20 ms·

Nissan [resolved]

436 points by zdw 4y ago

tgsovlerkhgsel 4y ago
Not just that, it also let the attacker find the customer's home address.
neop1x 4y ago
>> The response contained the victim's name, phone number, address, and car details I've seen this in a few other APIs. Although the frontend was not using or displaying it, the backend was still sending a lot of personal information in REST responses by default. :/
twojacobtwo 4y ago
>At this point, we identified that it was also possible to access customer information and run vehicle commands on Honda, Infiniti, and Acura vehicles in addition to Nissan. >We reported the issue to SiriusXM who fixed it immediately and validated their patch. Nice to see that it was addressed quickly, but it's frightening that such a shoddy system design was accepted by auto manufacturers with seemingly no oversight.
- julianlam 4y ago
  Are you surprised? I have seen companies prepare for a SOC2 compliance audit, and I get the feeling that these companies like vendors because the audit doesn't apply to vendors, so all they really have to do is ask the vendor to pinky swear that the software is safe.
- endtime 4y ago
  Why would they spend money on that? This severe vulnerability isn't going to hurt their bottom line, even if it "should". (I'm not endorsing this perspective, to be clear, just recognizing that it exists.)
  - User23 4y ago
    Indeed. Everyone says that they care about online security, but revealed preferences show that virtually nobody actually does. On the other hand revealed preferences tell a completely different story about physical security.
  - ticviking 4y ago
    Isn't doing that math and seeing how heartless corporations the opening premise of "Fight Club"?
    - spookthesunset 4y ago
      If Fight Club was filmed today, I’m pretty sure the final scenes would be blowing up the media buildings and not the banks/credit card buildings…
      - Retric 4y ago
        As in Twitter/Facebook/Google or CNN/Fox News?
  - philsnow 4y ago
    > This severe vulnerability isn't going to hurt their bottom line, even if it "should". When there's damnable, devastating security news for some publicly-traded company that makes it to the big news sources, the stock takes a 0-10% dive and then completely recovers within a couple weeks. Even if the company's response is completely bungled, mismanaged, or miscommunicated, the market doesn't understand security issues and it seems like the company just benefits from the news exposure. I wish I kept notes on the last few times I've seen this happen so that I could cite examples.
    - mughinn 4y ago
      It's not the market, the customers don't care. They won't stop buying the product because of security issues, it's because of THAT that the price recovers, not because "the market" doesn't understand security If the customers cared, there would be significant drop in the price of the stock because a vulnerability like this would result in lower sales
- mschuster91 4y ago
  > Nice to see that it was addressed quickly, but it's frightening that such a shoddy system design was accepted by auto manufacturers with seemingly no oversight. That's thanks to the old tale of "outsourcing what is not a core business". I get it, it's fine when you have the capacity and capability to do oversight - but in most cases, the beancounters eventually decide that this capacity is not needed, and then shit like this happens.
  - TedDoesntTalk 4y ago
    > outsourcing what is not a core business Except that this telematics product is a core business unit for SiriusXM.
    - mschuster91 4y ago
      Yeah but not for the car maker. So the suppliers cut corners whenever they can, and the demands from the manufacturers tend to be insane as well.
      - TedDoesntTalk 4y ago
        The vulnerability was in a Sirius product. If you’re suggesting auto manufacturers don’t write their own telematics software because it’s not core to their business, then… hallelujah! Can you imagine what kind of crap they’d deliver? I’d you’re suggesting something else, then I don’t understand.
- hackernewds 4y ago
  Imagine the risk when cars can also drive themselves, as 6 ton battering rams that can also self implode the evidence.
deleted 4y ago
[deleted]
brk 4y ago
This is super interesting, but why are people posting this kind of thing to tweet streams? Twitter is just absolute shit for trying to document this kind of research, IMO.
- dfee 4y ago
  Obviously the reach is better and that’s what they’ve optimized for.
  - layer8 4y ago
    They could tweet with a link to a blog post for the details. I guess some followers would still be too lazy to follow the link, but that’s not a valid argument anymore IMO.
- jeffbee 4y ago
  There are so many reasons to do it this way. You reach a huge audience. You don't have to how your own assets. If your post is popular, it won't get DDoSed off the air. Search engines will index it immediately. Etc. People get many benefits from posting this way.
  - gist 4y ago
    > You reach a huge audience. You would reach the same huge audience by putting in a summary and link to a website with the detailed info. > If your post is popular, it won't get DDoSed off the air So someone who is capable enough (or a team) to pull off and uncover this exploit can't be troubled to run a website (server whatever) that can handle ddos or traffic?
    - dnadler 4y ago
      > can't be troubled to run a website Yes, that's right. They have more important things to do than worry about hosting a website. They rightly use third party applications to disseminate information.
sc00ty 4y ago
https://threadreaderapp.com/thread/1597792097175674880.html https://threadreaderapp.com/thread/1597792097175674880.html
ffgh 4y ago
When something like this happens, is the development team to blame? Or maybe even the QA team? Wouldn't it be customary to test for things like this
- totally 4y ago
  What good is blame?
  - ilyt 4y ago
