Hacking Subaru: Tracking and controlling cars via the admin panel • Hacker News Board

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#121

Post by reaperducer » Thu, Jan 23, 2025, 4:57 PM UTC

beezle wrote: post #59

jeroenhd wrote: post #22

Earlier quoted context omitted.

> Number 1 why you need a car connected to the internet all the time To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot. > And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will. Legally speaking, I believe that depends on your…

Just as an aside - a friend had their car nicked in NYC this winter. He was able to tell the cops the car location from some Toyota find my car type thing. The cops said they saw nothing on the street so unless he could come and make the horn beep infront of a garage - and then get a warrant - there was nothing more to do. He now has a new vehicle.

a friend had their car nicked in NYC this winter. He was able to tell the cops the car location from some Toyota find my car type thing. The cops said they saw nothing on the street so unless he could come and make the horn beep infront of a garage - and then get a warrant - there was nothing more to do.

Here's the way it's done with Volvos (from the manual):

   If the vehicle has been stolen or otherwise used without permission, the vehicle's owner, police and Volvo Assistance can agree to track the vehicle.
 
   Note
   This applies even if the vehicle has been opened and stolen using the associated remote key.
   
   The following needs to be done:

   1. Contact Volvo Assistance and say that you need help tracking the vehicle. Tracking begins.
   2. File a police report.
   3. Contact Volvo Assistance again and give them the police case number.
   4. Volvo Assistance notifies the police of the vehicle's location.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#122

Post by ben7799 » Thu, Jan 23, 2025, 4:59 PM UTC

DwnVoteHoneyPot wrote: post #114

ben7799 wrote: post #107

I have a 2013 Outback Limited that is basically right before all this stuff got really stupid and weird. It's a great car other than it's not very fast and it gets really bad gas mileage. Amazing in the snow. I have had it since December 2012, so I've had plenty of service visits where I got newer loaners. (I special ordered my car to basically load it but not have Starlink, not have the Sunroof, but have the leather…

In addition to your comments, I think Subaru's all-wheel drive system has been switched to electrical instead of mechanical, making it worse. There are roller tests on youtube which show Subaru AWD being outperformed by Ford AWD systems.

They have different AWD systems in different vehicles and for some vehicles there is more than one system depending on which transmission you purchased. (At least when there was a choice)

Mine is electrically controlled (and many Subarus are) but it's still connected full time. IME driving other electrically controlled non-full time systems what you feel in those are the electrically controlled clutch packs completely disconnect the rear wheels and the AWD is 100% disabled until the traction control system kicks in. Then you get a brief moment where the car feels out of control until the clutch activates the AWD. The tradeoff is that system that completely disconnects the rear wheels results in those vehicles (E.x. Honda/Toyota) getting much better fuel economy than Subarus as they operate as front-wheel drive almost all the time.

I have never been in any Subaru that behaved that way. And a roller test is not where it matters anyway. Roller tests are contrived. Where you feel the difference between permanent AWD and part-time AWD is medium and high speed situations where the vehicle starts to lose control. Most people will never put any family crossover/SUV into a situation anywhere close to the roller tests or hill ascent tests.

All of this seems to become completely meaningless with EVs being the future.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#123

Post by stuff4ben » Thu, Jan 23, 2025, 5:01 PM UTC

As a DevSecOps/SRE whatever, I just gotta give props to the Subaru team for getting it patched within 24 hours. While it's just a small internal admin dashboard without real customer usage, the fact they acknowledged and fixed the issue so quickly speaks well of at least that part of Subaru IT.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#124

Post by numpad0 » Thu, Jan 23, 2025, 5:01 PM UTC

duxup wrote: post #41

mavdi wrote: post #20

Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.

I love my Subaru as far as reliability, all wheel drive performance in snow and ice, and such. But OMG it's consumer tech was dated when I bough it, and it's just full of inexplicable issues and caveats and such. Even just the limitations and the UX issues are so obvious that it sends a message that if they tried to fix them they would introduce just as many new issues. I'm at the point where despite the car being go…

I suspect it has to do with slow adoption of CarPlay/Android Auto in Japan - everyone still options aftermarket infotainment at dealerships and happier about it than with phone-based experiences. From a random Google search result[1]:

  > More than three-fourths (79%) cite the built-in navigation system. However, this percentage has decreased from 81% in 2022 and 82% in 2021. Use of Android Auto/Apple CarPlay apps is increasingly the preferred system, with 7% of users citing this in 2023, compared with 5% in 2022 and 3% in 2021.

