Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

141–150 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#141

Post by insane_dreamer »

preisschild wrote: post #12
netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

Or not requiring ANYTHING to authenticate in your forgetPassword endpoint, but being able to set a new password directly instead of sending a randomly generated per email / send a one time token to reset the password yourself via email

This one was especially egregious.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#142

Post by arrowleaf »

rjmunro wrote: post #52

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously . How did they verify the never exploited maliciously part? Did the person who's password they changed ever notice that their password didn't work any more and report the problem?

Assuming `samwcurry@gmail.com` belongs to the same person who owns samcurry.net, they changed their own password.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#143

Post by reginald78 »

ben7799 wrote: post #107

I have a 2013 Outback Limited that is basically right before all this stuff got really stupid and weird. It's a great car other than it's not very fast and it gets really bad gas mileage. Amazing in the snow. I have had it since December 2012, so I've had plenty of service visits where I got newer loaners. (I special ordered my car to basically load it but not have Starlink, not have the Sunroof, but have the leather…

We actually own two Outbacks, a 2011 and a 2019. Both my wife and I hate the touchscreen system in the 2019, it is full of irritating bugs and even the physical climate controls (which IIRC were going away for the 2020 model year) have horrible indicators of their status compared to the older one.

I'd say the backup camera is a welcome addition for the newer one but if the roads are even remotely dirty the camera almost immediately becomes totally obscured rendering it useless, which around here occurs at least half the year.

Combined with the battery drain issue I will probably not buy another one. At the most I'll give them a test drive to see if the control system has been returned to some semblance of sanity. Unfortunately all new cars seem to be privacy nightmares so I'm not sure how I'll avoid that.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#144

Post by oremolten »

blackeyeblitzar wrote: post #79

A shocking thing about Subaru cars with Starlink (their infotainment system and connected service for things like remote start) is how deep the violation of privacy is. For example they share your location data with Sirius XM by default, unless you go deep in their menus to realize it’s even happening and opt out. They bury the consent in fine print that you fly through at the dealership. Truly a despicable company.

all car companies do this since around 2011.(in the us) they also immediately sell all this data to car insurance companies. many apps on your phone that use location data for anything are mostly using an APK that includes a couple car insurance companies code that also just directly shares that with them. (they made the location APK for app makers to have an easy to use location data tool)

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#145

Post by Cumpiler69 »

fullofideas wrote: post #83
Cumpiler69 wrote: post #58

Earlier quoted context omitted.

For one, I didn't say "all Indians" are bad apples, just that the nepotism and cast issues are rampant enough that it's a know issue at this point in the tech industry where Indians are sometimes overrepresented. Secondly, do you expect people to post links to all cases of Indian nepotism/cast issues in the tech industry, when Google is at your fingertips with enough cases that it's not an isolated incident? That lin…

Fair enough that you did not say all Indians. But, your statement was broad enough to say nepotism is widespread among Indians in tech. And the article you linked was about fraud which doesn’t imply widespread nepotism in tech. I am not asking for articles for all instances but something that is more relevant to the point that you are making.

Sure, but if an group of Indian employees within Apple US are going out of their way to scam their employer for money, it's another black mark on the graph for that demographic being into unethical activities, since then you can't say anymore "well it's just one rouge bad apple, not representative for the whole group" when it's a coordinated effort of a whole group.

If they're wiling to go that far to scam their employer it's not a far fetch the fact they're also into nepotism when hiring.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#147

Post by _yb2s »

potato3732842 wrote: post #57
_yb2s wrote: post #17

Earlier quoted context omitted.

Why not just take a weekend to fly to where used cars are unrusted, and drive one back? Also, there are quite a few well made older cars that are fully galvanized and don’t rust. I know a few people in the Northeast still driving 1980s Volvo 740s, still unrusted after nearly 40 years of salty roads. 1987 and later had the best rustproofing. I believe many older Audis also are galvanized.

The best galvanization was in the 80s when the OEMs were scrambling in the "surprise, lead just got banned" era (lead acts like an anode, think of it like a lesser version of a high zinc primer). That said, it's not the thick hot dip you see on I beams or on bolts at the hardware store and a modern car with modern coatings and attention to corrosion is still better. Of the three continents that produce a lot of cars…

Just as a warning- one needs to be willing to dish out the cash for one of these high end 80s European cars: they can sometimes cost hundreds of dollars. Really nice examples can cost more than their value by weight as scrap steel. And, although most are still going strong, it's possible some only have another 30-40 years of usable life left before needing major repairs, possibly even sooner if they have over a million miles already. A good running used engine or transmission for one can easily cost over $100- so one should also budget for that down the road as well.

I just didn't want to get anyones hopes up on here, thinking they could easily afford one on a software engineer salary.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#148

Post by t1234s »

duxup wrote: post #130
t1234s wrote: post #129

Having developed back end portals like this one for much smaller companies I find it hard to believe that there is an open endpoint to reset a password without any type of verification. What goes wrong in development that this type of crap makes it to production?

It's weird, is there no feedback of any kind in these companies? All outsourced maybe? I don't get it. That would be a huge red flag and a fairly easy to understand / sell red flag.

Even if it was outsourced is there zero quality control?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#149

Post by anarticle »

t1234s wrote: post #148
duxup wrote: post #130

Earlier quoted context omitted.

It's weird, is there no feedback of any kind in these companies? All outsourced maybe? I don't get it. That would be a huge red flag and a fairly easy to understand / sell red flag.

Even if it was outsourced is there zero quality control?

Outsourcing means you want to impose an upper limit on the cost of the feature/software. Quality control may cost more, so yes!

The acceptance criteria are: service portal needs to work so employees can do xyz. The design is terrible but "works"!

Having to rearc after these terrible designs would cost more, so you can see where this is going...

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#150

Post by reaperman »

dv_dt wrote: post #94
bilekas wrote: post #19

> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

There was a recent HN posting on the US banning Chinese car brands from being connected to the internet. https://news.ycombinator.com/item?id=42706212 If Chinese companies comply with the ban by providing car models without internet connectivity, it's hilarious to me that that the nationalist regulation could make Chinese branded vehicles more desirable from a security & privacy standpoint.

The current 100% tariff on Chinese EV’s will negate that advantage for American consumers.
Post reply on HN