    "We must take security seriously or we got sued out of existence" is good motivator for management.
    - sitkack 4y ago
      Just limit lawsuit damage at the source, force arbitration, or collapse any plurality of suits into a slap-on-the-wrist class action!
- CoastalCoder 4y ago
  I'd say it depends on how far out you're willing to zoom. For example, legislators and regulators allowed this kind of laxity to be commercially advantageous. Voters allowed legislators and regulators to ignore the issue. To some extent, parents failed to instill in their children the civic virtue of voting wisely. Etc.
- ilyt 4y ago
  Manufacturers for even allowing that to exist (why the fuck telemetry app made by company making radio channels would have permissions to unlock the car in the first place) and company for woeful errors in security and data protection.
  - zuppy 4y ago
    most probably, because of CAN bus, which is the system that most of the cars use to connect their systems. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7219335/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7219335/ how CAN bus works: https://payatu.com/blog/kartheek.lade/automotive-security-part3 https://payatu.com/blog/kartheek.lade/automotive-security-pa... i’m aware that on this case there was something even dumber, an unsecured api endpoint, but as far as i know, if you’ve managed to reach the system you can do anything with any other connected device. there should not be a way to be able to do whatever you want just because you have access to the network.
gottebp 4y ago
The automotive firmware industry has had a strong preference historically for stable, old dependencies. With the advent of connected firmware, arises a strong force pushing in the other direction — towards frequent updates, built from latest and greatest dependencies. How they balance verification and validation for safety purposes with frequent and more volatile updates, will be interesting to watch.
- kube-system 4y ago
  Maybe the automotive firmware industry had it right. Software on the internet is often just plain bad. SiriusXM's software should have had proper authentication on the endpoints.
- AlexandrB 4y ago
  I wish they gave customers an off switch for remote access so at least older cars aren't rolling honeypots for hackers.
  - vorpalhex 4y ago
    Supposedly removing the sharkfin whokesale will do it, at the cost of also losing fm radio.
    - AlotOfReading 4y ago
      The sharkfin is usually only for external comms. There's still other comms on separate antennas like Bluetooth that can be potential entry points to the vehicle. Worse, even the external comms systems are moving to more redundant setups to mitigate signal loss scenarios.
      - deleted 4y ago
        [deleted]
      - vorpalhex 4y ago
        I'll have to dig up the post but a gentleman with a relatively new Subaru was kind enough to share his explorations and found significant logic parts integrated into the sharkfin, not just the antenna bundle. Likely a cost measure. How well does this extend to other vehicles? No clue.
ClarityJones 4y ago
When someone is believed to have "committed suicide" or "accidentally" left their car running in the garage, is it routine for investigators to audit the manufacturer's remote-start logs? Do those logs even exist?
- TylerE 4y ago
  It's actually more or less impossible with modern cars. Hell, in a lot of cities what comes out of the tailpipe is cleaner than what goes in the intake.
  - mschuster91 4y ago
    You can still die from carbon dioxide exposure/oxygen inefficiency. It will just take longer, now that carbon monoxide emissions are down because of catalytic converters eliminating a lot of them. And yet, a lot of people still die or get seriously injured, particularly because their "keyless" crap acts up [1]. [1] https://www.nytimes.com/2018/05/13/business/deadly-convenience-keyless-cars-and-their-carbon-monoxide-toll.html https://www.nytimes.com/2018/05/13/business/deadly-convenien...
    - philsnow 4y ago
      I agree that carbon dioxide exposure is dangerous, but it is probably less dangerous because (TIL) there's a specific brain mechanism that wakes you up when your blood has elevated CO2[0]. On the other hand, carbon monoxide poisoning will only wake you up if its symptoms (among which headache, nausea/vomiting, elevated heart rate, and cardiac arrest seem likely) do so. [0] https://medicine.uiowa.edu/content/specific-neurons-trigger-waking-due-inhaled-co2 https://medicine.uiowa.edu/content/specific-neurons-trigger-...
  - bombcar 4y ago
    Cleaner on noxious chemicals but not on carbon dioxide which is what gets humans. I’m kind of surprised garage doors don’t have co2 monitors built in but I suppose it could be used as a security bypass.
toast0 4y ago
My vehicle is safe, thanks to Ford. Telematics goes over terrestrial phone networks, and when 2g shutdown months after the car was made, they replaced the modem with a 3g modem that was alreadt obsolete and now that 3g is shutdown, there's no more internet access to the car. Thanks Ford!
- webmobdev 4y ago
  Your comment is insightful and made me realise something I was quite unaware of in India - that allowing your automobile to track, collect and share data has become so mainstreamed in the US / west that it is considered "normal"! I guess I shouldn't be surprised - most people are unaware that Ford (and some others) collect a lot of personal data when you take your car to the service centre (for e.g. they download your contact list and call logs from your car when they run the diagnostic software) More info here - Data could be what Ford sells next as it looks for new revenue - https://www.freep.com/story/money/cars/2018/11/13/ford-motor-credit-data-new-revenue/1967077002/ https://www.freep.com/story/money/cars/2018/11/13/ford-motor... and Ford Eyes Use of Customers’ Personal Data to Boost Profits - https://threatpost.com/ford-eyes-use-of-customers-personal-data-to-boost-profits/139209/ https://threatpost.com/ford-eyes-use-of-customers-personal-d... ).
