7 ms·

The headline on the site is a bit misleading. It's not "because of viral TikTok challenge", it's because the software and physical ignition interface is, in fac

The headline on the site is a bit misleading. It's not "because of viral TikTok challenge", it's because the software and physical ignition interface is, in fact, totally broken: "The thefts are reportedly easy to pull off because many 2015-2019 Hyundai and Kia vehicles lack electronic immobilizers that prevent thieves from simply breaking in and bypassing the ignition. The feature is standard equipment on nearly all vehicles from the same period made by other manufacturers." And from: https://www.hotcars.com/kia-boyz-easily-steal-base-kia-hyundais-across-america/ https://www.hotcars.com/kia-boyz-easily-steal-base-kia-hyund... "Based on research conducted by Donut Media, we see that stealing a Hyundai or a Kia model produced between 2011 and 2021 is astonishingly simple. Folks at Donut Media started this research with a regular screwdriver and a USB cable. They start by unscrewing the steering column case and exposing the wires and the ignition cylinder. Once they pull out the ignition cylinder, they find a twist lever that fits perfectly into the slot of a USB-A cable. Once they connect their spare USB Type-A to the ignition cylinder male port, they rotate the unit in a clockwise motion to find the car starting without a proper car key. " This is like saying that movies in the 1980s sparked a rash of car thefts because they showed people hotwiring cars all the time.

