Hacking Subaru: Tracking and controlling cars via the admin panel • Hacker News Board

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#211

Post by asa400 » Thu, Jan 23, 2025, 11:25 PM UTC

olyjohn wrote: post #136

DwnVoteHoneyPot wrote: post #114

Earlier quoted context omitted.

In addition to your comments, I think Subaru's all-wheel drive system has been switched to electrical instead of mechanical, making it worse. There are roller tests on youtube which show Subaru AWD being outperformed by Ford AWD systems.

The CVT in combination with the terrible traction control also kills any chance you have of getting out of a stuck situation. Subaru's AWD system is now mostly just marketing. So it's basically on part with most AWD systems, because most of them really are a joke.

I know this is a Subaru hate thread on a site that knows basically nothing about cars so I’m spitting into the wind here, but this is just untrue. I’ve had 3 Subarus over a 20 year period of time, driven the hell out of all of them in snow and dirt, worked on and modified all of them, and the traction control system on my most recent one is categorically, objectively better than either of the prior two. It makes about 100 more horsepower than the earliest one and still gets better fuel economy, at least in part because of the CVT, despite weighing probably 600 pounds more. The CVT works perfectly fine for anything that isn’t doing the Rubicon trail.

The AWD is one of the few remaining permanently fully engaged systems, unlike basically every other manufacturer.

You can hate on Subarus for the stuff they’re actually bad at (fuel economy, infotainment, wind noise, head gaskets in the EJ series engines) without having to make stuff up.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#212

Post by dboreham » Thu, Jan 23, 2025, 11:27 PM UTC

wolrah wrote: post #10

chatmasta wrote: post #6

For those who might not read the article, note that “Starlink” is not the SpaceX service. It’s an internal name for a Subaru customer service web app.

> It’s an internal name for a Subaru customer service web app. It's actually the name of Subaru's connected infotainment system: https://www.subaru.com/vehicle-info/subaru-starlink.html

Strictly it's a "telematics system" rather than infotainment.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#213

Post by lightedman » Thu, Jan 23, 2025, 11:28 PM UTC

ben7799 wrote: post #107

I have a 2013 Outback Limited that is basically right before all this stuff got really stupid and weird. It's a great car other than it's not very fast and it gets really bad gas mileage. Amazing in the snow. I have had it since December 2012, so I've had plenty of service visits where I got newer loaners. (I special ordered my car to basically load it but not have Starlink, not have the Sunroof, but have the leather…

" It's a great car other than it's not very fast and it gets really bad gas mileage."

My 2013 Outback Limited with rally package (wheel paddle shifters etc) gets 32 on the highway with my driving habits and almost 28 offroading. That's with larger tires and a disconnected swaybar for better articulation, everything else is stock. CVTs don't respond well to lead-footing.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#214

Post by motza » Thu, Jan 23, 2025, 11:49 PM UTC

Would the remote 'stop' stop a moving car? It's scary to think that someone could have easily used this basic exploit to stop all the affected vehicles on the road.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#215

Post by brookst » Thu, Jan 23, 2025, 11:53 PM UTC

dylan604 wrote: post #76

insane_dreamer wrote: post #50

Earlier quoted context omitted.

Remote start, climate etc from the app all require and always on connection (how else?). Tesla has the same thing. I use the remote app often - quite useful.

Remote start does not require an app nor an always on connection. I was able to do this with a key fob in the early 00s

Key fob works great if the car is close. Remote start by app is fantastic when it’s farther away.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#216

Post by amatecha » Fri, Jan 24, 2025, 12:01 AM UTC

tfw your car is also an always-online computer running proprietary software you have no control over ... and that software is written by people who think you can block login with a modal overlay, and who make a public-facing API call that resets a password with nothing more than the account's email address...

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#217

Post by amatecha » Fri, Jan 24, 2025, 12:07 AM UTC

netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

I was about to say exactly this. This is like REALLY BASIC stuff in designing web services. The fact you can reset the password with a single HTTP POST is mind-boggling, bypassing the 2FA by hiding a is mind-boggling. Like, completely negligent. (btw they took over a Subaru employee account, not Starlink)

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#218

Post by amatecha » Fri, Jan 24, 2025, 12:26 AM UTC

rjmunro wrote: post #52

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously . How did they verify the never exploited maliciously part? Did the person who's password they changed ever notice that their password didn't work any more and report the problem?

Right, especially considering the Subaru Starlink service has apparently existed since 2014 or so[0], I have to wonder how long these vulnerabilities have been present.

[0] https://web.archive.org/web/20140719230852/https://www.subar...

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#219

Post by amatecha » Fri, Jan 24, 2025, 12:28 AM UTC

willis936 wrote: post #7

niij wrote: post #3

How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?

I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling t…

It might be better to attach a dummy load to replace the antenna so you don't burn out the radio circuit which may have side effects (depending on their design). You could wrap that in foil to ensure it can't get a weak signal through.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#220

Post by JumpCrisscross » Fri, Jan 24, 2025, 12:30 AM UTC

dylan604 wrote: post #200

JumpCrisscross wrote: post #163

Earlier quoted context omitted.

> could do that with a key fob well before connected cars were a thing I’ve started my Subaru in the lot at 6,500’ from the top of the mountain at 10,500’. A fob isn’t going to scream over that distance. (None of this requires tracking, however, much less storing a year’s location off the car.)

That sounds like an awfully ridiculous thing to do Just because you can does not mean you should (or actually need to)

> because you can does not mean you should (or actually need to)

Most people don’t need to drive. Out of their driving, most of it is superfluous.

Pretty much everyone in my town with remote start uses it. Particularly if it’s a day where temperatures are close to 0°F and you’re weighing another run.