Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

31–40 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#31
post #16

Earlier quoted context omitted.

Does it actually never connect with the antenna disconnected? Most wireless receiving devices I’ve used will generally still work a bit with no antenna.

In the case of starlink, it's completely useless without the phased array antenna because the signals are highly directional.

Wrong Starlink. Subaru's is cellular based, not space.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#32

I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.

This is the way. What legitimate interest could Subaru have in maintaining this much data about their customers?

The same thing all car manufacturers are after... AI. And I'm not joking this time.

Cars have become a commodity, especially since China made their first vehicles that didn't get outright banned in Europe for being too unsafe to be roadworthy, and even some nominally "entry level" cars have more horsepower under the hood than a 1990s 7-series BMW (138 kW). Strict requirements on emissions, fuel consumption and crash safety have all but eliminated differences in optics (the amount of shapes is finite). So the only thing left to differentiate other than build quality (where China is rapidly catching up) is assistance systems... and there, AI is the hot craze, and AI only works when it has insane amounts of data to gobble up.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#33
post #16

Earlier quoted context omitted.

Does it actually never connect with the antenna disconnected? Most wireless receiving devices I’ve used will generally still work a bit with no antenna.

In the case of starlink, it's completely useless without the phased array antenna because the signals are highly directional.

Subaru Starlink is not the same as SpaceX Starlink.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#34
post #20

Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.

[flagged]

I've heard of this claim so often that I assume it to be true, though personally I've only had the fortune to work in better environments where my Indian colleagues aren't nepotistic. I suspect this might be related to the hiring bar: if a company only hires the top talent perhaps this would not be an issue.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#35
post #3

How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?

It depends on the car, but yes, you can pull a fuse. The component is called the DCM. If you do that though, you'll lose the front speakers and the microphone, which are routed through the DCM to support STARLINK-based cellular calls (like OnStar). The better solution is to disassemble the dash and replace the DCM with a bypass box, or yoink the cellular antenna cables as others have said. That's a bit of work for sure. I was lucky to have it done by Subaru under warranty service, in response to the 3G cell shutdown causing the DCM to malfunction and drain the battery.

Here's a chart of DCM fuse location by vehicle:

https://www.subaruoutback.org/threads/dcm-fuse-location-2020...

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#36
post #3

How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?

I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling t…

(note: Subaru trademark "STARLINK"(2012) predates and is unrelated to SpaceX trademark "Starlink"(2017))

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#37
post #14

Buying a car that is connected to the internet sounds horrific.

You'll have a hard time avoiding it if you buy a new car: https://foundation.mozilla.org/en/privacynotincluded/categor...

Don't buy a new one. Buy old one and remove all tracking devices if necessary.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#38
This claims to bypass the telematics functionality:

https://www.autoharnesshouse.com/69018.html

> Note for customers retaining OEM headunit: This adapter can also be used for those wishing to remove/disable the OEM Subaru Telematics functions. This is done to eliminate the tracking cabability that Subaru has built into these vehicles. If this is you, we will need to add an additional part to this adapter to re-enable the bluetooth microphone. Please purchase the option 2 adapter near the bottom of this page for this situation.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#39
post #34

Earlier quoted context omitted.

[flagged]

I've heard of this claim so often that I assume it to be true, though personally I've only had the fortune to work in better environments where my Indian colleagues aren't nepotistic. I suspect this might be related to the hiring bar: if a company only hires the top talent perhaps this would not be an issue.

Unfortunately I think it depends on the number and position of Indian folks.

Small numbers where you deal with people individually, I've not seen issues and it's nice to work with Indian devs.

In larger numbers or when in charge of hiring, there seems to be a prevalent issue of Indian cultural norms and favors kicking in and it can happen fast.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#40
post #29

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased i…

I was lucky to have the DCM in my 2019 Outback (which is responsible for cellular communication and thus this whole STARLINK thing) replaced with a bypass box under the warranty program related to the end of 3G service. My car was trying to go online 30 times an hour or something like that, draining the battery enough that it needed to be replaced after just 4 years. They don't have enough new DCMs so they were willi…

That's avg time to replace a battery.
Post reply on HN