15 ms·

Someone hacked YandexTaxi and ordered all available taxis to the same location

511 points by aaur0 4y ago

aaur0 4y ago
Someone hacked #YandexTaxi and ordered all available taxis to Kutuzov Prospect in Moscow. Now there is a huge traffic jam with taxis. It‘s like James Bond movie.
donkarma 4y ago
is this the future of self driving cars?
- deleted 4y ago
  [deleted]
- fffobar 4y ago
  And the future of the planned 6-th generation unmanned combat aircraft ...
- LinuxBender 4y ago
  I think you are right. I think the unknowns are, how tiny will the script be that commands all the cars into a lake and will it be a cloud hack or a local broadcast hack?
  - aaaaaaaaata 4y ago
    How about just driving you by billboards on, or for, Alphabet controlled properties?
    - gibspaulding 4y ago
      I feel like they're already heading towards manipulating routes to favor advertisers.
    - mjan22640 4y ago
      They do it the way around, personalise the billboard content to the people near it.
  - netsharc 4y ago
    First, a command to download updated GPS maps that says "There's now a bridge over that lake"...
    - rurp 4y ago
      Yep, I've had Google Maps direct me to drive into a wall or an empty field more than a couple times over the years. It's not uncommon for people to get stranded or even killed by blindly following bad GPS directions. The maps are often quite bad in less traveled areas. And these are the non-malicious cases!
      - lygaret 4y ago
        Sorry, this bugged me enough to try and find some data: > It's not uncommon for people to get stranded or even killed by blindly following bad GPS directions. Google took me to Wikipedia[0], which took me to a conference paper[1]: In a corpus of about 400 news articles from 2010 onwards (via Lexus Nexus search), they found 52 deaths related to navigation technologies, which accounted for about 25% of the incidents they recorded. 57% of the incidents were collisions; someone running into something due to GPS giving bad directions. 20% total involved being stranded. That's over ~6 years of US, UK, Canadian & Austrailian news reports. It may not be uncommon for GPS to kinda suck, but it is _very_ rare for GPS to kill people. [0]: https://en.wikipedia.org/wiki/Death_by_GPS https://en.wikipedia.org/wiki/Death_by_GPS [1]: https://www.researchgate.net/publication/312936003_Understanding_Death_by_GPS_A_Systematic_Analysis_of_Catastrophic_Incidents_Associated_with_Personal_Navigation_Technologies https://www.researchgate.net/publication/312936003_Understan...
        rurp 4y ago
        I haven't done any deep research on the topic but know of several specific fatal cases off the top of my head. It's not like someone dies every day, but for every reported case there are probably many that don't get reported as such. The much more common case is getting stuck and needing a rescue. Google maps is absolutely terrible at dirt roads. It will confidently give you directions that make absolutley no sense once you get away from pavement. It never got me stuck anywhere, but easily could have many times if I had been less cautious. Nowadays I know to ignore those directions in less developed areas. I think the broader point is that driving navigation tech is getting fairly good at happy path cases but is woefully underdeveloped outside of that.
  - ajsnigrutin 4y ago
    Better question is, will they be able to outlaw t-shirts with 20km/h speed limit signs on the back or people walking on the sidewalk wearing them.
    - kube-system 4y ago
      Pfft. I’ve already got my collection of t shirts ready: -1km/h NULL km/h false km/h <script>alert()</script> km/h
      - darepublic 4y ago
        don't forget 50/0 mph
      - ale42 4y ago
        :-D don't forget "undefined"!
      - ajsnigrutin 4y ago
        ; DROP table traffic_signs;
- nytesky 4y ago
  I’ve had this worry for years of a state level attack via network connected FSD cars. But I’m hardly alone, it was shown in a Fast and Furious movie, so people are thinking of it.
  - donkarma 4y ago
    oh yeah that was the first thing I thought of when I saw this
  - _jal 4y ago
    First mention of using driverless vehicles as weapons I recall was Daemon by Daniel Suarez. https://en.wikipedia.org/wiki/Daemon_(novel_series) https://en.wikipedia.org/wiki/Daemon_(novel_series)
    - hendrikrassmann 4y ago
      Don't forget the eighth 'The Fast and the Furious' movie.
    - gpm 4y ago
      IRobot (the film) predates that and uses the idea https://en.wikipedia.org/wiki/I,_Robot_(film) https://en.wikipedia.org/wiki/I,_Robot_(film) I forgot if any of the IRobot short stories used the concept - if they do they would predate the movie.
      - plasticchris 4y ago
        https://en.m.wikipedia.org/wiki/Sally_(short_story) https://en.m.wikipedia.org/wiki/Sally_(short_story) First mention of self driving cars becoming sentient and turning on humans I’m aware of, from 1953!
    - wsinks 4y ago
      Maybe one day I'll re-read Daemon. A book not so far ahead of its time. Might feel a little too close to home to re-read. I'll never forget the gig worker assembly scene.
- marginalia_nu 4y ago
  Beep beep, motherfucker!
- reaperducer 4y ago
