7 ms·

How does the Leaf connect to the servers to receive commands? How secure is this link? It would be easy to speculate that after breaking into the link between

How does the Leaf connect to the servers to receive commands? How secure is this link? It would be easy to speculate that after breaking into the link between Nissan servers and the car you'd be able to do rather more mischief and likely exploit vulnerabilities in the software itself to do things not exposed in the API. Its easy to imagine that there isn't even a firewall between the remotely-accessible system and the engine control system. Its also easy to imagine that the data being uploaded to Nissan is rather more privacy-invading than the travel log exposed by the public API. We want someone to hack into the Leaf and expose it wide open.

gravypod 11y ago
I've been wondering this too. Tesla does it as well. It makes me feel "bad" on the inside from a security perspective. Can I turn this feature off? How does it communicate?
- masklinn 11y ago
  > Can I turn this feature off? The article says that you can, by disabling CarWings/NissanConnect. Which you should probably do if you're a connected Leaf owner, as it lets anyone control AC/heating and gives them historic driving information (date, distance and "driving efficiency"). > How does it communicate? Lost the source (maybe one of the forums linked from http://www.troyhunt.com/2016/02/controlling-vehicle-features-of-nissan.html? http://www.troyhunt.com/2016/02/controlling-vehicle-features...) but I read the CarWings service sends an SMS to the car, which contacts the webservice to return its information.
  - willvarfar 11y ago
    Turning off the web API stops people communicating with Nissan's webservice; it doesn't stop the car communicating with Nissan's webservice.
    - tigeba 11y ago
      The car actually randomly asks you permission to do this. You will start the car up and there will be a dialog asking you to continue to allow the computer to communicate with Nissan. If I recall, you also need to enter in some credentials into the car's computer for it to communicate with Nissan.
      - mikestew 11y ago
        The car actually randomly asks you permission to do this. No, it asks you every...friggin'...time you start the car, with no way to say "you have my permission from now on". I wish it were random, at least that way there be times I don't have to punch the "OK" button.
        dangrossman 11y ago
        Only the 2011 and 2012 model years worked like that. Newer Leafs only require you to acknowledge the agreement every few months.
        reacweb 11y ago
        Is there an upgrade ? This is an unbearable nag screen.
        dangrossman 11y ago
        No. And even better, when CarWings stops working at the end of the year because there's no AT&T 2G network for it to connect to, you'll still be pressing "OK" twice a day for no reason at all.
- codeulike 11y ago
  Tesla do it properly though.
  - gravypod 11y ago
    No remote back doors, automatic updates, and ability to control my hardware are done "properly." It's giving Tesla the keys to the car I bought from them. When did such an egregious affront to privacy and device security become acceptable?
    - codeulike 11y ago
      On a Tesla its not a back door, its a front door, and its there by design. If you don't want a car that can accept some commands from the net, don't buy a Tesla. But my point is that given they wanted those features, Tesla at least built them with security in mind.
      - gravypod 11y ago
        I was very interested in the car up until they said that they would push out an "over the air update," please would you be able to point me were on their product page they said they could push software updates and remote commands to your device after you purchased it? I must have missed that. I originally thought the Tesla was a great car, but I at some point saw that you could remotely manipulate the car and there was no method of disabling it. I don't think anything of this nature is personally acceptably and I hate similar systems (see onstar).
        dangrossman 11y ago
        > please would you be able to point me were on their product page they said they could push software updates and remote commands to your device after you purchased it? "Model S periodically receives over the air software updates that add new features and refresh the touchscreen look and feel." "Autopilot features are progressively enabled over time with software updates. The current software is 7.0, adding automatic steering and parallel parking." https://www.teslamotors.com/models https://www.teslamotors.com/models "We may use personal information for a variety of reasons, such as those listed below: To provide service to your Tesla vehicle, including to contact you with service recommendations and to deliver over-the-air updates to your vehicle." https://www.teslamotors.com/about/legal https://www.teslamotors.com/about/legal "Tesla vehicles regularly receives over-the-air software updates that add new features and functionality. When an update is available, you’ll be notified on the center display with an option to install immediately, or schedule the installation for a later time." https://www.teslamotors.com/support/software-updates https://www.teslamotors.com/support/software-updates There's probably also purchase and service/warranty agreements you'd be signing prior to buying the car, but I don't own a Tesla so I don't know what's in those.
masklinn 11y ago
> How does the Leaf connect to the servers to receive commands? Cellular, apparently commands are pushed to the car via SMS, and the car connects to a webservice to return info or whatever.