  - philsnow 4y ago
    > they download your contact list and call logs from your car when they run the diagnostic software I'm inclined to believe you because I don't give cars access to my contacts and in general treat in-car software as already-compromised (I see the car manufacturer as more of an adversary than a partner), but do you have a source for this claim?
    - webmobdev 4y ago
      I remember reading about this a long time ago (5+ years ago I think) - it was Ford doing this and it did cause some mild outrage in the internet. Unfortunately I cannot find that particular article - Google has become shitty for finding old stuffs and possibly Ford PR has scrubbed the internet so that the public can't find it easily (a common practice in the evolving online marketing industry). I've added two sources to my earlier comment that disclose the gist of what I have claimed.
jrsj 4y ago
The good news is my Acura has a manual transmission so the number of people who can both hack and drive it is a bit more limited at least ;)
- at-fates-hands 4y ago
  So true. I remember seeing several videos of people trying to steal cars, only to find out its a manual and have to retreat. The best was a pair of criminals who robbed a store, got the managers keys, loaded up the car and then after several attempts of leaving with the loot (popping the clutch to hilarious effect) and realizing they couldn't drive a manual, just got of the car and took off on foot empty handed. This must be a generational thing. As soon as I was old enough to drive, I was taught how to drive a manual first.
- BoorishBears 4y ago
  They couldn't drive it with this hack anyways Manual cars are required to have a clutch lockout for starting (so you can't accidentally leave it in gear and have it lurch forward)
- chrisseaton 4y ago
  I don't get why people thinking driving a manual gearbox is such a mystery - it's not much different to automatic driving I've never met anyone who wasn't able to do it well enough.
  - kube-system 4y ago
    In the US they are not common and most people do not know how to operate one.
    - chrisseaton 4y ago
      There's really no magic to it - there's an extra pedal you depress when changing gear, and you bring up to re-engage the engine. Anyone can figure it out when presented with the pedal and the gear lever. People with no no education do it all around the world every day - I'm sure an American can figure it out.
gigel82 4y ago
I have a Nissan Leaf and it always bothered me there was no software way to fully disable telematics. I looked into how to disable the hardware but it's a very involved procedure and the car is leased so I dropped it, but maybe I need to revisit.
- bombcar 4y ago
  If you can find the radio antenna you may be able to wrap it in enough foil and lead to stop transmission.
  - ynniv 4y ago
    https://www.wikihow.com/Deactivate-OnStar https://www.wikihow.com/Deactivate-OnStar
  - mdorazio 4y ago
    It's typically in the shark fin above the rear windshield, which is not easy or convenient to RF isolate.
- mikestew 4y ago
  Your Leaf is too new. We've got an OG Leaf (2011) that had the old GPRS radio. When AT&T dropped that, Nissan generously offered a more modern cell radio for something like $300. Or they would take out the radio for free. Given the utter uselessness of Nissan's "remote" platform[0], guess which option we went for? But it's right behind the glove box, and unless the design has changed (it has been eleven years), a couple of screws should get you in the neighborhood of the antenna. [0] Seriously, what a slow-ass piece of shit. It was literally faster to walk out to the garage and turn the heat on than it was to do it through the app. And that assumes that Nissan's server could see its way clear to turn the heat on at all, which it frequently didn't.
vlucas 4y ago
They can't start my car if it's a manual! :)
- grecy 4y ago
  Remote start on manual trans cars is very common in Canada. My 2011 wrangler has it from factory.
- burnt_toast 4y ago
  Lol, manuals can be equipped with remote start too. Hopefully it wasn't left in gear.
  - jaywcarman 4y ago
    I was intrigued by this statement and did some searching. Sure enough it does exist: https://www.compustar.com/blog/can-you-remote-start-a-manual-transmission-stick-shift-vehicle/ https://www.compustar.com/blog/can-you-remote-start-a-manual... > This is accomplished via clutch bypass, reservation mode, and built-in safety features. I still would never want it... but it's an interesting system.
    - itslennysfault 4y ago
      I had a manual Acura Integra when I was younger and I installed a remote start on it because shops refused to (because it's dangerous af). Anyways, the clutch pedal simply presses a little button when it is all the way up. All I had to do is bridge the two wires going into that button and it would start without the clutch pressed. Amazingly I only ever tried to remote start it while in gear once. It retries 3 times so it jumped forward 3 times. About a foot each time, but didn't hit anything thankfully. I always wanted to add a sensor to the shifter so it'd only bypass the clutch sensor when in neutral, but I never got around to doing it.
- AdrianB1 4y ago
  I saw cars with remote start back in the 90's. All manual, in Eastern Europe, where automatic transmission is extremely rare.
rglover 4y ago
So from what I gathered, they weren't running any validation on the server aside from that the VIN existed and matched a customer's vehicle? No JWT token/cookie validating the logged in user or anything else?
- Firmwarrior 4y ago
  Pretty crazy if true The news is going to be saying "Security issue found, elite hackers elitely hacked into SiriusXM" when it should be saying "Sirius did not bother to implement any security at all for their remote management software"
- bornfreddy 4y ago
  Yup. And I wonder how they fixed it - did they actually find a way to distinguish the owner from the hackers? Does anyone know how the initial pairing with the app works?
