11 ms·
Jailbreaking Subaru StarLink
- helsinki 8y agoIf you did this to your car, what would you do to this system now that you have gained access? Install Android? I'm trying to think of a practical reason to actually do this to my WRX as Starlink is not an enjoyable platform.
- emilfihlman 8y agoLogging data, showing what you want on the screen, ...
- bdickason 8y agoI have a 2015 Impreza and find the built in UI cumbersome and annoying. It has a few bugs where it can get stuck on a specific menu and it also doesn’t update the song that’s playing via Bluetooth from Spotify etc. I feel like there are a ton of nice improvements to be had from the 2015 version if they could be figured out: 1. Better Spotify integration with album cover display, playlist scroll 2. Mirror google maps to the display 3. Show any push notifications that come in via your phone 4. Display engine diagnostic info when check engine light is on 5. Display a nice background image when not in use These are just a few features I’d personally love to see, not sure if any are at all feasible.
- helsinki 8y agoThank you for your response. I think it would be really cool to try and display the interface from a Cobb AccessPort to the screen. So much diagnostic info via Cobb.
- lykr0n 8y ago79656168267468697326697363277420746865207265618(C?)286845792E2E2E2E...? Don't blur information- block it out.
- pushpop 8y agoI’ve seen techniques used to reverse text that has been blurred with a fair degree of success, but that text was still easily readable in spite of being blurred. Which is weird because they must have looked at it while performing the transformation and thought “I can still read this”. Anyhow, the hack itself is impressive. I tip my hat to them.
- pushpop 8y agoHaha now I know it’s an Easter egg I have to say that’s a genius idea.
- klj8272 8y agoThe joke's on you
- ada1981 8y agoThe yolks on you.
- charliesome 8y agoIt looks like the author anticipated that someone would try to unblur the key and left a little easter egg there :) >> "7965616820746869732069736E277420746865207265616C206B65792E2E2E2E".scan(/../).map { |x| x.to_i(16).chr }.join => "yeah this isn't the real key...."
- richjdsmith 8y agoThis is awesome and absolutely hilarious!
- IshKebab 8y agoCyberchef is good for those sort of conversions.
- bdelay 8y agoNever assume anything. Well done. :)
- atemerev 8y agoLooks reasonably secure! I expected some horrifying engineering mistake, but the system looks well-designed by modern standards.
- tinus_hn 8y agoIt allows ssh login to system accounts without passwords, that seems like a pretty big mistake.
- jmartinpetersen 8y agoFrom what did you conclude this? I read it as if it allowed login over serial for those accounts, he didn't mention ssh in that context.
- solarkraft 8y agoStill, unprotected accounts seem like a pretty insecure idea to me. That's how our "attacker" got themselves in. Of course in a free world physical access to a device you own would mean that you can modify its behavior ("hack" the software).
- jmartinpetersen 8y agoSure, of course, but requiring a serial connection through a physical cable is still a less useful attack vector than ssh over wifi, which is what I gathered from the grandfather post - but not the article.
- bdelay 8y agoYou are correct. I don't believe those accounts worked over ssh due to a lack of password, just local serial.
- dugditches 8y agoDo cars even come without 'smart' options nowadays? As in, is it possible to buy a new basic trim car with a traditional radio/without a screen? That can be removed or replaced? I just wonder if this 'smart tech' will become like when you find a CD changer in the trunk of a car. Except these smart dashes won't be easily removable/swappable like an old cassette deck.
- gambiting 8y agoOf course. A basic model of a Dacia Sandero or Duster comes with a basic FM radio and nothing else. In some markets the same can be said about more upmarket brands like VW - a new polo cannot be specced with a basic FM radio and no smart features in the UK for instance, but in Germany or Poland it can. And in a lot of modern cars the head unit is replaceable even if the manufacturer didn't envision it as such because of course the market has produced replacements anyway - like on Mercedes cars the entire head unit can be replaced by a custom one with a larger screen and running Android while not losing any of the factory functionality. On Nissan's you usually get a full dash replacement for custom radios. Quick search in AliExpress uncovers custom head units for nearly any car in existence.
- solarkraft 8y agoOh, cool! I had not expected this. This suddenly makes a lot more cars viable for me (if I was in the market for a combustion car).
- SahAssar 8y agoThose cars still have a lot of computerized components though, right? It's just that the interface you see is mostly analog.
- gambiting 8y agoI'm not sure what you mean though. Like.....the throttle control is almost guaranteed to be digital, the dials use digital information bus to update speed and rpm even if they use analog dials......you cannot buy a car with a complexity of a Fiat Cinquecento anymore, yes, but I'm not sure if that's a bad thing.
