Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Insecure vehicles should be banned, not security tools like the Flipper Zero

saveflipper.ca

Post reply on HN
Print view View original

721–730 of 916 posts

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#721

Post by acdha »

numpad0 wrote: post #673
acdha wrote: post #546

Earlier quoted context omitted.

Again, all of those lower the value to the thieves. If they need to create a custom engine controller, they’re going to need to pay a lot more than the $0 they currently spend. If they need to replace the entertainment system, the cost of doing so will cut into their margin. Don’t make the mistake of thinking that a system needs to be perfect to be worthwhile.

I think you're in a desktop computer "whole product is one computer" moddel. A car is a set of computers, almost nothing in a car is central to itself. There's probably a body controller ECU that ties into engine ECU and driver's key systems. So theives would just generate and flash a new key/cert, that'll be certainly possible. Infotainment? That's almost literally an aftermarket parts. American reviewers tend to se…

> There's probably a body controller ECU that ties into engine ECU and driver's key systems. So theives would just generate and flash a new key/cert, that'll be certainly possible.

This sounds like the old desktop mentality you mentioned. You can’t just reflash things to bypass a secure boot process – the entire point is to prevent things like that! You’d design the driver’s key to pair with the various onboard systems and those systems to do a challenge-response cycle during the boot process so someone can’t easily drive away without the key or resell those parts, with both sides using a private key which never leaves that component. Yes, that kind of design can still be attacked but the goal here is to make it more expensive than it’s worth: needing a flatbed to take it somewhere for a rogue EE to work on it, for example, just isn’t going to make sense except for the most expensive luxury vehicles.

This brings me to:

> Infotainment? That's almost literally an aftermarket parts.

Yes, and those cost money. The entire point is that you don’t need to make it perfect, just expensive. If someone has to replace the display and speakers, that means they’re making less profit on the sale and making it more obvious that the vehicle was stolen which increases risk and reduces the number of buyers, especially for the most valuable vehicles.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#722

Post by dog_boxer72 »

phpisthebest wrote: post #717
vsuperpower2020 wrote: post #691

Earlier quoted context omitted.

Nobody knows a vehicle is insecure when they buy it. It's simpler, more cost efficient, and more valuable to society just to require cars to have basic security features. Your idea of market correction doesn't work in this case, because it's never advertised as having shitty security, and the average (or even informed) consumer will have no idea this is a problem until after they've bought the car.

In the age of information ignorance is no longer an option, Before I buy a car, most often the second largest purchase a person will make in their life next to housing. I do i TON of research, I look at insurance rates, I look at Theft Rates for that model, I look on Car Complaints and other Database for common failure items for that model, I have it inspected by a independent mechanic having them pay extra attention…

Yes anyone who doesn’t have the knowledge/time/motivation/cynicism to prevent themselves getting taken advantage of is basically asking for it, nay “deserves” it.

/sarcasm

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#723

Post by cyanydeez »

seanmcdirmid wrote: post #560
cyanydeez wrote: post #409

Earlier quoted context omitted.

when we consider wage theft as a significant driver of poverty, punishment for the 13 year old is more useless than anything.

So you would condemn the 13 year old to a (likely short) life of hardship because wage theft is a more important problem?

mmm

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#724

Post by CivBase »

phpisthebest wrote: post #717
vsuperpower2020 wrote: post #691

Earlier quoted context omitted.

Nobody knows a vehicle is insecure when they buy it. It's simpler, more cost efficient, and more valuable to society just to require cars to have basic security features. Your idea of market correction doesn't work in this case, because it's never advertised as having shitty security, and the average (or even informed) consumer will have no idea this is a problem until after they've bought the car.

In the age of information ignorance is no longer an option, Before I buy a car, most often the second largest purchase a person will make in their life next to housing. I do i TON of research, I look at insurance rates, I look at Theft Rates for that model, I look on Car Complaints and other Database for common failure items for that model, I have it inspected by a independent mechanic having them pay extra attention…

Do you look up the software security measures implemented by the keyfob too? That information would be very difficult for a layperson to find and make sense of.

This may be the "age of information", but information is only useful as your ability to find, understand, and evaluate it.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#725

Post by danielheath »

phpisthebest wrote: post #717
vsuperpower2020 wrote: post #691

Earlier quoted context omitted.