  - rglover 4y ago
    I mean the dirt simple way would be to authenticate the user's account, return some JWT/cookie, and then when you make requests to the API, pair that token w/ the VIN. If the VIN doesn't belong to that token (or the token itself is invalid), 403 it.
    - bornfreddy 4y ago
      Well yes, there are many ways this can be solved properly, but this doesn't mean they used any of those. P.S.: not that it matters, but - 401?
      - rglover 4y ago
        I'd use 403 for it. 401 is similar, but would apply more to "you typed in the wrong password" than "you tried to circumvent the security". The difference is narrow, though, and really it's just semantics so both would be valid IMO: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403 https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403
stainablesteel 4y ago
i just want a car that doesn't need firmware updates
Fej 4y ago
How does one disable the telematics system(s) on a Honda or Nissan?
- dangrossman 4y ago
  Unplug the antenna from the telematics unit. In my last Nissan, that was located right behind the glove box, not hard to get to.
kbrackbill 4y ago
Is it possible to buy a new car these days without the remote/cell connection stuff? Or if not, can it be disabled? My car is 15 years old so I haven't had to think about it yet, but I'm worried about what I'll do when it finally gives up. Maybe just buy another older used one or something. Alternatively, are there any killer features that make having an always connected car desirable? I understand why car manufacturers would want it for telemetry and updates and such but I'm not sure what the value is for me.
- Too 4y ago
  Send navigation instructions from phone, rather than entering address with a rotary knob on the slow IVI in the car.
- Shocka1 4y ago
  As someone who was on the R&D Infotainment team on the US side of one of the big Japanese manufacturers, I had many heated debates with management over these "features," which became a big enough deal for me that it was one of the main reasons I left the company. The executive suite on the American side R&D were always pushing these dubious features for the underlying data underneath. This was masked as "value" for the customer, but it's mostly a smokescreen so that the manufacturer can sell the data on the open market. There is a large Silicon Valley/MBA influence when it comes to data and how to monetize it. One may or may not be surprised of the philosophies here - the idea is to monetize the vehicle and data every step of the way. The data doesn't belong to the customer even though they bought the car. Given the pervasiveness I saw at this specific company and it's software suppliers, I would assume every supplier and manufacturer for newer model vehicles are doing this now. I'm a little old-ish school. At this point just give me a bluetooth connection that always works with my phone and I'm good. These newer vehicles are basically just another mobile phone on wheels, riddled with bugs and data collection services. No thanks.
- dangrossman 4y ago
  I use an app to turn on climate control in my car a few minutes before I'm ready to leave, so it's already warmed up in winter, or cooled down in summer, by the time I get in. My last few cars have been electric, so this doesn't involve starting up a noisy engine, and can safely be done if the car's parked in a garage too.
sawyna 4y ago
I think this must have been buried in years old docs and layers of design that nobody understands what's going on under the hood. I wouldn't blame either parties, I suppose the process can be improved but it's very subjective. There'll be a new missing piece tomorrow and you'll have to "improve" the process again. I think this is simply a side effect of fast moving software design. Things will settle down in a couple of decades when the AI lord takes over.
aksss 4y ago
Interfaces with rotary encoders (physical knobs), buttons, and disconnected operation will become premium features.
anotheracctfo 4y ago
A couple weeks ago my block was hit by thieves who got remote entry into a bunch of Toyotas and Hondas. I wonder if that's how they did it.
- 3np 4y ago
  Given how much is in common between the Japanese manufacturers, if Toyota and Honda are affected it's likely that several others are as well.
randcraw 4y ago
This trick works only if keyless services on your Honda were enabled. Thus this vulnerability is trivial to avoid, even without a patch.
cmckn 4y ago
As if I needed one more reason to hate SiriusXM.
jiveturkey 4y ago
this sounds useful since i often forget where i parked. i could remote flash and honk all hondas in the parking lot when i go christmas shopping. then the one not flashing is my car. or when the guy 3 cars ahead on his phone doesn’t move when the light changes, i can honk the car in back of him.
cgb223 4y ago
Am I correct in understanding that Nissan was using vehicle VINs as customer IDs and that’s why this worked? Or is he saying in addition to customer IDs that the auth API also accepted VINs?
magicalhippo 4y ago
Awesome, maybe this can work better than the provided app for my Leaf. The car never responds to remote commands to start the heater etc, no matter what the app says.
ElijahLynn 4y ago
Title is misleading. The vulnerability was patched after they reported it. One cannot use this vulnerability today.
- dang 4y ago
  Ok, I've squeezed a resolution into the title. Thanks!
  - ElijahLynn 4y ago
    Thank you
phonescreen_man 4y ago
Sales of flipper going up!
- avel 4y ago
  This is not related to radio hacks, it is just a poorly secured web API.
Thaxll 4y ago
It's mind blowing that removing a single k/v in an http post would lead to unlock any cars... wtf seriously. Like how can you not test that, the POST to fetch token should be bulletproof.
neoncontrails 4y ago
I simply can't take a Twitter account with a blue checkmark seriously anymore.

