Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Your Used Car Is a Little Too ‘Mobile’

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 102 posts

Re: When Your Used Car Is a Little Too ‘Mobile’

#71

Post by JohnFen »

RandomBacon wrote: post #58
LinuxBender wrote: post #19

Earlier quoted context omitted.

I have a small piece of black paper over mine. I am happy to let a law enforcement officer view it if they ask.

I thought about doing that, but if someone wants my VIN, they just have to squat down and look at the VIN that's punched in the frame of my truck. I haven't checked other vehicles, but I imagine they also have their VINs punched in the frame where it's easily visible. I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.

> I imagine they also have their VINs punched in the frame where it's easily visible.

It's not always easily visible, but the VIN must be stamped on the major components of the car by law. I believe this means visible from the driver's side windshield, stamped on the frame, and stamped on the major drivetrain components.

> I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.

In my state, it's illegal to do either of those things, but I don't believe it's illegal to obstruct the view of the VIN in a less permanent way.

Re: When Your Used Car Is a Little Too ‘Mobile’

#72

Post by pandaman »

LinuxBender wrote: post #19
nkrisc wrote: post #16

Earlier quoted context omitted.

On many (all?) modern cars it's also visible at the bottom of driver's side of the windshield. A car's VIN is public information.

I have a small piece of black paper over mine. I am happy to let a law enforcement officer view it if they ask.

What about parking tickets? Do they just leave the VIN# empty or impound your car?

Re: When Your Used Car Is a Little Too ‘Mobile’

#73

Post by winrid »

ta999999171 wrote: post #66
scarejunba wrote: post #41

Earlier quoted context omitted.

New cars are way safer than the ones from the 1980s, though. In just a risk-minimization strategy I prefer a new car with Alexa over a forty year old car without. The privacy risk is low with the new one, but the death risk is high with the old one. Rolled my car and I just crawled out of the wreck and walked away with a mild concussion.

You must not be a journalist. Also, the best way to reduce risk for you would be to let someone else drive. It takes a LOT to roll a street car these days, holy hell.

Well, if you somehow manage to de-beed a tire it's pretty easy. Maybe he was running from the cops. :)

Re: When Your Used Car Is a Little Too ‘Mobile’

#74

Post by OkGoDoIt »

myself248 wrote: post #61
gambler wrote: post #10

People are now beginning to realize that cellphones send out too much data. Well, modern cars are far worse. Do you know that some of them have weight sensors in seats? Do you know that they send this info out? On your phone, you at least have some control. You have zero control over your car's cell connection. I'm not even sure you can disable over-the-wire updates.

Pull the SIM card, or if it's an eUICC cut the trace. Yank the antenna wire, cap it with a terminator. Cut the module off the bus if you feel like pulling the fuse isn't enough.

Would the car detect the tampering and refuse to operate? Seems like there is a fair argument to be made for that by car manufacturers in the name of safety.

Re: When Your Used Car Is a Little Too ‘Mobile’

#75

Post by somehnguy »

OkGoDoIt wrote: post #74
myself248 wrote: post #61

Earlier quoted context omitted.

Pull the SIM card, or if it's an eUICC cut the trace. Yank the antenna wire, cap it with a terminator. Cut the module off the bus if you feel like pulling the fuse isn't enough.

Would the car detect the tampering and refuse to operate? Seems like there is a fair argument to be made for that by car manufacturers in the name of safety.

While totally possible I've never heard of such a thing actually happening. Tearing out the OnStar module on Chevrolets has been done by people with a specific mindset for a long time. Whats kinda neat is that if it does still work after tearing out the module it should continue to work forever because you just ripped out the update mechanism. Assuming you don't go to the dealer for service of course...but who does that?

Re: When Your Used Car Is a Little Too ‘Mobile’

#76

Post by scarejunba »

ta999999171 wrote: post #66
scarejunba wrote: post #41

Earlier quoted context omitted.

New cars are way safer than the ones from the 1980s, though. In just a risk-minimization strategy I prefer a new car with Alexa over a forty year old car without. The privacy risk is low with the new one, but the death risk is high with the old one. Rolled my car and I just crawled out of the wreck and walked away with a mild concussion.

You must not be a journalist. Also, the best way to reduce risk for you would be to let someone else drive. It takes a LOT to roll a street car these days, holy hell.

> Also, the best way to reduce risk for you would be to let someone else drive.

Hahaha, solid bants. I enjoyed that. But given that the Lyft pass is no longer available, looks like I've got to risk my life.

And of course I'm not a journalist, I do mostly productive work.

Re: When Your Used Car Is a Little Too ‘Mobile’

#77

Post by julianj »

o_____________o wrote: post #64
nemosaltat wrote: post #54

Earlier quoted context omitted.

I’m hearing that last sentence in the voice of the narrator from arrested development.

Ron Howard! Director of A Beautiful Mind, Apollo 13, Willow, etc., star of Happy Days, father of Bryce Dallas Howard. https://www.youtube.com/watch?v=70nqLIj6l_M

And not to forget Opie from the Andy Griffith show

Re: When Your Used Car Is a Little Too ‘Mobile’

#78

Post by scarejunba »

JohnFen wrote: post #69
scarejunba wrote: post #41

Earlier quoted context omitted.

New cars are way safer than the ones from the 1980s, though. In just a risk-minimization strategy I prefer a new car with Alexa over a forty year old car without. The privacy risk is low with the new one, but the death risk is high with the old one. Rolled my car and I just crawled out of the wreck and walked away with a mild concussion.

> The privacy risk is low with the new one Why do you say that? The new cars are constantly sending telemetry to the mothership.

Sorry, using the "risk = probability times damage" meaning here. It doesn't matter so much how much telemetry is sent until that leads to: a) compromising my privacy b) that breach leading to damage to me. I like to threat model things like this, rather than going on a binary scale of threatened/not-threatened and I think there is no threat model that leads to me needing to worry. Of course, if you have concrete information that I am in danger, I will pay you for it.

I rate that as astronomically unlikely, especially since my SSN is out there and I haven't been identity thefted yet despite making half a million a year and having more credit cards than I can keep track of.

Re: When Your Used Car Is a Little Too ‘Mobile’

#79

Post by julianj »

tyho wrote: post #13

BMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into the engine block and chassis so obviously cannot be changed, even after I sell the car. I also suspect these numbers are sequential. Till this car is scrapped I will be able to locate it, turn on the AC, unlock the doors etc.

In my area, the VIN is also easy to find with just a name from the public-facing tax property website.

Re: When Your Used Car Is a Little Too ‘Mobile’

#80

Post by nimbius »

somewhat off-topic, but if you'd like a hardware hack to disable the perpetual vehicle tracking in most modern cars, its actually a component of OnStar in GM vehicles. BMW Assist and others are patterned off the same technology as it all comes off the boat as a single embedded package from China. Its a cellular modem with a header for your OBD and ECM and data line for your info-tainment. its NOT built into the info-tainment.

on GM Vehicles You're looking for a metal box under the passenger side footwell, about the size of a cable modem. newer models have it in the trunk on the right or left side. You can remove the box, open it up, and inside will be a riser card with 2 or 3 connectors for a cell antenna. theres no SIM card.

Pull the riser and you wont get any error codes. Confirm the hack by pressing the OnStar button (or whatever your car calls it.) it will ring, but no one will pick up.

this will NOT affect your bluetooth ability OR your backup camera. thats actually part of the infotainment.

this WILL however disable the SOS button and the automated SOS on airbag deployment signal as the riser doesnt exist to make the call.

Post reply on HN