Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

101–110 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#101

Post by zhengyi13 »

tedmielczarek wrote: post #64
potato3732842 wrote: post #57

Earlier quoted context omitted.

The best galvanization was in the 80s when the OEMs were scrambling in the "surprise, lead just got banned" era (lead acts like an anode, think of it like a lesser version of a high zinc primer). That said, it's not the thick hot dip you see on I beams or on bolts at the hardware store and a modern car with modern coatings and attention to corrosion is still better. Of the three continents that produce a lot of cars…

Since Volvo was mentioned in the parent comment, did you know that if you buy a new Volvo you can get two free plane tickets to Gothenburg + one night's hotel stay to go pick it up at the Volvo factory? You can drive it around Europe for a while and then they will ship it back to the US for you. AFAIK it doesn't cost extra, it just adds some lead time as well as time waiting for your car to get to you after you fly h…

Our family did nearly exactly this when I was a child in the 80s, just subbing in Volkswagen and Dusseldorf IIRC. It was some months later when the car actually arrived on the west coast of the US, but my parents seemed to think it worthwhile.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#102

Post by reaperducer »

like_any_other wrote: post #2

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased i…

Assuming it's possible to not agree to it

My new car came with something called "Google Built-In," which seems to be the bastard sibling of Google Car Play.

During the set up, if you'd like to read the privacy policy, you must scan a QR code on your phone, which opens a web page that does not display on mobile devices.

If you'd like to opt-out of anything, you have to create a Google account, then log the car into that Google account, then log into that Google account on your phone, then go hunting for the settings on both the car and in the Google account online. Good luck finding them all.

Also, it is not possible to uninstall certain "essential" Google apps from the car. Apparently, YouTube is now an "essential" part of driving.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#103

Post by mattmaroon »

like_any_other wrote: post #2

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased i…

It’s not the Starlink you’re thinking of, that’s Subaru’s name for their in-car infotaimnent system and predates the SpaceX Starlink.

So it’s just Subaru.

Also I doubt any ad partners can disable your car (outside of vulnerabilities like this). Subaru can but that’s the case with most modern vehicles.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#105

Post by rurp »

reaperducer wrote: post #102
like_any_other wrote: post #2

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased i…

Assuming it's possible to not agree to it My new car came with something called "Google Built-In," which seems to be the bastard sibling of Google Car Play. During the set up, if you'd like to read the privacy policy, you must scan a QR code on your phone, which opens a web page that does not display on mobile devices. If you'd like to opt-out of anything, you have to create a Google account, then log the car into th…

Yeesh, which care manufacturer is this from?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#106

Post by pfooti »

mmmlinux wrote: post #86
aftbit wrote: post #29

Earlier quoted context omitted.

I was lucky to have the DCM in my 2019 Outback (which is responsible for cellular communication and thus this whole STARLINK thing) replaced with a bypass box under the warranty program related to the end of 3G service. My car was trying to go online 30 times an hour or something like that, draining the battery enough that it needed to be replaced after just 4 years. They don't have enough new DCMs so they were willi…

FWIW i never replaced the 3g box in my 2018 subaru, and never have a battery drain issue. the battery did fail about 4 years in to owning the car, but it was a cell failure not a drain issue.

My Subaru, a 2018 outback, would be completely battery dead if I left it parked for more than a week or so. Happened once at the airport, after which I started carrying a battery pack car starter. The guy at the airport who have us a jump said it happened all the time with Subarus in long term parking.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#107

Post by ben7799 »

I have a 2013 Outback Limited that is basically right before all this stuff got really stupid and weird. It's a great car other than it's not very fast and it gets really bad gas mileage. Amazing in the snow. I have had it since December 2012, so I've had plenty of service visits where I got newer loaners. (I special ordered my car to basically load it but not have Starlink, not have the Sunroof, but have the leather seats and the HK upgraded stereo.)

Every time I have gotten a newer Subaru as a loaner it strikes me that they are worse cars for all this new stuff. The user interface is horrible in the new ones. In a lot of cases they have a skeumorphic interface up on the touch screen that mimics the physical controls in my car! The actual physical controls are about 100x faster to operate and you quickly learn where the buttons are without looking.

I had an Ascent Onyx loaner last summer.. the entire touch screen UI looked like it was barely operating above 10fps. Just gross. Lots of the UI is black and white as well, not even tasteful grayscale. The Onyx I had also had the upgraded HK stereo and that is not as good as the one in my car as well, it sounded noticeably worse.

The electric steering on the new Subarus is terrible as well. My old Outback is not exactly a sports car but getting out of new one back into mine it feels like you're getting into a Porsche or something when you feel the hydraulic steering. Engine/Turbo lag on a lot of the new ones is gross as well.

This is of course even worse! My car only has 120k miles on it, I plan to keep it for another 4 years and then maybe give it to my kid when he gets his license. Somehow I doubt Subaru will have a competitive vehicle by then. For me to consider another one they'd really need to have an EV Outback/Forester/Ascent or a Hybrid version that gets at least 40mpg. And they need to fix all this horrible infotainment stuff in a way that the car operates better than a kids toy and actually drives well like an older Subaru. Also they need to get off the whole stupid thing with giant rims. It's supposed to be a Subaru, it needs to have tires appropriate to going relatively fast on dirt roads.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#108

Post by [deleted] »

preisschild wrote: post #12
netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

Or not requiring ANYTHING to authenticate in your forgetPassword endpoint, but being able to set a new password directly instead of sending a randomly generated per email / send a one time token to reset the password yourself via email

[deleted]

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#109

Post by reaperducer »

rurp wrote: post #105
reaperducer wrote: post #102

Earlier quoted context omitted.

Assuming it's possible to not agree to it My new car came with something called "Google Built-In," which seems to be the bastard sibling of Google Car Play. During the set up, if you'd like to read the privacy policy, you must scan a QR code on your phone, which opens a web page that does not display on mobile devices. If you'd like to opt-out of anything, you have to create a Google account, then log the car into th…

Yeesh, which care manufacturer is this from?

Volvo.
Post reply on HN