different skillset (as far as I can tell: people-skills and managing/navigating bureaucracy). And, further, getting anything done is going to be a constant uphill battle in most organizations because, as you point out, paying for security doesn't [directly] contribute to quarterly revenue targets, and even worse, often times puts you in direct opposition with the people who do contribute [directly] to those targets.
More generally, the vast majority of companies consider IT to be a cost center which means cutting costs (and the corners along with them) and going with the cheapest bidder is just Standard Business Practice(TM).
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
Difference is that now you develop the hack once and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong. Picking a lock is work you have to do for every vehicle, plus it looks pretty sketchy.
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
In modern vehicles with remote start, "starting the engine" leaves the immobilizer engaged.
If you have a car with factory remote start, try this yourself -- try remote starting the car, then getting in without the keys and driving away. You can't.
> At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
Your comment just tells me that a modern 7 series BMW or a Cayenne is now prime candidate for a similar hack. Couple of weeks for motivated hackers and now they can steal a luxury car and ship it to Africa / Middle East ? Six digits payout for couple weeks of work + cost of LLM subscription.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
High end luxury car lifts to order are sometimes literally that- a target car is tracked and when parked and left for some short period it gets lifted up into a truck with a Faraday cage and driven away.
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
Now I am not sure if it makes any easier. I was aware of cars getting lifted and put into a shipping container in mere hours. My train of thought was that now you can remote unlock and remote start so that a threat actor can get in at night or even daylight and drive away. If you remove the owner's profile from the car through the API, you delay the response by some time while customer support + police get the necessary info to start tracking the car which is already in an aluminium lined container on a ship headed off to another continent.
For theft to order by crews of good field workers and yard mechanics there's no real need for them to worry about hacking / remote access of high end cars - they can just mechanically lift / tow and isolate and leave the nerd stuff as a problem for down the line.
One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.
In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.
Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.
Brown said everyone needed a better stereo in the 1990s. Factory radios were lousy. But the aftermarket stereos that people bought to replace the factory-issued ones could easily transfer from one car to the next. For example, if thieves steal the factory stereo from a Volkswagen Jetta, they're going to need a buyer with a Volkswagen Jetta, and all a thief can offer is the stereo the owner had to begin with.
The switch of car sound systems from a discrete unit that used a standard DIN form factor and connections to an integrated part of the dashboard from the mid '90s onward (and now into the complex "infotainment" system) kinda killed it as well. You can't just grad a single box out the dash and run. Does mean that car stereos are either un-upgradable, or require 3rd party kits to replace chunks of the facia nowadays though.
Exactly. Someone like the author isn't going to steal my car, so unless I'm targeted by a three letter agency it's not something worth worrying about.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
>>so unless I'm targeted by a three letter agency it's not something worth worrying about.
I'm not so sure about that - I used to have some fancy cars in the past and I've heard many stories from people saying they've been followed to car parks, home, or had only the keys stolen from their home and nothing else - fancy high end cars are almost always stolen "on order" and not by opportunistic thieves. These are the kinds of people who will research what is needed to take your car before they come to your home.
That kind of organized car theft is somewhat localized and not evenly spread tbh. For instance, I live in a pretty major city that actually does have an issue with crime. But car jackings and car theft in general are significantly lower than a lot of other places approximately our size in the country. The prevailing theory is they’re just isn’t an easy way to do anything with them, it often depends in if there is a reliable way to get rid of the cars. Where I am, people usually just joyride them to another state or somewhere and ditch them after committing other crimes with it
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Car thieves destroy undrivable cars and just sell parts and scrap metals.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
Better locks also increase the time to break them. More time == more chances to be disturbed and have to go away and also an incentive to move on to the next house, bike, etc. In the case of bicycles I also advice to lock them close to much better bikes with similar locks: chances are that the thief will invest those 30 seconds to break the lock of the better looking bike.
The best advice I’ve seen is to use a chain or cable tightly tied to the bike, no slack, so that using a large cutter becomes very difficult.
Best bike security advice I every had was to spray paint my bike pink all over.
Security by Polish obscurity. https://en.wiktionary.org/wiki/obskurny
Giving a high quality bike lock to your neighbors is a great gift idea!
This is probably less security theater and more not-getting-sued theater.
Sued for what? It's rather the manufacturer should be sued for selling insecure vehicles. And slapped by authorities too.
Many countries have very broad cybercrime laws - like prohibitions on "gaining unauthorised access to a computer system". And in some countries, even when you're in the right going to court can be a costly and time-consuming endeavour.
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
Humanity has a long tradition of shooting the messenger.
And the message.
But the practice is far too commonly to sue the discloser rather than the manufacturer of the software.
That’s what you get for posting shit like this under your real name for the sake of “portfolio”
I miss the web being less career focused and more crazy
Images and touchscreens have ruined the internet indeed.
Based on my experience in this industry, every brand does this, has done this, and is currently building out a replacement for their current system that does this in a slightly different way.
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
Yes but that anyone can open my car halfway across the world for the lulz is another matter.
I was trying to figure out which make/model, based off of "I bought a new four wheel drive/SUV from them", specifically the "four wheel drive" part.
I'm assuming he means AWD.
This distinction (although I know it) has never made logical sense to me.
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
4WD: Distribution of power to the wheels is static. AWD: Distribution is dynamic.
4WD vehicles are often part-time 4WD, meaning they can be switched between 4WD and RWD or FWD.
AWD vehicles are full-time AWD because part-time AWD is unnecessary given that the drivetrain delivers power where it's most needed.
There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.) But I have yet to ever see a 4WD that could be "switched" to FWD.
The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype. That means the extra wheels cannot be triggered seamlessly. A 4FW has distinct driving modes whereas an AWD uses clutches to bounce between modes as needed.
Bluey has a couple lines about this distinction. In Australia, even small children have opinions on 4WD v AWD.
> There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.)
AIUI, you lose energy because the power/torque has to go through an extra differential, transfer case, etc, before reaching the rear wheels.
Going from the engine through the transmission to the front wheels is already a 'fixed cost', but the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay if you don't need to.
