Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Your Used Car Is a Little Too ‘Mobile’

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 102 posts

Re: When Your Used Car Is a Little Too ‘Mobile’

#11

Post by Johnny555 »

tzs wrote: post #8

There are enough street labels visible on the map of the car location in the screenshot from the myford site to figure out where that is. I was kind of surprised the article did not obfuscate that. It looks like it is at one of these businesses in Milford, CT: Stevens Ford Lincoln, Stevens Ford of Milford, Steven's Collision Center, or Colony Ford. I wonder if one of those Ford dealers is the dealer that failed to do…

If it's at a car dealer, I'm not sure there's any need to obfuscate it -- revealing that an off-lease car is on a car dealer's lot is not much of a breach.

If it was in a residential neighborhood it'd be a different story.

Re: When Your Used Car Is a Little Too ‘Mobile’

#12

Post by josephwegner »

Fun fact: Nissan Connect, which allows you to track, start, stop, lock, unlock, trigger horn, and toggle headlights is also massively insecure. In order to gain control of a Nissan Connect-enabled car, you need to know the VIN of the car and the name of the person to whom it is registered.

Most of the time those details can be found on the internet, but if you're reasonably motivated you can find the VIN visible on a car's dashboard and probably find the owner's name in their mailbox.

If you own a Nissan, register your car in Connect, or someone else will!

Re: When Your Used Car Is a Little Too ‘Mobile’

#13

Post by tyho »

BMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into the engine block and chassis so obviously cannot be changed, even after I sell the car. I also suspect these numbers are sequential. Till this car is scrapped I will be able to locate it, turn on the AC, unlock the doors etc.

Re: When Your Used Car Is a Little Too ‘Mobile’

#14

Post by alasdair_ »

Johnny555 wrote: post #7

I always do an infotainment system reset when I rent a car -- both when I start using the car, and just before I return it. I don't know what apps or other data other people synced, and I don't want anything I synced to be available to the next person. I'd be doubly sure to reset the car at the end of a lease.

I find it more amusing to enter in the address of a local liquor store, then a bar, then a weed shop, a casino, a strip club, a bail bondsman, the local municipal courthouse and finally a divorce lawyer’s offices.

Re: When Your Used Car Is a Little Too ‘Mobile’

#15

Post by speedgoose »

kube-system wrote: post #2

Yikes. This is a serious safety issue. Imagine if this wasn’t an EV, and someone started a car while in the new owner’s garage.

Can you start a ICE vehicle remotely? I thought it was mostly a EV thing, some people have aftermarket kits.

Re: When Your Used Car Is a Little Too ‘Mobile’

#16

Post by nkrisc »

tyho wrote: post #13

BMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into the engine block and chassis so obviously cannot be changed, even after I sell the car. I also suspect these numbers are sequential. Till this car is scrapped I will be able to locate it, turn on the AC, unlock the doors etc.

On many (all?) modern cars it's also visible at the bottom of driver's side of the windshield. A car's VIN is public information.

Re: When Your Used Car Is a Little Too ‘Mobile’

#17

Post by river99 »

tyho wrote: post #13

BMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into the engine block and chassis so obviously cannot be changed, even after I sell the car. I also suspect these numbers are sequential. Till this car is scrapped I will be able to locate it, turn on the AC, unlock the doors etc.

Also visible through the windshield from the outside.

Re: When Your Used Car Is a Little Too ‘Mobile’

#18

Post by river99 »

_sbrk wrote: post #9
river99 wrote: post #3

First thing I do in any rental car is turn off any remote tracking, mobile apps, clear out bluetooth and turn off wifi if equipped.

While always good to turn non-essential features off, this doesn't mean that you can't be tracked. Many vehicles, even if non-rental, now come standard with cellular voice/data connections. GM pioneered this with OnStar in the mid-90s[1], and other manufacturers soon followed. Combined with the "black box" recording of _every_ sensor in your car, there can be some pretty damning evidence against the driver in the eve…

Some cars have a tracking toggle switch. I believe BMW is one such example.

Re: When Your Used Car Is a Little Too ‘Mobile’

#19

Post by LinuxBender »

nkrisc wrote: post #16
tyho wrote: post #13

BMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into the engine block and chassis so obviously cannot be changed, even after I sell the car. I also suspect these numbers are sequential. Till this car is scrapped I will be able to locate it, turn on the AC, unlock the doors etc.

On many (all?) modern cars it's also visible at the bottom of driver's side of the windshield. A car's VIN is public information.

I have a small piece of black paper over mine. I am happy to let a law enforcement officer view it if they ask.

Re: When Your Used Car Is a Little Too ‘Mobile’

#20

Post by josephwegner »

speedgoose wrote: post #15
kube-system wrote: post #2

Yikes. This is a serious safety issue. Imagine if this wasn’t an EV, and someone started a car while in the new owner’s garage.

Can you start a ICE vehicle remotely? I thought it was mostly a EV thing, some people have aftermarket kits.

I can start my Nissan (not EV) from an app.
Post reply on HN