Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

21–30 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#21

Post by connicpu »

_yb2s wrote: post #16
willis936 wrote: post #7

Earlier quoted context omitted.

I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling t…

Does it actually never connect with the antenna disconnected? Most wireless receiving devices I’ve used will generally still work a bit with no antenna.

In the case of starlink, it's completely useless without the phased array antenna because the signals are highly directional.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#22

Post by jeroenhd »

bilekas wrote: post #19

> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

> Number 1 why you need a car connected to the internet all the time

To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot.

> And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

Legally speaking, I believe that depends on your local privacy laws. Practically speaking, car makers (and government agencies) love these features for troubleshooting and tech support, or for flagging crashes before any authorities or local press have time to arrive (think Tesla).

Don't ask them about finding your stolen car, though. Then the data may suddenly not be available.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#23

Post by TheJoeMan »

inetknght wrote: post #8
plagiarist wrote: post #5

I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.

> I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. Moreover, not just millions of dollars in aggregate, but millions of dollars per individual customer whose privacy was violated.

If I collected this much information about a single individual, I would go to jail for stalking. But with the wonders of technology, I can stalk "at scale"!

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#24

Post by willis936 »

_yb2s wrote: post #16
willis936 wrote: post #7

Earlier quoted context omitted.

I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling t…

Does it actually never connect with the antenna disconnected? Most wireless receiving devices I’ve used will generally still work a bit with no antenna.

The screen shows a no signal symbol. I seriously doubt that a cell protocol could lock with just an exposed coax. The truly paranoid could stuff a piece of foil in the coax connector to short it to ground.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#26

Post by Cumpiler69 »

mavdi wrote: post #20

Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.

[flagged]

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#27

Post by bilekas »

jeroenhd wrote: post #22
bilekas wrote: post #19

> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

> Number 1 why you need a car connected to the internet all the time To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot. > And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will. Legally speaking, I believe that depends on your…

> To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot

I really hope this was sarcastic. How did we ever manage to find our cars before IoT cars …

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#28

Post by ziddoap »

Is anyone aware of a list of affected models posted anywhere? All 2015+ models?

Obviously the ability to pull up account history, previous owners, etc. is applicable to anyone with a Subaru.

But I'm curious if location history shows up for people that have Subarus and never registered Starlink/never used the app. The author says:

>but it seemed that we had agreed to the STARLINK enrollment when we purchased it.

But it's not clear to me whether "it" refers to purchasing Starlink or purchasing the vehicle.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#29

Post by aftbit »

like_any_other wrote: post #2

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased i…

I was lucky to have the DCM in my 2019 Outback (which is responsible for cellular communication and thus this whole STARLINK thing) replaced with a bypass box under the warranty program related to the end of 3G service. My car was trying to go online 30 times an hour or something like that, draining the battery enough that it needed to be replaced after just 4 years. They don't have enough new DCMs so they were willing to replace it with a bypass box instead, which seems even better to me.

So at least my Subaru cannot connect to the cloud anymore. I'm sure it still stores location and telemetry data for insurance fraud reasons though.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#30

Post by Cerium »

ziddoap wrote: post #28

Is anyone aware of a list of affected models posted anywhere? All 2015+ models? Obviously the ability to pull up account history, previous owners, etc. is applicable to anyone with a Subaru. But I'm curious if location history shows up for people that have Subarus and never registered Starlink/never used the app. The author says: > but it seemed that we had agreed to the STARLINK enrollment when we purchased it. But…

Purchasing the vehicle.
Post reply on HN