>> the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay
True for a FWD v RWD car decisions, but in an AWD are not the rear differential and driveshaft still turning whenever the rear wheels are turning? Even the clutch packs should still be rotating even if disengaged. The fact that there is no power through them doesn't mean they aren't generating losses.
It depends. With conventional AWD (like all Subarus), you are correct that there is significant energy loss due to the AWD because there is a drivetrain to the rear wheels, even if it is not delivering power. Many hybrids, however, have AWD and they work by having a second, small electric motor that powers the rear wheels only when needed. That means no physical drivetrain to the rear wheels, so no energy loss. That's why a hybrid Toyota RAV4 AWD gets about 15% better gas mileage than the smaller and lighter hybrid Subaru Crosstrek AWD. The disadvantage of the electric motor approach is that it cannot deliver as much power to the rear wheels as a conventional physical AWD drivetrain can. That said, probably only an issue in deep mud or snow.
Well, no physical drivetrain to the front half of the car would make a difference. But even with electric motors in the rear there is a drivetrain between the wheel and the motor. If the idle rear electric motors are is still spinning then the total mass of spinning parts might well approach the mass of a Subaru drivetrain. Driveshafts are very light.
It sounds like the savings are more in construction costs than fuel savings.
4wd - locking transfer case in the middle. Best for off road.
AWD - clutch packs. Best for nasty conditions on road, IMHO.
^ this. 4wd is used on offroads and locks all wheels together, transfering equal power to all wheels. AWD varies power using different technologies, from a simple Haldex that transfers power back when front wheels slip to complex sensor controlled individual wheels. Some are front-biased (generally but not exclusively cheaper ones), some are rear-biased (mainly in sports cars) and some are true AWD, depending on the needs and expected pricing of the vehicle.
Not quite, no. It only locks all the wheels together if you also have axle lockers.
You might have something like a Series Landrover transfer box where in 4WD mode the front and rear axles are locked together and in 2WD mode only the rear axle is driven.
But does that make a Defender, RRC, or Disco with LT230 transfer box which has a lockable diff AWD or 4WD? The centre diff supplies power to both front and rear all the time, but can be locked in slippy conditions otherwise if one wheel spins *none* of the wheels get drive - the axle and centre diff will both spin.
Then what about the later Borg-Warner transfer box in later Range Rovers, where you still have a centre diff and epicyclic gearbox to set high and low range, but there's no diff lock - there's a massive viscous coupling that turns it into a ridiculously stiff LSD.
I doubt that there was ever a “legal” definition of AWD vs 4WD.
But in modern times, technology has most definitely blurred the distinction. Higher-end Jeeps also have a “full-time 4WD” that sounds an awful lot like an AWD system that can also do 4WD stuff.
So, eh, it’s probably not a good idea to argue too much about broad categories anymore. Individual systems must be compared
It's more of an industry wide thing:AWD means all wheel drive even when the vehicle has more than 4 wheels. So in the case of a vehicle with more than 4 wheels, 4 wheel drive would indicate four of the wheels are driven and the remainder are idlers. For instance 6x4 would indicate six wheels with four driven wheels.
https://en.wikipedia.org/wiki/Six-wheel_drive
So nwheels x n driven wheels.
You seem to be talking about something different. The conversation is about vehicles with four wheels and the differences between 4WD and AWD in that context. Perhaps you're saying that there is no difference?
But 6x4 notation is handy when you have six wheels, sure.
With a four wheel vehicle there is no difference between 4WD and AWD, just like with a six wheel vehicle there is no difference between 6WD and AWD.
That’s definitely not accurate, at least by the American definition of the terms 4WD and AWD.
What’s the distinction?
I don't know, but both Gemini and Wikipedia in my primary language seem to agree that AWD refers to 4WD with a center decoupling mechanism to run front and back in an asynchronous manner, with emphasis on Wikipedia only that this is strictly American definition of it and both describe both style of systems in the rest of the world.
I'm guessing that maybe a distinction between offroad capable cars and non-capable cars is useful for liability reasons. Or something else.
I don't think most people here have it right. From my understanding the main difference is that 4WD can be manually turned off (meaning going to 2WD mode). AWD is always on.
Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.
Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.
The RAV4 dynamically engages the back wheels with no mechanical coupling to the front wheels. It uses a separate electric motor in the back. Toyota calls it AWD.
AWD is an automatic 4 wheel drive when required.
Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage as power is always going to all wheels.
4WD is a permanent thing, or at least always on when you engage it. The system locks all the wheels to the same spin speed.
I don't think that's universally true
Indeed. Marketing ruins all definitions.
AWD is for on-road use. Each tire rotates at its own speed.
4WD is for off-road use. All tires rotate at the same speed.
That's incorrect. To have "All tires rotate at the same speed." you need 3 locking mechanism, which very few vehicles do.
At this point, the distinction is gone, because car bards marketing.
(AI lies)
I've thought through the "all tires rotate at the same speed" thing before and how it works mechanically (front differential, rear differential, transfer case) and I think in the "no differentials locked" condition the correct statement is: the sum of the front wheel speeds == the sum of the rear wheel speeds. So you can have your front wheels slip and the rear wheels can still get power, or you can have your rear wheels slip and the front wheels still get power, but if you have one wheel in the front and one wheel in the back that are slipping, you're hosed.
Re: the 3 locking mechanisms comment, in typical 4WD configurations the transfer case in 4H/4L is essentially locked (which is what makes the above sum front == sum rear condition). AWD transfer cases can be more flexible there; some essentially act as a 3rd differential and result in all four wheel speeds being essentially decoupled (for better or worse, easier to get stuck) while others actively control the front/back locking with clutches or hydraulics or whatever.
All tires don't rotate at the same speed even in 2WD, otherwise you wouldn't be able to turn without slipping.
Clutch pack vs transfer case.
Country differences (the writer seems to be Australian), plus some subtle technical differences few people know or care about.
Suffice to say, in British parlance any vehicle with four driven wheels can be called a "4×4"
Yes this, very common here too, nobody says AWD.
My first guess was a RAV4 as well from that description
> Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
What does this mean?
