7 ms·

BMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into

by tyho 7y ago

BMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into the engine block and chassis so obviously cannot be changed, even after I sell the car. I also suspect these numbers are sequential. Till this car is scrapped I will be able to locate it, turn on the AC, unlock the doors etc.

nkrisc 7y ago
On many (all?) modern cars it's also visible at the bottom of driver's side of the windshield. A car's VIN is public information.
- LinuxBender 7y ago
  I have a small piece of black paper over mine. I am happy to let a law enforcement officer view it if they ask.
  - techopoly 7y ago
    Not a bad idea. As far as I know it's not required to be visible
  - deleted 7y ago
    [deleted]
  - tbyehl 7y ago
    Not illegal per se, but you're handing cops PC to enter your car to move the paper and any further evidence of "crime" they can see while doing that is fair game.
  - RandomBacon 7y ago
    I thought about doing that, but if someone wants my VIN, they just have to squat down and look at the VIN that's punched in the frame of my truck. I haven't checked other vehicles, but I imagine they also have their VINs punched in the frame where it's easily visible. I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.
    - JohnFen 7y ago
      > I imagine they also have their VINs punched in the frame where it's easily visible. It's not always easily visible, but the VIN must be stamped on the major components of the car by law. I believe this means visible from the driver's side windshield, stamped on the frame, and stamped on the major drivetrain components. > I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it. In my state, it's illegal to do either of those things, but I don't believe it's illegal to obstruct the view of the VIN in a less permanent way.
    - grecy 7y ago
      > I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it. My Jeep has added "frame rust protection" from the factory (Canadian-spec) and I've never been able to find a VIN stamped anywhere on the frame. Apparently the coating covered it. It was a pain in the ass crossing borders in Africa when they didn't want to use the VIN at the base on the windshield.
  - pandaman 7y ago
    What about parking tickets? Do they just leave the VIN# empty or impound your car?
    - yellowapple 7y ago
      Parking tickets usually go off the license plate, last I checked. In fact, so do normal tickets, last I checked. My first job was punching in traffic ticket info for the CHP, and I don't recall ever seeing a VIN; just the LP and DL. This is in the US, though. Other places might have different information tracked on citations.
      - pandaman 7y ago
        LA parking tickets have VIN. You obviously cannot have DL on a parking ticket. Here is an example image: https://pci.etimspayments.com/pbw/include/la_sheriff/images/Ticket_Images.gif https://pci.etimspayments.com/pbw/include/la_sheriff/images/...
        yellowapple 7y ago
        > LA parking tickets have VIN. Noted. > You obviously cannot have DL on a parking ticket. Well yeah, obviously. I was talking about tickets in a broader sense, going by forms CHP 215 ("Notice to Appear", i.e. normal traffic tickets) and CHP 281 ("Notice to Correct Violation", i.e. "fix-it" tickets).
  - Piskvorrr 7y ago
    Also in the various databases? How does that work?
river99 7y ago
Also visible through the windshield from the outside.
- leni536 7y ago
  >Can unlock the door. >Visible through the windshield Interesting.
csours 7y ago
It's not strictly sequential, but it is easily guessed if not sequential. The first portion is manufacturer's information, and then the last 6 are a serial number of final assembly (generally speaking) VIN Card [big pdf]: https://www.genuinegmparts.com/src/pdf/resources/1960-2020_Vincards.pdf https://www.genuinegmparts.com/src/pdf/resources/1960-2020_V...
rad_gruchalski 7y ago
Yes, but: - at least in Germany, you have to give physical signature at the dealer to sign up for CarData - you need to give consent to every third party in order for them to access the data - to have the car linked to CarData, you have to get in the car, turn the ignition on, receive activation code displayed which is displayed on the infotainment, type the code back into the CarData platform
RandomBacon 7y ago
I'm curious, would it be possible for a malicious person to create a bunch of VMs running the app and brute force VINs to get access to thousands of vehicles and do things all at the same time? As it is, it already sounds like a theif's dream: no special, suspicious tools required: just a burner phone with an app, walk up to a car, enter the VIN, unlock doors, steal stuff.
- rad_gruchalski 7y ago
  No, it’s not possible: https://news.ycombinator.com/item?id=22259046 https://news.ycombinator.com/item?id=22259046
- fortytw2 7y ago
  VINs roughly follow patterns, so if you know one, you can figure out many other cars with very little brute force effort. vinwiki probably has a guide explaining them somewhere if you search
empath75 7y ago
So wait if I see a new bmw, all I need to do to break in is download the app and put in the VIN?
gassit 7y ago
I believe this is not quite correct, there is an additional step. Once you enter the VIN BMW ConnectedDrive will send a message to the car which you have to retrieve through the iDrive interface before it will 'pair' with online services or the app. You need to have physical access to the car. And if you sell the car and it is added to another ConnectedDrive account (or BMW mark it as sold) it disappears from your dashboard and you need physical access again to add it.
julianj 7y ago
In my area, the VIN is also easy to find with just a name from the public-facing tax property website.

by tyho 7y ago

nkrisc 7y ago

On many (all?) modern cars it's also visible at the bottom of driver's side of the windshield. A car's VIN is public information.

