Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hacked my car

programmingwithstyle.com

Post reply on HN
Print view View original

11–20 of 142 posts

Re: I hacked my car

#11

Post by EMIRELADERO »

meibo wrote: post #10
londons_explore wrote: post #5

What would be the downside of Hyundai just making all the info in this blog post public info? They could start fostering an app ecosystem for their cars. And it would be an extra selling point for their cars (especially if there are apps that won't run in other cars). And it might even turn into a new revenue stream by building an app store.

There are some things you don't want to run apps on, even if they're sandboxed, which isn't the case here - I would count "computer in my car that can talk to the stuff that makes it go" as one of these things.

And yet most cars run apps. Are you arguing that those not coming from/authorized by the manufacturer are less legitimate, or should not deserve the same treatment?

Re: I hacked my car

#12

Post by lozenge »

EMIRELADERO wrote: post #11
meibo wrote: post #10

Earlier quoted context omitted.

There are some things you don't want to run apps on, even if they're sandboxed, which isn't the case here - I would count "computer in my car that can talk to the stuff that makes it go" as one of these things.

And yet most cars run apps. Are you arguing that those not coming from/authorized by the manufacturer are less legitimate, or should not deserve the same treatment?

That seems... incredibly obvious? If there's a software bug that is a safety risk, the regulatory agencies force the manufacturer to implement a recall at their own expense. That wouldn't be the case for third party software.

Re: I hacked my car

#13

Post by tialaramex »

One of the things I remember being discussed on m.d.s.policy not so long ago was making a registry (maybe handled by IANA) for example private keys. Turns out Peter Gutmann did the heavy lifting (thank you Peter) to turn that from idle discussion into a draft document:

https://datatracker.ietf.org/doc/draft-gutmann-testkeys/

From the point of view of m.d.s.policy the main idea is to require CAs to reject these keys in certificates for the Web PKI and encourage software to use these keys (rather than their own examples) in sample code. Basically when you build my-cool-website.example and copy paste the private key from an example into your certificate fetching code, the CA should say "Er, no, you need to actually choose your own private key, that's what the word private means" and this should happen when you copy-paste a high-rated Stack Overflow example, the provided sample code from the library you used etc. Ideally these would all be the same keys is the idea.

It would also make sense for tools to care about these example keys e.g. GitHub could flag code that's checked in and has keys which are not these examples since maybe you used real keys by mistake in your GitHub repo, meanwhile your build-for-production CI tools could reject keys which are on the list because that means you forgot to pick actual keys for the real build.

Re: I hacked my car

#15

Post by Youden »

Wow, this series of posts is awesome! I have a Kia EV6 and just finding the OBD-II PIDs is a massive pain in the arse. Kia is actually required by EU law to disclose them (Art. 61 EU regulation 2018/858 [0]) but refused to do so even when I wrote to them. Need to follow that up with a complaint to the Spanish type approval authority (which approved the EV6)...

Writing custom software looks like a really promising alternative though, especially if the vehicle's cellular connection can be used. Hell, if the IVI uses the CAN bus, perhaps there's a reverse-engineerable list of PIDs.

[0]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...

Re: I hacked my car

#16

Post by hnick »

ReadTheLicense wrote: post #4
heynowheynow wrote: post #2

Don't expect much from a manufacturer who until recently didn't use immobilizers.

In what universe is 20+ years "recently"? Actually the Hyundai I had - with an immobilizer - was made in 1995 so 27 years. Is this American thing?

It might be, my 15 year old Getz has one (I know because it plays up sometimes due to poor conductivity), but that was never released in the US.

Re: I hacked my car

#17

Post by ThePhysicist »

That's why I try to never put any testing or development keys in repositories. From those keys sitting there it just takes one act of negligence for the keys to make it into a production environment. It's really frustrating that most people don't care about this at all. Even people forking my own projects would not listen when I told them to please just generate the keys dynamically (for which I included all necessary functionality in the software itself, easily accessible in CI and from the CLI via a simple make command), and instead just put dev keys smack in the repository [1]. And mind you those were some really "security minded" people from the CCC.

1: https://github.com/impfen/apps-inoeg/blob/main/tests/fixture...

Re: I hacked my car

#18

Post by devonallie »

>> I have to wonder if they used that linked “RSA Encryption & Decryption Example with OpenSSL in C” tutorial…

Makes me feel better about my own incompetencies. But also makes me scared for the future of safety in vehicles.

Re: I hacked my car

#20

Post by cs702 »

I've heard of much worse security no-no's. The worst example I'm familar with is of a Fortune-500 corporate database with data for millions of private citizens exposed for years on the public web over plain old http (not even https), without any password or public/private key protection, such that anyone anywhere with the right URL or IP address could access it.

The big question, of course, is: Why haven't we had a security apocalypse? I imagine it must be because most software engineers are honest, and because the bad actors who have the skills and resources to pull it off (e.g., foreign government agencies) have a vested interest in maintaining the status quo.

So, non-technical managers everywhere go on with their lives thinking their software infrastructure has been "secured," without really knowing whether it's true. Consider that no executive or manager at Hyundai was aware until now that their vehicles have been using a previously published private key to update their software.

Post reply on HN