Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

311–320 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#311

Post by asa400 »

snowingsnow wrote: post #249
asa400 wrote: post #211

Earlier quoted context omitted.

I know this is a Subaru hate thread on a site that knows basically nothing about cars so I’m spitting into the wind here, but this is just untrue. I’ve had 3 Subarus over a 20 year period of time, driven the hell out of all of them in snow and dirt, worked on and modified all of them, and the traction control system on my most recent one is categorically, objectively better than either of the prior two. It makes abou…

I have a 2014 forester. First time it snowed I slid off my driveway and one tire was off the ground. Had to get towed by a friend because that one wheel kept spinning. I thought the brakes were supposed to stop that automatically. Didn’t happen. Second time I tried to drove through a small patch of snow I lost all traction and had to dig out all the wheels and rock it. It was 2” of melting snow over a 50 foot by 10 f…

I second the sibling comment saying that this is likely a tire issue more than anything. If you're sliding down a snowy driveway or hill, no AWD/4WD in the world will save you from that, that's purely a mechanical grip issue, i.e., tires. Literally everything having to do with grip (getting unstuck, braking, handling, stopping) depends on tires.

I'd recommend something like a Michelin CrossClimate or (depending on whether you're going to go on dirt/mud/trails) something like a Yokohama Geolandar G015. Going with something that is 3-peak Mountain Snowflake rated will help in the cold and snow.

Failing that, if you're going to run a more economy/highway-focused tire, just make sure to replace them before they get too worn. Most tires' winter performance falls off a cliff when they're old.

I don't know if the 2014 models have the X-mode system, but if they do, you'll want to enable it when driving on anything snow/dirt/gravel/sand, it will make the traction control brake vectoring power transfer more aggressive.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#312

Post by solatic »

Mountain_Skies wrote: post #295
solatic wrote: post #276

Earlier quoted context omitted.

I left security work for a similar reason. In most companies, Security isn't there to collaboratively build more reliable and dependable products that protect customer privacy, bringing in a useful perspective of how things can go wrong, similar to QA's role. Instead, Security is there to be the internal police, who treat engineers (and other employees) like criminals, and get recognition and rewards for stopping the…

While I'm sure that's also common, my general impression was that security was there to provide legal protection against being found to have been guilty of willful negligence if there were a breach. There wasn't a top down push for actual security but there was one for getting all the proper boxes ticked so the company could get the compliance certifications required for insurance and to make the legal department hap…

That's the same pessimistic perspective. When SOC2 requires that commits be tied to reviews to show that work was visible and approved by management, and not just some cowboy engineer putting who-knows-what into production, but the control is implemented with a simple Jira issue regex so every developer just puts in place ABC-123 or ABC-999 on every commit, and anyway developers are free to open and close Jira issues without management noticing or approving, then the only people guilty of willful negligence are the so-called security engineers for putting in such weak controls and the auditors for approving them regardless, not to mention the security engineering's leadership's outright fraud for essentially lying about effective controls being in place when actually everybody internally considers it a massive joke.

The flip side of the joke being, of course, that everyone internally naturally prefers weaker controls (that help them ship faster compared) to stronger controls. So there's a wink and a nod and a smile and everyone moves on while institutionalized corruption is accepted. Nevermind that strong controls over commit messages can also help build automated documentation, notifications, and clear integrations like being able to link a production outage to the Git commit that triggered it, including full business context and knowledge of who to contact.

Note that there are two kinds of perspectives to build this kind of control - the glass-half-full perspective that builds Git -> Slack integrations to let people get notified quickly that a review was requested, including signals that this is a hotfix/simple/not-controversial/rubber-stamp to help get simple stuff approved quickly and deployed quickly, along with collaboration with auditors to get them the reports and commit samples they need. The glass-half-empty perspective is to say, well the auditors already have a built-in integration with Jira, so let's throw it in to Jira, along with a complicated and rigid workflow that forces everything to go through sprint planning and approvals by managers 3 levels up, and if it causes a production outage because something can't be fixed quickly, well that's not really Security's or Compliance's fault, the regulations are the regulations and the auditors are the auditors, and why are you trying to work around The Perfect Process That We Worked So Hard To Build, maybe you have malicious reasons hmmm? And maybe it's time we hired separate operators to run everything in production, like A Real Enterprise Company would, like some banks you've heard of?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#313

Post by plagiarist »

coldpie wrote: post #282
plagiarist wrote: post #5

I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.

The best case scenario for the next 5-10 years is that there will be no new federal privacy regulations. More likely, privacy regulations will be even further relaxed and customers will have even less recourse for violations. You might have some luck pursuing this at the state level if you're lucky enough to live in a handful of states such as California or Minnesota.

I wish you weren't correct. It is more likely some sort of federal regulation undoes protections such as CCPA.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#314

Post by HeyLaughingBoy »

prmoustache wrote: post #309
HeyLaughingBoy wrote: post #306

Earlier quoted context omitted.

