28 ms·

Insecure vehicles should be banned, not security tools like the Flipper Zero

• jnsaff2 3y ago
  An overpriced script-kiddie tool developed by russians launches a marketing campaign as a small market hands them the gift of making them seem like a relevant tool for criminals by banning it. Did I miss anything?
  • dang 3y ago
    You may have missed the HN guidelines which ask you not to be snarky, not to cross-examine, and not to post in the flamewar style. Could you please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and take the intended spirit of this site more to heart? We'd appreciate it.
• nightowl_games 3y ago
  Personally I think FOBs for cars are simply not worth it. The key with the remote for starting, locking and unlocking is ideal. Ford's with the on door key pad is pretty good too imo. Probably hackable tho. Down with fobs!
• h2odragon 3y ago
  Or, enforce existing laws against theft ... "Ban insecure vehicles" is chasing the technology of locks; there's always another circumvention.
  • ceejayoz 3y ago
    Companies that put out egregiously vulnerable vehicles should be held liable, though.
    • miohtama 3y ago
      Justice is being served https://www.hbsslaw.com/press/hyundai-kia-car-theft-defect/court-preliminarily-approves-revised-hyundai-kia-theft-settlement-valued-at-more-than-200-million https://www.hbsslaw.com/press/hyundai-kia-car-theft-defect/c...
    • deleted 3y ago
      [deleted]
    • tromp 3y ago
      Insurance companies should reflect unlock vulnerability of a car model in its premiums. That still leaves the problem that few people look at insurance premium when choosing what car to buy. What would help is a widely used certification system kept up-to-date by certification authorities in cooperation with insurance companies, similarly to what we have in place for a car model's fuel consumption.
      • elif 3y ago
        Crashes are such an outsized component of insurance coverage compared to theft that this would not be a substantial motivation for manufacturers.
        • shagie 3y ago
          From this month a year ago - State Farm declares 105 Kia, Hyundai models ‘ineligible’ for new insurance in Louisiana - https://www.nola.com/news/crime_police/kia-hyundai-models-ineligible-insurance-louisiana-state-farm-list/article_55fae098-a30d-11ed-afaa-5faa28983298.html https://www.nola.com/news/crime_police/kia-hyundai-models-in... ( https://news.ycombinator.com/item?id=34642224 https://news.ycombinator.com/item?id=34642224 40 points | Feb 3, 2023 | 90 comments ) Which then - Dealers still sell Hyundais and Kias vulnerable to theft, but insurance is hard to get https://www.npr.org/2023/05/04/1173048646/hyundai-kia-car-theft-tiktok-insurance-dealerships https://www.npr.org/2023/05/04/1173048646/hyundai-kia-car-th... And in October - Wheels Of Steal: Some Kias, Hyundais Easy To Hotwire; Owners Sue Carmakers, Get $200 Million https://www.forbes.com/advisor/car-insurance/kia-hyundai-antitheft-settlement/ https://www.forbes.com/advisor/car-insurance/kia-hyundai-ant... The Challenges of Insuring a Kia or Hyundai in 2024 - https://www.marketwatch.com/guides/insurance-services/insuring-your-kia-or-hyundai/ https://www.marketwatch.com/guides/insurance-services/insuri... --- I suspect that this has lead to Kia and Hyundai taking note of insurance rates and changing things.
      • drdaeman 3y ago
        This penalizes unaware pre-existing car owners. Not only they got a crappy car, they now have to pay more for it - all because the vendor was sloppy. Doesn’t seem fair to me. The responsible party should be the automaker that built or installed the security system, not the person who was sold a lie.
    • lupusreal 3y ago
      We'll end up banning windows at this rate, they're an egregious vulnerability in cars and buildings alike. American cities, soft on crime, can't stop thieves from breaking windows so maybe they'll go after car manufacturers and construction firms instead. Going after companies instead of criminals is more aligned with their left-wing sensibilities, I think that's what this is really about.
      • ceejayoz 3y ago
        That's not what egregious means.
