Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

eaton-works.com

Post reply on HN
Print view View original

21–30 of 64 posts

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#21

Post by noja »

esterna wrote: post #17
gruez wrote: post #15

Earlier quoted context omitted.

>The reason for this is that if the car gives people the ability to start a trip with a phone, it's dangerous to assume they'll always carry a keyfob as a backup. How's this any different than say, not bringing your wallet with you, because 95% of the time apple pay works, and then getting mad at the shop/credit card company/apple when the payment terminal randomly decides to not accept apple pay? Not to mention ther…

> How's this any different than say, not bringing your wallet with you, because 95% of the time apple pay works Apple Pay involves at least a third party (your bank) as a part of its function. This entity has to be reachable. Unlocking my car needs me, and my car. > when the payment terminal randomly decides to not accept apple pay? I would be justified in being mad if, randomly, my BMW car would decide to not accept…

> Apple Pay involves at least a third party (your bank) as a part of its function. This entity has to be reachable.

No it doesn't. It has to have a recent token, and if it does not it will contact your bank.

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#22

Post by [deleted] »

darknavi wrote: post #2

> November 3, 2025: Reported. > November 10, 2025: No response, followed up. > November 17, 2025: No response, followed up and copied some additional people on the thread. > November 20, 2025: It was no longer possible to access any of the internal APIs. The primary vulnerability was now fixed. > July 27, 2026: Published Quite the generous timeline on this person's behalf.

[deleted]

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#23

Post by Cider9986 »

knowaveragejoe wrote: post #16
spockz wrote: post #5

This is my primary concern with modern cars. You are at the complete merci of the security and correctness of the cloud management software for the correctly functioning of the car. Wouldn’t it be better if your phone/devices would pair directly with the car, exchange keys, and have the company cloud only function as a proxy. On holiday a guests BMW didn’t want to “start” anymore because it couldn’t phone home becaus…

I just want the most basic, no-frills EV truck. I'd even pay a premium over what such a thing _should_ cost. I want no cloud connectivity _at all_ unless I add it myself in some way.

Rivian let's you disable all connectivity.

https://news.ycombinator.com/item?id=47967786

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#24

Post by spockz »

gruez wrote: post #11
spockz wrote: post #5

This is my primary concern with modern cars. You are at the complete merci of the security and correctness of the cloud management software for the correctly functioning of the car. Wouldn’t it be better if your phone/devices would pair directly with the car, exchange keys, and have the company cloud only function as a proxy. On holiday a guests BMW didn’t want to “start” anymore because it couldn’t phone home becaus…

>On holiday a guests BMW didn’t want to “start” anymore because it couldn’t phone home because of lack of phone reception. They had to contact the dealer at home and move heaven and earth to get some dealer code to allow the car to start again for a while. Why is this even allowed? Surely there's more to this story? AFAIK last time I heard about something like this, it was because the guy's car was parked 5 stories u…

In this case it was with car keys and the valley where they are parked has no cell reception at all. Apparently they could still enter the car but not “start the engine”. They then managed to get a code from the dealer to unlock the car. I’m unsure whether it was a software bug relying on communication unnecessarily, a intended feature, or something like an alarm being triggered which triggered some fail safes.

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#25

Post by dotancohen »

xp84 wrote: post #13
gruez wrote: post #11

Earlier quoted context omitted.

>On holiday a guests BMW didn’t want to “start” anymore because it couldn’t phone home because of lack of phone reception. They had to contact the dealer at home and move heaven and earth to get some dealer code to allow the car to start again for a while. Why is this even allowed? Surely there's more to this story? AFAIK last time I heard about something like this, it was because the guy's car was parked 5 stories u…

> last time I heard about something like this, it was because the guy's car was parked 5 stories underground, and didn't carry his car keys, because he was using his phone to unlock all the time I hope you aren't suggesting that set of details makes this okay. I should be able to park in a faraday cage 2 miles underground and still start it the same as I can on the surface. Including with my phone, if it's equipped w…

My Tesla works like this. No internet connection needed, just Bluetooth.

I do keep a card key in my wallet just in case.

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#26

Post by dotancohen »

Cider9986 wrote: post #23
knowaveragejoe wrote: post #16

Earlier quoted context omitted.

I just want the most basic, no-frills EV truck. I'd even pay a premium over what such a thing _should_ cost. I want no cloud connectivity _at all_ unless I add it myself in some way.

Rivian let's you disable all connectivity. https://news.ycombinator.com/item?id=47967786

I believe that Tesla does, or did. I never disabled mine as I want the vehicle to improve on the roads that I frequent. And it has, noticeably so, in the four years I've owned the vehicle.

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#27

Post by dotancohen »

EatonZ wrote: post #4
nhance wrote: post #3

I love this sort of content on HN. I am very curious what the impact of powerful AI has on these type of things

In this case, AI wasn't used for anything.

I believe that it was used to generate the post that you replied to.

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#28

Post by jeffbee »

Cider9986 wrote: post #23
knowaveragejoe wrote: post #16

Earlier quoted context omitted.

I just want the most basic, no-frills EV truck. I'd even pay a premium over what such a thing _should_ cost. I want no cloud connectivity _at all_ unless I add it myself in some way.

Rivian let's you disable all connectivity. https://news.ycombinator.com/item?id=47967786

You can disable connectivity in any car by pulling fuses.

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#29

Post by gruez »

esterna wrote: post #17
gruez wrote: post #15

Earlier quoted context omitted.

>The reason for this is that if the car gives people the ability to start a trip with a phone, it's dangerous to assume they'll always carry a keyfob as a backup. How's this any different than say, not bringing your wallet with you, because 95% of the time apple pay works, and then getting mad at the shop/credit card company/apple when the payment terminal randomly decides to not accept apple pay? Not to mention ther…

> How's this any different than say, not bringing your wallet with you, because 95% of the time apple pay works Apple Pay involves at least a third party (your bank) as a part of its function. This entity has to be reachable. Unlocking my car needs me, and my car. > when the payment terminal randomly decides to not accept apple pay? I would be justified in being mad if, randomly, my BMW car would decide to not accept…

The point isn't that it's fine for smartphone car keys to randomly fail, it's that there's plenty of other reasons they can fail that you're already living on the edge if all you're carrying is your phone. Therefore the "it's dangerous to assume ..." claim doesn't hold.

Re: Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

#30

Post by cloudfudge »

bri3d wrote: post #14
xp84 wrote: post #13

Earlier quoted context omitted.

> last time I heard about something like this, it was because the guy's car was parked 5 stories underground, and didn't carry his car keys, because he was using his phone to unlock all the time I hope you aren't suggesting that set of details makes this okay. I should be able to park in a faraday cage 2 miles underground and still start it the same as I can on the surface. Including with my phone, if it's equipped w…

It doesn't; BMW use the CCC Digital Key standard for "Digital Key Plus" and there's no Internet required post provisioning. This story really reeks of misunderstanding or "needs more information" as for BMW especially, I don't see any scenario where this could have happened, regardless of physical or phone key use.

It's possible they were trying to do something like remote start, which (at least in my bmw) does use the godawful bmw online service. In the retelling, this might have expanded to "couldn't start the car."
Post reply on HN