Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

191–200 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#191

Post by Melatonic »

olyjohn wrote: post #136
DwnVoteHoneyPot wrote: post #114

Earlier quoted context omitted.

In addition to your comments, I think Subaru's all-wheel drive system has been switched to electrical instead of mechanical, making it worse. There are roller tests on youtube which show Subaru AWD being outperformed by Ford AWD systems.

The CVT in combination with the terrible traction control also kills any chance you have of getting out of a stuck situation. Subaru's AWD system is now mostly just marketing. So it's basically on part with most AWD systems, because most of them really are a joke.

I have a CVT in my 2017 H6 Outback and the traction control is very easy to turn off. Two buttons and both the traction and spin control is off and now it is just AWD with a limited slip differential in the back (feels pretty similar to my 2006 Outback H6 which had no electronic traction control). You can wheelspin all day if you want or feather the throttle or whatever - offroad driving has been amazing

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#192

Post by Gormo »

stn8188 wrote: post #13
willis936 wrote: post #7

Earlier quoted context omitted.

I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling t…

This is absolutely my biggest concern for when I inevitably am forced to replace our aging vehicles. The unfortunate reality of living in the Northeast is that it's near impossible to find decent (not rusted) older cars for sale. Sure, I'm within the 99.9999% of Americans who have nothing to hide, but that unequivocally does not justify the physical capability of remote monitoring or control.

> I'm within the 99.9999% of Americans who have nothing to hide

Let's not encourage the "nothing to hide" arguments here -- the reality is that almost everyone has plenty to hide.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#193

Post by ellisd »

duxup wrote: post #41
mavdi wrote: post #20

Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.

I love my Subaru as far as reliability, all wheel drive performance in snow and ice, and such. But OMG it's consumer tech was dated when I bough it, and it's just full of inexplicable issues and caveats and such. Even just the limitations and the UX issues are so obvious that it sends a message that if they tried to fix them they would introduce just as many new issues. I'm at the point where despite the car being go…

Subaru's in-vehicle entertainment technology has long been criticized, even before features like CarPlay became standard. Take my 2012 WRX, for example—its Bluetooth reception was the worst I've ever experienced in a Bluetooth-equipped vehicle. Audio feeds would randomly pop and drop out during podcasts, even when the phone was within a two-foot radius of the deck.

Over the years, I tried multiple iOS and Android phones, but nothing improved the situation. Ultimately, the only solution was a complete deck replacement. Now, I’m using a "Joying" Android head unit with a rip-off version of CarPlay, which has finally resolved these issues.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#194

Post by parsimo2010 »

like_any_other wrote: post #2

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased i…

No, disagreeing does not completely disable anything, as you can call Subaru at any time and tell them that you want to subscribe, and they can enable Starlink remotely.

I do not know exactly what is transmitted or stored when you do not have an active subscription, but you are one warrant away from having the police ordering Subaru to track your car. But they would probably try this with your cell provider before they try your car manufacturer.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#196

Post by 01100011 »

ben7799 wrote: post #107

I have a 2013 Outback Limited that is basically right before all this stuff got really stupid and weird. It's a great car other than it's not very fast and it gets really bad gas mileage. Amazing in the snow. I have had it since December 2012, so I've had plenty of service visits where I got newer loaners. (I special ordered my car to basically load it but not have Starlink, not have the Sunroof, but have the leather…

I have been stranded twice because of Subaru firmware bugs which they knew about and failed to notify me. First one was the battery charging bug(which still happens even with the firmware fix, just more slowly). The second was the fuel gauge bug. This is a 2017 Outback, my second and last Subaru I'll ever own.

Regarding Starlink, there's actually a battery drain issue on older systems because the 3G modem fails to find a base station (because 3G is deprecated) and drains your battery doing retries. You can remove the Starlink module, but since the Bluetooth microphone and front speakers are routed through it, you'll lose that functionality unless you spend $80 for a dongle to restore them.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#197

Post by KomoD »

hulium wrote: post #180
afh1 wrote: post #160

Earlier quoted context omitted.

All cars in Europe must be connected to the internet at all times by law, to determine their location, in case of an accident the law states. https://europa.eu/youreurope/citizens/travel/security-and-em... In the US a bill was passed requiring driver impairment equipment on all vehicles and automatic deactivation of the vehicle if the driver is determined to be impaired. Current impairment technology monitors head an…

> All cars in Europe must be connected to the internet at all times by law, to determine their location The source you link very explicitly contradicts that: > Your eCall system is only activated if your vehicle is involved in a serious accident. The rest of the time the system remains inactive. This means that when you are simply driving your vehicle, no tracking (registering your car's position or monitoring your d…

(Also not in Europe but in the EU, there's a difference)

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#199

Post by mattmaroon »

jmward01 wrote: post #151
mattmaroon wrote: post #103

Earlier quoted context omitted.

It’s not the Starlink you’re thinking of, that’s Subaru’s name for their in-car infotaimnent system and predates the SpaceX Starlink. So it’s just Subaru. Also I doubt any ad partners can disable your car (outside of vulnerabilities like this). Subaru can but that’s the case with most modern vehicles.

Any partner that pays enough $$$ can likely do whatever they want. That is obvious by the fact that a year of driving history is displayed. If they didn't want to sell the data/access then they wouldn't be collecting such a long history of it. This is evil. I will avoid being forced to give this information at every possible turn and the companies doing this, and hiding how much they collect, should all be shut down.

That's absurd. Collecting and selling your data and allowing a third party to remotely lock your car are two very different things. I have no doubt car companies sell your data, I am extremely skeptical third parties can buy rights to control your car and if that ever happened, we'd all hear about it really fast.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#200

Post by dylan604 »

JumpCrisscross wrote: post #163
dylan604 wrote: post #74

Earlier quoted context omitted.

I could do that with a key fob well before connected cars were a thing. People just choose to ignore the most basic of information

> could do that with a key fob well before connected cars were a thing I’ve started my Subaru in the lot at 6,500’ from the top of the mountain at 10,500’. A fob isn’t going to scream over that distance. (None of this requires tracking, however, much less storing a year’s location off the car.)

That sounds like an awfully ridiculous thing to do

Just because you can does not mean you should (or actually need to)

Post reply on HN