They mean someone who's extremely passionate about this could identify the car brand or exact model in question just by listening to the sound the lock makes from the posted video. You know, like the experts who can identify a wine by smelling it, or a violin just by listening to it.
It's not hard to figure out the brand anyway. I don't know why he hid it in the first place. I'm all for name and shame.
Or a car brand by the door mirror shape.
he*
I wouldn't know, and don't want to investigate. I try to stay generic, grammatically it's fine. I'm sure it can be grating to some but I'm not using this as a trigger word.
it's not grammatically fine - you're talking about 1 person
https://en.wikipedia.org/wiki/Singular_they
I am more concerned with the use of automatic video blurring of the text outputs on the computer.
Toyota also uses flutter for their infotainment
Why its been disclosed and patched....
Sicko here. Here's a Toyota door unlock beep. https://www.youtube.com/watch?v=yVdQd9UjAzA
Yeah they also did a video on YouTube about how they used Flutter in the RAV 4, and the first code snippet he posted... `dartExecutor`. lol
hah. protip... it's not a 2022 rav4. the bonnet gives it away
It seems ridiculous that there would be consumer demand to unlock a car from a phone in the first place. The tech crowd will just complain that it should be easier to do a better job securing web services. But what is the point of all this infrastructure and complexity? So you can be just a little bit more lazy. This sort of tech is both a vulnerability and a waste of human resources and ingenuity.
I have no utility for remote unlocking. Remote locking (and the status in the app) saves my bacon because I often forget to lock the doors and in my neighborhood people will go through your car looking for change. It's not a big deal but I've had them get blood and stuff on the seats :/
Remote start is huge where I live. When it's -10C and there's a foot of snow you have to dig out in the morning, you can start your car from the app and then start shovelling. The alternative is a hokey pokey of shovelling yourself a path to the car, getting in, starting it, getting out, resuming shovelling. Not the end of the world but it's very nice. Even if there's no snow it's nice to get the cabin above freezing while you're eating breakfast without putting your boots on.
You don't need the internet for any of that. Your phone has a bunch of short-range radios it can use to contact the car directly.
I'm in Canada and was going to say this as well. Also, the nice thing about a phone vs. key fob for remote start is that with the phone you're less likely to accidentally remote start the car in your garage compared to a key fob. My parents always disabled remote start on their key fobs because they parked in a garage, but having the remote start option on your phone when parked outside at work, etc. is really convenient.
I have an Acura RDX with remote start on the keyfob and it is very difficult to accidentally do. You have to first lock the car from the fob, get back a response saying it’s indeed locked then hold the remote start button for several seconds before it will start. Any other inputs in between those two actions cancels out the remote start sequence. It also shuts off after a few minutes if you don’t get in and actually “start” the car just in case you did manage to accidentally trigger it.
shit remote start doesn't even have to require snow.
i'm in legit cold canada and being able to open my garage remotely and start my car means it's a lot easier to herd small kids into a warm, comfy carseat.
i mean; i like the remote start angle, but that can be done with a key-press on a key. no damn app needed.
as for "I often forget to lock the doors"... why do you often forget to lock the doors?
BMW - the car unlocks the doors when I approach and auto locks the doors when I move away from the car, so generally I never interact with 'locking' at all. Except when this doesn't work, for instance, if the boot is open because I'm getting shopping out, then I close the boot and walk away, quite often it will not lock at that point, perhaps because I moved away from the door but it didn't lock because the boot was open. The app is useful so that I can firstly check the car is locked, and secondly lock it. I personally have no need to unlock remotely - maybe my wife might say 'hey I need to get something from your car' and I'm not around? But I've never needed that yet. My wife's Hyundai has told me via the app 'hey you've left the car unlocked' and I've been able to lock it remotely. So definitely in favour of that feature.
> as for "I often forget to lock the doors"... why do you often forget to lock the doors?
Having just switched from an "old-school" car to one of these "keyless" types, I think the problem is actually self-reinforcing -- the keyless entry and start stuff means you interact with the key less and less so you're more likely to forget to interact with it to lock the car. I can't think of a time I forgot to lock my old school car and yet it's happened more than once with the newer car since I got it a few months ago.
My not-even-all-that-new car just locks automatically shortly after you close the door, so there's nothing to "forget".
I have an even harder time now since one of my cars automatically locks when I walk away while the other doesn't. I've been so spoiled by that functionality.
Luckily the other car will at least notify me if I leave it unlocked and can lock it through my phone. Would be nice if it just also auto-locked.
You don't have ADHD I guess?
> that can be done with a key-press on a key
Only if you're like right next to the car. I prefer to remote start my car when I'm more than a few minute walk away from it so it actually has a chance to warm up or cool down. Starting it ten seconds before I get to the car is practically worthless.
> It seems ridiculous that there would be consumer demand to unlock a car from a phone in the first place.
I really like using my phone as my key for my car. It's nice having less stuff in my pockets.
Would I pay a monthly fee for this - no. Is it nice to make sure your car is locked if you forgot and to remote start your car in really hot / cold weather, yes.
Do you own a car? What’s more likely, misplacing your car keys, or misplacing your phone?
I’m not saying physical keys are not needed, but a nice digital solution is one of the things I really wish I had a Tesla. I wish the other car manufacturers would actually invest in good mobile experiences, they’re all such ass.
> What’s more likely, misplacing your car keys, or misplacing your phone?
good question. I don't know? There are three things I carry with me literally everywhere: phone, keys, and wallet. Any one of them missing in the morning means I have to hunt around the house to find them before I can leave for work. This would not change if I could unlock my car with my phone (I still need to be able to lock my front door and/or let myself in when I come home again, requiring keys)
There are also keyless solutions to your front door. The second time I had to call a locksmith in Shanghai I got pitched on a combination lock for my apartment door.
That's not to say they make sense. The total amount I spent on having the locksmith let me back in to my apartment that year was significantly less than the cost of putting in a combination lock.
In the western world, where labor is expensive and goods are cheap, you could put in 3 smart locks for the price of one call from a locksmith. I know, I’ve done both.
It’s interesting to see where redundancy reduces reliability.
Unlike say etcd where three improves reliability to the best of the three, three locks would decrease reliability to the worst among them.
