14 ms·

I recently picked up a Volt which includes this OnStar 4G setup and have to say I'm extremely concerned at how quickly this "my car is on the internet" feature

I recently picked up a Volt which includes this OnStar 4G setup and have to say I'm extremely concerned at how quickly this "my car is on the internet" feature set is spreading. Everything is managed by OnStar through their device that's factory installed into every new Chevy vehicle. They have had security breaches and had to fix white-hat reported vulnerabilities in the past[1]. This system isn't just "4G wifi as a hotspot", it has almost full access to every system in the car. Chevy offers this mobile app called MyLink which lets you remote-start, lock, unlock your car using this same connection. History shows that car manufacturers have not given near enough thought to the security of access to a vehicle. I'm afraid that it's only a matter of time before we have a bot net either using cars, a bot-net that attacks and takes over cars, or both, with the potential of lots of damage and loss of life. As such I immediately told OnStar to disable service to my car and will be finding and disconnecting the OnStar box (as it still phones home periodically) as I just have no reason to trust such a thing at this time. [1] https://www.wired.com/2015/09/gm-took-5-years-fix-full-takeover-hack-millions-onstar-cars/ https://www.wired.com/2015/09/gm-took-5-years-fix-full-takeo...

chrisper 10y ago
Stuff like this has been around forever. I once drove a 2007 BMW 7 series which let me unlock/lock my car from my phone. I also got weather data etc. on my dash. Now it is finally making it to normal cars. My 2014 Passat has it as well. However, I didn't activate it since it is tracking my location. On the other hand, stuff like Onstar can save lives. http://www.mercurynews.com/2014/10/14/san-jose-mount-hamilton-road-rescue-frees-woman-who-spent-18-hours-in-ravine/ http://www.mercurynews.com/2014/10/14/san-jose-mount-hamilto...
- _audakel 10y ago
  tl;dr of mercurynews: A 28-year-old Campbell woman who spent the night at the bottom of a 500-foot ravine after veering off Mount Hamilton Road was rescued Tuesday morning and flown to a hospital to be treated for her injuries. The General Motors’ OnStar system and Apple’s Find My iPhone service determined users’ location.
- pjc50 10y ago
  The EU is trying to make something like Onstar - "eCall" - mandatory for all new cars. I'm concerned how that's going to turn out.
tclancy 10y ago
Obligatory story: I bought a Camaro when the new ones first came out (2009). I ran into some issues with the radio, found out via forums I was 3 firmware versions behind and then slowly found out car dealers were ill-prepared to be software vendors. They had no idea about the radio updates and their system showed nothing for me against my VIN. This was a common enough experience across the country that one of the coders working on the radio started giving the updates out via email. Which is how I wound up sitting in my car with two USB sticks full of C#. Put the first one in, turn the key, updates. Then open the driver's side door to reset the process (yes, seriously) and put the second USB stick in. Before that experience I used to laugh off the idea of a weaponized mp3 file or people taking control of cars remotely. Now I think about that auto-boot USB port and the fact my driver's side door is a toggle to God-knows-what.
- vvanders 10y ago
  Yowza. I don't see how all mfgrs don't move to Tesla's update model. Knowing how things go it'll probably be 10 years before we're there.
  - caleblloyd 10y ago
    Probably because they would have to support tens of models and tens of millions of vehicles. Big car companies contract their head units out per body style, so one company may design the 2008-2012 head units and another 2013-2016. They likely have wildly different sensors, firmware update formats, etc. Bigger car companies prefer stability over features and don't design everything in-house like Tesla. Their shareholders also expect them to turn profits, which leads to risk adversion and slower product cycles.
    - lucaspiller 10y ago
      The head units can also be vastly different by region - which doesn't really make much sense to me. Sure in US you have satellite radio which is unheard of elsewhere, but that's about it. I have a 2010 Prius and the US model has a DVD for navigation, where as the EU model has a HDD and needs to go to a dealer for €€€ updates.
mtgx 10y ago
I can't find the article anymore, but around 2003 or 2004 there was an article on the NYT about law enforcement using OnStar to spy on what people are talking about in the car (on the phone, etc).
- _audakel 10y ago
  maybe this? Cartapping: How Feds Have Spied On Connected Cars For 15 Years https://www.forbes.com/sites/thomasbrewster/2017/01/15/police-spying-on-car-conversations-location-siriusxm-gm-chevrolet-toyota-privacy/#3db1c8ee2ef8 https://www.forbes.com/sites/thomasbrewster/2017/01/15/polic...
stcredzero 10y ago
History shows that car manufacturers have not given near enough thought to the security of access to a vehicle. Here's how GM could beat Tesla, along with why it won't happen. GM could just take a look at what Tesla is doing, and do all of the same things, then do certain key things better. From a sheer resources and capability standpoint, GM could beat the pants off of Tesla. I think Tesla is counting on: 1) GM and other big automakers being too set in their ways and 2) GM and other big automakers getting some key things very, very wrong. Security is probably a key example. It's an oft-cited insurgency move to use the big power's culture against itself.
- empath75 10y ago
  Here's how Blackberry could beat Apple, along with why it won't happen. Blackberry could just take a look at what Apple is doing, and do all of the same things, then do certain key things better. From a sheer resources and capability standpoint, Blackberry could beat the pants off of Apple. I think Apple is counting on: 1) Blackberry and other big phone makers being too set in their ways and 2) GM and other big phone makers getting some key things very, very wrong. Security is probably a key example. It's an oft-cited insurgency move to use the big power's culture against itself.