That's like 80% CP/AA adoption by 2060.

UI/UX and especially overall experience polish had always been a major challenge for Japanese engineering. Everything is committee designed in perpetual intra-company tug of war, and it shows as a "family sized mega pack" UI consists of bunch of snippet codes each with an attention grab dialog to prove its worth. That was clearly one of major causes that led to total collapse of domestic phone industry and iPhone dominance, but I suppose it hasn't affected car infotainment, or mass market cars in general.

1: https://japan.jdpower.com/sites/japan/files/file/2023-11/202...

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#125

Post by MisterTea » Thu, Jan 23, 2025, 5:02 PM UTC

aftbit wrote: post #49

bongodongobob wrote: post #40

Earlier quoted context omitted.

That's avg time to replace a battery.

Hmm really? My Camry made it nearly 10 years, and my Civic still had a good battery 6 years in when I sold it. Regardless, the battery and DCM were both tested by Subaru. The battery tested bad, and the DCM tested for a high parasitic draw. I drove the car daily, and the battery would die if I didn't drive it for 4 days. I didn't just make this up either, search "DCM parasitic draw" on Google for more. Subaru even se…

Depends on the battery and how it was (ab)used. I have seen batteries last only 3 years or as long as 7.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#126

Post by therealfiona » Thu, Jan 23, 2025, 5:05 PM UTC

That's it... I'm not buying a car with any internet connection unless I can rip it out. And every day that's going to get harder.

Guess I'll stick with old Kai Vans...

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#127

Post by eptcyka » Thu, Jan 23, 2025, 5:08 PM UTC

js2 wrote: post #90

blackeyeblitzar wrote: post #81

Earlier quoted context omitted.

Subaru infotainment is also very controlling. Want to use the keypad while you’re taking a phone call on the go? No, it won’t let you if the car is moving. You’ll need to use your phone’s UI. Other CarPlay cars don’t do this.

My 2017 Mazda with CarPlay does something similar. It truncates any lists (songs, podcast episodes, contacts, etc) that CarPlay displays to 10 items. All it does is incentivize folks to use their phone. It's incredibly annoying because the Mazda command dial for interacting with CarPlay is otherwise excellent and I don't think that limiting the list size does anything to reduce distraction.

It is an incentive to use Siri. You can’t actually use carplay if Siri is disabled.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#128

Post by duxup » Thu, Jan 23, 2025, 5:14 PM UTC

numpad0 wrote: post #124

duxup wrote: post #41

Earlier quoted context omitted.

I love my Subaru as far as reliability, all wheel drive performance in snow and ice, and such. But OMG it's consumer tech was dated when I bough it, and it's just full of inexplicable issues and caveats and such. Even just the limitations and the UX issues are so obvious that it sends a message that if they tried to fix them they would introduce just as many new issues. I'm at the point where despite the car being go…

I suspect it has to do with slow adoption of CarPlay/Android Auto in Japan - everyone still options aftermarket infotainment at dealerships and happier about it than with phone-based experiences. From a random Google search result[1]: > More than three-fourths (79%) cite the built-in navigation system. However, this percentage has decreased from 81% in 2022 and 82% in 2021. Use of Android Auto/Apple CarPlay apps is i…

>UI/UX and especially overall experience polish had always been a major challenge for Japanese engineering.

I can believe it. The whole issue of "Japanese video game companies don't understand the internet" to some extent still feels like it is an issue at times.

For a while it felt like we got late 1990s solutions in the mid 2010s... it's gotten better-ish in the land of video games, but man it's so bad at times still.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#129

Post by t1234s » Thu, Jan 23, 2025, 5:14 PM UTC

Having developed back end portals like this one for much smaller companies I find it hard to believe that there is an open endpoint to reset a password without any type of verification. What goes wrong in development that this type of crap makes it to production?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#130

Post by duxup » Thu, Jan 23, 2025, 5:15 PM UTC

t1234s wrote: post #129

Having developed back end portals like this one for much smaller companies I find it hard to believe that there is an open endpoint to reset a password without any type of verification. What goes wrong in development that this type of crap makes it to production?

It's weird, is there no feedback of any kind in these companies?

All outsourced maybe?

I don't get it. That would be a huge red flag and a fairly easy to understand / sell red flag.