3 ms·

> What would the illegal part be in this instance? I don't know exactly what country they're located in, but I'm assuming that filming yourself unlocking rando

> What would the illegal part be in this instance? I don't know exactly what country they're located in, but I'm assuming that filming yourself unlocking random peoples car in the wild can be classified as breaking into something, especially if a corporation would like to hide a story and have government contacts they can engage in the silencing. I don't see anything wrong with what they did, they went above and beyond to test Honda's systems for Honda, in exchange for nothing. But I do worry about courts not being as technically adept as me, and not seeing it like this.

jeroenhd 4y ago
Opening random cars is probably a crime, but do we have reason to believe they weren't testing on their own car? They go out of their way not to make the details public to prevent car theft so I think any decent court should see that they're operating in good faith. A bad court may sentence them regardless, but I don't think responsible disclosure would've helped them in that situation either.
- causi 4y ago
  You might could get them on unauthorized access to a computer system, but I believe this would technically fall outside most places' law regarding breaking into a vehicle since they didn't actually open the vehicle.
- capableweb 4y ago
  > Opening random cars is probably a crime, but do we have reason to believe they weren't testing on their own car? Yes, we do, since one of their videos are labeled "field test" which I presume means "testing random vehicles found in the wild". > We have successfully tested the latest models of Honda vehicles. And we strongly believe the vulnerability affects all Honda vehicles currently existing on the market. Please see the field test video down below. https://rollingpwn.github.io/rolling-pwn/video/Demo-Video-Field-Test.mp4 https://rollingpwn.github.io/rolling-pwn/video/Demo-Video-Fi... > so I think any decent court should see that they're operating in good faith [...] A bad court may sentence them regardless I hope so too, for the sake of the authors. Overall, they did the only thing they could do in this situation, since Honda doesn't seem to be receptive to security disclosures at all.
  - rfoo 4y ago
    Given that the author(s) live in China and has been doing similar tricks for like, forever. I don't think most of the "crime" or "court" things in this thread make any sense to them.
    - capableweb 4y ago
      I'm glad :) (about that it doesn't make sense for them, not that they live in China)
      - rfoo 4y ago
        Yup, not necessarily good, just I don't see them in immediate trouble. Laws are lacking for these cases in China, OTOH you don't face fair judgement if someone decided to f-u :( see WooYun[1] for an example. tl;dr China had their own HackerOne/BugCrowd and it's even founded earlier than both, only to have it killed in 2016 because it annoyed the wrong guy. [1] https://en.wikipedia.org/wiki/WooYun https://en.wikipedia.org/wiki/WooYun
wongarsu 4y ago
But that's a criminal matter, in a crime that doesn't target Honda. Getting police to prosecute that without naming any victims would he hard, if it's even legally possible in their jurisdiction. Getting anywhere would involve some legwork from Honda to find the victims, and convincing the relevant parties to prosecute, before you get to a court case at all.

jeroenhd 4y ago

Opening random cars is probably a crime, but do we have reason to believe they weren't testing on their own car? They go out of their way not to make the details public to prevent car theft so I think any decent court should see that they're operating in good faith. A bad court may sentence them regardless, but I don't think responsible disclosure would've helped them in that situation either.

causi 4y ago
You might could get them on unauthorized access to a computer system, but I believe this would technically fall outside most places' law regarding breaking into a vehicle since they didn't actually open the vehicle.
capableweb 4y ago
> Opening random cars is probably a crime, but do we have reason to believe they weren't testing on their own car? Yes, we do, since one of their videos are labeled "field test" which I presume means "testing random vehicles found in the wild". > We have successfully tested the latest models of Honda vehicles. And we strongly believe the vulnerability affects all Honda vehicles currently existing on the market. Please see the field test video down below. https://rollingpwn.github.io/rolling-pwn/video/Demo-Video-Field-Test.mp4 https://rollingpwn.github.io/rolling-pwn/video/Demo-Video-Fi... > so I think any decent court should see that they're operating in good faith [...] A bad court may sentence them regardless I hope so too, for the sake of the authors. Overall, they did the only thing they could do in this situation, since Honda doesn't seem to be receptive to security disclosures at all.
- rfoo 4y ago
  Given that the author(s) live in China and has been doing similar tricks for like, forever. I don't think most of the "crime" or "court" things in this thread make any sense to them.
  - capableweb 4y ago
    I'm glad :) (about that it doesn't make sense for them, not that they live in China)
    - rfoo 4y ago
      Yup, not necessarily good, just I don't see them in immediate trouble. Laws are lacking for these cases in China, OTOH you don't face fair judgement if someone decided to f-u :( see WooYun[1] for an example. tl;dr China had their own HackerOne/BugCrowd and it's even founded earlier than both, only to have it killed in 2016 because it annoyed the wrong guy. [1] https://en.wikipedia.org/wiki/WooYun https://en.wikipedia.org/wiki/WooYun

wongarsu 4y ago

But that's a criminal matter, in a crime that doesn't target Honda. Getting police to prosecute that without naming any victims would he hard, if it's even legally possible in their jurisdiction. Getting anywhere would involve some legwork from Honda to find the victims, and convincing the relevant parties to prosecute, before you get to a court case at all.