Physically unlocking with NFC could be done without all the security holes.
Modern cars already make it much more difficult to lock your keys in the car than in ye olden days.
And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff. It's not like that "did I lock it" check helps prevent a "someone smashed the window and grabbed something out of it" scenario anyway.
NFC is vulnerable to relay attacks, so newer systems are including UWB (like AirTags) where the car can confirm the distance to the key fob
And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff.
It's completely unnecessary.
Modern cars automatically lock themselves when they sense there are no keys nearby, nobody in the seats, and the doors are closed for x minutes.
This is not true at all.
It is true. It is precisely how my car works. You'll have to do better than a one-line dismissal.
Your car is not all cars. Therefor, a one line dismissal is rather sufficient to counter your point.
Neither of my modern cars have that behavior.
It can be useful if you lost the keys for $REASON while hiking or doing any activity and you can phone somebody else who has access to the API and ask them to unlock and remote start the car. It doesn't happen that often, but it happens, and in the big scheme of things it's more likely to happen [1] that somebody stealing it via a vulnerability in the car maker web services.
Or at least as a car owner, this is my risk assessment exercise output.
[1] Yeah, I just pulled this off my ass, don't think there are trustworthy stats either in one direction or the other.
At least in the old days I could put my car keys into the wash and they'd still work fine. I could go to the local hardware store and get convenient duplicates for almost no money. Losing your car keys in the old days was a very easy situation to remedy.
Meanwhile, if I'm out in public and a bad update bricks my phone (or cell coverage is down?) I can no longer use my car. The idea that consumers would hope for more entrenchment into the phone ecosystem is absolutely baffling.
I think my car key would be the thing in my pockets that I'm the least likely to misplace. It's only ever in like one of three places.
This appears to be the simplest and safest solution.
"Just don't lose them" isn't really a solution. Humans make mistakes and occasionally leave them in pockets, drop inside couch cushions, etc. Especially if kids are involved.
> What’s more likely, misplacing your car keys, or misplacing your phone?
Misplacing the phone actually. Car keys are either in someone's pocket/bag (then you talk to whoever used the car last) or in a set place in my home. The phone might be wherever I used it last.
Google's Find Device and Apple's similar service mean that you can always determine where your cellphone is. If someone sets a bag on top of my keys, or something similar, the only way to find them is to physically search until I luck out and find them.
So, while I misplace my phone more often, I also find it with less difficulty.
> Google's Find Device and Apple's similar service mean that you can always determine where your cellphone is.
Hmm? As in which room? What if it accidentally slid under the bed sheets, or someone put a piece of clothing over it, and it's on silent? True stories.
>Google's Find Device and Apple's similar service mean that you can always determine where your cellphone is.
And so can the police, and so can DHS, and so can ICE, and so can Google ad services, and so can the last 50 highest bidders, and so can ...
> Do you own a car? What’s more likely, misplacing your car keys, or misplacing your phone?
I do own a car. Keys in home are always in exact same spot. Phone can we literally anywhere, good I have smartwatch and I can trigger "locate my phone" that way.
I just don't get the idea of unlocking car though app via internet. Neither I get the "keyless entry" (meaning I do not even need to touch the key fob to unlock car) and "start button" (well if you place key in ignition switch then you will not lose it!)
The security drawback is not worth, fixing non-existing problem in the first place.
BYD has NFC unlock, can be paired to your phone or you R smart watch. Very good quality cars, much higher spec, better price etc than a tesla
long term reliability outside of warranty is the question for many of us, and tesla simply has data for much longer
My wife and I were in her Hyundai Ioniq 6 a couple of months ago, and we both got out of the car. One of our dogs was in the back seat and jumped into the front.
Unfortunately Hyundai decided, in their wisdom, to put the door lock button (to lock all doors) in the console between the front seats. Exactly where Sally stepped when she came from the back.
Both my wife's keys and phone were still in the car.
30 minutes later, a local mechanic showed up. He gently pried the front door open with something like a whoopie cushion, and was able to poke the door lock button and open everything. It took him about 5 minutes.
Hyundai Canada can, of course, open the doors remotely, but when I called them they refused to and only offered to call CAA (the Canadian version of AAA, and the people Hyundia sub-contracts their roadside assistance to). I guess that makes sense considering the liability of remotely unlocking for someone whose identity they can't verify.
Wife has an Ioniq 9, and she shared her digital key with me via Google Wallet. Look into that as an option for next time, I'd assume Apple has a similar implementation.
That said, the digital key is much more finicky/failure prone than my Tesla's implementation, and has a backup keycard I keep in my wallet (but have never had to use). Generally, rebooting the phone fixes it for some amount of time, until it stops working again with no indication until I try to unlock her car.
Wow that's an interesting edge case.
"What’s more likely, misplacing your car keys, or misplacing your phone?"
…And what about the many other things one misplaces about the house? For instance, Wireless mice, TV and various other remote controls, etc.
I just cannot understand why the tech crowd hasn't developed a much-needed Missing Objects protocol.
Think of this. When you lose an object you immediately go to a big button that's hidden and securely bolted down (so you can never lose it) then press it. Like your fob key and car, it activates all these easily-lost items and they start beeping madly so you can find them. Lose the mouse in the couch somewhere and the 'couch' starts beeping. Voilà, one found mouse.
It's crazy that a simple concept like this doesn't exist in practice.
My Onn Google TV box (that cost like $39.99) has a beeping find my remote feature which links to Google Home so I can just say "hey Google find my keys".
Owned a car for 30 years. Have misplaced keys but always had a spare. What's more likely to be stolen, your car keys or your phone? Your question and my question are both facile.
I’m unlikely to lose either. The keys have an AirTag. The phone show up on find my.
unlock with nfc then ? He is pointing out the rediculousness of the design choice of using the web to unlock the car which is at arms reach
Running out of battery on my phone.
not a problem, just plug in to the usb port in your kia's headlight.
What’s more likely, misplacing your car keys, or misplacing your phone?
Are there cars that let you drive them without the key?
My car allows me to unlock it with a phone from the other side of the planet. But to actually drive, it requires the key to be inside.
