Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Insecure vehicles should be banned, not security tools like the Flipper Zero

saveflipper.ca

Post reply on HN
Print view View original

631–640 of 916 posts

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#631

Post by Reubachi »

Zak wrote: post #598
acdha wrote: post #549

Earlier quoted context omitted.

Think about what happens when people lose their keys, which will reliably happen.

In the old days, most or all car companies had the ability to look up the bitting code to cut a replacement key (the mechanical kind) from the car's VIN. There's no reason they can't do the same with an encryption key. Of course they'd need to do a good job securing that database since inappropriate access to it would make stealing cars very easy.

There is a very good reason that isn't possible/analagous to traditional rekeying.

Mechanical keys are not secure. They can be reproduced with basic skills. That's why there used to be a giant key cutting industry where much of the business was car keys (Thanks, GM.)

The whole idea of CA PKI and all modern TPM architecture on devices is that they CAN'T be reproduced or replaced in context without massive effort that would make the intended use moot; IE replacing the TPM and associated on both the key and car. This would require some bureaucratic pointless process to prove your identity, and it would be very expensive and frustrating, and completely at the manufacturers will.

Further, if the car CPU could allow this, it would be >.0001 second before theives use the same exact tools that the manufacturers use. This is basically what's happening now with current NFC/Radio Keyfobs. Basic access to existing cpu through canbus makes NFC/Radio moot.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#632

Post by michael1999 »

markhahn wrote: post #29
hoofhearted wrote: post #21

Sooo they have been stealing Infiniti's from my area recently with relative ease allegedly by using a Bluetooth obd2 reader connected to an android tablet running a pirated copy of some Nissan service tech software. Nobody from any of the Infiniti groups is 100% certain how they are doing it, but the best theory out there is above. Just the other night, a crew of dudes stole 3 Q50’s from my neighborhood with relative…

Obviously, we want owners to have full access to their car's CANBUS. So the question is: how should the OBD-2 plug (or wiring) be protected?

Put the powertrain lockout system on a signed and physically protected network segment. Let the headlights, mirrors, etc live on a less secure segment.

This will impose higher costs when replacing these systems, because it will require key management of some kind. Either central cert management (with 20 year expiry?) or local key management. So only impose this on a tiny subnet for the starter/immobilizer.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#633

Post by jbombadil »

Oras wrote: post #519
jbombadil wrote: post #500

There are cars where the security is trivial to bypass. Create a list of those make/models. 1) Raise insurance premium on those models. 2) Force dealers that every time they sell such a car, they must get a signature from the buyer on a piece of paper that says "I recognize that the security of this car is borderline non existent and I will be paying a lot more in insurance because my car is trivial to steal". Grandf…

You know there is a manufacturer who doesn’t offer insurance to their own cars. I don’t think it has stoped people from buying https://youtu.be/RCR-5-rf3MM?si=0vFozL7NKMC14NB2 00:29

Lol.

I don't think that'd even be an issue. A manufacturer wouldn't be allowed to offer insurance directly to customers in Canada. At least in BC there are mandatory insurance through ICBC.

So if the intent of the government is to increase security, make those cars less appealing by making them more expensive.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#634

Post by franga2000 »

alexb_ wrote: post #616
creaturemachine wrote: post #608

Earlier quoted context omitted.

Tik-Tok-inspired Kia thefts weren't a problem in Canada because they've required immobilizers since 2007, something Kia skimped on for the US market.

[flagged]

The manufacturer is not the victim here, the buyer is. If I pay a contractor to install a new door and lock on my apartment and it turns out they did a terrible job which made it trivial for a thief to break in, the contractor should be liable.

Crime exists, this is the world we live in. Failing to implement even the most basic security measure, which is considered industry standard, in a high-value product that is known to be very attractive to thieves and then selling that product to consumers with no warning that "unlike most other cars on the market, which have many layers of security features, this car can be stolen using a cheap toy" makes the inevitable thefts absolutely Kia's fault.