        • fargle 3y ago
          yeah it kinda is
          • ceejayoz 3y ago
            No. Windows balance a variety of competing needs - security, ventilation, egress during emergencies, mental health, lighting, etc. It would be, perhaps, egregiously negligent for a maximum security prison architect to install large plate glass windows in their cells, but having windows isn't automatically egregious. A car without windows (or with unbreakable ones) is a deathtrap in an accident; omitting them would be egregiously dangerous. The same isn't true for, say, Kia/Hyundai's decision not to include immobilizers: https://www.ctvnews.ca/autos/kia-and-hyundai-vehicles-in-canada-not-affected-by-u-s-theft-issue-automakers-say-1.6252590 https://www.ctvnews.ca/autos/kia-and-hyundai-vehicles-in-can... > CNN reported that only 26 per cent of Hyundai and Kia models from 2015 to 2019 were equipped with electronic immobilizers in the U.S., compared with 96 per cent of all other vehicles in those years, making the Hyundai and Kia models roughly twice as likely to be stolen. Those stats make it pretty clear that immobilization was already the industry standard. Skipping them was like knowingly writing open SQL injection holes in a web application.
            • lupusreal 3y ago
              Egregious is subjective. You think it's egregious for cars to have locks which can be circumvented by thieves. Maybe I think it's egregious that construction firms don't install iron bars on all ground floor windows.
    • PeterisP 3y ago
      In a bunch of scenarios (mining, military, boats, planes) the vehicles explicitly don't have locks or ignition keys, you press a button and it starts up, you're good to go - should the manufacturer be liable if one gets stolen?
      • rascul 3y ago
        US military vehicles might have a cable that locks to the steering wheel. So if you try to drive it, you can't steer well. But if not setup properly, it can be steered just fine.
        • ceejayoz 3y ago
          US military vehicles are protected by the "people with guns who will shoot you" industry standard.
          • adolph 3y ago
            > US military vehicles are protected by the "people with guns who will shoot you" industry standard. Unless you are an MP, that stuff stays in the armory cage. And if you are headed to the range, ammunition is delivered separately to the range and systems are stringently checked for ammo before returning, afterwards they will do a lockdown inspection of the barracks and everyone's personal vehicles.
      • ceejayoz 3y ago
        No; each of those scenarios involves external access controls that are standard for those industries. (Fences, guards, controlled access.) It's nothing like the Kia/Hyundai scenario, where such vulnerabilities stemmed from not doing the industry standard thing (immobilizers).
        • Ekaros 3y ago
          Isn't police the external control? It is just that governments have failed to provide enough of these controls... So maybe they should be punished collectively for it?
    • Ekaros 3y ago
      As long as they are regulatory compliant, there should absolutely not be any liability. If regulations are not updated fast enough maybe people responsible for that should be removed from office or punished.
      • ceejayoz 3y ago
        > As long as they are regulatory compliant, there should absolutely not be any liability. No; willfull negligence is something that should engender liability.
    • deleted 3y ago
      [deleted]
  • acdha 3y ago
    This is true in absolute terms but over simplified because it glosses over the differences in scale. We require cars to have seatbelts because even though people still die in crashes, it’s a statistically certainty that many fewer die when seatbelts are used. Setting minimum standards is a critical function of governments in maintaining healthy markets because it prevents cheating from being cost effective. If you make a safety feature optional, you will have some fraction of people say that they don’t need it and then cost society money when it turns out they were wrong. In the case of poor locks, even if much of the cost is paid by the owners’ insurance there’s still a lot of expense from the extra police and court costs, and stolen cars are often used to support other crimes.
    • thfuran 3y ago
      >even if much of the cost is paid by the owners’ insurance Insurers aren't usually charities. Those costs are still borne by the insured.
      • acdha 3y ago
        Yes. That’s why I listed it first as a separate category – it’s easy to see a stolen car as a loss of, say, $20-30k for the private insurance company and owner but there’s also going to be a cost for the time the police spend investigating, the city might spend disposing of a wrecked vehicle, the courts spend processing a car thief, etc. and potentially other significant costs if, say, a Kia challenge teenager hits another person or the vehicle is used to rob a house or business. While we can’t prevent it in absolute terms, there is still a significant social benefit to reducing car theft rates.
