Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

261–270 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#261

Post by jajko »

reaperman wrote: post #150
dv_dt wrote: post #94

Earlier quoted context omitted.

There was a recent HN posting on the US banning Chinese car brands from being connected to the internet. https://news.ycombinator.com/item?id=42706212 If Chinese companies comply with the ban by providing car models without internet connectivity, it's hilarious to me that that the nationalist regulation could make Chinese branded vehicles more desirable from a security & privacy standpoint.

The current 100% tariff on Chinese EV’s will negate that advantage for American consumers.

Europe doesn't have that high tariffs on them, neither does rest of the world. Chinese manufacturers will continue their global meteoric rise whether they are successful in US or not, its just 4% of population even if wealthy.

And if they actually do provide better cars (more secure and respecting privacy while massively cheaper), who am I to complain.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#262

Post by wil421 »

netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

I used my chrome inspector to edit a read only field in Jira. Surprisingly I was able to edit it and submit the change. It complete fucked up whatever protect we were about to use and we had to start over. The JIRA admins were scratching their heads.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#263

Post by prmoustache »

brookst wrote: post #215
dylan604 wrote: post #76

Earlier quoted context omitted.

Remote start does not require an app nor an always on connection. I was able to do this with a key fob in the early 00s

Key fob works great if the car is close. Remote start by app is fantastic when it’s farther away.

Why would you want to remote start a car if you are a mile away?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#264

Post by mattsimpson »

netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

This is exactly what I came here to say as well. Whoever wrote this fundamentally just doesn't get it.

This whole thing is honestly what I've suspected/expected owning this car, but it's somehow still surprising to see. My guess is no car company does this really well right now, and makes me want to drive a 1998 Acura Integra instead.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#266

Post by badmintonbaseba »

cmgbhm wrote: post #206
Melatonic wrote: post #185

Earlier quoted context omitted.

Good to know Seems pretty blanket wide legalese. The part about audio recordings seems a bit troublesome however

The non troublesome use-case is clicking the starlink button and taking to their support. Having bought a Subaru, I really tried to see where the consent is in the process. In my case, I think it’s the account establishment process that the dealer did.

How is that supposed to work for second hand vehicles?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#267

Post by mattmaroon »

jmward01 wrote: post #238
mattmaroon wrote: post #199

Earlier quoted context omitted.

That's absurd. Collecting and selling your data and allowing a third party to remotely lock your car are two very different things. I have no doubt car companies sell your data, I am extremely skeptical third parties can buy rights to control your car and if that ever happened, we'd all hear about it really fast.

Do you honestly think that they have a limit to what they will sell? I could easily imagine them selling this access to companies that repossess vehicles. An 'ownership dispute' fee that prevents your car from starting and grants additional access to the company. As soon as I typed that I couldn't stop thinking that that has to be a real thing they make real money on already. If it isn't then my guess it is only beca…

Yes, I think if they sold that it would have happened by now and you'd have heard about it. Law of big news applies. Also a quick Google would tell you Ford tried to patent this in 2023 and people were outraged over the idea so they dropped it. So I doubt some other car company is doing it and secretly getting away with it.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#268

Post by mattmaroon »

dang wrote: post #245
mattmaroon wrote: post #103

Earlier quoted context omitted.

It’s not the Starlink you’re thinking of, that’s Subaru’s name for their in-car infotaimnent system and predates the SpaceX Starlink. So it’s just Subaru. Also I doubt any ad partners can disable your car (outside of vulnerabilities like this). Subaru can but that’s the case with most modern vehicles.

Ok, we've taken Starlink out of the title above. Thanks!

NP. It wasn't inaccurate, but surely confusing to people who haven't owned a Subaru!

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#269

Post by hmmm-i-wonder »

snowingsnow wrote: post #249
asa400 wrote: post #211

Earlier quoted context omitted.

I know this is a Subaru hate thread on a site that knows basically nothing about cars so I’m spitting into the wind here, but this is just untrue. I’ve had 3 Subarus over a 20 year period of time, driven the hell out of all of them in snow and dirt, worked on and modified all of them, and the traction control system on my most recent one is categorically, objectively better than either of the prior two. It makes abou…

I have a 2014 forester. First time it snowed I slid off my driveway and one tire was off the ground. Had to get towed by a friend because that one wheel kept spinning. I thought the brakes were supposed to stop that automatically. Didn’t happen. Second time I tried to drove through a small patch of snow I lost all traction and had to dig out all the wheels and rock it. It was 2” of melting snow over a 50 foot by 10 f…

Sounds like a wrong tire problem, not an AWD problem to me.

My parents also had a 2014 Forrestor. They parked it next to my shed when they went on a cruise one winter, and it crawled itself out of a 2 foot snowbank without shovelling it when they got back. That thing was a tank in snow and I definitely abused it when I had the chance.

For the 'tire spinning in the air', sounds like the other tires must have been spinning too so there wasn't anywhere to transfer the power to, but I'm only guessing.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#270

Post by syndeo »

scottbez1 wrote: post #135
duxup wrote: post #41

Earlier quoted context omitted.

I love my Subaru as far as reliability, all wheel drive performance in snow and ice, and such. But OMG it's consumer tech was dated when I bough it, and it's just full of inexplicable issues and caveats and such. Even just the limitations and the UX issues are so obvious that it sends a message that if they tried to fix them they would introduce just as many new issues. I'm at the point where despite the car being go…

Hmm this is really different than my experience with a 2018 Crosstrek, so maybe things have changed? When I bought it, Subaru was among the earlier CarPlay/Android Auto adopters (we specifically ruled out a new model year Prius because it lacked it and we couldn't wait a year to replace our totaled car just for CarPlay/AA), and other than a very rare issue where the head unit screen doesn't turn on, it's been pretty…

It's something about how they have it configured. I have a '17 Honda Civic and its built-in CarPlay lets me pan and scroll just fine. However, on my '23 Ascent, I have to tap arrows to pan the map, and vertical "scrolling" is actually just pagination. Same iPhone, different behavior. It must be some simple config toggle on Subaru's end that they left off for whatever reason.
Post reply on HN