  is this the future of self driving cars? My prediction: Ransomware hits self-driving cars. You're locked in the car until you Venmo the bad guys some credits. To encourage compliance, the stereo starts playing the sound of running water.
  - javajosh 4y ago
    One would hope your car would be more secure than your venmo account.
- xwdv 4y ago
  No, the future is to command all self driving cars to immediately accelerate to 100 mph and do not stop for whatever reason no matter what. Pure remote code execution.
- unixbane 4y ago
  there were already such bugs before, and my analysis is that even the older ECU cars before the 2000s had such bugs, just nobody bothers to look for them (also ECUs have been causing deaths from bugs but they just assume its the driver's fault). self driving cars will be the next order of magnitude of problems. ECU 1x, smart 10x, self driving 100x. > In July 2015, IT security researchers announced a severe security flaw assumed to affect every Chrysler vehicle with Uconnect produced from late 2013 to early 2015.[120] It allows hackers to gain access to the car over the Internet, and in the case of a Jeep Cherokee was demonstrated to enable an attacker to take control not just of the radio, A/C, and windshield wipers, but also of the car's steering, brakes and transmission.[120] Chrysler published a patch that car owners can download and install via a USB stick, or have a car dealer install for them.[120] > https://en.wikipedia.org/wiki/Chrysler#Chrysler_Uconnect https://en.wikipedia.org/wiki/Chrysler#Chrysler_Uconnect
  - alluro2 4y ago
    :O I would put the number of drivers who downloaded and installed the patch somewhere between 5-10.
    - toast0 4y ago
      It's ok, those cars probably lost or will lose connectivity as 3g goes away.
      - unixbane 4y ago
        Yeah but probably all vehicles have the same types of vulnerabilities.
- quantumduck 4y ago
  Not the future, it did already happen, albeit on a smaller scale with Cruise: https://www.thedrive.com/news/a-swarm-of-self-driving-cruise-taxis-blocked-san-francisco-traffic-for-hours https://www.thedrive.com/news/a-swarm-of-self-driving-cruise... The worst part is they were never really transparent about what the issue was.
- hedora 4y ago
  Self driving cars are not needed for this. It happens on The Jetsons all the time.
doesnotexist 4y ago
Needs this music https://www.youtube.com/watch?v=JEyEkbOlMfA&t=690s https://www.youtube.com/watch?v=JEyEkbOlMfA&t=690s
- crtasm 4y ago
  and then some https://www.youtube.com/watch?v=07tYdd7drSE https://www.youtube.com/watch?v=07tYdd7drSE
  - deleted 4y ago
    [deleted]
hinkley 4y ago
This is what happens when optimists win and the realists are cut out of the conversation. As a taxi service, I believe I would want to know if I'm about to have a shortage of taxis in any one area of town, and I'd better only have a concentration in one area of town for an event the entire world is talking about, like a reunion tour or a championship game. Even with the hack, the moment all of the taxis started converging on one area of town, alarms should have been going off and managers should have been asking questions. But that's not what happened, because we say yes the moment money enters the conversation, without bothering to ask what it says about you as a person if you'll do anything for money, or for that matter if the money is even real or just a trick to get our attention.
- monksy 4y ago
  This is more of what happens when you do the least effort to build a product to make a buck. They're probably optimized for the average happy path, however flooding isn't a concern until someone gets upset.
  - lbriner 4y ago
    Not necessarily. Despite us armchair critics, it is also very easy to miss an attack vector when building your software. We find stuff after years that we can't believe we missed like a missing auth check. Not that unusual at all when you are talking about 10s of 1000s of lines of code written by different people over the span of about 8 years.
    - hinkley 4y ago
      That’s why I favored detection at the top. I’ve worked on complex code signing apps that the blockchain people would recognize. Shit is hard. You can’t stop many things and still make money. But if you figure out what the boundaries are of the nominally running system, you can chart or earn when you start to lose the plot. I prefer charts over alerts, because as the company grows we keep forgetting to update the alerts. But then you need people who look at the charts between other tasks or you won’t catch anything and have to go back to alerts.
jbverschoor 4y ago
Someone also seems to have hacked this post on twitter... it's not loading
- r721 4y ago
  Yeah, there's a spike on downdetector's chart: https://downdetector.com/status/twitter/ https://downdetector.com/status/twitter/
- gaius_baltar 4y ago
  Some nitter instances also show it: https://nitter.42l.fr/runews/status/1565319649683804160#m https://nitter.42l.fr/runews/status/1565319649683804160#m You can also search for #YandexTaxi : https://nitter.42l.fr/search?q=%23YandexTaxi https://nitter.42l.fr/search?q=%23YandexTaxi
- deleted 4y ago
  [deleted]
- edm0nd 4y ago
  https://www.bleepingcomputer.com/news/technology/twitter-is-down-showing-something-went-wrong-errors/ https://www.bleepingcomputer.com/news/technology/twitter-is-...
