Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Subaru: Tracking and controlling cars via the admin panel

samcurry.net

Post reply on HN
Print view View original

291–300 of 334 posts

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#291

Post by Angostura »

afh1 wrote: post #160
bilekas wrote: post #19

> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

All cars in Europe must be connected to the internet at all times by law, to determine their location, in case of an accident the law states. https://europa.eu/youreurope/citizens/travel/security-and-em... In the US a bill was passed requiring driver impairment equipment on all vehicles and automatic deactivation of the vehicle if the driver is determined to be impaired. Current impairment technology monitors head an…

That's a bizarre interpretation of 'cars in Europe must have a system to automnatically call emergency services when they crash/their airbags deploy'

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#292

Post by indymike »

scottbez1 wrote: post #135
duxup wrote: post #41

Earlier quoted context omitted.

I love my Subaru as far as reliability, all wheel drive performance in snow and ice, and such. But OMG it's consumer tech was dated when I bough it, and it's just full of inexplicable issues and caveats and such. Even just the limitations and the UX issues are so obvious that it sends a message that if they tried to fix them they would introduce just as many new issues. I'm at the point where despite the car being go…

Hmm this is really different than my experience with a 2018 Crosstrek, so maybe things have changed? When I bought it, Subaru was among the earlier CarPlay/Android Auto adopters (we specifically ruled out a new model year Prius because it lacked it and we couldn't wait a year to replace our totaled car just for CarPlay/AA), and other than a very rare issue where the head unit screen doesn't turn on, it's been pretty…

I have a 2018 Crosstrek and a 2024 Outback. They both are really, really, good, and here are the two rough edges.

* Crosstrek doesn't do wireless CP/AA, and the USB only supplies 1.5a, so it sometimes isn't enough to charge the phone while listening to music and navigating. This is a common problem in 2018 vehicles. USB-C had not conquered the world yet.

* Outback has a big screen. The only complaint is that it is too aggressive, telling users no because the vehicle is moving. Passenger operating the touch screen is a thing, and nothing is worse than having to pull over so someone can change a setting. Also, it is a very bad experience to be going 70MPH, tap a button, and be told no - will be interesting to see if this causes accidents where people momentarily stop paying attention to the road because they are raging to the touch screen.

One thing that is really nice about Subaru is that the controls just evolve a little from model year to model year. When I got the Outback, there were only a few buttons that had moved to get used to. Aside from climate control, almost everything has buttons, and most of the time, they are on a stalk or steering wheel.

There is no cure for digital privacy in any modern car. And there is no consumer choice to enable or disable data sharing. We need some legislative intervention here.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#293

Post by dml2135 »

I live in the city so I've never owned a car, but would like to get one at some point. I'd want at least a plug-in hybrid, if not full electric, and absolutely no internet connectivity or tracking (or at least something that can be physically removed).

Is there even a single (new) car that fits this criteria?

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#294

Post by dml2135 »

dylan604 wrote: post #235
JumpCrisscross wrote: post #220

Earlier quoted context omitted.

> because you can does not mean you should (or actually need to) Most people don’t need to drive. Out of their driving, most of it is superfluous. Pretty much everyone in my town with remote start uses it. Particularly if it’s a day where temperatures are close to 0°F and you’re weighing another run.

> Most people don’t need to drive. This is one of those comments that just tells everyone reading that you don't think much outside whatever area you dwell. There are lots of people not anywhere near you that do need to drive. Not accepting not everyone is like you is just small minded, and makes the conversation not worth having

"most" != "everyone"

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#295

Post by Mountain_Skies »

solatic wrote: post #276
_joel wrote: post #47

Earlier quoted context omitted.

That seems like a culture issue rather than an appsec issue?

I left security work for a similar reason. In most companies, Security isn't there to collaboratively build more reliable and dependable products that protect customer privacy, bringing in a useful perspective of how things can go wrong, similar to QA's role. Instead, Security is there to be the internal police, who treat engineers (and other employees) like criminals, and get recognition and rewards for stopping the…

While I'm sure that's also common, my general impression was that security was there to provide legal protection against being found to have been guilty of willful negligence if there were a breach. There wasn't a top down push for actual security but there was one for getting all the proper boxes ticked so the company could get the compliance certifications required for insurance and to make the legal department happy. Essentially it was financial risk management rather than data risk management.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#296

Post by [deleted] »

netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

[deleted]

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#297

Post by interloxia »

panki27 wrote: post #88

This is even worse than the VW data leak reported around a month ago. [1] [1] https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo...

Discussion at the time

https://news.ycombinator.com/item?id=42524422

https://news.ycombinator.com/item?id=42547864

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#298

Post by xp84 »

blackeyeblitzar wrote: post #87
Cumpiler69 wrote: post #26

Earlier quoted context omitted.

[flagged]

> Indians are some of the most racially nepotistic out there I’ve heard this claim made often here but never observed it in real life. I think you and others who repeat this claim are confusing nepotism with just using one’s network to accelerate hiring. If someone happens to have a social or professional network mostly of one race, that doesn’t mean they’re automatically nepotistic when they draw from that network.…

First of all the term nepotism doesn’t get used there because white managers with mostly white teams simply get called racist, and “in violation of our DEI policy.”

For white people, just having your whole network be mostly white is itself said to be a red flag to a lot of people, regardless of how it came to be that way. So the same should apply to Indian people too. Their network ought to be more diverse if that’s the only place they are going to hire from.

(Or else we can drop the quotas, and hire on merit only - I’m absolutely fine with that!)

Personally my network has plenty of both. I’ve worked with some incredible Indian, American, and Indian-American people and they’ve each earned my respect.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#299

Post by xp84 »

preisschild wrote: post #12
netsharc wrote: post #4

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

Or not requiring ANYTHING to authenticate in your forgetPassword endpoint, but being able to set a new password directly instead of sending a randomly generated per email / send a one time token to reset the password yourself via email

To me that sounds exactly like what I would expect from some of the junior developers I’ve met in recent years. Most of the business logic in JavaScript. Poor modeling of a client-server relationship, and no consideration of which parts of the system can be trusted. The design was based on the non-technical requirements doc or the mockups, and an inexperienced front-end developer asked the inexperienced backend guy (or maybe they’re the same person) for an endpoint, and for the inputs, he mapped directly the fields in the form.

Thankfully, even AI writes better code than this, so as this type of developer quickly becomes unemployable over the next few years, I think we’ll see a temporary increase in code quality.

Re: Hacking Subaru: Tracking and controlling cars via the admin panel

#300

Post by numpad0 »

grogenaut wrote: post #250
duxup wrote: post #128

Earlier quoted context omitted.

>UI/UX and especially overall experience polish had always been a major challenge for Japanese engineering. I can believe it. The whole issue of "Japanese video game companies don't understand the internet" to some extent still feels like it is an issue at times. For a while it felt like we got late 1990s solutions in the mid 2010s... it's gotten better-ish in the land of video games, but man it's so bad at times sti…

sony fixed this with the ps4 by saying eff it "harware is done in japan where we're good at it, you brits and yanks can have the software"

Weird part is it doesn't seem to be working out as a business. They've completely lost mystique doing that.
Post reply on HN