Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hacked my car

programmingwithstyle.com

Post reply on HN
Print view View original

121–130 of 142 posts

Re: I hacked my car

#121

Post by ClumsyPilot »

bornfreddy wrote: post #118
dabigjhall wrote: post #41

This sort of idiocy is why I removed the modem from my Niro EV: https://www.kianiroforum.com/threads/how-to-remove-head-unit... (It is basically the same head unit, Kias/Hyundais share a lot of components.) IMO Kia makes great cars but I don't trust them with Internet security. Android device permanently connected to the Internet with unfettered access to the CAN bus of my car....no thank you. And even if it was rela…

Wow, nice! I don't own a Kia, but being able to disable built-in radio is a great feature in my eyes. As for people commenting about "nothing to hide" and paranoia, I guess that they never worked on the other side. Seeing how even very innocent-looking data can be (ab)used, I would definitely prefer less data to be gathered about everyone.

> people commenting about "nothing to hide"

have they never heard of credit card fraud, identity theft, etc?

Re: I hacked my car

#122

Post by Nextgrid »

londons_explore wrote: post #5

What would be the downside of Hyundai just making all the info in this blog post public info? They could start fostering an app ecosystem for their cars. And it would be an extra selling point for their cars (especially if there are apps that won't run in other cars). And it might even turn into a new revenue stream by building an app store.

> downside of Hyundai just making all the info in this blog post public info?

All the CAN protocol data being public means there's no need for expensive documentation, proprietary scan tools or trips to the dealership for key/module programming if it's all been reverse-engineered (a lot of programming and security-related things in cars are more down to obscurity than actual public-key-cryptographic authentication). Hell, it may even remove the need for expensive modules (over 1k bucks for what is essentially a slow microcontroller on a conformal-coated board running shitty firmware) if the docs allow third-parties to reimplement module functionality on the cheap. It would also blow up any future attempts at subscription-based heated seats or A/C if the published docs make bypassing it trivial.

Re: I hacked my car

#123

Post by Nextgrid »

rasz wrote: post #97
teamonkey wrote: post #65

Earlier quoted context omitted.

The garage can charge ridiculous amounts of money for trivial features and upgrades. Although the manufacturer may benefit from an App Store, the garage gets nothing. Toyota, for example, charges something like $150 for a single satnav maps update, although now CarPlay/Android Auto is a standard feature and has tanked that market.

GM charges for access to key cloning and module programming/pairing. Its not overly expensive (~$40 per module), but super annoying and bug infested (software crashing/failing/constantly updating). https://www.acdelcotds.com Afaik Ford has similar program where you pay one time fee for ability to reprogram modules remotely. Imo a good deal for consumers.

> GM charges for access to key cloning and module programming/pairing

A lot of this is done entirely in security by obscurity so there might not even be any actual cryptography/authentication involved. It's purely a rent-seeking operation.

Re: I hacked my car

#124

Post by Nextgrid »

zcw100 wrote: post #116

I wish that I felt comfortable hacking my new $50k car but I’m glad you do. I usually break stuff I hack.

Realistically speaking, if you brick the thing you put it back together and take it to the dealership and they'll swap the bricked module. Rinse and repeat if needed.

The car being new and under warranty is a major advantage in this case.

Re: I hacked my car

#125

Post by Nextgrid »

jpoesen wrote: post #50
twawaaay wrote: post #38

Most development at very large companies happens by hordes of people who call themselves developers but do not care about development and barely understand anything they are doing. Most coding happens by copying and pasting from Stack* and then restarting the application hundreds of times and tinkering with the code mindlessly until it happens to work. Anything besides getting the "happy path" (sic!) to work is a sec…

"most developers from Asia do not really expect or care about privacy" -> You did a casual racism there, unless you can back up your claim with non-anecdotal evidence.

I think it's less about the nationality of the developers themselves and more about the environment they learned in. Countries that are a common outsourcing destination foster shitty development practices and corner-cutting (it wouldn't be outsourced otherwise), so if most of the IT work in the country is working on such outsourced projects then the majority of the IT talent is likely to pick up & perpetuate bad practices.

Re: I hacked my car

#128

Post by AlotOfReading »

alerighi wrote: post #119
AlotOfReading wrote: post #87

Earlier quoted context omitted.

I've been involved with the software side at a few companies producing autonomous vehicles and took a look at SSG-39 to see how much better nuke standards are. They're pretty dang similar to automotive standards (UL4600, SOTIF, etc). The difference is in the regulatory environment and execution. Automotive software is not well-regulated and most OEMs don't think either the software or the people that produce it are w…

Automobile software has good standard for critical parts. The problem is all the software never considered a remote attack, since it was not connected to the internet. The CAN bus was local and the only way to interact was to physically connect to the bus, thus it has no security built in (every device can send any command since every device is trusted). Now to enable all the smart stuff there is a connection between…

That's not how any car I know of works. Infotainment stuff can't go on the CAN bus due to bandwidth limitations. It's usually on its own network. Historically that was MOST, now it's usually Ethernet (or A2B for some specific components). That network may be bridged to other networks like CAN with a locked down gateway module, but frankly even that design is out of style due to security issues.

If you know a manufacturer putting radio devices on the CAN bus, by all means name and shame. I'd be morbidly curious because of how obviously terrible an idea that is.

Post reply on HN