r721 4y ago
Google-translated Kommersant article: https://www-kommersant-ru.translate.goog/doc/5538017?_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-kommersant-ru.translate.goog/doc/5538017?_x_tr_s...
rdxm 4y ago
Barrin92 4y ago
this is also something that's oddly absent from the self-driving debates. Mass deployment of the same models or apis in automated systems is very brittle because it means errors are highly correlated. it's like a form of central planning. individual drivers or individual taxi firms in a market due to their decentralization are much more robust to any kind of individual failure. People often ask "is the car smarter than the driver?" but the correct question would be if the car, or system is more diverse than the aggregate knowledge of all the participants.
- karmanyaahm 4y ago
  Yes. Additionally, this is a commonly cited win of cars in cars v. public transport. You can take your car anywhere in the zombie apocalypse*, whereas any system that requires central planning (trains) are more likely to break. Making cars (human or machine driven) depend on a centralized service basically takes away that advantage. * assuming you have enough fuel/battery
  - mr_toad 4y ago
    Typically in apocalyptic settings the roads are quickly clogged with abandoned vehicles.
smm11 4y ago
Daemon, by Daniel Suarez. Not to ruin it, but computers summon all smart cars at once for a task.
- eps 4y ago
  That was not a very good book.
  - noir_lord 4y ago
    I enjoyed it but it was a case of his ability to come up with interesting ideas exceeding his abilities as a writer. It desperately needed a better editor.
tpmx 4y ago
I'd like to think Ukrainan hackers were behind this.
- andrewxdiamond 4y ago
  It being the work of Russian dissidents would be much better in my opinion
  - eastbound 4y ago
    But it could be an Uber employee who still has access to the Yandex Taxi DB after the split up that happened a few months ago… Revoking accesses it hard.
  - smcl 4y ago
    There actually are some Russian Anarchists doing some very risky sabotage ops inside Russia, so it's not out of the question: https://www.vice.com/en/article/5d3den/russian-anarchists-are-sabotaging-railways-to-stop-putins-war-on-ukraine https://www.vice.com/en/article/5d3den/russian-anarchists-ar...
- robot9000 4y ago
  - coffeeblack 4y ago
    Isn’t it?
  - ChrisClark 4y ago
    You don't need to actually state the obvious.
  - BurningPenguin 4y ago
    Username checks out, i guess?
- trhway 4y ago
  A related - today is the first, and thus kind of celebrated, day of school in the former-USSR territories, like Russia and Ukraine, and the top Russian TV channels in Crimea were hacked to broadcast Zelenskiy speech congratulating schoolchildren there with the first day of school https://focus.ua/voennye-novosti/527684-hakery-postaralis-obrashchenie-zelenskogo-pokazali-po-rossiyskim-telekanalam-v-krymu-video https://focus.ua/voennye-novosti/527684-hakery-postaralis-ob...
DonHopkins 4y ago
Elevator Pitch: jammr.com: It's like Uber for Traffic Jams!
- deleted 4y ago
  [deleted]
- EwanG 4y ago
  I suspect you're kidding, but you know, having lived through a few very long traffic jams I could imagine some scenarios where I'd be willing to pay for: 1) Rickshaw or cargo bike with a narrow pull along trailer to let me use the bathroom 2) Similar setup with food and drink 3) Similar setup with a few gallons of gas if I've gotten a bit too close to empty 4) More expensive (XL?) version of the service where I am getting delivery from a helicopter (since drones flying over congested traffic is not an FAA approved delivery method) You might not be able to make this a daily thing, but when things get bad I suspect the margins might be unreal.
  - gs17 4y ago
    Or the idea from Nathan For You where another driver will be delivered on a motorcycle (in places they're allowed to cut between traffic jams) to take over while you ride to your destination on the back of the bike.
  - DonHopkins 4y ago
    >1) Rickshaw or cargo bike with a narrow pull along trailer to let me use the bathroom doodoober.com is available! shyt.com is taken though.
aaron695 4y ago
wmeredith 4y ago
What does "all available" mean in this context? YandexTaxi operates in 1000+ cities and is connected to 700,000 drivers.
- MaKey 4y ago
  This happened in Moscow, so probably all available taxis in Moscow.
  - gdy 4y ago
    Nope, just dozens of taxi app accounts were hacked and used to order taxis to the same street. That's a tiny fraction of over 70'000 taxis in Moscow.
hangsi 4y ago
This reminds me of a classic (non-internet powered) version of this where every business in London was sent to some unsupecting resident's address in order to win a bet, clogging the streets in the process: The Berners Street Hoax of 1810. https://en.wikipedia.org/wiki/Berners_Street_hoax https://en.wikipedia.org/wiki/Berners_Street_hoax
- googlryas 4y ago
  Just to point out some possibly ambiguous phrasing, but the person pulling the prank was trying to win the bet - the tradespeople and visitors were called there to use their services(ie chimney sweeps thought they were going to sweep a chimney), not that they themselves were going to claim some prize.
