Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

41–50 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#41

Post by duxup »

mavdi wrote: post #20

Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.

I love my Subaru as far as reliability, all wheel drive performance in snow and ice, and such.

But OMG it's consumer tech was dated when I bough it, and it's just full of inexplicable issues and caveats and such. Even just the limitations and the UX issues are so obvious that it sends a message that if they tried to fix them they would introduce just as many new issues. I'm at the point where despite the car being good, I'm not interested in a new one from Subaru.

I just want carplay or android auto whatever similar services a given mobile OS provides to do similar things. That's it, every time it's something else (even when offering car play) from a car maker it is so bad and so naively built that it makes me less confidant in that company.

I know, they want my data and all and that's the motivation, but man it's just such a downer with every system.... and here I am with a good car in most respects and I'm not planning on buying from them again.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#42

Post by godber »

godber wrote: post #38

This claims to bypass the telematics functionality: https://www.autoharnesshouse.com/69018.html > Note for customers retaining OEM headunit: This adapter can also be used for those wishing to remove/disable the OEM Subaru Telematics functions. This is done to eliminate the tracking cabability that Subaru has built into these vehicles. If this is you, we will need to add an additional part to this adapter to re-enable…

The info on that page seems a bit contradictory, but maybe I need more coffee.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#43

Post by t0bia_s »

Imagine that manufacturer can do that without any hacks and your knowledge about data collecting. Now imagine that you sell those cars to foreign countries that your government consider as enemy. I'm curious when there will be some ban of car brand, like TikTok.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#44

Post by bean-weevil »

netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

It may well be over the line, but it sounds like subaru is grateful for the report, so nothing will come of it. Definitely not a risk I would take.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#45

Post by connicpu »

Meneth wrote: post #33
connicpu wrote: post #21

Earlier quoted context omitted.

In the case of starlink, it's completely useless without the phased array antenna because the signals are highly directional.

Subaru Starlink is not the same as SpaceX Starlink.

Well that's highly confusing. I'm surprised there wasn't a trademark dispute.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#46

Post by _joel »

netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

Glad they had unit and integration tests to make sure that an unauthenticated user couldn't reset passwo... oh, wait...

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#47

Post by _joel »

Mountain_Skies wrote: post #9
netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

Back when I used to do AppSec, these types of issues were extremely common. Software developers and their managers would argue endlessly about them not being real vulnerabilities, which meant I had to put together a proof of exploitability. And since these were interdepartmental fights, office politics get involved. Just one of the dozen or so reasons why I stopped doing AppSec and went back to development.

That seems like a culture issue rather than an appsec issue?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#48

Post by bityard »

godber wrote: post #38

This claims to bypass the telematics functionality: https://www.autoharnesshouse.com/69018.html > Note for customers retaining OEM headunit: This adapter can also be used for those wishing to remove/disable the OEM Subaru Telematics functions. This is done to eliminate the tracking cabability that Subaru has built into these vehicles. If this is you, we will need to add an additional part to this adapter to re-enable…

Is there anything like this for Toyota DCM?

We bought a second-hand 2021 Highlander and thus did not sign any contract allowing our family to be tracked by Toyota. I went on a hunt recently for information on neutering the DCM but have thus far only found speculation and contradictory info.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#49

Post by aftbit »

bongodongobob wrote: post #40
aftbit wrote: post #29

Earlier quoted context omitted.

I was lucky to have the DCM in my 2019 Outback (which is responsible for cellular communication and thus this whole STARLINK thing) replaced with a bypass box under the warranty program related to the end of 3G service. My car was trying to go online 30 times an hour or something like that, draining the battery enough that it needed to be replaced after just 4 years. They don't have enough new DCMs so they were willi…

That's avg time to replace a battery.

Hmm really? My Camry made it nearly 10 years, and my Civic still had a good battery 6 years in when I sold it.

Regardless, the battery and DCM were both tested by Subaru. The battery tested bad, and the DCM tested for a high parasitic draw. I drove the car daily, and the battery would die if I didn't drive it for 4 days. I didn't just make this up either, search "DCM parasitic draw" on Google for more. Subaru even sent me a letter outlining my options for repairs.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#50

Post by insane_dreamer »

bilekas wrote: post #19

> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

Remote start, climate etc from the app all require and always on connection (how else?). Tesla has the same thing.

I use the remote app often - quite useful.

Post reply on HN