436 points by zdw 4y ago

Not just that, it also let the attacker find the customer's home address.

>> The response contained the victim's name, phone number, address, and car details I've seen this in a few other APIs. Although the frontend was not using or displaying it, the backend was still sending a lot of personal information in REST responses by default. :/

twojacobtwo 4y ago

>At this point, we identified that it was also possible to access customer information and run vehicle commands on Honda, Infiniti, and Acura vehicles in addition to Nissan. >We reported the issue to SiriusXM who fixed it immediately and validated their patch. Nice to see that it was addressed quickly, but it's frightening that such a shoddy system design was accepted by auto manufacturers with seemingly no oversight.

julianlam 4y ago
Are you surprised? I have seen companies prepare for a SOC2 compliance audit, and I get the feeling that these companies like vendors because the audit doesn't apply to vendors, so all they really have to do is ask the vendor to pinky swear that the software is safe.
endtime 4y ago
Why would they spend money on that? This severe vulnerability isn't going to hurt their bottom line, even if it "should". (I'm not endorsing this perspective, to be clear, just recognizing that it exists.)
- User23 4y ago
  Indeed. Everyone says that they care about online security, but revealed preferences show that virtually nobody actually does. On the other hand revealed preferences tell a completely different story about physical security.
- ticviking 4y ago
  Isn't doing that math and seeing how heartless corporations the opening premise of "Fight Club"?
  - spookthesunset 4y ago
    If Fight Club was filmed today, I’m pretty sure the final scenes would be blowing up the media buildings and not the banks/credit card buildings…
    - Retric 4y ago
      As in Twitter/Facebook/Google or CNN/Fox News?
- philsnow 4y ago
  > This severe vulnerability isn't going to hurt their bottom line, even if it "should". When there's damnable, devastating security news for some publicly-traded company that makes it to the big news sources, the stock takes a 0-10% dive and then completely recovers within a couple weeks. Even if the company's response is completely bungled, mismanaged, or miscommunicated, the market doesn't understand security issues and it seems like the company just benefits from the news exposure. I wish I kept notes on the last few times I've seen this happen so that I could cite examples.
  - mughinn 4y ago
    It's not the market, the customers don't care. They won't stop buying the product because of security issues, it's because of THAT that the price recovers, not because "the market" doesn't understand security If the customers cared, there would be significant drop in the price of the stock because a vulnerability like this would result in lower sales
mschuster91 4y ago
> Nice to see that it was addressed quickly, but it's frightening that such a shoddy system design was accepted by auto manufacturers with seemingly no oversight. That's thanks to the old tale of "outsourcing what is not a core business". I get it, it's fine when you have the capacity and capability to do oversight - but in most cases, the beancounters eventually decide that this capacity is not needed, and then shit like this happens.
- TedDoesntTalk 4y ago
  > outsourcing what is not a core business Except that this telematics product is a core business unit for SiriusXM.
  - mschuster91 4y ago
    Yeah but not for the car maker. So the suppliers cut corners whenever they can, and the demands from the manufacturers tend to be insane as well.
    - TedDoesntTalk 4y ago
      The vulnerability was in a Sirius product. If you’re suggesting auto manufacturers don’t write their own telematics software because it’s not core to their business, then… hallelujah! Can you imagine what kind of crap they’d deliver? I’d you’re suggesting something else, then I don’t understand.
hackernewds 4y ago
Imagine the risk when cars can also drive themselves, as 6 ton battering rams that can also self implode the evidence.

deleted 4y ago

[deleted]

brk 4y ago

This is super interesting, but why are people posting this kind of thing to tweet streams? Twitter is just absolute shit for trying to document this kind of research, IMO.

dfee 4y ago
Obviously the reach is better and that’s what they’ve optimized for.
- layer8 4y ago
  They could tweet with a link to a blog post for the details. I guess some followers would still be too lazy to follow the link, but that’s not a valid argument anymore IMO.
jeffbee 4y ago
There are so many reasons to do it this way. You reach a huge audience. You don't have to how your own assets. If your post is popular, it won't get DDoSed off the air. Search engines will index it immediately. Etc. People get many benefits from posting this way.
- gist 4y ago
  > You reach a huge audience. You would reach the same huge audience by putting in a summary and link to a website with the detailed info. > If your post is popular, it won't get DDoSed off the air So someone who is capable enough (or a team) to pull off and uncover this exploit can't be troubled to run a website (server whatever) that can handle ddos or traffic?
  - dnadler 4y ago
    > can't be troubled to run a website Yes, that's right. They have more important things to do than worry about hosting a website. They rightly use third party applications to disseminate information.