- ekimekim 4y ago
  What I love about this is that it's a textbook example of a reflection DoS attack (https://en.wikipedia.org/wiki/Denial-of-service_attack#Reflected_attack https://en.wikipedia.org/wiki/Denial-of-service_attack#Refle...) - you send a message with a spoofed reply-to address, such that the message you sent (in this case, a letter) is much cheaper than the response eventually sent to the victim (in this case, tradespeople / goods / dignitaries).
unixbane 4y ago
lol get rekt. i wish business people would immediately imagine this every time a software product is pitched to them
jetzzz 4y ago
Message from hackers at the driver's phone says: "Girls and guys, stop feeding the yellow, work with Wheely".
squarefoot 4y ago
Quite surprised that Uber still operates in Russia given the situation.
- Gunnerhead 4y ago
  Uber was selling it's stake back in February [1]. Not sure of the results of that, but maybe it's a contractual licensing issue? https://www.bloomberg.com/news/articles/2022-02-28/uber-to-accelerate-sale-of-yandex-taxi-joint-venture https://www.bloomberg.com/news/articles/2022-02-28/uber-to-a...
  - twelve40 4y ago
    Uber seems to have been transferring business to Yandex as far back as 2018 World Cup - that's when the Uber Android app stopped working for me there. Yet, I've seen it work for some people this summer, very weird.
inasio 4y ago
Back in the day (1960s?) two relatives of mine had a prank battle going on. One of them posted an add in the local newspaper offering to buy old Christmas trees, at the address of their adversary. Half the city showed up, were told trees were not in fact being bought, and everybody dumped the trees at their door.
- meibo 4y ago
  Seems like a great way to stock up your firewood supply for the next winter, if you manage to target it in a way that doesn't cause half the city to show up, but maybe a little less than that?
  - zeven7 4y ago
    Pine is really smokey and burns fast
    - midoridensha 4y ago
      It's worse than that. The sap in it will collect in the chimney and then cause a chimney fire. You really don't want to burn that stuff in a fireplace.
      - TEP_Kim_Il_Sung 4y ago
        So use a rocket stove? Burns too hot and efficient to leave residue.
        yibg 4y ago
        Yeah, let me just dig the old rocket stove out of the basement and fire it up.
        TEP_Kim_Il_Sung 4y ago
        They are fairly easy and cheap to construct, plenty of guides for rocket stoves, and rocket mass heaters. Want to heat an entire garage 24h with a hand full of twigs? An ordinary oven can't cope.
cafard 4y ago
If I were a taxi driver, I think it would take me some time to get to the point of admiring the ingenuity.
- UncleEntity 4y ago
  I used to be a taxi driver and anytime something looked to be turning into a major clusterfuck like that I’d just get the hell out. One night Modest Mouse played downtown Phoenix and went past the time light rail stopped running on weeknights. Same thing happened, basically everyone who took the train called for a cab. Once I realized what was happening I just grabbed the first group who flagged me down and got the hell’s out of there. What I especially like about the video is it is completely obvious something isn’t right and they’re all still trying to get to the pickup point.
late2part 4y ago
Did any of the taxis fall out of a hospital window?
b1n 4y ago
Is there any way of confirming this? Without knowledge of Russian or context this could just be taxis on some sort of protest rally.
- mr_toad 4y ago
  Or just a bug in the routing.
- r721 4y ago
  See here (article contains Yandex Go statement): https://news.ycombinator.com/item?id=32682199 https://news.ycombinator.com/item?id=32682199
dm33tri 4y ago
The message on driver's screen says something like "Note from passenger: Guys and girls, stop feeding the yellow [Yandex], switch to Wheely!"
- nivertech 4y ago
  Many drivers do not read the passengers' comments on the order. Anyone who took a second to read this comment would've understood that there is something fishy here.
fblp 4y ago
Just wait til the day when someone does this with an autonomous car or delivery drone fleet!
- gvb 4y ago
  Already happened: "A Swarm of Self-Driving Cruise Taxis Blocked San Francisco Traffic for Hours" https://www.thedrive.com/news/a-swarm-of-self-driving-cruise-taxis-blocked-san-francisco-traffic-for-hours https://www.thedrive.com/news/a-swarm-of-self-driving-cruise...
throwaway14356 4y ago
its the central planning thing all over again
konart 4y ago
The title is kind of misleading. Yandex has thousands of cars here in Moscow. There were around 60 in this jam on the prospect. So most likely not "ordered all avaiable", but "the order was forwareded for all available in the radius" or something like that. Surely you can't order a car in Yadex Taxi much less order all of them or even a car from another part of the city.
- nikau 4y ago
  This video shows at least 45 cabs, so dare say there was a lot more than 60: https://www.reddit.com/r/Damnthatsinteresting/comments/x3nehm/russias_largest_taxi_company_was_hacked_and_all/ https://www.reddit.com/r/Damnthatsinteresting/comments/x3neh...
katazd 4y ago
revealing venerability is awesome
josephd79 4y ago
hack the planet!