a_shovel 4y ago
From what I've gathered, "Viral TikTok Challenge" and its variations are sleeper-agent activation phrases for news editors which make them automatically accept the next story pitch you give them.
- jdlshore 4y ago
  Headlines are chosen by the editor, not the journalist, to my knowledge.
kens 4y ago
I'm pretty sure that steering wheel locks were required by law starting in the 1970s. Does this process bypass the steering wheel lock somehow? Or do these cars not have steering wheel locks?
- phonescreen_man 4y ago
  The plastic under the steering wheel is removed exposing the ignition barrel, at the end of the barrel you can pop it off. Exposing a little fob like turner, stick your usb cable over it and twist. The steering lock gets released. This is an old car stealing trick however, in the olden days you could do the same thing but the steering column would remain locked. Skinny 12 year olds in the UK had enough strength to snap the lock by grabbing the wheel and quickly pulling it in either direction, once you broke the lock you were good to go! We called them twocs (taken without owners consent) the whole adventure was known as joy riding.. The Kia boys were a couple of American youths doing something similar and uploading videos of it on tik tok. A reporter asked them, don’t you feel bad for people who’s cars you are stealing? The kid replied nah, they got insurance. The reporter- what if they don’t have insurance? The kid straight faced and serious- that’s illegal so they shouldn’t be doing that. Sure the video of that interview is out there somewhere. Hilarious. Also unlucky if your car got stolen. Don’t blame the kids they just bored and need guidance.
gwill 4y ago
I could see an argument that the "viral challenge" is forcing them to change it. The manufacturers were aware of the problem, and doing the absolute minimum to address it. They were giving out steering wheel locks and offering to do a software fix for anywhere between $170 and $500. The issue spread through the "tiktok challenge" and that's forced them to make a move toward helping customers.
- deleted 4y ago
  [deleted]
- TaylorAlexander 4y ago
  I guess it’s more like “companies forced to fix known flaw pointed out in viral TikTok trend” or something.
  - hdjjhhvvhga 4y ago
    That's spot on. But the question for The Verge is, would you click on that headline?
    - xoa 4y ago
      I mean, yeah? That's actually still an interesting phenomenon that combines multiple hot button/trending things. I think in this case a more accurate headline is actually still plenty clickable. They simply didn't do a great job on the wording this time. It happens.
    - b112 4y ago
      Or is it a paid story, with tiktok struggling to stay in the US, and this is a "tiktok good for all" story?
    - TaylorAlexander 4y ago
      Trick question, I would not click on a link to The Verge.
      - 4y ago
deleted 4y ago
[deleted]
kube-system 4y ago
The proliferation of knowledge about how easy it was to do this, and the resulting subcultural trend, is the reason they are being forced to change it. Otherwise, people would be stealing them at the same rates they were before the recent trend.
johncessna 4y ago
> "The thefts are reportedly easy to pull off because many 2015-2019 Hyundai and Kia vehicles lack electronic immobilizers that prevent thieves from simply breaking in and bypassing the ignition. The feature is standard equipment on nearly all vehicles from the same period made by other manufacturers." It's more than that. It's a combination of a lack of electronic immobilizer and putting the mechanical component behind a piece of plastic. If they really want to save pennies on the immobilizer, they can move the mechanical piece further down the steering column
nimbius 4y ago
if this is what it took to get two large multinational automakers to capitulate to basic theft immobilization in their vehicles to protect customers, perhaps we should reconsider the 'tiktok is objective evil' narrative.
- jimt1234 4y ago
  Totally agree. Sounds like they're just using an established, more generic narrative to deflect accountability - basically, "It's not our fault, it's the hackers and bad kids on the internet." We see this all the time for security incidents: "Hackers steal data from BigCorp", when the headline should read more like, "BigCorp released a faulty product, and now you're suffering."
- autoexec 4y ago
  > perhaps we should reconsider the 'tiktok is objective evil' narrative. I don't think the fact that tiktok was educating car thieves on ideal targets leading to an increase in stolen vehicles is a great example of tiktok's benevolence or enough to excuse it for the other harms it enables. That said, nothing is pure evil all the time. Tiktok is just a popular means of communication and sometimes the message being communicated will be good and sometimes it will be bad. There's no criticism of tiktok's content that doesn't apply just as much to youtube or any other social media platform. However, tiktok still has their own privacy/security issues, the concerns over what and who gets promoted or suppressed by tiktok's algorithms/moderators, and of course that whole supporting china/genocide/the oppression of hong kong thing all of which makes me doubt the "tiktok is evil" narrative is going to go away just because a couple car companies caved to some bad press.
rootusrootus 4y ago
> The feature is standard equipment on nearly all vehicles from the same period made by other manufacturers. Even worse, that feature has been pretty common on mainstream vehicles since the 90s.
- kube-system 4y ago
  Which makes it an excellent opportunity to undercut competitors by a hundred bucks.
  - owenmarshall 4y ago
    I wonder how systemic these kinds of shortcuts are in the wider market, not just automotive. How many problems that were solved in expensive ways decades ago are lurking beneath the surface, waiting to be discovered again because the problem - and solution! - are effectively invisible to most consumers?
    - kube-system 4y ago
      Pretty much everything. The practice of engineering is as much an exercise in knowing what problems to solve as it is a practice in knowing which problems you can get away with not solving.
- rodgerd 4y ago
  It's interesting to me that there's a similar problem in New Zealand with NZ-new and second-hand imports of the same model cars: the Toyota Prius C and Toyota Aqua are the same vehicle, but Aquas that were imported second-hand from Japan don't typically have immobilisers, and are heavily targeted for theft. Given that ex-Japan models of cars are typically higher-spec than NZ-new equivalents, it's seems an odd difference; I have to wonder if there are differences in car theft rates in Japan or South Korea that play into the difference in what is a pretty basic piece of equipment in Western markets.
  - ggreer 4y ago
throw1230 4y ago
Additionally, this only happens for cars built for the U.S. The other countries have electronic immobilizer requirements, so they have them.
- shortcake27 4y ago
  Ah that makes sense. I briefly combed the article and was confused because I had a factory immobiliser in my base model 97 Lantra.
- katbyte 4y ago
  was curious, all new cars in canada required them after 2007! https://www.cbc.ca/news/canada/anti-theft-device-now-mandatory-in-canadian-made-vehicles-1.677141 https://www.cbc.ca/news/canada/anti-theft-device-now-mandato... but now we're seeing a rash of thefts of keyless fob vehicles with a relay attack making me glad my tacoma needs a key
  - rtpg 4y ago
    I thought keyless fobs all had some sort of counter to prevent replay attacks
    - pseudo0 4y ago
      Relay, not replay attack. For vehicles that unlock and push to start based on the proximity of the key, basically all you need to do is use a pair of software defined radios to trick the car into thinking that the key is there. Hence a relay attack, where one attacker is located near the key and the other is located near the vehicle, and the two attackers pass the components of the challenge/response to the vehicle via the channel between the two attackers.
      - rtpg 4y ago
        Ah, that makes sense. Thanks for the detailed explanation
      - 4y ago
outworlder 4y ago
This is funny because we have a Hyundai Elantra 2010 and that one has an immobilizer. You can't turn it on without the encoded key. I guess that at some point Hyundai and Kia decided to save some money?
- agilob 4y ago
  >I guess that at some point Hyundai and Kia decided to save some money? If this can be fixed with a software update, that's not saving money. That's making money by making you pay extra for the immobilizer.
mcguire 4y ago
Back in the '80s and '90s, many computer vendors like Sun and IBM shipped their systems with radically broken security configs, not to mention holes in their software. Often, the only way to get them to fix their problems was to make their problems very public. Hence, BUGTRAQ. https://bugtraq.securityfocus.com/archive https://bugtraq.securityfocus.com/archive
eof 4y ago
I just bought a 23 Kia Telluride (was also looking at palisades) to upgrade my 05 outback; I did extensive research, and ended up zoning in on Hyundai-Kia specifically because their electronics are so 'hackable,' while still containing all the cutting edge sensors. I think it is going to be a tiny sliver of cars that are allowed to get away with having a vehicle be able to be controlled like a remote control from a completely unencrypted, trivially intercepted-and-changed protocol. In the future I suspect if manufacturers want to put these features on cars, they will have to protect the communication between the different systems.
- theGnuMe 4y ago
  How do you like it? And why did you pick the Telluride over the Palisade?
  - eof 4y ago
    It's of course a huge improvement. It was close and I'd probably have been happy with either but ultimately the telluride had features i cared about (better towing) and palisade had some i didn't (electified third row seats); and I like the look of the telluride better. I live in a rural area and got the trim with the 'offroadish' appeal; which didn't really exist in palisade.
at-fates-hands 4y ago
Someone is clearly taking advantage of this: More than 3,000 cars have been reported stolen in Minneapolis this year, including 432 Kias and 368 Hyundais. Officers are warning people to do what they can to protect their vehicles because this year, an average of 13 cars are stolen each day. Prior to this spring, Hondas, Toyotas, Chevys, and Fords were the most common cars stolen in Minneapolis. But as word spread on social media this year about how easy Kias and Hyundais are to steal, they now account for more car thefts. https://www.fox9.com/news/data-kias-and-hyundais-now-most-stolen-cars-in-minneapolis https://www.fox9.com/news/data-kias-and-hyundais-now-most-st...
supercanuck 4y ago
>This is like saying that movies in the 1980s sparked a rash of car thefts because they showed people hotwiring cars all the time. Probably did, but the scale of the problem is much larger considering TikTok's reach.