sc00ty 4y ago

https://threadreaderapp.com/thread/1597792097175674880.html https://threadreaderapp.com/thread/1597792097175674880.html

ffgh 4y ago

When something like this happens, is the development team to blame? Or maybe even the QA team? Wouldn't it be customary to test for things like this

totally 4y ago
What good is blame?
- ilyt 4y ago
  "We must take security seriously or we got sued out of existence" is good motivator for management.
  - sitkack 4y ago
    Just limit lawsuit damage at the source, force arbitration, or collapse any plurality of suits into a slap-on-the-wrist class action!
CoastalCoder 4y ago
I'd say it depends on how far out you're willing to zoom. For example, legislators and regulators allowed this kind of laxity to be commercially advantageous. Voters allowed legislators and regulators to ignore the issue. To some extent, parents failed to instill in their children the civic virtue of voting wisely. Etc.
ilyt 4y ago
Manufacturers for even allowing that to exist (why the fuck telemetry app made by company making radio channels would have permissions to unlock the car in the first place) and company for woeful errors in security and data protection.
- zuppy 4y ago
  most probably, because of CAN bus, which is the system that most of the cars use to connect their systems. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7219335/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7219335/ how CAN bus works: https://payatu.com/blog/kartheek.lade/automotive-security-part3 https://payatu.com/blog/kartheek.lade/automotive-security-pa... i’m aware that on this case there was something even dumber, an unsecured api endpoint, but as far as i know, if you’ve managed to reach the system you can do anything with any other connected device. there should not be a way to be able to do whatever you want just because you have access to the network.

gottebp 4y ago

The automotive firmware industry has had a strong preference historically for stable, old dependencies. With the advent of connected firmware, arises a strong force pushing in the other direction — towards frequent updates, built from latest and greatest dependencies. How they balance verification and validation for safety purposes with frequent and more volatile updates, will be interesting to watch.

kube-system 4y ago
Maybe the automotive firmware industry had it right. Software on the internet is often just plain bad. SiriusXM's software should have had proper authentication on the endpoints.
AlexandrB 4y ago
I wish they gave customers an off switch for remote access so at least older cars aren't rolling honeypots for hackers.
- vorpalhex 4y ago
  Supposedly removing the sharkfin whokesale will do it, at the cost of also losing fm radio.
  - AlotOfReading 4y ago
    The sharkfin is usually only for external comms. There's still other comms on separate antennas like Bluetooth that can be potential entry points to the vehicle. Worse, even the external comms systems are moving to more redundant setups to mitigate signal loss scenarios.
    - deleted 4y ago
      [deleted]
    - vorpalhex 4y ago
      I'll have to dig up the post but a gentleman with a relatively new Subaru was kind enough to share his explorations and found significant logic parts integrated into the sharkfin, not just the antenna bundle. Likely a cost measure. How well does this extend to other vehicles? No clue.

ClarityJones 4y ago

When someone is believed to have "committed suicide" or "accidentally" left their car running in the garage, is it routine for investigators to audit the manufacturer's remote-start logs? Do those logs even exist?

TylerE 4y ago
It's actually more or less impossible with modern cars. Hell, in a lot of cities what comes out of the tailpipe is cleaner than what goes in the intake.
- mschuster91 4y ago
  You can still die from carbon dioxide exposure/oxygen inefficiency. It will just take longer, now that carbon monoxide emissions are down because of catalytic converters eliminating a lot of them. And yet, a lot of people still die or get seriously injured, particularly because their "keyless" crap acts up [1]. [1] https://www.nytimes.com/2018/05/13/business/deadly-convenience-keyless-cars-and-their-carbon-monoxide-toll.html https://www.nytimes.com/2018/05/13/business/deadly-convenien...
  - philsnow 4y ago
    I agree that carbon dioxide exposure is dangerous, but it is probably less dangerous because (TIL) there's a specific brain mechanism that wakes you up when your blood has elevated CO2[0]. On the other hand, carbon monoxide poisoning will only wake you up if its symptoms (among which headache, nausea/vomiting, elevated heart rate, and cardiac arrest seem likely) do so. [0] https://medicine.uiowa.edu/content/specific-neurons-trigger-waking-due-inhaled-co2 https://medicine.uiowa.edu/content/specific-neurons-trigger-...
- bombcar 4y ago
  Cleaner on noxious chemicals but not on carbon dioxide which is what gets humans. I’m kind of surprised garage doors don’t have co2 monitors built in but I suppose it could be used as a security bypass.

toast0 4y ago

My vehicle is safe, thanks to Ford. Telematics goes over terrestrial phone networks, and when 2g shutdown months after the car was made, they replaced the modem with a 3g modem that was alreadt obsolete and now that 3g is shutdown, there's no more internet access to the car. Thanks Ford!