  - protomyth 10y ago
    To be fair, Blackberry (RIM) was not bigger than Apple on the day of the iPhone announcement. Also, RIM was kind of forced to build something like the iPhone by Verizon according to Losing the Signal by Jacquie McNish https://smile.amazon.com/Losing-Signal-Extraordinary-Spectacular-BlackBerry/dp/1250060176/ref=smi_www_rco2_go_smi_b2609328962?_encoding=UTF8&*Version*=1&*entries*=0&ie=UTF8 https://smile.amazon.com/Losing-Signal-Extraordinary-Spectac...
    - kbenson 10y ago
      To be honest, there is some truth in the ideas behind the point though. RIM always liked to control everything, and at most give Enterprises control, but not end users. Apple targeted consumers, and relied on consumers to push into enterprise for them. IIRC, it was actually some time before iOS even supported basic enterprise features (like company control and reset for company devices, etc).
js2 10y ago
Also a new Volt owner, and I plan to detach the antenna from the OnStar unit in mine. You can't disable it entirely or the car gets angry.
- jameskilton 10y ago
  I tried pulling the OnStar fuse from the fuse box and the only change I noticed was that the in-car microphone stopped working! Makes one wonder just how ingrained OnStar tech is in these vehicles.
  - bonestamp2 10y ago
    You guys might appreciate this little how to: https://www.youtube.com/watch?v=i0dvLuWna9Q https://www.youtube.com/watch?v=i0dvLuWna9Q
    - js2 10y ago
      Yeah, I've seen that, thanks. I think the location is different on the gen2.
Andrenid 10y ago
I've posted this before, but it's relevant so I'll post it again. Not sure if this has changed since I last posted, but it's a hell of a warning sign on how they practice: So, I'm an Australian. We don't have OnStar but I've heard about it via the net. I keep getting emails for 2 different people's OnStar accounts to my Email address... and OnStar won't do anything about it. I have a pretty short Gmail address because I signed up early (6 characters), and Gmail's autocorrect/fuzzy email receiving means I get emails for all sorts of people that have mistyped their email and mine is "close" to what they typed. To give you an idea of how bad this OnStar situation is: - The emails have all the personal details inside each one. Name, home address, car make/model and various ID/registration details, home phone number, etc. - It gives me full access to the cars maintenance records via monthly emails with EVERYTHING in the email relating to the car, INCLUDING LETTING ME EDIT IT via a link. - It gives me a link directly to their OnStar account, and the password is the persons postcode, WHICH IS IN THE EMAIL. There's quicklinks to access the full account, change vehicle details, remotely access various aspects of the vehicle's features, etc. - I can send directions to their GPS from my browser, which comes up on their screen. - ... lots lots more "could" be done if I was inclined. I've emailed OnStar support about it a few times, they don't reply. The closest I get to any form of reply is an automatic message telling me to call them on a "toll free number" (not free for me to call from here!) PS, Mr Buchner, your 'tires' on your GMC Terrain are low and your oil needs changing urgently. It's overdue by months.
- bonestamp2 10y ago
  Oh brother, I know your pain. I too have a 6 character gmail address because I signed up in 2004 when it was in beta and I too get email for all sorts of people (both accidentally and because people just give out my email address as a fake when they sign up for something stupid). It can be fun too though, like when someone signs up for a dating site with your email and you can login to what is effectively your account. I had the same problem as you with a large bank... kept getting emails with someone else's balance in them. I kept responding and trying to get the bank's attention, but nothing. Eventually I tweeted at them publicly with a description of the problem and that got them to clear it up pretty quickly. ;)
nommm-nommm 10y ago
>History shows that car manufacturers have not given near enough thought to the security of access to a vehicle Yeah! No kidding! I read last year about how Nissan's Leaf API was entirely unauthenticated, all you needed was the VIN to mess with people's climate control. https://www.troyhunt.com/controlling-vehicle-features-of-nissan/ https://www.troyhunt.com/controlling-vehicle-features-of-nis...
bonestamp2 10y ago
Your concern is valid and it's not lost on manufacturers. I am familiar with one manufacturer whose vehicles will have a bus level firewall in some new vehicles released later this year. Of course, eventually all vehicles will have it. Vehicle development cycles are usually multiple years so it takes time to roll this stuff out. You might say an internet connected head unit should just be disconnected from the vehicle bus, and there's some merit to that. But, customers want to be able to control the volume from their steering wheel or the head unit should control the subwoofer amp in the back of the vehicle, or change vehicle settings from the head unit display... so the head unit needs to be on the bus to do all of these things. The goal is to limit what the head unit has access to on the bus. For example, there's no reason the PCM (powertrain control module) should be allowed to receive anything other than high level configuration information from the head unit (switching between standard and sport mode driving profiles for example).
- cjiang 10y ago
  Do you know who makes the bus level firewall? Do you mind sharing the manufacturer's name?
  - bonestamp2 10y ago
    I'm sorry, I can't share the manufacturer or the firewall they're using. But I don't want to be unhelpful... I know that Bosch makes a CGW module that has firewall functionality: http://www.bosch-mobility-solutions.com/en/products-and-services/passenger-cars-and-light-commercial-vehicles/connectivity-solutions/central-gateway-cgw/ http://www.bosch-mobility-solutions.com/en/products-and-serv...
awqrre 10y ago
You are probably vulnerable even if you don't subscribe too... There needs to be an "airplane mode" that completely disables wireless communications...

