Hacking Subaru: Tracking and controlling cars via the admin panel
1–10 of 334 posts
Re: Hacking Subaru: Tracking and controlling cars via the admin panel
#2> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously.
So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car?
> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it.
Assuming it's possible to not agree to it - does that completely disable the system, or is everyone with a Subaru just one warrant away from getting locked in their car until the police can come to arrest them? Does the car still store (I'm charitably assuming it doesn't transmit) location data, so all your friends can retroactively be identified and arrested as well, even if you never agreed to any tracking?
(To get ahead of the usual retort - haha yes, phones also track this data, therefore let's not fix any problems unless we can fix all of them at the same time. But actually let's use the other problems as an excuse to do nothing.)
Re: Hacking Subaru: Tracking and controlling cars via the admin panel
#3How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?
Re: Hacking Subaru: Tracking and controlling cars via the admin panel
#4Hah, them being able to bypass the 2FA by commenting-out the line:
$('#securityQuestionModal').modal('show');
is... mind-boggingly stupid of whoever got the job to write that Starlink web-app.
OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?
Re: Hacking Subaru: Tracking and controlling cars via the admin panel
#5I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.
Re: Hacking Subaru: Tracking and controlling cars via the admin panel
#6For those who might not read the article, note that “Starlink” is not the SpaceX service. It’s an internal name for a Subaru customer service web app.
Re: Hacking Subaru: Tracking and controlling cars via the admin panel
#7How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?
I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible.
Pulling the antenna cable is the right move.
Fun fact on car GPS: it actually feeds back through carplay so your navigation gets worse without it. What I have yet to figure out is if the network connection is given to the car through carplay.
Re: Hacking Subaru: Tracking and controlling cars via the admin panel
#8I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.
> I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner.
Moreover, not just millions of dollars in aggregate, but millions of dollars per individual customer whose privacy was violated.
Re: Hacking Subaru: Tracking and controlling cars via the admin panel
#9Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?
Back when I used to do AppSec, these types of issues were extremely common. Software developers and their managers would argue endlessly about them not being real vulnerabilities, which meant I had to put together a proof of exploitability. And since these were interdepartmental fights, office politics get involved. Just one of the dozen or so reasons why I stopped doing AppSec and went back to development.
Re: Hacking Subaru: Tracking and controlling cars via the admin panel
#10For those who might not read the article, note that “Starlink” is not the SpaceX service. It’s an internal name for a Subaru customer service web app.
> It’s an internal name for a Subaru customer service web app.
It's actually the name of Subaru's connected infotainment system: https://www.subaru.com/vehicle-info/subaru-starlink.html