webmobdev 4y ago
Your comment is insightful and made me realise something I was quite unaware of in India - that allowing your automobile to track, collect and share data has become so mainstreamed in the US / west that it is considered "normal"! I guess I shouldn't be surprised - most people are unaware that Ford (and some others) collect a lot of personal data when you take your car to the service centre (for e.g. they download your contact list and call logs from your car when they run the diagnostic software) More info here - Data could be what Ford sells next as it looks for new revenue - https://www.freep.com/story/money/cars/2018/11/13/ford-motor-credit-data-new-revenue/1967077002/ https://www.freep.com/story/money/cars/2018/11/13/ford-motor... and Ford Eyes Use of Customers’ Personal Data to Boost Profits - https://threatpost.com/ford-eyes-use-of-customers-personal-data-to-boost-profits/139209/ https://threatpost.com/ford-eyes-use-of-customers-personal-d... ).
- philsnow 4y ago
  > they download your contact list and call logs from your car when they run the diagnostic software I'm inclined to believe you because I don't give cars access to my contacts and in general treat in-car software as already-compromised (I see the car manufacturer as more of an adversary than a partner), but do you have a source for this claim?
  - webmobdev 4y ago
    I remember reading about this a long time ago (5+ years ago I think) - it was Ford doing this and it did cause some mild outrage in the internet. Unfortunately I cannot find that particular article - Google has become shitty for finding old stuffs and possibly Ford PR has scrubbed the internet so that the public can't find it easily (a common practice in the evolving online marketing industry). I've added two sources to my earlier comment that disclose the gist of what I have claimed.

jrsj 4y ago

The good news is my Acura has a manual transmission so the number of people who can both hack and drive it is a bit more limited at least ;)

at-fates-hands 4y ago
So true. I remember seeing several videos of people trying to steal cars, only to find out its a manual and have to retreat. The best was a pair of criminals who robbed a store, got the managers keys, loaded up the car and then after several attempts of leaving with the loot (popping the clutch to hilarious effect) and realizing they couldn't drive a manual, just got of the car and took off on foot empty handed. This must be a generational thing. As soon as I was old enough to drive, I was taught how to drive a manual first.
BoorishBears 4y ago
They couldn't drive it with this hack anyways Manual cars are required to have a clutch lockout for starting (so you can't accidentally leave it in gear and have it lurch forward)
chrisseaton 4y ago
I don't get why people thinking driving a manual gearbox is such a mystery - it's not much different to automatic driving I've never met anyone who wasn't able to do it well enough.
- kube-system 4y ago
  In the US they are not common and most people do not know how to operate one.
  - chrisseaton 4y ago
    There's really no magic to it - there's an extra pedal you depress when changing gear, and you bring up to re-engage the engine. Anyone can figure it out when presented with the pedal and the gear lever. People with no no education do it all around the world every day - I'm sure an American can figure it out.

gigel82 4y ago

I have a Nissan Leaf and it always bothered me there was no software way to fully disable telematics. I looked into how to disable the hardware but it's a very involved procedure and the car is leased so I dropped it, but maybe I need to revisit.

bombcar 4y ago
If you can find the radio antenna you may be able to wrap it in enough foil and lead to stop transmission.
- ynniv 4y ago
  https://www.wikihow.com/Deactivate-OnStar https://www.wikihow.com/Deactivate-OnStar
- mdorazio 4y ago
  It's typically in the shark fin above the rear windshield, which is not easy or convenient to RF isolate.
mikestew 4y ago
Your Leaf is too new. We've got an OG Leaf (2011) that had the old GPRS radio. When AT&T dropped that, Nissan generously offered a more modern cell radio for something like $300. Or they would take out the radio for free. Given the utter uselessness of Nissan's "remote" platform[0], guess which option we went for? But it's right behind the glove box, and unless the design has changed (it has been eleven years), a couple of screws should get you in the neighborhood of the antenna. [0] Seriously, what a slow-ass piece of shit. It was literally faster to walk out to the garage and turn the heat on than it was to do it through the app. And that assumes that Nissan's server could see its way clear to turn the heat on at all, which it frequently didn't.

vlucas 4y ago

They can't start my car if it's a manual! :)

grecy 4y ago
Remote start on manual trans cars is very common in Canada. My 2011 wrangler has it from factory.
burnt_toast 4y ago
Lol, manuals can be equipped with remote start too. Hopefully it wasn't left in gear.
- jaywcarman 4y ago
  I was intrigued by this statement and did some searching. Sure enough it does exist: https://www.compustar.com/blog/can-you-remote-start-a-manual-transmission-stick-shift-vehicle/ https://www.compustar.com/blog/can-you-remote-start-a-manual... > This is accomplished via clutch bypass, reservation mode, and built-in safety features. I still would never want it... but it's an interesting system.
  - itslennysfault 4y ago
    I had a manual Acura Integra when I was younger and I installed a remote start on it because shops refused to (because it's dangerous af). Anyways, the clutch pedal simply presses a little button when it is all the way up. All I had to do is bridge the two wires going into that button and it would start without the clutch pressed. Amazingly I only ever tried to remote start it while in gear once. It retries 3 times so it jumped forward 3 times. About a foot each time, but didn't hit anything thankfully. I always wanted to add a sensor to the shifter so it'd only bypass the clutch sensor when in neutral, but I never got around to doing it.
AdrianB1 4y ago
I saw cars with remote start back in the 90's. All manual, in Eastern Europe, where automatic transmission is extremely rare.

rglover 4y ago

So from what I gathered, they weren't running any validation on the server aside from that the VIN existed and matched a customer's vehicle? No JWT token/cookie validating the logged in user or anything else?