LinuxBender 7y ago
I have a small piece of black paper over mine. I am happy to let a law enforcement officer view it if they ask.
- techopoly 7y ago
  Not a bad idea. As far as I know it's not required to be visible
- deleted 7y ago
  [deleted]
- tbyehl 7y ago
  Not illegal per se, but you're handing cops PC to enter your car to move the paper and any further evidence of "crime" they can see while doing that is fair game.
- RandomBacon 7y ago
  I thought about doing that, but if someone wants my VIN, they just have to squat down and look at the VIN that's punched in the frame of my truck. I haven't checked other vehicles, but I imagine they also have their VINs punched in the frame where it's easily visible. I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.
  - JohnFen 7y ago
    > I imagine they also have their VINs punched in the frame where it's easily visible. It's not always easily visible, but the VIN must be stamped on the major components of the car by law. I believe this means visible from the driver's side windshield, stamped on the frame, and stamped on the major drivetrain components. > I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it. In my state, it's illegal to do either of those things, but I don't believe it's illegal to obstruct the view of the VIN in a less permanent way.
  - grecy 7y ago
    > I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it. My Jeep has added "frame rust protection" from the factory (Canadian-spec) and I've never been able to find a VIN stamped anywhere on the frame. Apparently the coating covered it. It was a pain in the ass crossing borders in Africa when they didn't want to use the VIN at the base on the windshield.
- pandaman 7y ago
  What about parking tickets? Do they just leave the VIN# empty or impound your car?
  - yellowapple 7y ago
    Parking tickets usually go off the license plate, last I checked. In fact, so do normal tickets, last I checked. My first job was punching in traffic ticket info for the CHP, and I don't recall ever seeing a VIN; just the LP and DL. This is in the US, though. Other places might have different information tracked on citations.
    - pandaman 7y ago
      LA parking tickets have VIN. You obviously cannot have DL on a parking ticket. Here is an example image: https://pci.etimspayments.com/pbw/include/la_sheriff/images/Ticket_Images.gif https://pci.etimspayments.com/pbw/include/la_sheriff/images/...
      - yellowapple 7y ago
        > LA parking tickets have VIN. Noted. > You obviously cannot have DL on a parking ticket. Well yeah, obviously. I was talking about tickets in a broader sense, going by forms CHP 215 ("Notice to Appear", i.e. normal traffic tickets) and CHP 281 ("Notice to Correct Violation", i.e. "fix-it" tickets).
- Piskvorrr 7y ago
  Also in the various databases? How does that work?

river99 7y ago

Also visible through the windshield from the outside.

leni536 7y ago
>Can unlock the door. >Visible through the windshield Interesting.

csours 7y ago

It's not strictly sequential, but it is easily guessed if not sequential. The first portion is manufacturer's information, and then the last 6 are a serial number of final assembly (generally speaking) VIN Card [big pdf]: https://www.genuinegmparts.com/src/pdf/resources/1960-2020_Vincards.pdf https://www.genuinegmparts.com/src/pdf/resources/1960-2020_V...

rad_gruchalski 7y ago

Yes, but: - at least in Germany, you have to give physical signature at the dealer to sign up for CarData - you need to give consent to every third party in order for them to access the data - to have the car linked to CarData, you have to get in the car, turn the ignition on, receive activation code displayed which is displayed on the infotainment, type the code back into the CarData platform

RandomBacon 7y ago

I'm curious, would it be possible for a malicious person to create a bunch of VMs running the app and brute force VINs to get access to thousands of vehicles and do things all at the same time? As it is, it already sounds like a theif's dream: no special, suspicious tools required: just a burner phone with an app, walk up to a car, enter the VIN, unlock doors, steal stuff.

rad_gruchalski 7y ago
No, it’s not possible: https://news.ycombinator.com/item?id=22259046 https://news.ycombinator.com/item?id=22259046
fortytw2 7y ago
VINs roughly follow patterns, so if you know one, you can figure out many other cars with very little brute force effort. vinwiki probably has a guide explaining them somewhere if you search

empath75 7y ago

So wait if I see a new bmw, all I need to do to break in is download the app and put in the VIN?

gassit 7y ago

I believe this is not quite correct, there is an additional step. Once you enter the VIN BMW ConnectedDrive will send a message to the car which you have to retrieve through the iDrive interface before it will 'pair' with online services or the app. You need to have physical access to the car. And if you sell the car and it is added to another ConnectedDrive account (or BMW mark it as sold) it disappears from your dashboard and you need physical access again to add it.

julianj 7y ago

In my area, the VIN is also easy to find with just a name from the public-facing tax property website.