5 ms·

Where I live car insurance is very comprehensive and one of biggest reasons why people insure their cars is as protection for theft. For the most popular cars,

by zubiaur 11y ago

Where I live car insurance is very comprehensive and one of biggest reasons why people insure their cars is as protection for theft. For the most popular cars, the ones at higher risk of being stolen, tracking is mandatory. All insurance companies require it, otherwise they won't insure your car. So, with the justification of a higher risk and by acting in a coordinated manner, peruvian insurance companies (4 which control the market) have effectively deployed a vast tracking network. Don't know if something similar could happen in the US, there are too many insurance companies as to easily establish common policies across the board and I suspect that it would be harder to come up with a credible justification for it.

TwoBit 11y ago
So what's the car theft rate there? What about RF key validation?
celticninja 11y ago
There are different types of tracker, the ones used for theft prevention / detection tend to be the type that are only activated once a theft is reported. The article is about active type ones that record all driving behaviour to assess your driving.
- avn2109 11y ago
  Once the (very closed source) metrology hardware and transmitter are installed, you have no way of knowing if they decide to track you intermittently, constantly, or never. Can they remotely and silently activate the tracking system at arbitrary times? Probably yes. Can they push software updates over the air to drastically change the functionality of the tracking system? Also probably yes. At the risk of sounding like RMS, an insurance vehicle tracker is not your computer - it doesn't do as you tell it, and it is not on your side. Furthermore you have no idea what they do with the data downstream, particularly wrt giving it to the law and storing it in very insecure ways such that (other) malicious actors can get it. Unless you're the kind of person that believes in the truthfulness, good faith, and technical competence of insurance companies and the police, in which case I have a bridge in Brooklyn that I'd like to sell you.
  - PinguTS 11y ago
    Normally, trackers design for theft detection and reporting can not be re-used for active tracking without changing firmware. The first one is triggered by a dedicated signal from within the car to be activated. Otherwise they are offline to conserve energy. Energy is a very very limited resource in a car. When they are activated, they send a text message for the GPS position. Only a vary view newer once can trigger a web request to report the GPS position. When they are activated they can receive text messages to execute commands like disabling the engine. Versus active trackers are the once mostly designed and engineered within the last 5 years, are able to consume very low energy while activated. They report the position (and may acceleration, deceleration and other parameters) via a web request. Theft prevention are mostly established legacy systems more than 10 years old. Thats a different technology then we are used today.
    - zubiaur 11y ago
      The ones used here are activated remotely. If we assume the tracker to be similar to a cellphone and that it goes into standby mode after the car is of it will be drawing in about 2 - 4 ma, considering that a small car battery has a capacity of 45Ah the consumption would be negligible, it would deplete the battery in 625 days.
      - PinguTS 11y ago
        You are not working in automotive? mA is a considerable amount even when running. In switched off mode, any ECU (with very few exceptions) should not draw more than 100 nA. Remember, there is not only 1 ECU. There are around 40 to more than 100 ECUs. A battery should deplete not more than 50% in 8 weeks.
  - Mo3 11y ago
    There are in fact some ways.. 1) Measure power draw from the car battery (not 100% conclusive probably but a 24-hour measurement might be) 2) Get a 20$ RTLSDR stick, drive somewhere remote with no cell coverage and watch for the tracking device in the GSM/3G frequencies - if found to try to connect it is at least powered on and trying to listen to commands 3) If activated and running on GSM, there might be a chance to listen to and decrypt its communication with the cell tower, especially if text messages are being used - and if not or it's running on 3G you could still monitor how active and frequent the device is in sending and receiving data
nroets 11y ago
Over the last 2 decades, technology has secured many products from common criminals. Think of Internet banking or the authentication provided by mobile phone SIM cards. Yet cars theft is still surprisingly common. Why is that ?
- rconti 11y ago
  Car theft has virtually fallen off a cliff in the United States. In 2013, the rate was 1/3 of what it was in 1991 (the peak for auto thefts in the US). https://www.nicb.org/newsroom/news-releases/historical-look-at-vehicle-theft-in-the-u-s- https://www.nicb.org/newsroom/news-releases/historical-look-...
- semi-extrinsic 11y ago
  Because car manufacturers are idiots who, in the race for the most "ooh, shiny" features don't appear to understand what "improvements" are actually useful and appreciated. If you look at many of the nice features on an S-class Mercedes, for instance, they're neither expensive nor technologically advanced, yet other car manufacturers don't see them as selling points. E.g. the ability to get cold air in your face and warm air on your feet simultaneously. Or the tiny fabric flap between the driver's seat and the central console that stops stuff from your pocket falling down into that hard-to-reach gap. To wit: look at the amplifier attacks that got hundreds of Range Rovers stolen in London last year [1]. Is the tiny effort saved in not getting the keys out of your pocket worth a 50x increase in the chance of your car being stolen? And the subsequent large increase in insurance premiums? Most reasonable people would say "No". [1] http://www.theguardian.com/money/2014/oct/27/thieves-range-rover-keyless-locking http://www.theguardian.com/money/2014/oct/27/thieves-range-r...
shostack 11y ago
Here they are under the guise of roadside assistance and can silently listen in on you. Google stuff about ONStar for details.
- zubiaur 11y ago
  Indeed, wonder if they have been tapped of if there are backdoors built in. This made me think of the "official cars" the peruvian government gets gifted from time to time. These cars are used by ministers, the president and important people in the government. Shortly after china gifted a batch of cars an limos the japanese government did the same. Wonder if they are tapped?