511 points by aaur0 4y ago

Someone hacked #YandexTaxi and ordered all available taxis to Kutuzov Prospect in Moscow. Now there is a huge traffic jam with taxis. It‘s like James Bond movie.

donkarma 4y ago

is this the future of self driving cars?

deleted 4y ago
[deleted]
fffobar 4y ago
And the future of the planned 6-th generation unmanned combat aircraft ...
LinuxBender 4y ago
I think you are right. I think the unknowns are, how tiny will the script be that commands all the cars into a lake and will it be a cloud hack or a local broadcast hack?
- aaaaaaaaata 4y ago
  How about just driving you by billboards on, or for, Alphabet controlled properties?
  - gibspaulding 4y ago
    I feel like they're already heading towards manipulating routes to favor advertisers.
  - mjan22640 4y ago
    They do it the way around, personalise the billboard content to the people near it.
- netsharc 4y ago
  First, a command to download updated GPS maps that says "There's now a bridge over that lake"...
  - rurp 4y ago
    Yep, I've had Google Maps direct me to drive into a wall or an empty field more than a couple times over the years. It's not uncommon for people to get stranded or even killed by blindly following bad GPS directions. The maps are often quite bad in less traveled areas. And these are the non-malicious cases!
    - lygaret 4y ago
      Sorry, this bugged me enough to try and find some data: > It's not uncommon for people to get stranded or even killed by blindly following bad GPS directions. Google took me to Wikipedia[0], which took me to a conference paper[1]: In a corpus of about 400 news articles from 2010 onwards (via Lexus Nexus search), they found 52 deaths related to navigation technologies, which accounted for about 25% of the incidents they recorded. 57% of the incidents were collisions; someone running into something due to GPS giving bad directions. 20% total involved being stranded. That's over ~6 years of US, UK, Canadian & Austrailian news reports. It may not be uncommon for GPS to kinda suck, but it is _very_ rare for GPS to kill people. [0]: https://en.wikipedia.org/wiki/Death_by_GPS https://en.wikipedia.org/wiki/Death_by_GPS [1]: https://www.researchgate.net/publication/312936003_Understanding_Death_by_GPS_A_Systematic_Analysis_of_Catastrophic_Incidents_Associated_with_Personal_Navigation_Technologies https://www.researchgate.net/publication/312936003_Understan...
      - rurp 4y ago
        I haven't done any deep research on the topic but know of several specific fatal cases off the top of my head. It's not like someone dies every day, but for every reported case there are probably many that don't get reported as such. The much more common case is getting stuck and needing a rescue. Google maps is absolutely terrible at dirt roads. It will confidently give you directions that make absolutley no sense once you get away from pavement. It never got me stuck anywhere, but easily could have many times if I had been less cautious. Nowadays I know to ignore those directions in less developed areas. I think the broader point is that driving navigation tech is getting fairly good at happy path cases but is woefully underdeveloped outside of that.
- ajsnigrutin 4y ago
  Better question is, will they be able to outlaw t-shirts with 20km/h speed limit signs on the back or people walking on the sidewalk wearing them.
  - kube-system 4y ago
    Pfft. I’ve already got my collection of t shirts ready: -1km/h NULL km/h false km/h <script>alert()</script> km/h
    - darepublic 4y ago
      don't forget 50/0 mph
    - ale42 4y ago
      :-D don't forget "undefined"!
    - ajsnigrutin 4y ago
      ; DROP table traffic_signs;
nytesky 4y ago
I’ve had this worry for years of a state level attack via network connected FSD cars. But I’m hardly alone, it was shown in a Fast and Furious movie, so people are thinking of it.
- donkarma 4y ago
  oh yeah that was the first thing I thought of when I saw this
- _jal 4y ago
  First mention of using driverless vehicles as weapons I recall was Daemon by Daniel Suarez. https://en.wikipedia.org/wiki/Daemon_(novel_series) https://en.wikipedia.org/wiki/Daemon_(novel_series)
  - hendrikrassmann 4y ago
    Don't forget the eighth 'The Fast and the Furious' movie.
  - gpm 4y ago
    IRobot (the film) predates that and uses the idea https://en.wikipedia.org/wiki/I,_Robot_(film) https://en.wikipedia.org/wiki/I,_Robot_(film) I forgot if any of the IRobot short stories used the concept - if they do they would predate the movie.
    - plasticchris 4y ago
      https://en.m.wikipedia.org/wiki/Sally_(short_story) https://en.m.wikipedia.org/wiki/Sally_(short_story) First mention of self driving cars becoming sentient and turning on humans I’m aware of, from 1953!
  - wsinks 4y ago
    Maybe one day I'll re-read Daemon. A book not so far ahead of its time. Might feel a little too close to home to re-read. I'll never forget the gig worker assembly scene.
marginalia_nu 4y ago
Beep beep, motherfucker!
reaperducer 4y ago
is this the future of self driving cars? My prediction: Ransomware hits self-driving cars. You're locked in the car until you Venmo the bad guys some credits. To encourage compliance, the stereo starts playing the sound of running water.
- javajosh 4y ago
  One would hope your car would be more secure than your venmo account.
xwdv 4y ago
No, the future is to command all self driving cars to immediately accelerate to 100 mph and do not stop for whatever reason no matter what. Pure remote code execution.
unixbane 4y ago
there were already such bugs before, and my analysis is that even the older ECU cars before the 2000s had such bugs, just nobody bothers to look for them (also ECUs have been causing deaths from bugs but they just assume its the driver's fault). self driving cars will be the next order of magnitude of problems. ECU 1x, smart 10x, self driving 100x. > In July 2015, IT security researchers announced a severe security flaw assumed to affect every Chrysler vehicle with Uconnect produced from late 2013 to early 2015.[120] It allows hackers to gain access to the car over the Internet, and in the case of a Jeep Cherokee was demonstrated to enable an attacker to take control not just of the radio, A/C, and windshield wipers, but also of the car's steering, brakes and transmission.[120] Chrysler published a patch that car owners can download and install via a USB stick, or have a car dealer install for them.[120] > https://en.wikipedia.org/wiki/Chrysler#Chrysler_Uconnect https://en.wikipedia.org/wiki/Chrysler#Chrysler_Uconnect
- alluro2 4y ago
  :O I would put the number of drivers who downloaded and installed the patch somewhere between 5-10.
  - toast0 4y ago
    It's ok, those cars probably lost or will lose connectivity as 3g goes away.
    - unixbane 4y ago
      Yeah but probably all vehicles have the same types of vulnerabilities.
quantumduck 4y ago
Not the future, it did already happen, albeit on a smaller scale with Cruise: https://www.thedrive.com/news/a-swarm-of-self-driving-cruise-taxis-blocked-san-francisco-traffic-for-hours https://www.thedrive.com/news/a-swarm-of-self-driving-cruise... The worst part is they were never really transparent about what the issue was.
hedora 4y ago
Self driving cars are not needed for this. It happens on The Jetsons all the time.