a_shovel 4y ago

From what I've gathered, "Viral TikTok Challenge" and its variations are sleeper-agent activation phrases for news editors which make them automatically accept the next story pitch you give them.

jdlshore 4y ago
Headlines are chosen by the editor, not the journalist, to my knowledge.

kens 4y ago

I'm pretty sure that steering wheel locks were required by law starting in the 1970s. Does this process bypass the steering wheel lock somehow? Or do these cars not have steering wheel locks?

phonescreen_man 4y ago
The plastic under the steering wheel is removed exposing the ignition barrel, at the end of the barrel you can pop it off. Exposing a little fob like turner, stick your usb cable over it and twist. The steering lock gets released. This is an old car stealing trick however, in the olden days you could do the same thing but the steering column would remain locked. Skinny 12 year olds in the UK had enough strength to snap the lock by grabbing the wheel and quickly pulling it in either direction, once you broke the lock you were good to go! We called them twocs (taken without owners consent) the whole adventure was known as joy riding.. The Kia boys were a couple of American youths doing something similar and uploading videos of it on tik tok. A reporter asked them, don’t you feel bad for people who’s cars you are stealing? The kid replied nah, they got insurance. The reporter- what if they don’t have insurance? The kid straight faced and serious- that’s illegal so they shouldn’t be doing that. Sure the video of that interview is out there somewhere. Hilarious. Also unlucky if your car got stolen. Don’t blame the kids they just bored and need guidance.