    • chankstein38 3y ago
      Thank you. Reading through these comments I was surprised at how illogical so many of these comments are. People talking about towing cars or picking locks acting as if it's not obvious what the distinction is here. Yeah people, nothing can have perfect security. That's a given anyway. I think the point is that if you can steal it with a $250 device SDR device, the car's level of security is the issue not the device and that should be acknowledged by their government before they ban something that will do nothing except put these things in the hands of only the bigger crime groups. These things likely wouldn't be hard to manufacture by hand if these criminals wanted to get a hold of them.
  • markhahn 3y ago
    since there's "always another circumvention" we shouldn't even bother right? the "there are always bugs" refrain is horribly corrosive - it doesn't absolve the victim in any sense.
    • chatmasta 3y ago
      I think the point is not that we don't regulate locks, but that we don't ban lockpicks.
  • Chris2048 3y ago
    You can always smash the window, but that can draw negative attention.
• badRNG 3y ago
  It seems like the most straightforward path here is to ban auto thefts all together.
  • networkchad 3y ago
    [dead]
  • LoganDark 3y ago
    Yeah! If we make it illegal, then people will stop breaking the laws. That is how it works, right?
    • lupusreal 3y ago
      Maybe we could try enforcing those laws with no mercy given to the "wayward teens who don't know any better" (they do.)
      • ceejayoz 3y ago
        We tried that sort of approach; it's pretty widely considered a mistake. https://en.wikipedia.org/wiki/Violent_Crime_Control_and_Law_Enforcement_Act https://en.wikipedia.org/wiki/Violent_Crime_Control_and_Law_...
        • whimsicalism 3y ago
          I agree that 7 years ago it was widely considered a mistake, but I think we are currently reaching by a new consensus based on the opinions I have been seeing more commonly in the last 3 years. We are in a conservative moment in the US right now.
          • jen20 3y ago
            This story is about Canada, though…
            • 3y ago
• kludgemaker 3y ago
  Insecure people should be banned, not security tools like firearms.
  • abfan1127 3y ago
    I know this is tongue in cheek, but the proper phrase should be "insecure people should be held responsible for their insecure decisions, not security tools like Flipper or firearms."
• sidewndr46 3y ago
  This has to be one of the dumbest things I've read in a while. All vehicles are insecure. I can hook a tow truck to almost any vehicle, including an 80,000 lbs tractor trailer and drive off with it. That'd actually attract less attention that outright hotwiring a vehicle. The solution is to identify, arrest, and prosecute criminals. Which the government is not obligated to do in the US.
  • deleted 3y ago
    [deleted]
  • officeplant 3y ago
    This is about Canada, but rant away.
  • merpnderp 3y ago
    We already identify, arrest, and prosecute criminals, we just don't hand out custodial sentences. Being in jail/prison sucks and is a good incentive to not steal cars. Plus it is impossible to steal cars while locked up.
    • nemo44x 3y ago
      > We already identify, arrest, and prosecute criminals... We've given up on that part in many instances.
  • eli 3y ago
    These cars are being sold with defective security measures. They don't work the way manufactures promise or customers expect. It shouldn't be any different than a car sold with headlights that are too dim
    • sidewndr46 3y ago
      But that is my point. All security measures are defective. I can always tie a chain to your vehicle and leave with it. Security measures deter criminals, they can never stop them. Only the government can do that. The government is not obliged to do that in the US. Thus, no one can stop criminals To metaphorically put it: no matter how good your 2FA is, I can always get around it if I can torture you or threaten your loved ones.
• Forge36 3y ago
  Someone once stole my grandfather's car with a screwdriver. The ignition switch was broken off (probably with a hammer), and the starter could be actuated with the screwdriver. I don't remember how long he drove it that way. Banning the tech is a bandaid to deeper problems. It's also great advertising that these tools are effective.
• gchamonlive 3y ago
  Security flaws are not born equal. I think there is supposed to be a clear distinction between flaws inherent in technology -- since you only know what you know nobody should be expected to develop impenetrable digital fortresses since that doesn't exist and would actually be harmful for the consumer -- and those flaws born out of neglect. The latter should be specified and treated accordingly, because it isn't a valid excuse that technology can't be 100% secure that the industry should accept poor standards. Also, Flipper Zero can be made DIY, so I don't know if I get it, but the law will be DOA, and actually work against the democatization and awareness of such flaws by the public.