Firmwarrior 4y ago
Pretty crazy if true The news is going to be saying "Security issue found, elite hackers elitely hacked into SiriusXM" when it should be saying "Sirius did not bother to implement any security at all for their remote management software"
bornfreddy 4y ago
Yup. And I wonder how they fixed it - did they actually find a way to distinguish the owner from the hackers? Does anyone know how the initial pairing with the app works?
- rglover 4y ago
  I mean the dirt simple way would be to authenticate the user's account, return some JWT/cookie, and then when you make requests to the API, pair that token w/ the VIN. If the VIN doesn't belong to that token (or the token itself is invalid), 403 it.
  - bornfreddy 4y ago
    Well yes, there are many ways this can be solved properly, but this doesn't mean they used any of those. P.S.: not that it matters, but - 401?
    - rglover 4y ago
      I'd use 403 for it. 401 is similar, but would apply more to "you typed in the wrong password" than "you tried to circumvent the security". The difference is narrow, though, and really it's just semantics so both would be valid IMO: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403 https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403

stainablesteel 4y ago

i just want a car that doesn't need firmware updates

Fej 4y ago

How does one disable the telematics system(s) on a Honda or Nissan?

dangrossman 4y ago
Unplug the antenna from the telematics unit. In my last Nissan, that was located right behind the glove box, not hard to get to.

kbrackbill 4y ago

Is it possible to buy a new car these days without the remote/cell connection stuff? Or if not, can it be disabled? My car is 15 years old so I haven't had to think about it yet, but I'm worried about what I'll do when it finally gives up. Maybe just buy another older used one or something. Alternatively, are there any killer features that make having an always connected car desirable? I understand why car manufacturers would want it for telemetry and updates and such but I'm not sure what the value is for me.

Too 4y ago
Send navigation instructions from phone, rather than entering address with a rotary knob on the slow IVI in the car.
Shocka1 4y ago
As someone who was on the R&D Infotainment team on the US side of one of the big Japanese manufacturers, I had many heated debates with management over these "features," which became a big enough deal for me that it was one of the main reasons I left the company. The executive suite on the American side R&D were always pushing these dubious features for the underlying data underneath. This was masked as "value" for the customer, but it's mostly a smokescreen so that the manufacturer can sell the data on the open market. There is a large Silicon Valley/MBA influence when it comes to data and how to monetize it. One may or may not be surprised of the philosophies here - the idea is to monetize the vehicle and data every step of the way. The data doesn't belong to the customer even though they bought the car. Given the pervasiveness I saw at this specific company and it's software suppliers, I would assume every supplier and manufacturer for newer model vehicles are doing this now. I'm a little old-ish school. At this point just give me a bluetooth connection that always works with my phone and I'm good. These newer vehicles are basically just another mobile phone on wheels, riddled with bugs and data collection services. No thanks.
dangrossman 4y ago
I use an app to turn on climate control in my car a few minutes before I'm ready to leave, so it's already warmed up in winter, or cooled down in summer, by the time I get in. My last few cars have been electric, so this doesn't involve starting up a noisy engine, and can safely be done if the car's parked in a garage too.

sawyna 4y ago

I think this must have been buried in years old docs and layers of design that nobody understands what's going on under the hood. I wouldn't blame either parties, I suppose the process can be improved but it's very subjective. There'll be a new missing piece tomorrow and you'll have to "improve" the process again. I think this is simply a side effect of fast moving software design. Things will settle down in a couple of decades when the AI lord takes over.

aksss 4y ago

Interfaces with rotary encoders (physical knobs), buttons, and disconnected operation will become premium features.

anotheracctfo 4y ago

A couple weeks ago my block was hit by thieves who got remote entry into a bunch of Toyotas and Hondas. I wonder if that's how they did it.

3np 4y ago
Given how much is in common between the Japanese manufacturers, if Toyota and Honda are affected it's likely that several others are as well.

randcraw 4y ago

This trick works only if keyless services on your Honda were enabled. Thus this vulnerability is trivial to avoid, even without a patch.

cmckn 4y ago

As if I needed one more reason to hate SiriusXM.

jiveturkey 4y ago

this sounds useful since i often forget where i parked. i could remote flash and honk all hondas in the parking lot when i go christmas shopping. then the one not flashing is my car. or when the guy 3 cars ahead on his phone doesn’t move when the light changes, i can honk the car in back of him.

cgb223 4y ago

Am I correct in understanding that Nissan was using vehicle VINs as customer IDs and that’s why this worked? Or is he saying in addition to customer IDs that the auth API also accepted VINs?

magicalhippo 4y ago

Awesome, maybe this can work better than the provided app for my Leaf. The car never responds to remote commands to start the heater etc, no matter what the app says.

ElijahLynn 4y ago

Title is misleading. The vulnerability was patched after they reported it. One cannot use this vulnerability today.

dang 4y ago
Ok, I've squeezed a resolution into the title. Thanks!
- ElijahLynn 4y ago
  Thank you

phonescreen_man 4y ago

Sales of flipper going up!

avel 4y ago
This is not related to radio hacks, it is just a poorly secured web API.

Thaxll 4y ago

It's mind blowing that removing a single k/v in an http post would lead to unlock any cars... wtf seriously. Like how can you not test that, the POST to fetch token should be bulletproof.

neoncontrails 4y ago

I simply can't take a Twitter account with a blue checkmark seriously anymore.