Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Insecure vehicles should be banned, not security tools like the Flipper Zero

saveflipper.ca

Post reply on HN
Print view View original

651–660 of 916 posts

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#651

Post by jjav »

fargle wrote: post #583

stupid on stupid. - it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem - but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you fo…

Indeed, it is dumb to ban anything.

A tool is a tool, it doesn't make the product weak, it already was.

Also it is silly to ban insecure cars, that's quite the slippery slope. If the cars are too easy to steal insurance will increase accordingly and that will provide incentives to fix that without banning anything.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#652

Post by AnthonyMouse »

franga2000 wrote: post #634
alexb_ wrote: post #616

Earlier quoted context omitted.

[flagged]

The manufacturer is not the victim here, the buyer is. If I pay a contractor to install a new door and lock on my apartment and it turns out they did a terrible job which made it trivial for a thief to break in, the contractor should be liable. Crime exists, this is the world we live in. Failing to implement even the most basic security measure, which is considered industry standard, in a high-value product that is k…

> Failing to implement even the most basic security measure, which is considered industry standard, in a high-value product that is known to be very attractive to thieves and then selling that product to consumers with no warning that "unlike most other cars on the market, which have many layers of security features, this car can be stolen using a cheap toy" makes the inevitable thefts absolutely Kia's fault.

I don't think this logic works. If you buy a classic vehicle, they don't have these kinds of things either. People make replicas that likewise don't. And there is no clear line here. Basically any car can be stolen by, if nothing else, replacing the car's computer with one that accepts the thief's key.

Meanwhile a car is a large purchase where people can reasonably be expected to do some research. If you're about to buy a car you should read some reviews, and the reviewers should tell you if their security is bad. Then you know and can make your decision. People who learn of this may want to buy a different car, or take some other countermeasures if they buy this one.

Kia doesn't have any kind of a monopoly in this market. There are many other carmakers. Maybe you don't care that their security is bad because you always park your car in a garage. Maybe you like the discount you got because other buyers wanted a car with better security. Why does it have to be illegal, instead of letting the market sort it out in the presence of actual competition?

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#653

Post by 0x457 »

K0balt wrote: post #594
raizer88 wrote: post #47

Earlier quoted context omitted.

All CANBUS packages that are useful to drive a car should be encrypted using a public/private key that is in the owner key. Decryption chips are cheap and fast.

CANbus protocol makes this hard. Payloads are limited to 64 bits, to start with. But the payload for each message could be encrypted, even though secure key exchange would be difficult. Even so, it would be possible, I think.

It's so hard that (almost) every European manufacturer figured it out.

There is also FlexRay. There is nothing interesting you can do with CANbus on new mercs. Even unencrypted CANbus messages go through gateways that (could) prevent headlights from reporting key presence.

There is a reason that some cars don't have reasonable attack vectors (excluding parachuting the driver out of the car) and some can be started with a screwdriver (or slight more involved way with CANbus). It's not complexity, it's cost.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#654

Post by FerretFred »

rale00 wrote: post #623
fargle wrote: post #583

stupid on stupid. - it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem - but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you fo…

> if kia makes a cheap car with crappy locks either don't buy it Immobilizers were a standard feature on cars for decades. If you went to buy a car, no one was putting immobilizer on the list of features, and they certainly wouldn't let you try breaking the ignition lock on a test drive. If they had advertised that their vehicles were insecure, then sure, it's on the buyer, but they didn't.

How about Jaguar Land Rover making expensive cars with allegedly crappy locks? https://www.mirror.co.uk/news/uk-news/range-rover-owners-str...

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#655

Post by cogman10 »

markhahn wrote: post #29
hoofhearted wrote: post #21

Sooo they have been stealing Infiniti's from my area recently with relative ease allegedly by using a Bluetooth obd2 reader connected to an android tablet running a pirated copy of some Nissan service tech software. Nobody from any of the Infiniti groups is 100% certain how they are doing it, but the best theory out there is above. Just the other night, a crew of dudes stole 3 Q50’s from my neighborhood with relative…

Obviously, we want owners to have full access to their car's CANBUS. So the question is: how should the OBD-2 plug (or wiring) be protected?

You don't protect the wiring, you protect the start protocol. Similar to asking "Can we protect the internet by protecting the ethernet cables?"

Put a public key on the engine controller, have it challenge the key with a random start number, have the key respond with the signature of that number, engine starts.

You can do that challenge over the can bus.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#656

Post by joe_the_user »

fargle wrote: post #583

stupid on stupid. - it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem - but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you fo…

Sure "don't ban anything", if your car crashes and kills you, "should have read Consumers' Reports". Those botulism eggs? Keep an eye things, damn it. /s

This ill-informed attitude goes over well here unfortunately.

And security may not be quite as pressing safety but poor security cost society besides costing the individual. When poor workers can't get to work 'cause stolen car, their bosses also suffer, when stolen cars are used in further you also get a social cost. etc.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#657

Post by WWLink »

jjav wrote: post #651
fargle wrote: post #583

stupid on stupid. - it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem - but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you fo…

Indeed, it is dumb to ban anything. A tool is a tool, it doesn't make the product weak, it already was. Also it is silly to ban insecure cars, that's quite the slippery slope. If the cars are too easy to steal insurance will increase accordingly and that will provide incentives to fix that without banning anything.

Hrmm I wonder what would happen if I made a bank that used an unencrypted website for online banking lol.

The problem with your solution here where the insurance company raises rates... yea they already did that with regards to Kia/Hyundai cars and Kia Boyz thefts. The problem is, well, put it this way...

The last time you bought a car, did you check that the car had immobilizer software/hardware present on it? They don't really advertise that stuff anymore. About the only way you'd know on some brands is a nondescript red dot that shows up for a moment when you start the ignition.

Really, I'd bet a lot of people only found out their car didn't have an immobilizer feature until their insurance company dropped them or jacked their rates up... and that's a problem. See, you can buy a car NOW, and everyone thinks it's a good safe car.. until it turns out it wasn't.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#658

Post by hn_acker »

lithos wrote: post #201
sokoloff wrote: post #128

Earlier quoted context omitted.

I'm struggling to connect how the banning of security tools would be a violation of the (US) second amendment. A violation of the first, fourth, and ninth? I can see that. A propensity to violate the fifth? I can see that. But I can't see a strong connection to the second.

There was a point in the US where encryption was barred from export based on arms export laws. Lots a pretty famous open source stories from such. So it's not far fetched at all for the most part. Though this is in US law, not Canada as related to the news story.

> There was a point in the US where encryption was barred from export based on arms export laws.

Are there any US court cases that suggested treating encryption as something covered by the Second Amendment? It would be more strange than putting malware under the Second Amendment. I can appreciate the gotcha of "if the US government defines encryption as arms then the second amendment applies" to disincentivize such a definition, but the government could simply call encryption something other than "arms" and thus avoid the Second Amendment.

I think the general consensus in the US is that encryption falls firmly under the First Amendment. It's not as if the First and Second Amendments are necessarily mutually exclusive with respect to any given tool, but I think case law is such that the Second Amendment doesn't apply to encryption.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#660

Post by happytiger »

GuB-42 wrote: post #617

> Security tools like Flipper Zero are essentially programmable radios, known as Software Defined Radios (SDRs) The Flipper Zero is not a SDR, it is less capable than that. That's the ironic part, the Flipper Zero is a rather weak hacking tool. It can open car doors, but it is so impractical that it is not much more than a party trick. You have to record the code by pressing the button on the keyfob out of range of t…

The idea of banning the flipper is like banning legos because you can build lockpicks out of them — it’s just nonsensical politician logic.
Post reply on HN