Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

251–260 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#251

Post by inejge »

NooneAtAll3 wrote: post #226
hulium wrote: post #180

Earlier quoted context omitted.

> All cars in Europe must be connected to the internet at all times by law, to determine their location The source you link very explicitly contradicts that: > Your eCall system is only activated if your vehicle is involved in a serious accident. The rest of the time the system remains inactive. This means that when you are simply driving your vehicle, no tracking (registering your car's position or monitoring your d…

how does it determine "serious accident"?

I'll try to dig up the criteria someday, if they're written down, but I imagine that "anything that triggered airbag inflation" is a good approximation.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#252

Post by rasz »

t1234s wrote: post #129

Having developed back end portals like this one for much smaller companies I find it hard to believe that there is an open endpoint to reset a password without any type of verification. What goes wrong in development that this type of crap makes it to production?

>$('#securityQuestionModal').modal('show');

Iv seen a couple of industrial deployments "secured" by a modal so Im totally buying whats in the article.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#253

Post by rasz »

willis936 wrote: post #7
niij wrote: post #3

How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?

I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling t…

How is your Toyota battery drain now. Subaru will constantly try to reconnect killing 12V battery in no time.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#254

Post by dangus »

rurp wrote: post #202

There are a striking number of stories in this thread of incompetence and unethical behavior on the part of Subaru, and it makes me sad that the company has turned into such a wreck. Maybe they were always run this way but older technology didn't allow them to be quite so scummy. I bought a Subaru in the aughts that I absolutely loved and had assumed my next car would be from the same company. But when I test drove a…

IMO Subaru has been one of the most overrated car brands for decades.

Sure, these data privacy issues are rampant across the automotive industry. It really isn’t just Subaru.

But really what I’m talking about is the entire product. I have no idea why people like them so much:

- Some of the worst exterior styling of any brand

- Cheap interiors that are so ugly

- Their history is riddled with major powertrain issues especially for how well-regarded they are

- Historically horrific gas mileage compared to competitors as a tradeoff for symmetrical all-wheel-drive that realistically very few of their buyers need.

- Their gas mileage isn’t bad anymore but they haven’t even released any hybrids yet, meanwhile every competitor under the sun has hybrids all over the place

- Their current infotainment system is god awful with horrendous graphics and the climate controls are stuck inside it

I think the only positive thing I can say about the brand is the they’re the last company selling a non-euro-luxury station wagon in the US, but really it’s basically a similar stance as a typical crossover SUV so you might as well buy one of those (or just get yourself a used E Class wagon and end up with a much better car).

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#255

Post by Izikiel43 »

blendo wrote: post #232

Did users have to explicitly sign up for Starlink in order to enable tracking? Or is that the default behavior for all new Subarus? And, can this tracking be deactivated? I have a Mazda, and it required a phone call to Mazda to get it disabled.

Can you share more info on Mazda?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#257

Post by winrid »

lightedman wrote: post #213
ben7799 wrote: post #107

I have a 2013 Outback Limited that is basically right before all this stuff got really stupid and weird. It's a great car other than it's not very fast and it gets really bad gas mileage. Amazing in the snow. I have had it since December 2012, so I've had plenty of service visits where I got newer loaners. (I special ordered my car to basically load it but not have Starlink, not have the Sunroof, but have the leather…

" It's a great car other than it's not very fast and it gets really bad gas mileage." My 2013 Outback Limited with rally package (wheel paddle shifters etc) gets 32 on the highway with my driving habits and almost 28 offroading. That's with larger tires and a disconnected swaybar for better articulation, everything else is stock. CVTs don't respond well to lead-footing.

The disconnected swaybar won't impact mileage FWIW

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#258

Post by akimbostrawman »

beezle wrote: post #239

Slightly off topic: How are recent Mazda's in regard to all of this stuff? They were not included in that Mozilla privacy expose and I have a CX on my short list for this spring.

They are above greed so they don't do that unlike literally everybody else pinky promise.... Do people seriously believe any tech corporations is above surveillance capitalism.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#259

Post by bilekas »

afh1 wrote: post #160
bilekas wrote: post #19

> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

All cars in Europe must be connected to the internet at all times by law, to determine their location, in case of an accident the law states. https://europa.eu/youreurope/citizens/travel/security-and-em... In the US a bill was passed requiring driver impairment equipment on all vehicles and automatic deactivation of the vehicle if the driver is determined to be impaired. Current impairment technology monitors head an…

> All cars in Europe must be connected to the internet at all times by law, to determine their location, in case of an accident the law states.

It isn't connected to 'the internet' either, its an emergency call activation service. IE you can actuvate it to call 112 (Emergency services) when needed without a charge, infact it uses a SIM card to do so.

Infact on your link it doesn't mention 'online' or 'internet' anywhere/

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#260

Post by xattt »

NooneAtAll3 wrote: post #225
cmgbhm wrote: post #206

Earlier quoted context omitted.

The non troublesome use-case is clicking the starlink button and taking to their support. Having bought a Subaru, I really tried to see where the consent is in the process. In my case, I think it’s the account establishment process that the dealer did.

> that the dealer did is that even legal? can one go to court for "absence of consent"?

”You opted-in and consented to sharing of information by looking at the car”
Post reply on HN