7 ms·

It's genuinely scary to see how trivial these attacks often are. Who on earth wrote these API endpoints and thought they were acceptably secure? If the car com

• smarx007 11y ago
  Bad stuff happens - I think it's a pretty safe assumption. What is worse is that there was some PM out there who didn't want to immediately disable the whole service until the issue was fixed. So I think this disclosure is a fair thing to do - when they choose between PR image or security, they must understand that both can get dragged through the mud.
  • mavhc 11y ago
    Who will you trust to make your next car, a car company or a software company with a record of good security?
    • smarx007 11y ago
      An automotive company for sure, but it might not be Nissan (I actually drive Qashqai).
    • dyarosla 11y ago
      Ideally a car company with a record of good manufacturing partnered with a software company with a record for good security. But I don't see that kind of partnership happening with the likely players we're talking about in the space.
    • marssaxman 11y ago
      Neither. I'll continue to assume that embedded code is shitty and insecure, because it always has been before, and nothing about the fundamental economics of the problem have changed.
  • mikeash 11y ago
    Seems to me that this goes beyond "bad stuff happens." To me, that phrase would apply to stuff like using a weak random number generator, or forgetting to check some critical piece of authentication, or accidentally leaving some test code enabled that lets people go where they shouldn't. Basically, inattention or oversights or lack of understanding. But here, we have a system that's deliberately designed to use, as its only public-facing authentication token, a string of characters literally printed on the car. No amount of inattention or oversight could possibly lead a person to confuse that for secret data, unless they were somehow totally unfamiliar with cars. I have a hard time figuring out how something like this could even ship. To me, this is a lot worse than responding badly when told there is a vulnerability. After all, if you think it's OK to use something any passing stranger can read as a secret key, some random internet dude telling you it's insecure probably won't suddenly make you realize you've got it all wrong.
• tigeba 11y ago
  The previous API had authentication. The new API was rolled out earlier this year, and it seems like a pretty bizarre omission indeed. edit: I will inform HN if my climate control mysteriously turns on today :)
• wnevets 11y ago
  it was probably outsourced and written exactly to spec.
  • chippy 11y ago
    Yep, and now they are trying to get the outsourcer to fix it...