Yes, lots of cars (particularly relatively new ones) allow Phone-As-Key, either via UWB (so the phone can stay in your pocket) or NFC (so the phone has to be placed on an NFC reader).
I’ve used it more often than I’d expect. Mostly just in situations where I take my key out of my pocket then forget it when I run back to the car. Beach, gym, skiing, etc. Or, if my wife drove us and I’m the one running out to grab something.
Clearly, not a critical use case but it is handy.
Remote locking and remote start are much more useful.
Many car brands do this.
Mazda charges $10-15/month for their remote unlock/start app.
https://mymazda.com/MyMazda/mazdaConnectedServices.action
There are use cases: you want to give a family member some item. They're at work and in a meeting. Get them to remote unlock their car and place the item in it. But really I think it's an extension of remote start which is very necessary in cold climates.
That's a pretty big stretch to me, especially since key fobs can usually unlock a door from across the parking lot without even leaving the building.
I live in a cold climate. Remote start isn't even necessary much less very necessary. I start the car, then clean off all the snow and leave. Running the engine isn't going to remove a foot of snow off the windshield and it definitely won't off the roof or hood.
Regardless remote starters do not need the web or a phone, they existed in the 1990s.
> remote start which is very necessary in cold climates
Not just necessary, but very necessary? I understand it's convenient, but I think you've overstated it a bit. You can always start your car and then go back in the house for a few.
This is less secure and even illegal in some places.
Factory remote start is designed to be operated while unattended, and prevents people from stealing the car, prevents it from running too long, etc.
We used (until Subaru said 'fuck you, pay us') the mobile access so that I could unlock my family member's vehicle when I rode along with them or remote start it ahead of them while we're out and about. It's nice to be able to get back into the car and sit and wait without having to grab the key out of their purse.
They hook a lot of people now with the first couple years free, then spin around and go for a $150+ a year whammy. We gave up.
I still dont understand whats wrong with putting a key in a door to unlock it.
I had a 2007 Chevy HHR. It had remote start/unlock. When I lived in Denver, I used the remote start during winter to warm the car up before getting in.
Also, there was something sticky with the door lock. If I used the key instead of the fob, sometimes the anti-theft system would not disarm and the only way I found to disarm it was to use the fob to turn that alarm off. Grrrr. Fobs lasted about 3 years and cost $100 to replace/reprogram.
My current car (a Miata) has a key only to unlock the door in the event of a dead battery. It has a pushbutton instead of the traditional ignition key, so the key is pretty useless outside of a dead battery.
The problem is no one can control this remotely. Some people would prefer your access to the vehicle be conditional.
Most cars still have a physical lock hidden under the handle for emergencies, like opening the car when the battery is dead.
All remote unlock is doing is adding an unnecessary insecure remote layer on top of that for convenience.
I think weex means loan vendors and carmakers would like your access to your car to be controlled by them not the driver -- so they can lock you out if you don't pay them every month.
Which is what I was replying to. They cant lock you out because your car has a physical lock, its just that they hide it these day.
It seems ridiculous to think that because we cannot create a technical facility to securely open the car, the consumers are called ridiculous. It is hackernews but this looks to me like enterprise compliance news.
Enterprise compliance confuses people. The problems are all simple in principle, but there are so many of them and they cost so much that nearly no enterprise seems to be able to manage the basics. It'd say the more HN comment here is one who misunderstands that complex problems cannot be solved by technical solutions alone.
At that point: why do you even need to leave the house? You can use VR goggles for everything.
The desire to connect every single thing to the Internet is a complete waste of resources in exchange for profound security issues and mild reliability risks. Use a key. It's the right tool for the job.
I'm not convinced it is even lazy to use a phone to unlock a car.
Not sure the reliability risks are that mild in this case. Phones can run out of battery. I would not want to be locked out of my car in the winter because I ran out of batteries and looking at my car which both can charge it and save me from the elements.
its just more convenient, say im outside my home, theres something i need in the car, i can either go back inside to get the keys, or just open the car from the app (not to mention turning on heater / AC remotely)
you can argue that the security tradeoff is not worth it, but claiming the demand is not there is just silly
I mean that is not what they argued, what they argued was
> So you can be just a little bit more lazy
Which:
> i can either go back inside to get the keys, or just open the car from the app
I think qualifies, personally. Your house might be way bigger than mine though
You can uncharitably call basically any consumer device that improves daily life in the last century as letting people "be a little more lazy".
Should we get rid of washing machines, dryers, Cuisinarts, in-sink disposals, etc too? They've even killed and injured people all so people could do slightly less work.
Humans love convenience, our entire modern life is oriented around technology created to serve those motivations. An extra way to unlock something with a single point of failure is unsurprisingly going to appeal to that same instinct.
Repeat after me: exponential growth must be maintained at all cost
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Evil.
Is there an online database for instructions on how to disconnect your car from the cloud?
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Somebody make this happen.
Usually the most practical thing to do is to remove the antenna. The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
> The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
I read comments that this may still not be ideal, as when you take it a dealer service (especially during the warranty period), all the collected data is cached locally and may eventually get uploaded to the proverbial mothership at that time. If you can/could tell it to stop collecting generally, then there's nothing to upload, antenna or not.
Not sure how valid this thinking is, but it is worth considering as a 'threat model'.
The seems to be recent proof that smart TVs actually do this caching. If a shitty TV from walmart does it you can safely bet it is implemented in your 50K car.
Unless that also causes it to never enter sleep mode and keep searching for a signal and drain your battery
In a few years, new cars probably won’t pass inspection or be allowed insurance if their internet access is disabled and not fixed by an authorized technician in a timely manner.
Most US states don't have a safety inspection. [1]
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
[1] https://en.wikipedia.org/wiki/Vehicle_inspection_in_the_Unit...
[2] https://legiscan.com/LA/text/HB1085/2026
And in the UK you have to report every modification(including this one) to your insurer, or your insurance is null and void. The MOT(annual test) couldn't care any less about any of this or any modifications - as long as your car can pass a set of(very basic) tests, it's legal to use on the road.
They already are worse.
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
Samsug definitely was (is) trying to slowly replace google. A lot of there stuff runs Tizen but yeah they now more about security than a car maker at least.