gravypod 11y ago

I've been wondering this too. Tesla does it as well. It makes me feel "bad" on the inside from a security perspective. Can I turn this feature off? How does it communicate?

masklinn 11y ago
> Can I turn this feature off? The article says that you can, by disabling CarWings/NissanConnect. Which you should probably do if you're a connected Leaf owner, as it lets anyone control AC/heating and gives them historic driving information (date, distance and "driving efficiency"). > How does it communicate? Lost the source (maybe one of the forums linked from http://www.troyhunt.com/2016/02/controlling-vehicle-features-of-nissan.html? http://www.troyhunt.com/2016/02/controlling-vehicle-features...) but I read the CarWings service sends an SMS to the car, which contacts the webservice to return its information.
- willvarfar 11y ago
  Turning off the web API stops people communicating with Nissan's webservice; it doesn't stop the car communicating with Nissan's webservice.
  - tigeba 11y ago
    The car actually randomly asks you permission to do this. You will start the car up and there will be a dialog asking you to continue to allow the computer to communicate with Nissan. If I recall, you also need to enter in some credentials into the car's computer for it to communicate with Nissan.
    - mikestew 11y ago
      The car actually randomly asks you permission to do this. No, it asks you every...friggin'...time you start the car, with no way to say "you have my permission from now on". I wish it were random, at least that way there be times I don't have to punch the "OK" button.
      - dangrossman 11y ago
        Only the 2011 and 2012 model years worked like that. Newer Leafs only require you to acknowledge the agreement every few months.
        reacweb 11y ago
        Is there an upgrade ? This is an unbearable nag screen.
        dangrossman 11y ago
        No. And even better, when CarWings stops working at the end of the year because there's no AT&T 2G network for it to connect to, you'll still be pressing "OK" twice a day for no reason at all.
codeulike 11y ago
Tesla do it properly though.
- gravypod 11y ago
  No remote back doors, automatic updates, and ability to control my hardware are done "properly." It's giving Tesla the keys to the car I bought from them. When did such an egregious affront to privacy and device security become acceptable?
  - codeulike 11y ago
    On a Tesla its not a back door, its a front door, and its there by design. If you don't want a car that can accept some commands from the net, don't buy a Tesla. But my point is that given they wanted those features, Tesla at least built them with security in mind.
    - gravypod 11y ago
      I was very interested in the car up until they said that they would push out an "over the air update," please would you be able to point me were on their product page they said they could push software updates and remote commands to your device after you purchased it? I must have missed that. I originally thought the Tesla was a great car, but I at some point saw that you could remotely manipulate the car and there was no method of disabling it. I don't think anything of this nature is personally acceptably and I hate similar systems (see onstar).
      - dangrossman 11y ago
        > please would you be able to point me were on their product page they said they could push software updates and remote commands to your device after you purchased it? "Model S periodically receives over the air software updates that add new features and refresh the touchscreen look and feel." "Autopilot features are progressively enabled over time with software updates. The current software is 7.0, adding automatic steering and parallel parking." https://www.teslamotors.com/models https://www.teslamotors.com/models "We may use personal information for a variety of reasons, such as those listed below: To provide service to your Tesla vehicle, including to contact you with service recommendations and to deliver over-the-air updates to your vehicle." https://www.teslamotors.com/about/legal https://www.teslamotors.com/about/legal "Tesla vehicles regularly receives over-the-air software updates that add new features and functionality. When an update is available, you’ll be notified on the center display with an option to install immediately, or schedule the installation for a later time." https://www.teslamotors.com/support/software-updates https://www.teslamotors.com/support/software-updates There's probably also purchase and service/warranty agreements you'd be signing prior to buying the car, but I don't own a Tesla so I don't know what's in those.

masklinn 11y ago

> How does the Leaf connect to the servers to receive commands? Cellular, apparently commands are pushed to the car via SMS, and the car connects to a webservice to return info or whatever.