Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Insecure vehicles should be banned, not security tools like the Flipper Zero

saveflipper.ca

Post reply on HN
Print view View original

81–90 of 916 posts

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#81

Post by evandale »

InitialLastName wrote: post #73
stainablesteel wrote: post #35

how are major car manufacturers so far behind in security? and why can't they go back to the old solutions that didn't have these problems? its just such a stupid thing to watch IF these fancy keys that let you start your car without inserting anything cause your car to become extremely vulnerable THEN maybe its a bad idea, jesus christ

Because whenever it's even vaguely cold outside, my neighbor likes to be able to start and idle her giant truck in her driveway without leaving her house (for 40 minutes before she drives a mile to work).

Car ownership is way too cheap and accessible in North America for the amount of damage they cause.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#82

Post by Chris2048 »

sidewndr46 wrote: post #10

This has to be one of the dumbest things I've read in a while. All vehicles are insecure. I can hook a tow truck to almost any vehicle, including an 80,000 lbs tractor trailer and drive off with it. That'd actually attract less attention that outright hotwiring a vehicle. The solution is to identify, arrest, and prosecute criminals. Which the government is not obligated to do in the US.

but then you'd need a tow truck.. Doesn't seem a lot simpler, anyone could snap a pic of your registration plate. I think towing a vehicle does attract a fair amount of attention, especially if there is no obvious reason for it.

Also, they don't need to steal the car - if they can freely open it can can just steal anything inside.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#83

Post by nonethewiser »

whimsicalism wrote: post #64
sidewndr46 wrote: post #10

This has to be one of the dumbest things I've read in a while. All vehicles are insecure. I can hook a tow truck to almost any vehicle, including an 80,000 lbs tractor trailer and drive off with it. That'd actually attract less attention that outright hotwiring a vehicle. The solution is to identify, arrest, and prosecute criminals. Which the government is not obligated to do in the US.

> Which the government is not obligated to do in the US. Just a talking point - and the US has one of the most extensive criminal justice apparatuses of any country. This article is about Canada - which has largely failed to control its organized crime+ports situation, unlike authorities in the US where most organized crime is organized from abroad and so difficult to disrupt but also less effective.

[flagged]

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#84

Post by bongodongobob »

sidewndr46 wrote: post #10

This has to be one of the dumbest things I've read in a while. All vehicles are insecure. I can hook a tow truck to almost any vehicle, including an 80,000 lbs tractor trailer and drive off with it. That'd actually attract less attention that outright hotwiring a vehicle. The solution is to identify, arrest, and prosecute criminals. Which the government is not obligated to do in the US.

The US has the most prisoners per capita, but go on.

"They aren't doing enough about car hackers! Car hackers are just running free and the gubmint won't stop them!"

Ridiculous.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#85

Post by tylerchilds »

At this point, banning security tools a violation of the second amendment.

Microsoft suffers breach after breach after acquisition after acquisition. I verbally note them to my wife to remember, "This is not normal." and even she said, "Why do the numbers keep getting worse and worse." and I told her, "The database keeps getting larger and larger ever since they were only slapped on the wrist for not letting me boot straight to firefox since childhood."

If you took away my ability to understand why the world around me is failing, we'd fall into further disrepair than we already are and we're not really allowed to repair anything, now are we?

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#86

Post by threetonesun »

sidewndr46 wrote: post #10

This has to be one of the dumbest things I've read in a while. All vehicles are insecure. I can hook a tow truck to almost any vehicle, including an 80,000 lbs tractor trailer and drive off with it. That'd actually attract less attention that outright hotwiring a vehicle. The solution is to identify, arrest, and prosecute criminals. Which the government is not obligated to do in the US.

Sure pros will always steal cars that way, but you never want to end up with a vehicle that any bored person can steal for the lulz.

Late 90s - Early 2000 Honda/Acura owners went through this. Even though they were very good cars they became undesirable because you could hardly park them anywhere without coming back to missing parts.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#87

Post by caskstrength »

newsclues wrote: post #43
hoofhearted wrote: post #34

Earlier quoted context omitted.

Fix the cars. A brand new $60,000 car shouldn’t be so simple to swipe. They probably spent less time stealing my neighbors car than he did waiting on the credit check to buy the car lol… it’s crazy these days with cars.

Cars are computers now. What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. No level of technology will stop this. But cutting off the profit motive by making it very hard to export cars will have a massive impact on these crimes, and for old and new cars.

> What do we know about computer security and physical access? If I can touch the machine, I can hack and own it.

Can you hack and own my fully patched Pixel phone? Or my GF's iPhone? Sure, sophisticated state-sponsored actors can sometimes do it by burning several million dollars worth of 0days in the process, but some two-digit IQ riff-raffs? Probably not so much.

EDIT: just to be clear - by "two-digit IQ riff-raff" I meant OP's neighborhood car thieves, not you :)

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#88

Post by acdha »

newsclues wrote: post #43
hoofhearted wrote: post #34

Earlier quoted context omitted.

Fix the cars. A brand new $60,000 car shouldn’t be so simple to swipe. They probably spent less time stealing my neighbors car than he did waiting on the credit check to buy the car lol… it’s crazy these days with cars.

Cars are computers now. What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. No level of technology will stop this. But cutting off the profit motive by making it very hard to export cars will have a massive impact on these crimes, and for old and new cars.

> What do we know about computer security and physical access? If I can touch the machine, I can hack and own it.

It’s not the 2000s any more. Even national security agencies have trouble with phone decryption, and that suggests a path forward for cars using a tamper-resistant secure element since car thieves won’t spend more money attacking something than they can resell it for. Cars need service regularly you can have a way to replace a damaged SE which is more restricted so a legitimate owner can regain control of their stolen property - if you required, say, a government photo ID check for the owner on the title to reset the encryption keys, car thieves are highly unlikely to spend time getting high-quality fake ID since the odds of getting caught would go up dramatically, and you could deter shady auto shops by requiring them to submit proof of their ID verification for that service.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#89

Post by Chris2048 »

acdha wrote: post #75
raizer88 wrote: post #47

Earlier quoted context omitted.

All CANBUS packages that are useful to drive a car should be encrypted using a public/private key that is in the owner key. Decryption chips are cheap and fast.

Maintenance is a big key management problem though: if only the owner has it, there will be problems when people inevitably lose it. If there are shared keys for service departments or databases, thieves will get access to them. Things like time-limited on-demand keys can limit those problems but now you can’t get your car serviced when Toyota’s servers go down and they need to commit to not breaking API compatibilit…

The same problem exist for car keys.

The answer is, when a person "inevitably lose[s] it", they need to pay to get their electronics refit.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#90

Post by RegnisGnaw »

tylerchilds wrote: post #85

At this point, banning security tools a violation of the second amendment. Microsoft suffers breach after breach after acquisition after acquisition. I verbally note them to my wife to remember, "This is not normal." and even she said, "Why do the numbers keep getting worse and worse." and I told her, "The database keeps getting larger and larger ever since they were only slapped on the wrist for not letting me boot…

Again this is not the US. This involves Canada, there is no second amendment.
Post reply on HN