Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, - Page 1
Forum section: electronics / general

author: Karel
author_rank: Super Contributor
timestamp: January 09, 2023, 06:23:34 pm
content: Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and Morehttps://samcurry.net/web-hackers-vs-the-auto-industry/

author: DimitriP
author_rank: Super Contributor
timestamp: January 09, 2023, 06:38:30 pm
content: Which will be te first country to add software security testing to their vehicle roadworthiness tests?

author: Faranight
author_rank: Unknown
timestamp: January 09, 2023, 06:41:58 pm
content: I'm surprised nobody has yet managed to remotely murder someone on the road due to these vehicle vulnerabilities.

author: Benta
author_rank: Super Contributor
timestamp: January 09, 2023, 09:06:48 pm
content: If you read carefully, it's all about gaining access to the company network, not the car itself.The "hacks" for open/close/start etc. apply to idiot car buyers who think it's cool to start the car using the smartphone. Again, the company network.Yawn.

author: MrMobodies
author_rank: Super Contributor
timestamp: January 09, 2023, 09:18:38 pm
content: https://volkswagenforum.com/forum/general-tech-7/case-cost-disabling-car-net-37546/Quotehttps://old.reddit.com/r/whatcarshouldIbuy/comments/ihzyfg/vw_carnet_sells_your_driving_information_to/Quote*Another incentive not to use the in car subscription stuff.Any car I would want it left alone, no remote access and that radio/cellular stuff switched off and I think I'd buy my own gps tracker.

author: TimFox
author_rank: Super Contributor
timestamp: January 09, 2023, 09:29:15 pm
content: There have been many car thefts reported recently in Chicago of Kia vehicles due to an USB vulnerability.https://www.carscoops.com/2022/10/this-is-how-easy-it-is-to-steal-a-hyundai-or-kia-with-a-usb-cable/There are pending class-action suits against the manufacturer.https://topclassactions.com/lawsuit-settlements/consumer-products/auto-news/kia-class-action-claims-vehicles-can-be-stolen-with-usb-cable-as-shown-on-tiktok/

author: Benta
author_rank: Super Contributor
timestamp: January 09, 2023, 11:25:47 pm
content: Quote from: TimFox on January 09, 2023, 09:29:15 pmThat seems a bit over the top. They have to break into the car first, which has always been an issue.You could steal 90s Fords with a screwdriver in the ignition lock.And those thieves are really low-achievers. I mean, who'd want to steal a KIA?

author: tom66
author_rank: Super Contributor
timestamp: January 09, 2023, 11:45:25 pm
content: Quote from: MrMobodies on January 09, 2023, 09:18:38 pmThis is odd, because I have a Golf with Car-Net and (a) the telematics module is easily reached (it's just behind the instrument cluster, about 30 minutes to remove) and (b) it's on its own fuse, so even if you didn't want to disable it by physically removing it, pulling that fuse should be enough. A software change shouldn't be needed, and I'm not surprised the dealer had no idea how to do it.VW's service infrastructure is shite, though -- no doubt about that. After a battery fault occurred on my car, they had it away from me for 7 weeks while they figured out how to fix it. In the end, a tech from Germany was flown over.

author: TimFox
author_rank: Super Contributor
timestamp: January 09, 2023, 11:56:39 pm
content: Quote from: Benta on January 09, 2023, 11:25:47 pmThe reports in Chicago indicate that the stolen Kias are used in crimes, then abandoned.Apparently, one needs only to break a window with a screwdriver, then proceed to the USB port.A rational thief would presumably target commonly-available autos that are easier to steal than other commonly-available autos, especially if only to obtain a temporary vehicle for criminal activity.From an December, 2022 news item on the Chicago CBS TV station:"Kias and Hyundais each had about 3,500 car thefts, accounting for nearly 38% of all car thefts in the city.So many Kias were stolen in Chicago, that they account for about 10% of the city's 36,300 registered Kias and about 7% of the city's 53,500 Hyundais, according to data from the Illinois Secretary of State.That number does not include the 86 Hyundais and 62 Kias swept up in 1,500 carjackings since November of this year, according to police data obtained in a public records request.Thousands of Kia and Hyundai owners have lost their cars in Chicago and other U.S. cities thanks in part to TikTok videos that show how to exploit a hack on certain models that lack engine immobilizers.Car thieves, dubbed "Kia boys" by some, are able to break into cars and start them with nothing more than a screwdriver and USB charger."By comparison, about 1500 Chevrolets, 1200 Dodges, 1000 (each) Fords and Jeeps, and 900 (each) Hondas and Toyotas were stolen.Reference (with complete Chicago data):https://www.cbsnews.com/chicago/news/kia-hyundais-stolen-chicago/

author: Pagesing
author_rank: Newbie
timestamp: January 11, 2023, 03:58:34 pm
content: This seems like an extremely serious vulnerability considering that you can affect the starter and start/stop engine. Of course, this does not mean that you can break into cars, but it does not get any better. Access to personal data is a separate thing that could be mentioned, but I think everyone understands it anyway.

author: jm_araujo
author_rank: Regular Contributor
timestamp: January 11, 2023, 05:43:09 pm
content: I've seen the video of the hacking of the KIAs and Hyundais.It has nothing to do with USB ports in the car. You have to disassemble the steering column and take apart the lock, and the hole where the lock turns the eletrical switch is an exact match in size with an USB type A plug. A screwdriver can also be used, but it doesn't make the headlines as juicy.What I didn't knew was that cars are still beeing sold without immobilizers! Is that an USA thing?

author: Benta
author_rank: Super Contributor
timestamp: January 11, 2023, 08:27:39 pm
content: Quote from: jm_araujo on January 11, 2023, 05:43:09 pmI wondered about that myself.

author: Halcyon
author_rank: Unknown
timestamp: January 11, 2023, 10:57:49 pm
content: Quote from: Benta on January 09, 2023, 09:06:48 pmThat being said, it can be used to get live location information about a vehicle (depending on make/model). Ive been involved in this kind of thing in my previous job and I can tell you 100% that via certain manufacturers, law enforcement (and others) can gain access to vehicle location, regardless whether or not the end-user subscribes to any kind of package or service. I know at least one manufacturer won't reveal that they can do this publicly (and most of their dealers don't know), but I have seen and used that data personally myself.If law enforcement and security agencies can access it, so too can people who exploit poorly written or vulnerable APIs.

author: Benta
author_rank: Super Contributor
timestamp: January 11, 2023, 11:23:09 pm
content: Quote from: Halcyon on January 11, 2023, 10:57:49 pmToo true, but still doesn't merit the "sensational" OP video. We're still talking Nav/Infotainment info, not crucial car safety system.But this is why I love my '97 MX-5/Miata: it's all car, zero smartphone

author: Stray Electron
author_rank: Super Contributor
timestamp: January 12, 2023, 01:16:27 am
content: Quote from: DimitriP on January 09, 2023, 06:38:30 pmNone! It will be left up the consumers to figure out which vehicles are safe and reliable to drive and which ones aren't. But by the time that consumers learn that, the manufacturers will be building new models with new bugs. Just like the car market today and today's software market. Tesla and Windows both come to mind.Governments, as usual, will be 15 to 20 years behind.

author: rdl
author_rank: Super Contributor
timestamp: January 12, 2023, 05:20:29 pm
content: Looks like I'll be keeping my 20 year old truck a little longer...