I used to commute into the city by express bus. Drive to Metro Transit Park-n-Ride lot, park the car and get on the bus. On the way back a lot of people would start their cars (via app) when about 5 minutes away from the lot. That translates to about 4-5 miles at freeway speed. Alternately, at the office, some people parked at a lot that was about a mile away and it's nice to be able to start your car when it's 95F o…

All I see is a waste of gasoline. Back when I was living in a cold country and drove a car early in the morning I would just use gloves, keep my jacket and heat my seat with a fart. ;-)

Whatever works for you. Me, I like my creature comforts.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#315

Post by brookst »

prmoustache wrote: post #263
brookst wrote: post #215

Earlier quoted context omitted.

Key fob works great if the car is close. Remote start by app is fantastic when it’s farther away.

Why would you want to remote start a car if you are a mile away?

Umm… maybe not a mile, but if you’re walking ten minutes in ice/snow (maybe a quarter mile), it is VERY nice to have it warm when you get there. I’m surprised this is surprising.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#316

Post by Eavolution »

robertlagrant wrote: post #301
GJim wrote: post #281

Earlier quoted context omitted.

But not in the UK or EU. Need I say which law protects us..... the one a significant number of HN readers (a technical news site!) appear to remain in shocking ignorance of?

You can do this in the UK or EU if you like; you just need to have permission to do so from the data subject.

How does that work if the car's sold? The car itself doesn't know it's been sold.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#317

Post by yesiamyourdad »

duxup wrote: post #41
mavdi wrote: post #20

Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.

I love my Subaru as far as reliability, all wheel drive performance in snow and ice, and such. But OMG it's consumer tech was dated when I bough it, and it's just full of inexplicable issues and caveats and such. Even just the limitations and the UX issues are so obvious that it sends a message that if they tried to fix them they would introduce just as many new issues. I'm at the point where despite the car being go…

I loved mine until the transmission blew out at 96,000 miles. Could be a one-off, but then a friend bought a used one with 108,000 miles, and the dealer proudly noted that it had a new transmission just installed. I think that vaunted reliability is gone.

That aside, the one thing I haven't liked is the electronics. Many times it gets out of sync with the phone and simply can't connect, the only fix is to shut the car off, open the door so the stereo shuts off, then restart the car. The FM radio also quit working at one point, which I didn't really care about, but the dealer applied a software update and it started working again. That's just the visible stuff though, so much of the car is software controlled now, I think you have to start taking any software issues as a warning about the overall car.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#318

Post by ben_w »

JumpCrisscross wrote: post #304
UltraSane wrote: post #280

Earlier quoted context omitted.

I've learned it is normally pretty easy to tell what caste someone is from. But watching a Brahmin who really believes they are vastly better than Dalits act like as arrogant as the Goa'uld from Stargate SG1 was really something.

> I've learned it is normally pretty easy to tell what caste someone is from With all due respect, you’ve fooled yourself into ignorance. Many Indians haven’t had a relationship with caste for generations, particularly in the cities or upper and middle classes. (Intermarriage and wealth have rendered it indiscernible.) There are also something like 25,000 castes and subcastes. It’s not a system designed for anyone to…

> There are also something like 25,000 castes and subcastes.

That makes it sound like castes are professions (which IIRC used to be somewhat inherited in the UK, hence names like Smith and Cooper), but where people then tried to assign ranks to those professions (like the family names Bishop and King)?

I am almost totally ignorant of how it really works, but I'm an omni-curious nerd, if you want to enlighten me :)

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#319

Post by snowingsnow »

hmmm-i-wonder wrote: post #269
snowingsnow wrote: post #249

Earlier quoted context omitted.

I have a 2014 forester. First time it snowed I slid off my driveway and one tire was off the ground. Had to get towed by a friend because that one wheel kept spinning. I thought the brakes were supposed to stop that automatically. Didn’t happen. Second time I tried to drove through a small patch of snow I lost all traction and had to dig out all the wheels and rock it. It was 2” of melting snow over a 50 foot by 10 f…

Sounds like a wrong tire problem, not an AWD problem to me. My parents also had a 2014 Forrestor. They parked it next to my shed when they went on a cruise one winter, and it crawled itself out of a 2 foot snowbank without shovelling it when they got back. That thing was a tank in snow and I definitely abused it when I had the chance. For the 'tire spinning in the air', sounds like the other tires must have been spin…

Nope just one wheel. Factory tires. I like everyone telling me it’s my fault for not having the right tires. Lol. Like the claims Subaru makes are only valid if I spend a grand on tires for my new car. If you have to tie yourself in knots to justify marketing you can fuck right off.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#320

Post by yesiamyourdad »

_joel wrote: post #47
Mountain_Skies wrote: post #9

Earlier quoted context omitted.

Back when I used to do AppSec, these types of issues were extremely common. Software developers and their managers would argue endlessly about them not being real vulnerabilities, which meant I had to put together a proof of exploitability. And since these were interdepartmental fights, office politics get involved. Just one of the dozen or so reasons why I stopped doing AppSec and went back to development.

That seems like a culture issue rather than an appsec issue?

"no matter what they tell you, it's always a people problem." - Gerald Weinberg
Post reply on HN