Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

11–20 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#11

I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.

This is the way. What legitimate interest could Subaru have in maintaining this much data about their customers?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#12
post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

Or not requiring ANYTHING to authenticate in your forgetPassword endpoint, but being able to set a new password directly instead of sending a randomly generated per email / send a one time token to reset the password yourself via email

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#13
post #3

How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?

I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling t…

This is absolutely my biggest concern for when I inevitably am forced to replace our aging vehicles. The unfortunate reality of living in the Northeast is that it's near impossible to find decent (not rusted) older cars for sale. Sure, I'm within the 99.9999% of Americans who have nothing to hide, but that unequivocally does not justify the physical capability of remote monitoring or control.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#15

I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.

This is the way. What legitimate interest could Subaru have in maintaining this much data about their customers?

The most charitable guess I can make is that they use it to improve their driver assist, lane keeping, pacing, and that sort of thing.

location and g force and direction when the automated system shuts off and returns control to the driver, that sort of thing. I don't agree with it, but that would be my guess.

I own a Subaru that does this, so I'm not happy about it, but what can I do?

That's rhetorical.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#16
post #3

How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?

I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling t…

Does it actually never connect with the antenna disconnected? Most wireless receiving devices I’ve used will generally still work a bit with no antenna.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#17
post #13

Earlier quoted context omitted.

I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling t…

This is absolutely my biggest concern for when I inevitably am forced to replace our aging vehicles. The unfortunate reality of living in the Northeast is that it's near impossible to find decent (not rusted) older cars for sale. Sure, I'm within the 99.9999% of Americans who have nothing to hide, but that unequivocally does not justify the physical capability of remote monitoring or control.

Why not just take a weekend to fly to where used cars are unrusted, and drive one back?

Also, there are quite a few well made older cars that are fully galvanized and don’t rust. I know a few people in the Northeast still driving 1980s Volvo 740s, still unrusted after nearly 40 years of salty roads. 1987 and later had the best rustproofing. I believe many older Audis also are galvanized.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#18

I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.

This is the way. What legitimate interest could Subaru have in maintaining this much data about their customers?

Unfortunately, selling it to repo men is a widely accepted practice.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#19
> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it.

This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#20
Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.
Post reply on HN