> will soon
You realise that in the EU cars have a SIM in, and an emergency button? This is since 2018, see: 112 eCall regulation.
I do realise. That by itself is worrysome. But now car manufacturers tie legallly required functions like the enmergency buttons with bloated platforms of "convenience" functions that users can not disable completely.
Correct me if I'm wrong, but I think I've read somewhere that it can be a SIM-less phone that abuses emergency call flow in 3GPP. GSM specs have special accomodations for 911/112 type calls that don't require a SIM(that sometimes ironically lead to normal calls working fine and just emergency calls failing).
Yes, you don't (in most countries) need a SIM for 112/911, and even when you do have one, you are allowed to use other carriers for such calls, even when you ordinarily shouldn't be able to roam onto them.
The specs do have that, but I used to work at a major mobile telco which didn't implement that part of the spec. The argument was that people would use emergency calls to test phones without a SIM. That may well have changed, but you can't assume that the spec will always be implemented in the network.
Interesting, in the US this is a regulatory requirement and the decision is not up to the telco.
I'm always confounded by how bad most car security seems to be. I've given this about 5 seconds of thinking, and wouldn't it be pretty simple to do a local app-car setup step that generated a private key stored in the app and stored the public key in the car, requiring all commands to be signed with the private key in order to be accepted? There's no reason why the car manufacturers server should even be allowed to send commands to the car just based on a user account anyway.
The follow up/linked article at the bottom is worth a read too as it's the 'world-wide' part of it. Definitely a great read from both Sam and Shubs
https://samcurry.net/forgerock?ref=shubs.io
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
Hah not only same message from me but exact same year too, end of the GMT800 and the TJ. Probably other stuff I’m forgetting.
Why 2006 specifically?
That's more my personal estimation than a Number Backed By Science (tm) but here are my reasons:
1. Enough computer control for reasonable efficiency
2. Largely independent computers
3. No centralized infotainment that controls the entire car (you can swap the radio)
4. Still lots of knobs and dials, no touchscreens
5. Enough computers to get pretty good diagnostics if/when something goes wrong
6. Most of them have lock clickers, maybe trunk, almost nothing else
7. Engines are older, built "heavily" and don't suffer from too much boost / high bearing load
I think the last one is a big one that the closer a car gets to say 2020ish the more you really have to look at how it was built to know what you're getting. It's great to have a two-stage oil pump to reduce pumping losses when an engine doesn't REALLY need 60psi of oil pressure at all times. But GM 6.2L V8s are grenading all over the place to save less than 1mpg and over 100kmi at say 18mpg vs 17mpg that's 5555 gallons of gas vs 5882 gallons or 350 gallons. Even at $5/gallon that's only $1750 in gas vs $10-$20k for a new engine and I can't imagine it's net-reduced emissions as there's absolutely a bunch of emissions encapsulated in that at least $10k price. This is just one example.
BTW I'm not advocating for any policy or that anyone should be forced to do anything. I'm just personally more excited about keeping older (fuel injected, computer controlled, efficient) cars running well than I am about spending a bunch of money on a new car that's got a lot of engine "innovation" in it where all the kinks haven't been worked out yet.
2009 still had 3G modems. 3G isn't online anymore.
I think they mean any car that can't be trivially defeated by shimming the door lock and plugging into the obd2 to program a new key.
I think automaker failed security the moment its cars connected to the internet
GM was doing this 25 years ago.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
They had other issues. SQLI, XSS and XSRF were rampant in those days.
I've pondered how "secure" the old OnStar system was. It was apparently just some level of in-band signalling/modem communication on top of AMPS (or CDMA).
I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.
Toyota and its luxury brand, Lexus, use the ForgeRock Identity Platform (specifically OpenAM and OpenIDM) to manage customer identities and backend authentication for their connected car and telematics services.
The fact that cars can be controlled over the net at all is itself absurd. Especially in today’s cybersecurity scenario..
why is it named X brand? i kept re-reading thinking that it’s tesla? maybe. if the author wanted to avoid naming the brand couldn’t he have used something like “a manufcaturer” instead?
Warning: The video in the article contains VERY loud bleeps.
Hi - I've fixed this and uploaded a replacement video with less loud beeps. Sorry about that.
I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
H265 plays fine in firefox for me! No special extensions, just linux
Your system is broken, FF has supported h265 on every OS for a long time now:
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
>Android from Firefox 137 using hardware only.
https://developer.mozilla.org/en-US/docs/Web/Media/Guides/Fo...
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
> Using a 20 year old codec for 2.5% would be insane.
Surprisingly, in my experience h264 produces higher quality (better VMAF) for the same bitrate.
My theory is all the codec-optimisation attention went to h264 because of the crazy licensing situation of h265
The crazy licensing situation is only relevant to nerds, pretty much any chip you care about has hardware h265 decode.
You probably used the wrong settings. Netflix said "AV1 streaming sessions achieve VMAF scores that are 4.3 points higher than AVC and 0.9 points higher than HEVC sessions" 9 months ago: https://netflixtechblog.com/av1-now-powering-30-of-netflix-s...
> If anything, he should be using a newer codec like AV1 that's also widely supported.
I don't think that's accurate, since the first Apple processors with AV1 support only came out in late 2023 (A17 Pro, M3).
huh. plays fine for me in firefox stable on linux, and with no extensions in firefox. Do you mean OS extensions?
Plays fine for me in Firefox on Windows.
God.. Nice write-up, horrible video.. "oh let's go from portrait to landscape in the middle of the recording!".
It's a one minute video, would it have been so hard to redo it.
Edit: raining downvotes, well fuck me, I guess you all prefer sloppy shit.
you would do yourself some good to learn to differentiate constructive criticism from this sort of mean vitriol. I have no doubt that this is the explanation for the downvotes. there is truly no need to be so abrasive. it only serves to detract from whatever good-faith intentions you had, if any.
Your description of the video describes the quality of your post very well, which is why you are being downvoted.
I love a good old fashioned hacker story in the morning :)
Any guesses to what brand the two cars are in the garage? They look like Nissan.
