5 ms·
If it can be done remotely, it can be hacked. So just waiting for shady dealers paying hackers to disable cars their competitors sold to drive them out of busin
by rdtsc 9y ago
If it can be done remotely, it can be hacked. So just waiting for shady dealers paying hackers to disable cars their competitors sold to drive them out of business.
- afarrell 9y agoYour larger point is very correct, but far more likely would be organized crime disabling a fleet of commercial vehicles to secure a ransom.
- averagewall 9y agoI doubt these are the factory immobilizers built into the ECU. You can probably just connect two wires together to bypass it. So the ransom would have to be less than the cost of an urgent callout of a mechanic.
- Balgair 9y agoI would really doubt that with most cars made in this century. The On Board Computer (OBC) likely has a satellite hook-up via OnStar or some similar system. You'd likely have to replace the entire OBC, which is many thousands of dollars. I guess you could push-start a manual and get that working, but good luck with that.
- deleted 9y ago[deleted]
- nthj 9y agoThese are separate machines from the OBC that wire into the ignition system. As best I can tell, they are simple timers that reset when they receive a text message over the cellular networks. A friend of mine was warned not to go camping in the boonies near their payment date.
- Balgair 9y ago> A friend of mine was warned not to go camping in the boonies near their payment date. Your friend needs to find a new car, I think. That's insane. Why would you pay someone to do that to you?
- pavel_lishin 9y agoWhy not disable individuals' cars as well? If you can get into the immobilizer system, you can likely get contact information for the driver. Immobilize the car at 3am, and schedule an automated phone call at 6am: "Your car has been immobilized. Send 1 BTC to <address> to unlock your car." I understand that it's more effort than just contacting a single company after immobilizing their fleet, but is a company with a fleet likely to have their cars equipped with immobilizers?
- lordlimecat 9y agoDisabler that only responds to crypto-signed request encrypted with hardcoded per-device keys. Have fun. "It can be hacked" really only because good security practice like the above would involve extra costs and the dealership / hardware manufacturer have little incentive to do so. But as a maxim, it doesn't really work: good security is possible.
- rdtsc 9y ago> Disabler that only responds to crypto-signed request encrypted with hardcoded per-device keys. Have fun. Those keys will end up somewhere in a database.
- lordlimecat 9y agoSo now instead of just hacking a disabler, you need to: * hack a database to recover the symmetric key * hack the private key repository needed for signing the requests * do it all without being noticed / getting the key revoked And really, all of those boil down to "gain unauthorized access to a system", which is to say now we can make the maxim "if it can be hacked, it can be hacked." That, I can agree with.