- huffmsa 8y ago> Back before every app was built with Electron and used around three gigs of RAM to send a tweet, Shots fired.
- devwastaken 8y agoLet's not make this dead horse the top comment like every other hn thread please.
- huffmsa 8y agoThere in lies the issue with forums which allow voting without comment on other comments. I'm personally preferential to the 2channel/2chan/4chan system of no votes and no tree threading. But if there's a voting system, I see no problem letting it represent the readerships preferences for topical jokes. /Off topic As for the actual article in question, thinks look solid. There isn't much to add beyond the presented material. Harman did a decent but not perfect job from the outset, you need serial port access for this to work, and they were responsive about fixing the exploit.
- hombre_fatal 8y agoWithout a voting system, then people would have to wade through low effort noise like yours just to find the good contributions. The system works great. In fact, people need to have showdead=true just to see your epic "shots fired" comment now.
- solarkraft 8y agoWonderful write-up, but I find it sad that this is handled as a vulnerability, while it is really a way for users to liberate their device and make it do what they want to do.
- bdelay 8y agoI agree, but I don't have a consulting-firm/reputation/team of lawyers etc. to hide behind. Reporting flaws to companies related to embedded is often still scary today. The point of this is that hey, this isn't actually that hard if you're willing to put in the time. If you're moderately talented, you can probably learn it too! As opposed to the standard exploit write-up/security conference circuit thing, where a lot of the details are kept secret and it seems like the entire point is to make other people think you're cool instead of teaching something. :)
- burfog 8y agoGetting things patched is awful. A reasonably simple thing I'd like is to secure myself against meddling by Subaru. That includes updates I don't agree with and tracking of my vehicle. Disabling the network connection would pretty much stop the tracking. Alternately, disabling GPS would work. Anybody worried about both stored data and about cellular companies reporting tower locations would need to disable both. Undesired updates can mostly be stopped by disabling the network connection. Dealer service could be trouble; they might do an update without asking for my permission. Scrambling the crypto keys would probably stop the dealer service people from making updates. Some of the above would also be needed to keep Subaru from uploading camera data taken in my garage. As it is now, Subaru could be watching me in my house! So, take the above as the high-priority goals.
- thomasfedb 8y agoNice to see that the response from Subaru and Harman was to agree that it was broken and to fix it.
- Causality1 8y agoWouldn't it be lovely if we had some kind of digital consumer rights bill that required all computerized devices to have some method for the end user to gain root access?
- mathieuh 8y agoSecurity and ease of use are kind of orthogonal I’m not saying this shouldn’t be a thing, but it requires more thought that just giving users root
- Causality1 8y agoOh make me jump through hoops. Make me send a registration card with my name, address, and ten cereal box tops if you want. I'm just tired of having to make purchasing decisions not on the basis of what devices have the best specs, but which ones are the least hostile to me actually owning the slab of glass and plastic I blew an entire paycheck on.
- jhfdbkofdcho 8y agoMy car’s head unit runs that QNX thing. The firmware is authenticated with a few 512-bit RSA keys, easily cracked. The applications were written as flash and Java applets. This car isn’t 5 years old.
- deleted 8y ago[deleted]
- RandomBacon 8y ago> Another way would be to remove the head unit from a vehicle, but I'm not wealthy enough to void the warranty on a car Taking something apart does not void the warranty! In fact it is illegal in the US for companies to arbitrarily deny the warranty unless they can prove that the user actually broke the item, taking apart ≠ breaking. Magnuson–Moss Warranty Act (P.L. 93-637)
- tjoff 8y agoThere are other things than warranty though. I believe tesla will revoke access to charge stations and their cloud for instance.
- whenchamenia 8y agoWhich is sleazy af. I really wish I could get behind tsla, but they persist with bold lies and consumer toxic behavior. Why cant this guy let the tech speak for itself?
- ed_balls 8y agoThis is not that simple. You don't want people hack a car that have a "self-driving" capabilities. Bugs could kill a lot of people.
- dwighttk 8y agoor community bug fixes could save a lot of people...
- ryukafalz 8y agoIf by "people" you mean the owner of the car, of course they should be able to do whatever they want with it. If they modify something and it ends up hurting someone, they're liable for it. It's not that different from modifying an older car.
- 8y ago
- mrfusion 8y agoOffshoot topic. Is this a trademark issue for spacex’s new system? I didn’t realize there was an existing product with the same name.
- bpicolo 8y agoDifferent trademark classes https://en.wikipedia.org/wiki/International_(Nice)_Classification_of_Goods_and_Services https://en.wikipedia.org/wiki/International_(Nice)_Classific...