gwill 4y ago

I could see an argument that the "viral challenge" is forcing them to change it. The manufacturers were aware of the problem, and doing the absolute minimum to address it. They were giving out steering wheel locks and offering to do a software fix for anywhere between $170 and $500. The issue spread through the "tiktok challenge" and that's forced them to make a move toward helping customers.

deleted 4y ago
[deleted]
TaylorAlexander 4y ago
I guess it’s more like “companies forced to fix known flaw pointed out in viral TikTok trend” or something.
- hdjjhhvvhga 4y ago
  That's spot on. But the question for The Verge is, would you click on that headline?
  - xoa 4y ago
    I mean, yeah? That's actually still an interesting phenomenon that combines multiple hot button/trending things. I think in this case a more accurate headline is actually still plenty clickable. They simply didn't do a great job on the wording this time. It happens.
  - b112 4y ago
    Or is it a paid story, with tiktok struggling to stay in the US, and this is a "tiktok good for all" story?
  - TaylorAlexander 4y ago
    Trick question, I would not click on a link to The Verge.
    - 4y ago

deleted 4y ago

[deleted]

kube-system 4y ago

The proliferation of knowledge about how easy it was to do this, and the resulting subcultural trend, is the reason they are being forced to change it. Otherwise, people would be stealing them at the same rates they were before the recent trend.

johncessna 4y ago

> "The thefts are reportedly easy to pull off because many 2015-2019 Hyundai and Kia vehicles lack electronic immobilizers that prevent thieves from simply breaking in and bypassing the ignition. The feature is standard equipment on nearly all vehicles from the same period made by other manufacturers." It's more than that. It's a combination of a lack of electronic immobilizer and putting the mechanical component behind a piece of plastic. If they really want to save pennies on the immobilizer, they can move the mechanical piece further down the steering column

nimbius 4y ago

if this is what it took to get two large multinational automakers to capitulate to basic theft immobilization in their vehicles to protect customers, perhaps we should reconsider the 'tiktok is objective evil' narrative.

jimt1234 4y ago
Totally agree. Sounds like they're just using an established, more generic narrative to deflect accountability - basically, "It's not our fault, it's the hackers and bad kids on the internet." We see this all the time for security incidents: "Hackers steal data from BigCorp", when the headline should read more like, "BigCorp released a faulty product, and now you're suffering."
autoexec 4y ago
> perhaps we should reconsider the 'tiktok is objective evil' narrative. I don't think the fact that tiktok was educating car thieves on ideal targets leading to an increase in stolen vehicles is a great example of tiktok's benevolence or enough to excuse it for the other harms it enables. That said, nothing is pure evil all the time. Tiktok is just a popular means of communication and sometimes the message being communicated will be good and sometimes it will be bad. There's no criticism of tiktok's content that doesn't apply just as much to youtube or any other social media platform. However, tiktok still has their own privacy/security issues, the concerns over what and who gets promoted or suppressed by tiktok's algorithms/moderators, and of course that whole supporting china/genocide/the oppression of hong kong thing all of which makes me doubt the "tiktok is evil" narrative is going to go away just because a couple car companies caved to some bad press.

rootusrootus 4y ago

> The feature is standard equipment on nearly all vehicles from the same period made by other manufacturers. Even worse, that feature has been pretty common on mainstream vehicles since the 90s.

kube-system 4y ago
Which makes it an excellent opportunity to undercut competitors by a hundred bucks.
- owenmarshall 4y ago
  I wonder how systemic these kinds of shortcuts are in the wider market, not just automotive. How many problems that were solved in expensive ways decades ago are lurking beneath the surface, waiting to be discovered again because the problem - and solution! - are effectively invisible to most consumers?
  - kube-system 4y ago
    Pretty much everything. The practice of engineering is as much an exercise in knowing what problems to solve as it is a practice in knowing which problems you can get away with not solving.
rodgerd 4y ago
It's interesting to me that there's a similar problem in New Zealand with NZ-new and second-hand imports of the same model cars: the Toyota Prius C and Toyota Aqua are the same vehicle, but Aquas that were imported second-hand from Japan don't typically have immobilisers, and are heavily targeted for theft. Given that ex-Japan models of cars are typically higher-spec than NZ-new equivalents, it's seems an odd difference; I have to wonder if there are differences in car theft rates in Japan or South Korea that play into the difference in what is a pretty basic piece of equipment in Western markets.
- ggreer 4y ago

throw1230 4y ago

Additionally, this only happens for cars built for the U.S. The other countries have electronic immobilizer requirements, so they have them.