Nobody knows a vehicle is insecure when they buy it. It's simpler, more cost efficient, and more valuable to society just to require cars to have basic security features. Your idea of market correction doesn't work in this case, because it's never advertised as having shitty security, and the average (or even informed) consumer will have no idea this is a problem until after they've bought the car.

In the age of information ignorance is no longer an option, Before I buy a car, most often the second largest purchase a person will make in their life next to housing. I do i TON of research, I look at insurance rates, I look at Theft Rates for that model, I look on Car Complaints and other Database for common failure items for that model, I have it inspected by a independent mechanic having them pay extra attention…

> In the age of information ignorance is no longer an option

The age of information was great.

In the age of misinformation, knowledge outside your specialty is no longer cheap enough to reliably obtain.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#726

Post by sgerenser »

dymk wrote: post #720
happytiger wrote: post #660

Earlier quoted context omitted.

The idea of banning the flipper is like banning legos because you can build lockpicks out of them — it’s just nonsensical politician logic.

What kind of lockpick can you build out of legos?

That’s the joke

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#728

Post by technofiend »

strangattractor wrote: post #707
GuB-42 wrote: post #617

> Security tools like Flipper Zero are essentially programmable radios, known as Software Defined Radios (SDRs) The Flipper Zero is not a SDR, it is less capable than that. That's the ironic part, the Flipper Zero is a rather weak hacking tool. It can open car doors, but it is so impractical that it is not much more than a party trick. You have to record the code by pressing the button on the keyfob out of range of t…

At one time is was possible to open car doors with a coat hanger. Nobody suggested banning coat hangers. They fixed the doors.

I locked myself out of my car so often I ended up wedging a coat hanger under the rear bumper. You're right: car doors used to be trivial to yank open when you knew the trick. These days I'd love to create a little side project that sets the alarm off on my car any time a relay attack is detected. I'm sure Mark Rober or someone will end up doing it.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#729

Post by vsuperpower2020 »

phpisthebest wrote: post #717
vsuperpower2020 wrote: post #691

Earlier quoted context omitted.

Nobody knows a vehicle is insecure when they buy it. It's simpler, more cost efficient, and more valuable to society just to require cars to have basic security features. Your idea of market correction doesn't work in this case, because it's never advertised as having shitty security, and the average (or even informed) consumer will have no idea this is a problem until after they've bought the car.

In the age of information ignorance is no longer an option, Before I buy a car, most often the second largest purchase a person will make in their life next to housing. I do i TON of research, I look at insurance rates, I look at Theft Rates for that model, I look on Car Complaints and other Database for common failure items for that model, I have it inspected by a independent mechanic having them pay extra attention…

Car thefts are extremely dangerous for everyone on or near the road. It's obviously better to just not allow car manufacturers to neglect basic security practices. There's also entire categories of issues you don't have to research anymore because they've been optimized out of every modern car. Soon cars being hacked with toys will be added to that list for you. Notably, "airbag explosion rate" wasn't on that research project of yours.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#730

Post by acdha »

kube-system wrote: post #719
jasomill wrote: post #677

Earlier quoted context omitted.

Require resets to be initiated and authorized by the F&I department, whose security and KYC processes should already be substantially similar to those of other institutions that regularly approve $50,000+ loans.

My prediction: 1. As a result, we'll see costs like losing the keys to a rental car go from a $250-500 fee to a $2500-5000 fee, due to the additional costs to process and the additional loss of use. 2. Criminal rings that steal high value cars will go from often using tow trucks, to exclusively using tow trucks. 3. The number of cars stolen via stolen keys will remain unchanged. Yes, the key itself will be more secur…

Your second point is leaving out a lot: there’s no way adding a requirement that you have heavy equipment and a skilled operator isn’t going to reduce the number of thefts, and those trucks are in more limited supply and easier to track than a small tablet. They’re also way less stealthy so there’s a lot more time to get caught.

The third point may be true for classic theft but would not be true for the growing category of thefts caused by abusing wireless keys. If you can’t easily get a new key, the resell value for that car is going down dramatically.

Post reply on HN