- dwighttk 8y agoHas anyone done this on a Tesla? Seems like free battery capacity is quite the carrot for that effort.
- thisismyaccoun7 8y agoI was surprised to see him give up at having to bruteforce the password for root on ssh. That's how the community got into Mazdas, at least the 2015 I had anyway. The password was simple, jci, presumably because it was designed by Johnson Control Istruments. You think a company is going to heavily lock down an embedded system they don't expect anyone to try to access, or are they going to make the password easy so that all the techs and engineers can remember it?
- stefan_ 8y agoThey also had an authorized_keys file so it doesn't seem a stretch that the password login is some device-specific autogenerated value since the engineers would just use PubKey auth.
- bdelay 8y agoTwo reasons I didn't do that: 1. I believe Harman had a previous device hacked back around 2014 due to a weak shadow hash. My guess was that they learned their lesson and made the password more complex. An easy way to test would be to diff the latest shadow file in the updated Subaru images (assuming they exist) -- if it changed, you may be right, if not, I'd still wager it is strong enough. I don't like the idea of a backdoor like that available, but it is what it is. 2. The QNX6 hashing mechanism, to the best of my knowledge, isn't fully understood. Upstream changes to JTR seem to indicate that it has some form of bug in it or isn't fully reverse-engineered. That, along with having to spend presumably a large amount of time learning about contributing to hashcat & gpu programming, made this seem like a potential dead end without massive time investment. So, is it possible it is crackable? Almost certainly, but I'm one guy doing this and you have to spend your time carefully in these ventures.
- thisismyaccoun7 8y agoThanks for thr reply! That all makes sense. With the Mazda, I don't think anyone bothered to try to go as far as you did with the software because it was so easy to get wifi turned on, connect, and then let your device try short password after password (and at just three lowercase letters, the result came fast). Given the reet of the work and your first point, it does seem like yours is the smart choice in this case. I was just surprised you didn't tey bruteforcing via ssh at first. Thanks for the awesome article by the way! My Mazda got totalled last month, and I got a new 2019 Honda Fit I haven't gotten around to messing with yet. This gives some great ideas for how to proceed.
- morpheuskafka 8y agoI've always wondered about how CarPlay worked with random OEM units like these, each running their own RTOS and having different binaries and libraries available. I'm assuming Apple would want to write in Objective-C which isn't really known for embedded support?
- hoorayimhelping 8y ago>Subaru will have updates for head units affected by this flaw in the coming weeks. Wow, this is so cool! I've been getting emails from Subaru to update my headunit. No idea that I'd see it getting detailed on github and hacker news. >Harman and Subaru should not assume that the biggest flaw is releasing update files. Letting customers update their own head units is wonderful, and it lets security researchers find flaws and report them. Yes!! Good good, I have to coordinate with a "Service Technician," drop my car off, have it sit around for a couple of hours, then get it back for something that would take me 20 minutes to do.
- j_m_b 8y agoNow I just wish I could have the EyeSight on my Subaru Forrester hacked so that the adaptive cruise control doesn't go off after three seconds of being at a full stop.
- dpnvektor 8y agoPro tip: hit the speed up or down button any time in that three second window to buy yourself another 7 seconds of activation. Annoying, but potentially hackable!
- filoeleven 8y agoI wish I could send the EyeSight stream to a storage device so they could act as a dashcam.
- chendragon 8y agoSort of an aside, but I do sort of wonder what goes into the decision to go with Freescale/QNX as opposed to allwinner/rockchip/MTK and Android in this application. Surely the cost would be similar or less, and the performance could potentially be better?
- userbinator 8y agoFreescale and Motorola before it have had a long history of supplying microcontrollers for automotive applications. I'm not sure the other companies even have the extended temperature range components which are required for automotive use.
- segmondy 8y agovery exciting read, when you say "vehicles internal network" do you mean the CAN bus? :-O
- inamberclad 8y agoOn a related note, SpaceX's Dragon apparently can apparently be SSH'd into according to an engineer I spoke with. Hopefully the connection is well secured.
- deleted 8y ago[deleted]
- usmannk 8y agoQuestion to the author (hopefully you’re still around!): why do you think the dat files weren’t included in the signed iso?
- bdelay 8y agoSee the Note from Harman section. Hence, as the check wasn't working, I never ran into the check. Dat file signatures may very well be in the header or stored somewhere else.
- usmannk 8y agoAh I see, missed that the first time around. Another thing I’m wondering after processing this: did you ever try to ssh as the dm or daemon user after seeing the passwd file originally in ifs-subaru-gen3.raw? P.S. Thank you for writing this! It’s super interesting snd very easy to follow. I’ve shared it with friends both for the content and also as an example of excellent technical writing.