chrisper 10y ago

Stuff like this has been around forever. I once drove a 2007 BMW 7 series which let me unlock/lock my car from my phone. I also got weather data etc. on my dash. Now it is finally making it to normal cars. My 2014 Passat has it as well. However, I didn't activate it since it is tracking my location. On the other hand, stuff like Onstar can save lives. http://www.mercurynews.com/2014/10/14/san-jose-mount-hamilton-road-rescue-frees-woman-who-spent-18-hours-in-ravine/ http://www.mercurynews.com/2014/10/14/san-jose-mount-hamilto...

_audakel 10y ago
tl;dr of mercurynews: A 28-year-old Campbell woman who spent the night at the bottom of a 500-foot ravine after veering off Mount Hamilton Road was rescued Tuesday morning and flown to a hospital to be treated for her injuries. The General Motors’ OnStar system and Apple’s Find My iPhone service determined users’ location.
pjc50 10y ago
The EU is trying to make something like Onstar - "eCall" - mandatory for all new cars. I'm concerned how that's going to turn out.

tclancy 10y ago

Obligatory story: I bought a Camaro when the new ones first came out (2009). I ran into some issues with the radio, found out via forums I was 3 firmware versions behind and then slowly found out car dealers were ill-prepared to be software vendors. They had no idea about the radio updates and their system showed nothing for me against my VIN. This was a common enough experience across the country that one of the coders working on the radio started giving the updates out via email. Which is how I wound up sitting in my car with two USB sticks full of C#. Put the first one in, turn the key, updates. Then open the driver's side door to reset the process (yes, seriously) and put the second USB stick in. Before that experience I used to laugh off the idea of a weaponized mp3 file or people taking control of cars remotely. Now I think about that auto-boot USB port and the fact my driver's side door is a toggle to God-knows-what.