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
>only attempt if you know that you're doing, so as to avoid damaging it
If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).
> Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door
or sometimes, even just shim it open.
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Looks like we are doomed then.
Are door locks actually intended to deter professional thieves though? I thought they were intended to add enough friction to deter crimes of opportunity.
I think they are meant to comply with the requirement of some insurer that the house must be able to be locked. That's it. The professional thieves in the US don't even bother picking the lock, they break down the door and are in.
Thieves usually just smash the window, because its quicker
The lock on my front door merited a 15 minute video from the LockPickingLawyer. He could pick it, but it required some time and tools that the average lock picker wouldn't have available. 15 minutes has to be a record for him, but still it's only 15 minutes.
> nicest (and second most expensive) place I have lived at had the worst locks
Did it have an alarm system?
I bought myself an Autel key programmer and boy was it funny to add in my own keys arbitrarily with no authentication to my own car.
No wonder the ratbag kids these days are running around with them - they're only like $400 on Aliexpress and Temu. The world of "all keys lost" shenanigans is a wild one. There's cat-and-mouse games between Autel and automakers and users trying to "block" certain regions and users from leveraging the all-keys-lost features to try to cut down on auto theft, but where there's a will, there's a way, and Autel's just running a shitty Android app on an Android 8 tablet...
This is a Rav4
I drive a 1999 Mitsubishi Eclipse GS-T Turbo ... sweet car.
I miss my DSMs. I had a couple of 1st gens but always wanted a 2nd gen. When I looked at prices a few years ago I decided I'll never own one unless I have a large exit. I'm only interested in a GSX and prices have gone up way too much.
Nice car, but personally the 3000GT is the one for me :)
I do miss my Starion, but not the fines.
Those things are cool, wife had one when I met her (non turbo). It's a shame they stopped making them.
Why GPT-5.6? Was this done before the release of GPT-6, or is there some difference in restrictions between the two?
Daybreak blue (for defensive action) was for a long time a specific model selection, basically Sol 5.6. Later it became a toggle available for any 5.6 model. Last time I checked it wasn’t available for 6+.
Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
I'm glad I bought a Corolla LE that does NOT have remote start. I still have to insert the key to start the engine. So much more secure.
Vehicles with factory remote start still require the key to drive the car. None of the "remote start over the internet" vulnerabilities found to date allow anyone to drive the car.
I do wish my new car (Volvo EV) had a physical key for practical reasons (having a place to put it and thus remember to bring it with me is an underrated feature of car ignitions) but I don't think there is anything that fundamentally makes it impossible for CANBus attacks to work against cars with proper keys.
I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?
The key has a RFID chip in it that is read by the ignition switch.
It's times like these that make me happy to own 30+ year old shit boxes that don't have any means to connect to the internet.
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
> Why is he protecting the car company
He is not protecting the a car company. He is protecting himself.
Both can be true.
The whole post is so badly written and explained. At least it wasn't AI generated I guess
I think it's because it critically was missing context. So you're constantly trying to frame and reconcile it while reading. When first reading I thought there was actually a car brand named X -- and it doesn't seem out of the question.
But it makes the content seem awkward and clunky. So a reader going in with the correct context has a very different experience.
I didn't find this hard to read or understand, though perhaps his writing style just aligns with my own and I do have experience in the methods being used.
What a ludicrous complaint. It's perfectly readable. What possible motivation does one have to broadly proclaim something is "badly" done from an armchair without a modicum of justification? And then follow it up with an AI-whine. It's roiling to me.
I found it difficult because I didn't realize that X brand is a placeholder. I don't know all the car brands.
No more than your comment, right? Look there's another comment about the title: https://news.ycombinator.com/item?id=50419520
Manufacturer is not disclosed, but the car in video is RAV4. Lol
> Reconstructing the requests, we found that a lot of these APIs needed no authentication beyond the hardcoded API keys sitting in the JavaScript bundle.
I've heard so many horror stories starting like this.
"there were no servlets (or resources) registered against paths that included the path traversal within them. [..] We were incredibly annoyed by this"
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
The byline says “security researcher”, but I didn’t find any mention of disclosure to the platform security team in the blog post. What gives?
The companion blog post from Sam Curry says the issues were reported and fixed within hours.
The authors do this kind of stunt hacking all the time, they look at shit that has no security contact, no bugbounty, and they hack them without permission for clout
Admin password/credentials compiled into a JavaScript SPA bundle, freely accesible to the internet. Twice. Classic rookie mistake.
Somebody’s going to get themselves hauled off to jail in a car from another manufacturer to make sure they’re locked on the way. Australia has zero tolerance for this.
I knew it was going to be Toyota as soon as I saw the title, their software from top to bottom is a total clown show.
Recently rented a Mitsubishi. Not so sure about that.
All this talk about door locks makes me laugh. A door lock on a car can only ever be as secure a the window inches above it. No matter how high tech your lock, any idiot with a rock can get inside within seconds.
Car ignitions, actually starting a car a driving it away, are a totally different thing.
Can anybody guess what automaker?
LLM seems to think it’s Toyota/Lexus based on an open source alternative client[1] documenting the same APIs that appear in the blog post.
A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.
[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...
I received an email from Toyota asking me to connect to a newly-purchased vehicle in their app. I hadn't actually purchased a Toyota, but I went ahead and installed the app to see what it would do, and I ended up having full access to someone's car. I could see the car's location, lock/unlock it, and even start the engine remotely. I did try to contact Toyota about the issue through various channels and never got a response.
If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.
Yes the car in the video looks like an RX350
RAV4 is always in the top 10 of most stolen cars [1]. Maybe this is why.
[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...
Almost certainly not. For one, this hack only unlocks the car, it doesn't start it or allow it to actually drive. The reason they're stolen frequently is the same reason the Camry and Accord used to be the top stolen vehicles ~20 years ago: they're best-selling vehicles and thus the parts from them are relatively valuable and have a worldwide market.
Looks like the XA50 AFAICT
Definitely XA50. My sister bought one last week, time to find the sim card....
Isuzu is my guess? They might be tied to https://whg-telematics.com.au (my guess at the redacted URL if it is even partially real in the post).
