Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

231–240 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#231

Post by liveoneggs »

aftbit wrote: post #29
like_any_other wrote: post #2

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased i…

I was lucky to have the DCM in my 2019 Outback (which is responsible for cellular communication and thus this whole STARLINK thing) replaced with a bypass box under the warranty program related to the end of 3G service. My car was trying to go online 30 times an hour or something like that, draining the battery enough that it needed to be replaced after just 4 years. They don't have enough new DCMs so they were willi…

my subaru is eating through batteries!

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#233

Post by dylan604 »

arcanemachiner wrote: post #223
dylan604 wrote: post #68

Earlier quoted context omitted.

> So at least my Subaru cannot connect to the cloud anymore. Sounds like something you can use to justify a higher selling price when the time comes

I envy your optimism.

i've been looking at getting a used car, and this is actually one of the considerations for me. no touch screen is another.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#234

Post by blendo »

blendo wrote: post #232

Did users have to explicitly sign up for Starlink in order to enable tracking? Or is that the default behavior for all new Subarus? And, can this tracking be deactivated? I have a Mazda, and it required a phone call to Mazda to get it disabled.

“SOA does not collect any vehicle-generated data unless the vehicle is associated with an active STARLINK subscription service. To sign up for the STARLINK service, you must have a MySubaru account.”

https://www.subaru.com/support/privacy-policies/vehicle-priv...

So looks like you’re only tracked if you are signed up with Starlink, having first obtained the prerequisite MySubaru account.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#235

Post by dylan604 »

JumpCrisscross wrote: post #220
dylan604 wrote: post #200

Earlier quoted context omitted.

That sounds like an awfully ridiculous thing to do Just because you can does not mean you should (or actually need to)

> because you can does not mean you should (or actually need to) Most people don’t need to drive. Out of their driving, most of it is superfluous. Pretty much everyone in my town with remote start uses it. Particularly if it’s a day where temperatures are close to 0°F and you’re weighing another run.

> Most people don’t need to drive.

This is one of those comments that just tells everyone reading that you don't think much outside whatever area you dwell. There are lots of people not anywhere near you that do need to drive. Not accepting not everyone is like you is just small minded, and makes the conversation not worth having

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#236

Post by SoftTalker »

like_any_other wrote: post #2

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased i…

If there's a warrant for your arrest, you're not going to avoid it by the police not having remote access to your car locks.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#237

Post by beezle »

theonething wrote: post #92
beezle wrote: post #59

Earlier quoted context omitted.

Just as an aside - a friend had their car nicked in NYC this winter. He was able to tell the cops the car location from some Toyota find my car type thing. The cops said they saw nothing on the street so unless he could come and make the horn beep infront of a garage - and then get a warrant - there was nothing more to do. He now has a new vehicle.

Is your comment supporting the find my car feature or saying it was useless?

The cops could only act if the car was on the street without getting a warrant first and they would not even consider that unless he went to the area in question and made the car do something distinctive enough.

We all know that even if the cops would file for the warrant, it would not happen quickly and the car would be chopped and gone long before.

So basically, yes this was a useless feature. Perhaps if it happened in a small town/remote area the outcome might have been different. Major city? I doubt the result would be much different than NYC.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#238

Post by jmward01 »

mattmaroon wrote: post #199
jmward01 wrote: post #151

Earlier quoted context omitted.

Any partner that pays enough $$$ can likely do whatever they want. That is obvious by the fact that a year of driving history is displayed. If they didn't want to sell the data/access then they wouldn't be collecting such a long history of it. This is evil. I will avoid being forced to give this information at every possible turn and the companies doing this, and hiding how much they collect, should all be shut down.

That's absurd. Collecting and selling your data and allowing a third party to remotely lock your car are two very different things. I have no doubt car companies sell your data, I am extremely skeptical third parties can buy rights to control your car and if that ever happened, we'd all hear about it really fast.

Do you honestly think that they have a limit to what they will sell? I could easily imagine them selling this access to companies that repossess vehicles. An 'ownership dispute' fee that prevents your car from starting and grants additional access to the company. As soon as I typed that I couldn't stop thinking that that has to be a real thing they make real money on already. If it isn't then my guess it is only because they haven't thought about it. Companies will do anything they are explicitly allowed to do or have plausible deniability on to make money.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#240

Post by SoftTalker »

_yb2s wrote: post #17
stn8188 wrote: post #13

Earlier quoted context omitted.

This is absolutely my biggest concern for when I inevitably am forced to replace our aging vehicles. The unfortunate reality of living in the Northeast is that it's near impossible to find decent (not rusted) older cars for sale. Sure, I'm within the 99.9999% of Americans who have nothing to hide, but that unequivocally does not justify the physical capability of remote monitoring or control.

Why not just take a weekend to fly to where used cars are unrusted, and drive one back? Also, there are quite a few well made older cars that are fully galvanized and don’t rust. I know a few people in the Northeast still driving 1980s Volvo 740s, still unrusted after nearly 40 years of salty roads. 1987 and later had the best rustproofing. I believe many older Audis also are galvanized.

Yes exactly. Facebook, Craigslist (yes people still use it) allows searching in any area. Ideally if you have a willing friend living in a salt-free state, search for cars for sale in that area and have your friend take it for an inspection. If it seems good, fly in, buy it, drive home. Rust-free is a given so there's not really a premium to pay for it, unlike buying cars in the northern states.
Post reply on HN