It's not like people are saying the thieves did nothing wrong, both sides are at fault: the thieves stole people's cars to enrich themselves and Kia secretly omitted a basic security feature which in turn enabled thousands of fully predictable and preventable thefts from their customers, again, to enrich themselves.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#635

Post by deepsun »

alexb_ wrote: post #616
creaturemachine wrote: post #608

Earlier quoted context omitted.

Tik-Tok-inspired Kia thefts weren't a problem in Canada because they've required immobilizers since 2007, something Kia skimped on for the US market.

[flagged]

Just use "passw0rd" everywhere. It's the fault of a hacker who steals your account, not your fault. Every single time.

Especially that no security is absolute. Effort matters.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#636

Post by patmorgan23 »

2024throwaway wrote: post #178
keiferski wrote: post #148

Earlier quoted context omitted.

Because the modern Western world is in a "religion hangover" where it wants to reject all outwardly religious ideas, while simultaneously denying that a) religions have been the foundation of pretty much all ethical behavior since the beginning of civilization and b) many supposedly secular belief systems are really just extensions of religious ones with the "I believe in..." statement cut off.

> religions have been the foundation of pretty much all ethical behavior since the beginning of civilization I reject this statement wholeheartedly, and find it a pretty disgusting stance. The idea that the only reason not to kill someone (or otherwise act ethically) is due to religion is horrendous, especially given most religions historical track record on murdering others and other ethical violations.

How many European states where founded as theocratic monarchys? The United States is found on the idea that "All men are created equal, and endowed by their creator (God) with certain unalienable rights"

Yes people have done horrible things in the name of religion. But you still can't talk about morality without talking about religion. (And I'm an atheist)

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#637

Post by topspin »

anigbrowl wrote: post #615
topspin wrote: post #595

Earlier quoted context omitted.

I had exactly the opposite reaction. Tools like flipper zero are trivial. Banning these make as much sense as banning the next designer drug. Yet that's the idiocy we default to, and the logical conclusion is the "War On Electronics." Manufacturers have been reckless, featurizing their products and ignoring basic expectations of their customers. It isn't unreasonable to expect that some low life knucklehead can't jus…

I don't disagree with the premise that car manufacturers should do better, but the same people that insist messing around with a Flipper Zero is Serious Business tend to be the same people who say regulation of things like vehicle standards and an unwelcome interference with the free market. I stand by my claim that the headline reflects a childish mindset instead of looking at both sides of the issue.

> the headline reflects a childish mindset

The mature mindset being the frictionless acceptance of new laws to empower more minders and more law enforcement to utterly fail at preventing new "crime."

Understood.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#638

Post by sonicanatidae »

alexb_ wrote: post #616
creaturemachine wrote: post #608

Earlier quoted context omitted.

Tik-Tok-inspired Kia thefts weren't a problem in Canada because they've required immobilizers since 2007, something Kia skimped on for the US market.

[flagged]

You are conflating "what's right" and "how the world actually works".

Trust me. I have similar issues, to a clinical level, in fact.

Does this sound familiar?

https://en.wikipedia.org/wiki/Obsessive%E2%80%93compulsive_p...

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#639

Post by gchamonlive »

engineer_22 wrote: post #505
gchamonlive wrote: post #435

Earlier quoted context omitted.

If by social danger you mean I would be really impressed if you managed to throw a flipper zero into someone and kill him, then yes that is the gist. It's a matter of degree.

ok - well I agree with you. You had a good comment, and I appreciate it :)

cheers! I also liked to be put to test in whatever argument I find myself in. Hope it was as interesting for you as it was for me.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#640

Post by sonicanatidae »

whycome wrote: post #622
fargle wrote: post #583

stupid on stupid. - it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem - but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you fo…

Let's say a hardware exploit for iPhones becomes obvious and is spread through social media. Something absurd like "attaching a shorted iphone cable". Are you going to be the first to buy an add-on lock or immobilizer? And everyone should also have to purchase an add-on?

>And everyone should also have to purchase an add-on?

Yes!

-Apple

Post reply on HN