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
Up until recently most Isuzus were sold as Holdens. They don't sell passenger cars here because they don't make much of them anymore. At least for export.
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
Why should we?
Because its fun?
From reputation alone, I would not be surprised if it were Kia/Hyundai.
https://en.wikipedia.org/wiki/Kia_Challenge
Is there literally no market for a single lineup of "non-bling" cars as far as IT goes? I haven't met a single person, even non-geeks, who like this shit. Ok, some might like a big screen for navigation. But they don't like the system powering it becoming obsolete 3 years later.
I do understand that selling your customers' data is lucrative, but of all the car makers, not a single one thinks there's a market for an alternative?!! I don't understand.
I'm also slightly worried about HN's "solution": buy cars old enough not to be enshittified. Sure, I get the instinct, but there's a limit on how long that'll work. Much better would be to be politically engaged and work for a better future where this shit is illegal.
And this, kids, is why we're not getting a "connected" car.
Hyundai
Not if you take them (there are two security workers behind this) at their word:
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerockCombined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...
That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
On the non-Australian side (the Sam Curry blog)
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).Defamation/legal risk, even if such legal actions will be spurious
The color scheme on the admin panel suggests Toyota.
Imagine what K.A.R.R could do with that.
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
I’m questioning the need for connected cars in the first place. Perhaps we could revisit that trend.
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.
Maybe a Slate truck is of interest
Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
considering cybercab and waymo . That trend is going nowhere
Makes perfect sense for fully-automated vehicles that aren’t privately owned. Everything else, I think there’s an argument to be made.
Not that I expect the argument to go anywhere.
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees.
Is it so hard to just offer said hackers a boatload of cash to switch sides?
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!”
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
Yeah, the problem isn't a dearth of technical security expertise, the problem is turning that technical expertise into meaningful organizational changes, which requires a rather different skillset (as far as I can tell: people-skills and managing/navigating bureaucracy). And, further, getting anything done is going to be a constant uphill battle in most organizations because, as you point out, paying for security doesn't [directly] contribute to quarterly revenue targets, and even worse, often times puts you in direct opposition with the people who do contribute [directly] to those targets.
More generally, the vast majority of companies consider IT to be a cost center which means cutting costs (and the corners along with them) and going with the cheapest bidder is just Standard Business Practice(TM).
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
Difference is that now you develop the hack once and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong. Picking a lock is work you have to do for every vehicle, plus it looks pretty sketchy.
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
>>and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong
I don't see any indication here that's the case - opening the doors is very different than being able to start the engine and drive off.
From the last paragraph:
At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
In modern vehicles with remote start, "starting the engine" leaves the immobilizer engaged.
If you have a car with factory remote start, try this yourself -- try remote starting the car, then getting in without the keys and driving away. You can't.
well you clearly didn't read the article...
> At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
Your comment just tells me that a modern 7 series BMW or a Cayenne is now prime candidate for a similar hack. Couple of weeks for motivated hackers and now they can steal a luxury car and ship it to Africa / Middle East ? Six digits payout for couple weeks of work + cost of LLM subscription.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
0 - https://samcurry.net/hacking-subaru
High end luxury car lifts to order are sometimes literally that- a target car is tracked and when parked and left for some short period it gets lifted up into a truck with a Faraday cage and driven away.
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
Now I am not sure if it makes any easier. I was aware of cars getting lifted and put into a shipping container in mere hours. My train of thought was that now you can remote unlock and remote start so that a threat actor can get in at night or even daylight and drive away. If you remove the owner's profile from the car through the API, you delay the response by some time while customer support + police get the necessary info to start tracking the car which is already in an aluminium lined container on a ship headed off to another continent.
For theft to order by crews of good field workers and yard mechanics there's no real need for them to worry about hacking / remote access of high end cars - they can just mechanically lift / tow and isolate and leave the nerd stuff as a problem for down the line.
One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.
In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.
Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.
Factory stereos got good (and complicated). Aftermarkets got cheap.
The switch of car sound systems from a discrete unit that used a standard DIN form factor and connections to an integrated part of the dashboard from the mid '90s onward (and now into the complex "infotainment" system) kinda killed it as well. You can't just grad a single box out the dash and run. Does mean that car stereos are either un-upgradable, or require 3rd party kits to replace chunks of the facia nowadays though.
Exactly. Someone like the author isn't going to steal my car, so unless I'm targeted by a three letter agency it's not something worth worrying about.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
>>so unless I'm targeted by a three letter agency it's not something worth worrying about.
I'm not so sure about that - I used to have some fancy cars in the past and I've heard many stories from people saying they've been followed to car parks, home, or had only the keys stolen from their home and nothing else - fancy high end cars are almost always stolen "on order" and not by opportunistic thieves. These are the kinds of people who will research what is needed to take your car before they come to your home.
That kind of organized car theft is somewhat localized and not evenly spread tbh. For instance, I live in a pretty major city that actually does have an issue with crime. But car jackings and car theft in general are significantly lower than a lot of other places approximately our size in the country. The prevailing theory is they’re just isn’t an easy way to do anything with them, it often depends in if there is a reliable way to get rid of the cars. Where I am, people usually just joyride them to another state or somewhere and ditch them after committing other crimes with it
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Car thieves destroy undrivable cars and just sell parts and scrap metals.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
> Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car?
"tesla relay attack"
I mean, it's probably possible, but it's well above the "just have to outrun the bear" bar: Towing it and/or just buying a car for yourself.
Tesla? They aren't exactly known for their security. [0]
[0] https://www.wired.com/story/tesla-ultra-wideband-radio-relay...
> If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Read that part.
PIN mode only protects against driving, not entering.
Which then allows you to move the vehicle (not start it), as you have physical access. As in the article I linked to.
You don't need access to move a vehicle, you can lift it up and move it. Like when you park in a place you shouldn't.
> Also take a look at how easily a professional could gain access to your home if they wanted to.
Or an amateur with a mallet, a key blank, a file, and an o-ring.
https://en.wikipedia.org/wiki/Lock_bumping
Ear raping beep in the video, why the fuck would anyone ever do this? Just mute the fucking part instead of whatever the fuck this is...