5 ms·

They've had the injunction for two years, but haven't initiated a recall in the meantime! "Cover up" sounds accurate to me.

kllrnohj 11y ago
A recall for what? There's no safety issue here. There's no functional loss. Unless they advertised the car as being unstealable or anything close there's not even a marketing point that's not working as one could reasonably expect. Carmakers call this a theft-deterrant feature, they don't even call it anti-theft or similar. The immobilizer is not as secure as one would hope, but nobody ever promised you anything here in the first place. What keeps your car from being stolen is not the immobilizer. The government and laws are what keep your car from being stolen.
- scott_karana 11y ago
  It's obviously not a safety recall, but that doesn't mean it isn't serious. Other companies have been known to do voluntary recalls defective locks, why is VAG exempted in your mind? "It barely can even be considered an immobiliser" is almost certainly contrary to reasonable consumer expectations, and it wouldn't surprise me if the EU, at least, had laws regarding this kind of issue.
  - kllrnohj 11y ago
    It's not serious. It still requires someone to specifically target you & your car with special gear and know-how far outside the realm of the typical car thief.
    - ethbro 11y ago
      > It's not serious. It still requires someone to specifically target you & your car with special gear and know-how far outside the realm of the typical car thief. It wouldn't fill me with warm and fuzzies if I were sold a high-end door lock / alarm system / safe that was only exploitable with 'special gear and know-how far outside the realm of the typical thief.'
      - djrogers 11y ago
        >It wouldn't fill me with warm and fuzzies if I were sold a high-end door lock / alarm system / safe that was only exploitable with 'special gear and know-how far outside the realm of the typical thief.' Then you'd better never buy a high-end door lock / alarm system / safe, they all have that in common.
        ethbro 11y ago
        I'm not familiar with the current state of physical security exploitation, but I get the sense that it would take more than 30 minutes and pushing the button on a black box someone built for me to compromise. Unlike this. The issue with electronic exploitation is that the know-how component is relatively trivially automated. Script kiddies, etc. If I bought an $80k Porche, I'd be bit miffed that it could be stolen from a parking lot in the time it took me to have a sit-down lunch.
        kllrnohj 11y ago
        It takes 10 seconds to bypass a window. Alarm systems are a deterrant, not prevention.
        netfire 11y ago
        True, but isn't the whole point of an alarm system to draw attention to the thieves? If a thief can bypass the alarm system or other security measures, it may not look they are stealing the car. This gives them a significant amount of time before law enforcement can be informed and greatly lessens the chance of them being caught.
        ethbro 11y ago
        That's the whole point of an immobilizer. To prevent the typical physical methods (break window, hotwire ignition) from being accepted unless the security token is also present. I don't think Porche et al are under any illusions their windows are rock-proof. ;)
        11y ago
    - shawn-furyan 11y ago
      IDK about "far outside the realm of the typical car thief". Not that the typical car thief is going to be trailblazing the research, but once the research is done, it just takes someone putting a black box VW keyless unlocker together, and then it's in the realm of the typical car thief. In fact, at that point you're talking about the break in being the simplest part of the theft, with fencing being much more difficult.
      - kllrnohj 11y ago
        You really think your typical car thief is going to go find and purchase specialized tools? As always, relevant XKCD: https://xkcd.com/538/ https://xkcd.com/538/
        shawn-furyan 11y ago
        Uhm... these sort of tools are being developed and purchased all the time in black markets. See http://krebsonsecurity.com/ http://krebsonsecurity.com/ for plenty of examples.
    - scott_karana 11y ago
      You really think someone couldn't automate this, and sell the black box (or executable) to car thieves?

kllrnohj 11y ago

A recall for what? There's no safety issue here. There's no functional loss. Unless they advertised the car as being unstealable or anything close there's not even a marketing point that's not working as one could reasonably expect. Carmakers call this a theft-deterrant feature, they don't even call it anti-theft or similar. The immobilizer is not as secure as one would hope, but nobody ever promised you anything here in the first place. What keeps your car from being stolen is not the immobilizer. The government and laws are what keep your car from being stolen.

scott_karana 11y ago
It's obviously not a safety recall, but that doesn't mean it isn't serious. Other companies have been known to do voluntary recalls defective locks, why is VAG exempted in your mind? "It barely can even be considered an immobiliser" is almost certainly contrary to reasonable consumer expectations, and it wouldn't surprise me if the EU, at least, had laws regarding this kind of issue.
- kllrnohj 11y ago
  It's not serious. It still requires someone to specifically target you & your car with special gear and know-how far outside the realm of the typical car thief.
  - ethbro 11y ago
    > It's not serious. It still requires someone to specifically target you & your car with special gear and know-how far outside the realm of the typical car thief. It wouldn't fill me with warm and fuzzies if I were sold a high-end door lock / alarm system / safe that was only exploitable with 'special gear and know-how far outside the realm of the typical thief.'
    - djrogers 11y ago
      >It wouldn't fill me with warm and fuzzies if I were sold a high-end door lock / alarm system / safe that was only exploitable with 'special gear and know-how far outside the realm of the typical thief.' Then you'd better never buy a high-end door lock / alarm system / safe, they all have that in common.
      - ethbro 11y ago
        I'm not familiar with the current state of physical security exploitation, but I get the sense that it would take more than 30 minutes and pushing the button on a black box someone built for me to compromise. Unlike this. The issue with electronic exploitation is that the know-how component is relatively trivially automated. Script kiddies, etc. If I bought an $80k Porche, I'd be bit miffed that it could be stolen from a parking lot in the time it took me to have a sit-down lunch.
        kllrnohj 11y ago
        It takes 10 seconds to bypass a window. Alarm systems are a deterrant, not prevention.
        netfire 11y ago
        True, but isn't the whole point of an alarm system to draw attention to the thieves? If a thief can bypass the alarm system or other security measures, it may not look they are stealing the car. This gives them a significant amount of time before law enforcement can be informed and greatly lessens the chance of them being caught.
        ethbro 11y ago
        That's the whole point of an immobilizer. To prevent the typical physical methods (break window, hotwire ignition) from being accepted unless the security token is also present. I don't think Porche et al are under any illusions their windows are rock-proof. ;)
        11y ago
  - shawn-furyan 11y ago
    IDK about "far outside the realm of the typical car thief". Not that the typical car thief is going to be trailblazing the research, but once the research is done, it just takes someone putting a black box VW keyless unlocker together, and then it's in the realm of the typical car thief. In fact, at that point you're talking about the break in being the simplest part of the theft, with fencing being much more difficult.
    - kllrnohj 11y ago
      You really think your typical car thief is going to go find and purchase specialized tools? As always, relevant XKCD: https://xkcd.com/538/ https://xkcd.com/538/
      - shawn-furyan 11y ago
        Uhm... these sort of tools are being developed and purchased all the time in black markets. See http://krebsonsecurity.com/ http://krebsonsecurity.com/ for plenty of examples.
  - scott_karana 11y ago
    You really think someone couldn't automate this, and sell the black box (or executable) to car thieves?