by zubiaur 11y ago

TwoBit 11y ago

So what's the car theft rate there? What about RF key validation?

celticninja 11y ago

There are different types of tracker, the ones used for theft prevention / detection tend to be the type that are only activated once a theft is reported. The article is about active type ones that record all driving behaviour to assess your driving.

avn2109 11y ago
Once the (very closed source) metrology hardware and transmitter are installed, you have no way of knowing if they decide to track you intermittently, constantly, or never. Can they remotely and silently activate the tracking system at arbitrary times? Probably yes. Can they push software updates over the air to drastically change the functionality of the tracking system? Also probably yes. At the risk of sounding like RMS, an insurance vehicle tracker is not your computer - it doesn't do as you tell it, and it is not on your side. Furthermore you have no idea what they do with the data downstream, particularly wrt giving it to the law and storing it in very insecure ways such that (other) malicious actors can get it. Unless you're the kind of person that believes in the truthfulness, good faith, and technical competence of insurance companies and the police, in which case I have a bridge in Brooklyn that I'd like to sell you.
- PinguTS 11y ago
  Normally, trackers design for theft detection and reporting can not be re-used for active tracking without changing firmware. The first one is triggered by a dedicated signal from within the car to be activated. Otherwise they are offline to conserve energy. Energy is a very very limited resource in a car. When they are activated, they send a text message for the GPS position. Only a vary view newer once can trigger a web request to report the GPS position. When they are activated they can receive text messages to execute commands like disabling the engine. Versus active trackers are the once mostly designed and engineered within the last 5 years, are able to consume very low energy while activated. They report the position (and may acceleration, deceleration and other parameters) via a web request. Theft prevention are mostly established legacy systems more than 10 years old. Thats a different technology then we are used today.
  - zubiaur 11y ago
    The ones used here are activated remotely. If we assume the tracker to be similar to a cellphone and that it goes into standby mode after the car is of it will be drawing in about 2 - 4 ma, considering that a small car battery has a capacity of 45Ah the consumption would be negligible, it would deplete the battery in 625 days.
    - PinguTS 11y ago
      You are not working in automotive? mA is a considerable amount even when running. In switched off mode, any ECU (with very few exceptions) should not draw more than 100 nA. Remember, there is not only 1 ECU. There are around 40 to more than 100 ECUs. A battery should deplete not more than 50% in 8 weeks.
- Mo3 11y ago
  There are in fact some ways.. 1) Measure power draw from the car battery (not 100% conclusive probably but a 24-hour measurement might be) 2) Get a 20$ RTLSDR stick, drive somewhere remote with no cell coverage and watch for the tracking device in the GSM/3G frequencies - if found to try to connect it is at least powered on and trying to listen to commands 3) If activated and running on GSM, there might be a chance to listen to and decrypt its communication with the cell tower, especially if text messages are being used - and if not or it's running on 3G you could still monitor how active and frequent the device is in sending and receiving data

nroets 11y ago

Over the last 2 decades, technology has secured many products from common criminals. Think of Internet banking or the authentication provided by mobile phone SIM cards. Yet cars theft is still surprisingly common. Why is that ?

rconti 11y ago
Car theft has virtually fallen off a cliff in the United States. In 2013, the rate was 1/3 of what it was in 1991 (the peak for auto thefts in the US). https://www.nicb.org/newsroom/news-releases/historical-look-at-vehicle-theft-in-the-u-s- https://www.nicb.org/newsroom/news-releases/historical-look-...
semi-extrinsic 11y ago
Because car manufacturers are idiots who, in the race for the most "ooh, shiny" features don't appear to understand what "improvements" are actually useful and appreciated. If you look at many of the nice features on an S-class Mercedes, for instance, they're neither expensive nor technologically advanced, yet other car manufacturers don't see them as selling points. E.g. the ability to get cold air in your face and warm air on your feet simultaneously. Or the tiny fabric flap between the driver's seat and the central console that stops stuff from your pocket falling down into that hard-to-reach gap. To wit: look at the amplifier attacks that got hundreds of Range Rovers stolen in London last year [1]. Is the tiny effort saved in not getting the keys out of your pocket worth a 50x increase in the chance of your car being stolen? And the subsequent large increase in insurance premiums? Most reasonable people would say "No". [1] http://www.theguardian.com/money/2014/oct/27/thieves-range-rover-keyless-locking http://www.theguardian.com/money/2014/oct/27/thieves-range-r...

shostack 11y ago

Here they are under the guise of roadside assistance and can silently listen in on you. Google stuff about ONStar for details.

zubiaur 11y ago
Indeed, wonder if they have been tapped of if there are backdoors built in. This made me think of the "official cars" the peruvian government gets gifted from time to time. These cars are used by ministers, the president and important people in the government. Shortly after china gifted a batch of cars an limos the japanese government did the same. Wonder if they are tapped?