doesnotexist 4y ago

Needs this music https://www.youtube.com/watch?v=JEyEkbOlMfA&t=690s https://www.youtube.com/watch?v=JEyEkbOlMfA&t=690s

crtasm 4y ago
and then some https://www.youtube.com/watch?v=07tYdd7drSE https://www.youtube.com/watch?v=07tYdd7drSE
- deleted 4y ago
  [deleted]

hinkley 4y ago

This is what happens when optimists win and the realists are cut out of the conversation. As a taxi service, I believe I would want to know if I'm about to have a shortage of taxis in any one area of town, and I'd better only have a concentration in one area of town for an event the entire world is talking about, like a reunion tour or a championship game. Even with the hack, the moment all of the taxis started converging on one area of town, alarms should have been going off and managers should have been asking questions. But that's not what happened, because we say yes the moment money enters the conversation, without bothering to ask what it says about you as a person if you'll do anything for money, or for that matter if the money is even real or just a trick to get our attention.

monksy 4y ago
This is more of what happens when you do the least effort to build a product to make a buck. They're probably optimized for the average happy path, however flooding isn't a concern until someone gets upset.
- lbriner 4y ago
  Not necessarily. Despite us armchair critics, it is also very easy to miss an attack vector when building your software. We find stuff after years that we can't believe we missed like a missing auth check. Not that unusual at all when you are talking about 10s of 1000s of lines of code written by different people over the span of about 8 years.
  - hinkley 4y ago
    That’s why I favored detection at the top. I’ve worked on complex code signing apps that the blockchain people would recognize. Shit is hard. You can’t stop many things and still make money. But if you figure out what the boundaries are of the nominally running system, you can chart or earn when you start to lose the plot. I prefer charts over alerts, because as the company grows we keep forgetting to update the alerts. But then you need people who look at the charts between other tasks or you won’t catch anything and have to go back to alerts.

jbverschoor 4y ago

Someone also seems to have hacked this post on twitter... it's not loading

r721 4y ago
Yeah, there's a spike on downdetector's chart: https://downdetector.com/status/twitter/ https://downdetector.com/status/twitter/
gaius_baltar 4y ago
Some nitter instances also show it: https://nitter.42l.fr/runews/status/1565319649683804160#m https://nitter.42l.fr/runews/status/1565319649683804160#m You can also search for #YandexTaxi : https://nitter.42l.fr/search?q=%23YandexTaxi https://nitter.42l.fr/search?q=%23YandexTaxi
deleted 4y ago
[deleted]
edm0nd 4y ago
https://www.bleepingcomputer.com/news/technology/twitter-is-down-showing-something-went-wrong-errors/ https://www.bleepingcomputer.com/news/technology/twitter-is-...

