Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

201–210 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#201

Earlier quoted context omitted.

But at least they're made in South Carolina.

Only the EX90 it seems is made in SC, possibly just assembled from parts made in China. All other electric Volvos (including Polestar) are straight from China. Gas models and hybrids are still built in Europe but are being phased out.

Volvo EX40, fully electric is made in Belgium and it does not seem that it will be phased out soon.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#202
There are a striking number of stories in this thread of incompetence and unethical behavior on the part of Subaru, and it makes me sad that the company has turned into such a wreck. Maybe they were always run this way but older technology didn't allow them to be quite so scummy.

I bought a Subaru in the aughts that I absolutely loved and had assumed my next car would be from the same company. But when I test drove and looked into a new model I was shocked at how many terrible changes had been made, and I didn't even uncover half of what is in this thread.

I'm not holding my breath, but hopefully the bad press affects sales enough to make the people running this company care and alter their behavior. The mechanical cars themselves are still nice to drive, but the terrible interfaces, obscene amount of spying, and intrusively unethical behavior really kill the experience.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#203

Earlier quoted context omitted.

And car manufacturers are incentivized to remove such valuable and logical features. Enshittification abounds.

My Subaru supports remote start if you pay for the upgraded Starlink plan but if you want to do it from the keyfob, you have to buy some module and carry around an extra keyfob solely dedicated to remote start. It's a little ridiculous. They could have easily just made remote start something where you click and hold a button or whatever like any other car with that feature on the fob.

I'm not sure which model you have, but I don't think that's true. I think instead it's that unless you pay for the remote start upgrade (which as you say includes the extra fob) you can't start your car using the normal keyfob. But if you have the upgrade, you can also use the keyfob if you are close enough. At least, that's how it works for our 2018 Outback.

I think I've only used the dedicated remote start fob a couple times to test it, but I use the keyfob for remote starting frequently. If you want to try, here are some 3rd party instructions for which buttons to press to make it work: https://www.wheelsjoint.com/how-to-remote-start-subaru-outba...

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#204
post #52

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously . How did they verify the never exploited maliciously part? Did the person who's password they changed ever notice that their password didn't work any more and report the problem?

Assuming `samwcurry@gmail.com` belongs to the same person who owns samcurry.net, they changed their own password.

I don't think that's correct. See the section in the article "Enumerating Employee Emails" which finishes "The jdoe@subaru.com (redacted) email was valid! We went back to the reset password endpoint and hit send."

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#206

Last year, I submitted a "right to know" request to Subaru, and they sent the following back. I've reformatted it for legibility. Basically asserts they'll do and sell whatever they want (except another car to me). > Subaru may collect the following personal information about a consumer: > Categories of personal information: > Identifiers: Consumer records, Commercial information, Internet or Other Electronic Network…

Good to know Seems pretty blanket wide legalese. The part about audio recordings seems a bit troublesome however

The non troublesome use-case is clicking the starlink button and taking to their support.

Having bought a Subaru, I really tried to see where the consent is in the process. In my case, I think it’s the account establishment process that the dealer did.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#207
post #106

Earlier quoted context omitted.

FWIW i never replaced the 3g box in my 2018 subaru, and never have a battery drain issue. the battery did fail about 4 years in to owning the car, but it was a cell failure not a drain issue.

My Subaru, a 2018 outback, would be completely battery dead if I left it parked for more than a week or so. Happened once at the airport, after which I started carrying a battery pack car starter. The guy at the airport who have us a jump said it happened all the time with Subarus in long term parking.

This isn’t all that uncommon in any vehicle.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#208

Question, if you can remote start a subaru with starlink, does that mean I could start my car from the command line during winter??? I don't pay for starlink, never really looked into it, but it sounds cheaper than installing a remote start system lol.

https://github.com/G-Two/subarulink

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#209
post #47

Earlier quoted context omitted.

Back when I used to do AppSec, these types of issues were extremely common. Software developers and their managers would argue endlessly about them not being real vulnerabilities, which meant I had to put together a proof of exploitability. And since these were interdepartmental fights, office politics get involved. Just one of the dozen or so reasons why I stopped doing AppSec and went back to development.

That seems like a culture issue rather than an appsec issue?

It's the toxic culture that creates the security issues. Because people who won't listen to others end up doing stupid things.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#210

Earlier quoted context omitted.

I know how key fobs work, thank you. I mean the ability to control the car remotely without line of sight or being anywhere near it, such as turning on the climate to warm up the car while still in a building so it's not freezing cold when we get back to the car with the kids, or while the car is in the garage, locking the car remotely because you're blocks away and aren't 100% sure you locked it before you left, ope…

Maybe it's because I don't live in a cold climate, but I've never wanted to do this.

It's because you don't live in a cold climate.
Post reply on HN