  • hcfman 3y ago
    Europe expects you to. Otherwise you will be fined 15,000,000 euros. Thank you cyber resilience act.
  • whiterknight 3y ago
    Guns can be made DIY, but laws still mitigate.
    • gchamonlive 3y ago
      There is a big difference in putting together deadly artifacts and electronic devices you can fabricate using off-the-shelf chips and open protocols. Not saying you can't discuss regulating them, but to me they are in a different set of categories. Weapons are by default dangerous, their sole purpose being to cause physical harm, while a flipper zero can be used for instructional purposes and research. As much as I hate the concept, it would be ridiculous for me to propose regulating Alexa because a kid can cause financial harm to the parents using it, but a weapon can't be in any imaginable circumstance reachable by anyone untrained.
      • engineer_22 3y ago
        > but a weapon can't be in any imaginable circumstance reachable by anyone untrained. I agree with your main point that the FZ is easily reproduced. I think you miss the mark with this one. Firearms are easily made at home with simple tools and off-the-shelf materials. For example, the United States has a rich tradition of home-made firearms. To provide a concrete example, a shotgun can be made with a length of steel plumbing pipe, electrical tape, a nail, and a cap. Yes, it's that simple.
• hoofhearted 3y ago
  Sooo they have been stealing Infiniti's from my area recently with relative ease allegedly by using a Bluetooth obd2 reader connected to an android tablet running a pirated copy of some Nissan service tech software. Nobody from any of the Infiniti groups is 100% certain how they are doing it, but the best theory out there is above. Just the other night, a crew of dudes stole 3 Q50’s from my neighborhood with relative ease. Here is the ring cam video my neighbor posted: https://video.nest.com/clip/8ef4d060588d4c7289f87cccb00cb55a.mp4 https://video.nest.com/clip/8ef4d060588d4c7289f87cccb00cb55a...
  • bpoyner 3y ago
    The answer is simple, we need to ban android tablets. /s
    • hoofhearted 3y ago
      Fix the cars. A brand new $60,000 car shouldn’t be so simple to swipe. They probably spent less time stealing my neighbors car than he did waiting on the credit check to buy the car lol… it’s crazy these days with cars.
      • newsclues 3y ago
        Cars are computers now. What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. No level of technology will stop this. But cutting off the profit motive by making it very hard to export cars will have a massive impact on these crimes, and for old and new cars.
        • caskstrength 3y ago
          > What do we know about computer security and physical access? If I can touch the machine, I can hack and own it. Can you hack and own my fully patched Pixel phone? Or my GF's iPhone? Sure, sophisticated state-sponsored actors can sometimes do it by burning several million dollars worth of 0days in the process, but some two-digit IQ riff-raffs? Probably not so much. EDIT: just to be clear - by "two-digit IQ riff-raff" I meant OP's neighborhood car thieves, not you :)
• markhahn 3y ago
  always first blame the flawed security. sure, also blame attackers. never blame the attacker's tools. this is a place where "victim-blaming" is exactly the right thing to do. we can be supportive, even empathetic, of victims, who may have attempted to be secure, but failed due to bad tools, third parties, etc.
• wongarsu 3y ago
  Why even ban them? In this context "insecure" seems to mean "vulnerable to theft". If somebody wants to buy something that's easy to steal, that's their issue. If people inadvertently buy easy to steal vehicles that's an issue, and maybe there should be labeling, or or a testing initiative, or maybe it's just a temporary blip that will work itself out as independent parties pick up testing. If it's known which vehicles are prone to theft the market should work everything else out. Insurance can price it in, and buyers can factor it in to their purchasing decisions.
• jacknews 3y ago
  Indeed, the flipper-zero ban is obviously ridiculous, especially in light of the complete lack of even a hope of a ban on certain other tools that are often used for much more serious crimes; personal crimes rather than property crimes.
