3 ms·
No authentication. The only sort of authentication token is linearly predictable and printed in plain text on the outside of the car. No rate limiting. They su
by gburt 11y ago
No authentication. The only sort of authentication token is linearly predictable and printed in plain text on the outside of the car.
No rate limiting. They successfully used the linear nature to collect a list of valid VINs and validate them.
No apparent intrusion detection.
Bad response to security disclosure. They didn't fix the problem when it was reported, they still haven't addressed the researcher properly.
I'm not sure these are the right people to write life critical software (which admittedly, this vuln. does not appear to relate to life critical systems; just privacy and comfort).
- c-slice 11y agoAnd add on personal info release - the API will provide a username if queried with a VIN.
- seanp2k2 11y agoCar companies are terrible at making software. I'm not surprised that they want to lock down the ECU code, since it's probably awful and full of subtle bugs as well, and they don't want to get hit with tons of lawsuits when people find a bug in the firmware. Really wish they'd just use CarPlay / Android and go back to analog knobs to control HVAC stuff. Opening a modal dialog to adjust fan speed (in a 2015 MDX I've been in) is terrible UX and very distracting to do while driving. The 2nd gen Prius is no better, and the control panel UI in it looks like something from Windows 3.1.