r721 4y ago

Google-translated Kommersant article: https://www-kommersant-ru.translate.goog/doc/5538017?_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-kommersant-ru.translate.goog/doc/5538017?_x_tr_s...

rdxm 4y ago

Barrin92 4y ago

this is also something that's oddly absent from the self-driving debates. Mass deployment of the same models or apis in automated systems is very brittle because it means errors are highly correlated. it's like a form of central planning. individual drivers or individual taxi firms in a market due to their decentralization are much more robust to any kind of individual failure. People often ask "is the car smarter than the driver?" but the correct question would be if the car, or system is more diverse than the aggregate knowledge of all the participants.

karmanyaahm 4y ago
Yes. Additionally, this is a commonly cited win of cars in cars v. public transport. You can take your car anywhere in the zombie apocalypse*, whereas any system that requires central planning (trains) are more likely to break. Making cars (human or machine driven) depend on a centralized service basically takes away that advantage. * assuming you have enough fuel/battery
- mr_toad 4y ago
  Typically in apocalyptic settings the roads are quickly clogged with abandoned vehicles.

smm11 4y ago

Daemon, by Daniel Suarez. Not to ruin it, but computers summon all smart cars at once for a task.

eps 4y ago
That was not a very good book.
- noir_lord 4y ago
  I enjoyed it but it was a case of his ability to come up with interesting ideas exceeding his abilities as a writer. It desperately needed a better editor.

tpmx 4y ago

I'd like to think Ukrainan hackers were behind this.

andrewxdiamond 4y ago
It being the work of Russian dissidents would be much better in my opinion
- eastbound 4y ago
  But it could be an Uber employee who still has access to the Yandex Taxi DB after the split up that happened a few months ago… Revoking accesses it hard.
- smcl 4y ago
  There actually are some Russian Anarchists doing some very risky sabotage ops inside Russia, so it's not out of the question: https://www.vice.com/en/article/5d3den/russian-anarchists-are-sabotaging-railways-to-stop-putins-war-on-ukraine https://www.vice.com/en/article/5d3den/russian-anarchists-ar...
robot9000 4y ago
- coffeeblack 4y ago
  Isn’t it?
- ChrisClark 4y ago
  You don't need to actually state the obvious.
- BurningPenguin 4y ago
  Username checks out, i guess?
trhway 4y ago
A related - today is the first, and thus kind of celebrated, day of school in the former-USSR territories, like Russia and Ukraine, and the top Russian TV channels in Crimea were hacked to broadcast Zelenskiy speech congratulating schoolchildren there with the first day of school https://focus.ua/voennye-novosti/527684-hakery-postaralis-obrashchenie-zelenskogo-pokazali-po-rossiyskim-telekanalam-v-krymu-video https://focus.ua/voennye-novosti/527684-hakery-postaralis-ob...

DonHopkins 4y ago

Elevator Pitch: jammr.com: It's like Uber for Traffic Jams!

deleted 4y ago
[deleted]
EwanG 4y ago
I suspect you're kidding, but you know, having lived through a few very long traffic jams I could imagine some scenarios where I'd be willing to pay for: 1) Rickshaw or cargo bike with a narrow pull along trailer to let me use the bathroom 2) Similar setup with food and drink 3) Similar setup with a few gallons of gas if I've gotten a bit too close to empty 4) More expensive (XL?) version of the service where I am getting delivery from a helicopter (since drones flying over congested traffic is not an FAA approved delivery method) You might not be able to make this a daily thing, but when things get bad I suspect the margins might be unreal.
- gs17 4y ago
  Or the idea from Nathan For You where another driver will be delivered on a motorcycle (in places they're allowed to cut between traffic jams) to take over while you ride to your destination on the back of the bike.
- DonHopkins 4y ago
  >1) Rickshaw or cargo bike with a narrow pull along trailer to let me use the bathroom doodoober.com is available! shyt.com is taken though.

aaron695 4y ago

wmeredith 4y ago

What does "all available" mean in this context? YandexTaxi operates in 1000+ cities and is connected to 700,000 drivers.

MaKey 4y ago
This happened in Moscow, so probably all available taxis in Moscow.
- gdy 4y ago
  Nope, just dozens of taxi app accounts were hacked and used to order taxis to the same street. That's a tiny fraction of over 70'000 taxis in Moscow.

hangsi 4y ago

This reminds me of a classic (non-internet powered) version of this where every business in London was sent to some unsupecting resident's address in order to win a bet, clogging the streets in the process: The Berners Street Hoax of 1810. https://en.wikipedia.org/wiki/Berners_Street_hoax https://en.wikipedia.org/wiki/Berners_Street_hoax

googlryas 4y ago
Just to point out some possibly ambiguous phrasing, but the person pulling the prank was trying to win the bet - the tradespeople and visitors were called there to use their services(ie chimney sweeps thought they were going to sweep a chimney), not that they themselves were going to claim some prize.
ekimekim 4y ago
What I love about this is that it's a textbook example of a reflection DoS attack (https://en.wikipedia.org/wiki/Denial-of-service_attack#Reflected_attack https://en.wikipedia.org/wiki/Denial-of-service_attack#Refle...) - you send a message with a spoofed reply-to address, such that the message you sent (in this case, a letter) is much cheaper than the response eventually sent to the victim (in this case, tradespeople / goods / dignitaries).

unixbane 4y ago

lol get rekt. i wish business people would immediately imagine this every time a software product is pitched to them

jetzzz 4y ago

Message from hackers at the driver's phone says: "Girls and guys, stop feeding the yellow, work with Wheely".

squarefoot 4y ago

Quite surprised that Uber still operates in Russia given the situation.