vvanders 10y ago
Yowza. I don't see how all mfgrs don't move to Tesla's update model. Knowing how things go it'll probably be 10 years before we're there.
- caleblloyd 10y ago
  Probably because they would have to support tens of models and tens of millions of vehicles. Big car companies contract their head units out per body style, so one company may design the 2008-2012 head units and another 2013-2016. They likely have wildly different sensors, firmware update formats, etc. Bigger car companies prefer stability over features and don't design everything in-house like Tesla. Their shareholders also expect them to turn profits, which leads to risk adversion and slower product cycles.
  - lucaspiller 10y ago
    The head units can also be vastly different by region - which doesn't really make much sense to me. Sure in US you have satellite radio which is unheard of elsewhere, but that's about it. I have a 2010 Prius and the US model has a DVD for navigation, where as the EU model has a HDD and needs to go to a dealer for €€€ updates.

mtgx 10y ago

I can't find the article anymore, but around 2003 or 2004 there was an article on the NYT about law enforcement using OnStar to spy on what people are talking about in the car (on the phone, etc).

_audakel 10y ago
maybe this? Cartapping: How Feds Have Spied On Connected Cars For 15 Years https://www.forbes.com/sites/thomasbrewster/2017/01/15/police-spying-on-car-conversations-location-siriusxm-gm-chevrolet-toyota-privacy/#3db1c8ee2ef8 https://www.forbes.com/sites/thomasbrewster/2017/01/15/polic...

stcredzero 10y ago

History shows that car manufacturers have not given near enough thought to the security of access to a vehicle. Here's how GM could beat Tesla, along with why it won't happen. GM could just take a look at what Tesla is doing, and do all of the same things, then do certain key things better. From a sheer resources and capability standpoint, GM could beat the pants off of Tesla. I think Tesla is counting on: 1) GM and other big automakers being too set in their ways and 2) GM and other big automakers getting some key things very, very wrong. Security is probably a key example. It's an oft-cited insurgency move to use the big power's culture against itself.

empath75 10y ago
Here's how Blackberry could beat Apple, along with why it won't happen. Blackberry could just take a look at what Apple is doing, and do all of the same things, then do certain key things better. From a sheer resources and capability standpoint, Blackberry could beat the pants off of Apple. I think Apple is counting on: 1) Blackberry and other big phone makers being too set in their ways and 2) GM and other big phone makers getting some key things very, very wrong. Security is probably a key example. It's an oft-cited insurgency move to use the big power's culture against itself.
- protomyth 10y ago
  To be fair, Blackberry (RIM) was not bigger than Apple on the day of the iPhone announcement. Also, RIM was kind of forced to build something like the iPhone by Verizon according to Losing the Signal by Jacquie McNish https://smile.amazon.com/Losing-Signal-Extraordinary-Spectacular-BlackBerry/dp/1250060176/ref=smi_www_rco2_go_smi_b2609328962?_encoding=UTF8&*Version*=1&*entries*=0&ie=UTF8 https://smile.amazon.com/Losing-Signal-Extraordinary-Spectac...
  - kbenson 10y ago
    To be honest, there is some truth in the ideas behind the point though. RIM always liked to control everything, and at most give Enterprises control, but not end users. Apple targeted consumers, and relied on consumers to push into enterprise for them. IIRC, it was actually some time before iOS even supported basic enterprise features (like company control and reset for company devices, etc).

js2 10y ago

Also a new Volt owner, and I plan to detach the antenna from the OnStar unit in mine. You can't disable it entirely or the car gets angry.

jameskilton 10y ago
I tried pulling the OnStar fuse from the fuse box and the only change I noticed was that the in-car microphone stopped working! Makes one wonder just how ingrained OnStar tech is in these vehicles.
- bonestamp2 10y ago
  You guys might appreciate this little how to: https://www.youtube.com/watch?v=i0dvLuWna9Q https://www.youtube.com/watch?v=i0dvLuWna9Q
  - js2 10y ago
    Yeah, I've seen that, thanks. I think the location is different on the gen2.

