This guy is insanely skillful. Wow.
And more than that - insanely perseverant and tenacious. A very powerful combination.
I hacked my car
91–100 of 142 posts
Re: I hacked my car
#92This article confirms my insight that good programmers, especially those working in security, need to have a dose of OCD in them to be successful. ;-)
Re: I hacked my car
#93Earlier quoted context omitted.
We actually do this in our internal framework. All secrets (passwords, key material, etc) that we have in documentation and example projects are blacklisted for production in the framework itself and applications refuse to start.
Out of curiosity, do you have any tools/processes to avoid a situation like putting real secrets in new docs? Such as this popular story from 2017 [0]. And is there a way to automate publishing a test secret(s) to a doc and also send it to the blacklist? [0] https://www.reddit.com/r/cscareerquestions/comments/6ez8ag/a...
None other than peer reviews and habit. All our passphrases are something like “exampledatabasepassword” whereas in reality they are long tokens.
Then, secrets from production are hard to extract and typically rotated (semi-continuously). So it would be very strange if that somehow ended in up in a developers paste buffer to add to the docs.
Re: I hacked my car
#94The Mac address part stood out to me, has something changed over the year that made changing Mac addresses more complex? Back in college our school had some limitations on the internal networks in our dorms. After doing my normal stuff (you know mega downloading,ftp, limewire etc) my net stopped working. Come to find out they had a bandwidth monitor and would just block you for some time if you used too much and had…
Network cards have a factory-configured MAC address, which is the default one the adapter will use. As you figured out, the operating system is usually able to override this MAC address- but it has to redo this every time it initializes the adapter. It'll still have its original MAC on a different system. However, in the article they did not have control over the operating system. So how do you change the MAC address…
[deleted]
Re: I hacked my car
#95One of the things I remember being discussed on m.d.s.policy not so long ago was making a registry (maybe handled by IANA) for example private keys. Turns out Peter Gutmann did the heavy lifting (thank you Peter) to turn that from idle discussion into a draft document: https://datatracker.ietf.org/doc/draft-gutmann-testkeys/ From the point of view of m.d.s.policy the main idea is to require CAs to reject these keys i…
> https://datatracker.ietf.org/doc/draft-gutmann-testkeys/
I read the document hoping for an example Authorization: Bearer token auth, but was disappointed. Even more surprising was the lack of any ed25519 key; I would also have used this in my documentation.
Re: I hacked my car
#96Kudos to the author! I did some research in my car a few years ago. Unfortunately, the update packages were properly signed. So I reversed the CAN traffic and replaced the infotainment ECU with my own reimplementation. I published my work and findings on medium thinking that nobody could notice them... I have got a job in the automotive industry instead.
Re: I hacked my car
#97What would be the downside of Hyundai just making all the info in this blog post public info? They could start fostering an app ecosystem for their cars. And it would be an extra selling point for their cars (especially if there are apps that won't run in other cars). And it might even turn into a new revenue stream by building an app store.
The garage can charge ridiculous amounts of money for trivial features and upgrades. Although the manufacturer may benefit from an App Store, the garage gets nothing. Toyota, for example, charges something like $150 for a single satnav maps update, although now CarPlay/Android Auto is a standard feature and has tanked that market.
GM charges for access to key cloning and module programming/pairing. Its not overly expensive (~$40 per module), but super annoying and bug infested (software crashing/failing/constantly updating).
Afaik Ford has similar program where you pay one time fee for ability to reprogram modules remotely.
Imo a good deal for consumers.
Re: I hacked my car
#98Kudos to the author! I did some research in my car a few years ago. Unfortunately, the update packages were properly signed. So I reversed the CAN traffic and replaced the infotainment ECU with my own reimplementation. I published my work and findings on medium thinking that nobody could notice them... I have got a job in the automotive industry instead.
Any reason for not linking to that medium post? Did the new employer politely ask you to take it down?
Re: I hacked my car
#99One of the things I remember being discussed on m.d.s.policy not so long ago was making a registry (maybe handled by IANA) for example private keys. Turns out Peter Gutmann did the heavy lifting (thank you Peter) to turn that from idle discussion into a draft document: https://datatracker.ietf.org/doc/draft-gutmann-testkeys/ From the point of view of m.d.s.policy the main idea is to require CAs to reject these keys i…
I wonder if sample code using keys that don't look secure ("1111...") would lead to more or fewer incidents. Easier to guess, but more clear you're using guessable keys to the developer importing the code.
Re: I hacked my car
#100Earlier quoted context omitted.
The "Kia Boys" in Milwaukee stole almost 10,000 cars last year, mostly Kia and Hyundai models lacking immobilizers. That's 1 car theft per 58 city residents, in a single year. This gonzo documentary on the phenomenon's worth watching: https://www.youtube.com/watch?v=fbTrLyqL_nw57
Insane. And the cars in question have no immobilizer, so the process is just finding a 2021 or older Kia/Hyundai of a certain model, one with a physical key instead of a pushbutton. Then you just rip apart the steering column and turn the ignition cylinder. I was confused because a USB cable was involved, but it's apparently only because it slides nicely over the mechanism to help you turn it, as opposed to having to…
Insane? This is just what stealing a car was like in 1970. If you get the ignition to turn, you've stolen the car. If you're dependent on technology to stop vehicle theft, you've basically already lost. At the end of the criminals will just use a flatbed tow truck to steal the vehicle if it is worth enough.
The "immobilizers" you're referring to are the bane of my existence from my perspective. Instead of getting cheap $5 copies of my keys made, I have to pay something like $120 to Ford to get copies made.