4 ms·

It's unclear if the authors actually responsibly disclosed this, although they did make some attempts at contacting Honda, it's unclear how long they waited for

It's unclear if the authors actually responsibly disclosed this, although they did make some attempts at contacting Honda, it's unclear how long they waited for a reply. > What does Honda think about this Rolling-PWN Bug? > We have searched through the Honda official website, but we can not find any contact info for report Vulnerability. Seems Honda motor DOES NOT have a department to deal with security related issue for their products. And a person who works at HONDA has told us "The best way to report the Honda vulnerability is to contact customer service". Therefore, we filed a report to Honda Customer service, but we have not get any reply yet. > In addition, we found an article from Bleeping-Computer (https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack https://www.bleepingcomputer.com/news/security/honda-bug-let...), which Seems that Honda does not care about security issues anyway :( Hope the authors are either anonymous enough or in a jurisdiction they can't be sued for making this public.

Fnoord 4y ago
Looks like they published various videos of them exploiting the vulnerability in public space. Supposedly, OSINT techniques could at least uncover these locations.
iancarroll 4y ago
Is the obligation to find a security disclosure contact really on an individual researcher who already did free work for them, or is it on Honda to make it easy? I do not blame them at all. If corporations deprioritize security, that doesn’t mean we should shift responsibility onto individuals.
- capableweb 4y ago
  I absolutely don't blame them either, I wish more people showed how absolutely insecure most modern systems are. I'm was simply writing my comment out of worry for their safety, nothing else.
jeroenhd 4y ago
What would the illegal part be in this instance? They're not illegally accessing Honda's services, which is what most security researchers can end up sued about. This is a local replay attack using the researcher's own hardware. I don't see why they would possibly need to inform Honda first. Responsible disclosure for issues like these is more of a curtousy to show good intent and to protect people by allowing the manufacturer to roll out patches. Honda doesn't seem interested in protecting their customers and they seem unwilling to get into contact with these people, so if it's true that they tried to contact Honda, that's enough of a curtousy for me, at least.
- capableweb 4y ago
  > What would the illegal part be in this instance? I don't know exactly what country they're located in, but I'm assuming that filming yourself unlocking random peoples car in the wild can be classified as breaking into something, especially if a corporation would like to hide a story and have government contacts they can engage in the silencing. I don't see anything wrong with what they did, they went above and beyond to test Honda's systems for Honda, in exchange for nothing. But I do worry about courts not being as technically adept as me, and not seeing it like this.
  - jeroenhd 4y ago
    Opening random cars is probably a crime, but do we have reason to believe they weren't testing on their own car? They go out of their way not to make the details public to prevent car theft so I think any decent court should see that they're operating in good faith. A bad court may sentence them regardless, but I don't think responsible disclosure would've helped them in that situation either.
    - causi 4y ago
      You might could get them on unauthorized access to a computer system, but I believe this would technically fall outside most places' law regarding breaking into a vehicle since they didn't actually open the vehicle.
    - 4y ago
revjx 4y ago
I work with Honda. I've passed the link on. Doesn't look great if you appear to be ignoring this kind of thing!
- foobiekr 4y ago
  Honda makes great, reliable cars but they don’t give a shit about software or stuff like this. Consider their refusal to fix their head units - https://didhondafixtheclocks.com/ https://didhondafixtheclocks.com/
  - chasil 4y ago
    Toyota had a similar problem. https://www.edn.com/toyotas-killer-firmware-bad-design-and-its-consequences/ https://www.edn.com/toyotas-killer-firmware-bad-design-and-i...
    - KerrAvon 4y ago
      This stuff, more than anything, is an argument in favor of Tesla. The trad car companies _still_ don't really understand software. Some of them are learning -- I think VW management now understands the issue, although there are as yet no VW products demonstrating it.

Fnoord 4y ago

Looks like they published various videos of them exploiting the vulnerability in public space. Supposedly, OSINT techniques could at least uncover these locations.

iancarroll 4y ago

Is the obligation to find a security disclosure contact really on an individual researcher who already did free work for them, or is it on Honda to make it easy? I do not blame them at all. If corporations deprioritize security, that doesn’t mean we should shift responsibility onto individuals.

capableweb 4y ago
I absolutely don't blame them either, I wish more people showed how absolutely insecure most modern systems are. I'm was simply writing my comment out of worry for their safety, nothing else.

jeroenhd 4y ago

What would the illegal part be in this instance? They're not illegally accessing Honda's services, which is what most security researchers can end up sued about. This is a local replay attack using the researcher's own hardware. I don't see why they would possibly need to inform Honda first. Responsible disclosure for issues like these is more of a curtousy to show good intent and to protect people by allowing the manufacturer to roll out patches. Honda doesn't seem interested in protecting their customers and they seem unwilling to get into contact with these people, so if it's true that they tried to contact Honda, that's enough of a curtousy for me, at least.

capableweb 4y ago
> What would the illegal part be in this instance? I don't know exactly what country they're located in, but I'm assuming that filming yourself unlocking random peoples car in the wild can be classified as breaking into something, especially if a corporation would like to hide a story and have government contacts they can engage in the silencing. I don't see anything wrong with what they did, they went above and beyond to test Honda's systems for Honda, in exchange for nothing. But I do worry about courts not being as technically adept as me, and not seeing it like this.
- jeroenhd 4y ago
  Opening random cars is probably a crime, but do we have reason to believe they weren't testing on their own car? They go out of their way not to make the details public to prevent car theft so I think any decent court should see that they're operating in good faith. A bad court may sentence them regardless, but I don't think responsible disclosure would've helped them in that situation either.
  - causi 4y ago
    You might could get them on unauthorized access to a computer system, but I believe this would technically fall outside most places' law regarding breaking into a vehicle since they didn't actually open the vehicle.
  - 4y ago

revjx 4y ago

I work with Honda. I've passed the link on. Doesn't look great if you appear to be ignoring this kind of thing!

foobiekr 4y ago
Honda makes great, reliable cars but they don’t give a shit about software or stuff like this. Consider their refusal to fix their head units - https://didhondafixtheclocks.com/ https://didhondafixtheclocks.com/
- chasil 4y ago
  Toyota had a similar problem. https://www.edn.com/toyotas-killer-firmware-bad-design-and-its-consequences/ https://www.edn.com/toyotas-killer-firmware-bad-design-and-i...
  - KerrAvon 4y ago
    This stuff, more than anything, is an argument in favor of Tesla. The trad car companies _still_ don't really understand software. Some of them are learning -- I think VW management now understands the issue, although there are as yet no VW products demonstrating it.