Andrenid 10y ago

I've posted this before, but it's relevant so I'll post it again. Not sure if this has changed since I last posted, but it's a hell of a warning sign on how they practice: So, I'm an Australian. We don't have OnStar but I've heard about it via the net. I keep getting emails for 2 different people's OnStar accounts to my Email address... and OnStar won't do anything about it. I have a pretty short Gmail address because I signed up early (6 characters), and Gmail's autocorrect/fuzzy email receiving means I get emails for all sorts of people that have mistyped their email and mine is "close" to what they typed. To give you an idea of how bad this OnStar situation is: - The emails have all the personal details inside each one. Name, home address, car make/model and various ID/registration details, home phone number, etc. - It gives me full access to the cars maintenance records via monthly emails with EVERYTHING in the email relating to the car, INCLUDING LETTING ME EDIT IT via a link. - It gives me a link directly to their OnStar account, and the password is the persons postcode, WHICH IS IN THE EMAIL. There's quicklinks to access the full account, change vehicle details, remotely access various aspects of the vehicle's features, etc. - I can send directions to their GPS from my browser, which comes up on their screen. - ... lots lots more "could" be done if I was inclined. I've emailed OnStar support about it a few times, they don't reply. The closest I get to any form of reply is an automatic message telling me to call them on a "toll free number" (not free for me to call from here!) PS, Mr Buchner, your 'tires' on your GMC Terrain are low and your oil needs changing urgently. It's overdue by months.

bonestamp2 10y ago
Oh brother, I know your pain. I too have a 6 character gmail address because I signed up in 2004 when it was in beta and I too get email for all sorts of people (both accidentally and because people just give out my email address as a fake when they sign up for something stupid). It can be fun too though, like when someone signs up for a dating site with your email and you can login to what is effectively your account. I had the same problem as you with a large bank... kept getting emails with someone else's balance in them. I kept responding and trying to get the bank's attention, but nothing. Eventually I tweeted at them publicly with a description of the problem and that got them to clear it up pretty quickly. ;)

nommm-nommm 10y ago

>History shows that car manufacturers have not given near enough thought to the security of access to a vehicle Yeah! No kidding! I read last year about how Nissan's Leaf API was entirely unauthenticated, all you needed was the VIN to mess with people's climate control. https://www.troyhunt.com/controlling-vehicle-features-of-nissan/ https://www.troyhunt.com/controlling-vehicle-features-of-nis...

bonestamp2 10y ago

Your concern is valid and it's not lost on manufacturers. I am familiar with one manufacturer whose vehicles will have a bus level firewall in some new vehicles released later this year. Of course, eventually all vehicles will have it. Vehicle development cycles are usually multiple years so it takes time to roll this stuff out. You might say an internet connected head unit should just be disconnected from the vehicle bus, and there's some merit to that. But, customers want to be able to control the volume from their steering wheel or the head unit should control the subwoofer amp in the back of the vehicle, or change vehicle settings from the head unit display... so the head unit needs to be on the bus to do all of these things. The goal is to limit what the head unit has access to on the bus. For example, there's no reason the PCM (powertrain control module) should be allowed to receive anything other than high level configuration information from the head unit (switching between standard and sport mode driving profiles for example).

cjiang 10y ago
Do you know who makes the bus level firewall? Do you mind sharing the manufacturer's name?
- bonestamp2 10y ago
  I'm sorry, I can't share the manufacturer or the firewall they're using. But I don't want to be unhelpful... I know that Bosch makes a CGW module that has firewall functionality: http://www.bosch-mobility-solutions.com/en/products-and-services/passenger-cars-and-light-commercial-vehicles/connectivity-solutions/central-gateway-cgw/ http://www.bosch-mobility-solutions.com/en/products-and-serv...

awqrre 10y ago

You are probably vulnerable even if you don't subscribe too... There needs to be an "airplane mode" that completely disables wireless communications...