shortcake27 4y ago
Ah that makes sense. I briefly combed the article and was confused because I had a factory immobiliser in my base model 97 Lantra.
katbyte 4y ago
was curious, all new cars in canada required them after 2007! https://www.cbc.ca/news/canada/anti-theft-device-now-mandatory-in-canadian-made-vehicles-1.677141 https://www.cbc.ca/news/canada/anti-theft-device-now-mandato... but now we're seeing a rash of thefts of keyless fob vehicles with a relay attack making me glad my tacoma needs a key
- rtpg 4y ago
  I thought keyless fobs all had some sort of counter to prevent replay attacks
  - pseudo0 4y ago
    Relay, not replay attack. For vehicles that unlock and push to start based on the proximity of the key, basically all you need to do is use a pair of software defined radios to trick the car into thinking that the key is there. Hence a relay attack, where one attacker is located near the key and the other is located near the vehicle, and the two attackers pass the components of the challenge/response to the vehicle via the channel between the two attackers.
    - rtpg 4y ago
      Ah, that makes sense. Thanks for the detailed explanation
    - 4y ago

outworlder 4y ago

This is funny because we have a Hyundai Elantra 2010 and that one has an immobilizer. You can't turn it on without the encoded key. I guess that at some point Hyundai and Kia decided to save some money?

agilob 4y ago
>I guess that at some point Hyundai and Kia decided to save some money? If this can be fixed with a software update, that's not saving money. That's making money by making you pay extra for the immobilizer.

mcguire 4y ago

Back in the '80s and '90s, many computer vendors like Sun and IBM shipped their systems with radically broken security configs, not to mention holes in their software. Often, the only way to get them to fix their problems was to make their problems very public. Hence, BUGTRAQ. https://bugtraq.securityfocus.com/archive https://bugtraq.securityfocus.com/archive

eof 4y ago

I just bought a 23 Kia Telluride (was also looking at palisades) to upgrade my 05 outback; I did extensive research, and ended up zoning in on Hyundai-Kia specifically because their electronics are so 'hackable,' while still containing all the cutting edge sensors. I think it is going to be a tiny sliver of cars that are allowed to get away with having a vehicle be able to be controlled like a remote control from a completely unencrypted, trivially intercepted-and-changed protocol. In the future I suspect if manufacturers want to put these features on cars, they will have to protect the communication between the different systems.

theGnuMe 4y ago
How do you like it? And why did you pick the Telluride over the Palisade?
- eof 4y ago
  It's of course a huge improvement. It was close and I'd probably have been happy with either but ultimately the telluride had features i cared about (better towing) and palisade had some i didn't (electified third row seats); and I like the look of the telluride better. I live in a rural area and got the trim with the 'offroadish' appeal; which didn't really exist in palisade.

at-fates-hands 4y ago

Someone is clearly taking advantage of this: More than 3,000 cars have been reported stolen in Minneapolis this year, including 432 Kias and 368 Hyundais. Officers are warning people to do what they can to protect their vehicles because this year, an average of 13 cars are stolen each day. Prior to this spring, Hondas, Toyotas, Chevys, and Fords were the most common cars stolen in Minneapolis. But as word spread on social media this year about how easy Kias and Hyundais are to steal, they now account for more car thefts. https://www.fox9.com/news/data-kias-and-hyundais-now-most-stolen-cars-in-minneapolis https://www.fox9.com/news/data-kias-and-hyundais-now-most-st...

supercanuck 4y ago

>This is like saying that movies in the 1980s sparked a rash of car thefts because they showed people hotwiring cars all the time. Probably did, but the scale of the problem is much larger considering TikTok's reach.