Gunnerhead 4y ago
Uber was selling it's stake back in February [1]. Not sure of the results of that, but maybe it's a contractual licensing issue? https://www.bloomberg.com/news/articles/2022-02-28/uber-to-accelerate-sale-of-yandex-taxi-joint-venture https://www.bloomberg.com/news/articles/2022-02-28/uber-to-a...
- twelve40 4y ago
  Uber seems to have been transferring business to Yandex as far back as 2018 World Cup - that's when the Uber Android app stopped working for me there. Yet, I've seen it work for some people this summer, very weird.

inasio 4y ago

Back in the day (1960s?) two relatives of mine had a prank battle going on. One of them posted an add in the local newspaper offering to buy old Christmas trees, at the address of their adversary. Half the city showed up, were told trees were not in fact being bought, and everybody dumped the trees at their door.

meibo 4y ago
Seems like a great way to stock up your firewood supply for the next winter, if you manage to target it in a way that doesn't cause half the city to show up, but maybe a little less than that?
- zeven7 4y ago
  Pine is really smokey and burns fast
  - midoridensha 4y ago
    It's worse than that. The sap in it will collect in the chimney and then cause a chimney fire. You really don't want to burn that stuff in a fireplace.
    - TEP_Kim_Il_Sung 4y ago
      So use a rocket stove? Burns too hot and efficient to leave residue.
      - yibg 4y ago
        Yeah, let me just dig the old rocket stove out of the basement and fire it up.
        TEP_Kim_Il_Sung 4y ago
        They are fairly easy and cheap to construct, plenty of guides for rocket stoves, and rocket mass heaters. Want to heat an entire garage 24h with a hand full of twigs? An ordinary oven can't cope.

cafard 4y ago

If I were a taxi driver, I think it would take me some time to get to the point of admiring the ingenuity.

UncleEntity 4y ago
I used to be a taxi driver and anytime something looked to be turning into a major clusterfuck like that I’d just get the hell out. One night Modest Mouse played downtown Phoenix and went past the time light rail stopped running on weeknights. Same thing happened, basically everyone who took the train called for a cab. Once I realized what was happening I just grabbed the first group who flagged me down and got the hell’s out of there. What I especially like about the video is it is completely obvious something isn’t right and they’re all still trying to get to the pickup point.

late2part 4y ago

Did any of the taxis fall out of a hospital window?

b1n 4y ago

Is there any way of confirming this? Without knowledge of Russian or context this could just be taxis on some sort of protest rally.

mr_toad 4y ago
Or just a bug in the routing.
r721 4y ago
See here (article contains Yandex Go statement): https://news.ycombinator.com/item?id=32682199 https://news.ycombinator.com/item?id=32682199

dm33tri 4y ago

The message on driver's screen says something like "Note from passenger: Guys and girls, stop feeding the yellow [Yandex], switch to Wheely!"

nivertech 4y ago
Many drivers do not read the passengers' comments on the order. Anyone who took a second to read this comment would've understood that there is something fishy here.

fblp 4y ago

Just wait til the day when someone does this with an autonomous car or delivery drone fleet!

gvb 4y ago
Already happened: "A Swarm of Self-Driving Cruise Taxis Blocked San Francisco Traffic for Hours" https://www.thedrive.com/news/a-swarm-of-self-driving-cruise-taxis-blocked-san-francisco-traffic-for-hours https://www.thedrive.com/news/a-swarm-of-self-driving-cruise...

throwaway14356 4y ago

its the central planning thing all over again

konart 4y ago

The title is kind of misleading. Yandex has thousands of cars here in Moscow. There were around 60 in this jam on the prospect. So most likely not "ordered all avaiable", but "the order was forwareded for all available in the radius" or something like that. Surely you can't order a car in Yadex Taxi much less order all of them or even a car from another part of the city.

nikau 4y ago
This video shows at least 45 cabs, so dare say there was a lot more than 60: https://www.reddit.com/r/Damnthatsinteresting/comments/x3nehm/russias_largest_taxi_company_was_hacked_and_all/ https://www.reddit.com/r/Damnthatsinteresting/comments/x3neh...

katazd 4y ago

revealing venerability is awesome

josephd79 4y ago

hack the planet!