• stainablesteel 3y ago
  how are major car manufacturers so far behind in security? and why can't they go back to the old solutions that didn't have these problems? its just such a stupid thing to watch IF these fancy keys that let you start your car without inserting anything cause your car to become extremely vulnerable THEN maybe its a bad idea, jesus christ
  • InitialLastName 3y ago
    Because whenever it's even vaguely cold outside, my neighbor likes to be able to start and idle her giant truck in her driveway without leaving her house (for 40 minutes before she drives a mile to work).
    • evandale 3y ago
      Car ownership is way too cheap and accessible in North America for the amount of damage they cause.
      • MeImCounting 3y ago
        This. Owning cars should be something that corporations and the rich and hobbyists do. If you dont want your car broken into maybe dont leave it lying around unattended in public?
        • InitialLastName 3y ago
          I wouldn't go that far, but we should certainly stop subsidizing them so heavily that we forget there are any other options, or that humans were capable of happy, prosperous lives for millennia before they existed.
          • MeImCounting 3y ago
            Yeah maybe I shouldnt put both those statements together when really I think they are seperate opinions. I dont think society should be so car heavy. I also dont think its realistic for people to leave something lying around in public and expect it not to get broken into or stolen. Would you leave a backpack lying around on the public street in a big city and expect it to not get stolen/broken into?
• gadders 3y ago
  Try insuring a Range Rover in the UK: https://www.independent.co.uk/news/uk/home-news/range-rover-insure-london-premiums-soar-b2437075.html https://www.independent.co.uk/news/uk/home-news/range-rover-...
• newsclues 3y ago
  Canada needs to reinstate the national port police, and actually do their job in policing. Policy changes for cars or technology will not solve the lawlessness in Canada.
  • whimsicalism 3y ago
    Agreed. I am not sure why Canada has had so much comparative trouble with organized crime
    • RegnisGnaw 3y ago
      The port in question is in Montreal which is in the province of Quebec. The province of Quebec is a political minefield with special status that most politicians don't want to deal with.
      • whimsicalism 3y ago
        This is a problem throughout Canada. BC also has a serious problem.
        • RegnisGnaw 3y ago
          B.C. is no where as special as Quebec. The province of B.C. has never held a referendum to split. It does not have a special language police. Nor does it call itself a country :)
          • whimsicalism 3y ago
            I’m talking about the organized crime problem, not the thing you brought up. BC has a problem with organized crime in its ports.
            • RegnisGnaw 3y ago
              Ahh okay, yeah. Its easier for the federal government to deal with in B.C. (ports are federal jurisdiction in Canada) without the political sensitivity problem.
• whimsicalism 3y ago
  Honestly, think a major problem with this is that Canada has not managed to resolve their organized crime issues. I don’t know why the US federal apparatus has been so much more effective at disrupting organized crime, but Canadian groups fencing a lot of these stolen cars.
  • RegnisGnaw 3y ago
    The port in question is in Montreal which is in the province of Quebec. The province of Quebec is a political minefield with special status that most politicians don't want to deal with.
• MR4D 3y ago
  Politicians are always going to do what’s easy, not what’s hard.
• 1970-01-01 3y ago
  Security via obscurity is your friend when it comes to vehicle security. There are dozens and dozens of no-start conditions for a vehicle. Just pick two and deal with the minor inconvenience.
  • applied_heat 3y ago
    Indeed, hidden switch on a circuit somewhere and away you don’t go!
• tylerchilds 3y ago
  At this point, banning security tools a violation of the second amendment. Microsoft suffers breach after breach after acquisition after acquisition. I verbally note them to my wife to remember, "This is not normal." and even she said, "Why do the numbers keep getting worse and worse." and I told her, "The database keeps getting larger and larger ever since they were only slapped on the wrist for not letting me boot straight to firefox since childhood." If you took away my ability to understand why the world around me is failing, we'd fall into further disrepair than we already are and we're not really allowed to repair anything, now are we?
  • RegnisGnaw 3y ago
    Again this is not the US. This involves Canada, there is no second amendment.
  • sokoloff 3y ago
    I'm struggling to connect how the banning of security tools would be a violation of the (US) second amendment. A violation of the first, fourth, and ninth? I can see that. A propensity to violate the fifth? I can see that. But I can't see a strong connection to the second.
    • lithos 3y ago
      There was a point in the US where encryption was barred from export based on arms export laws. Lots a pretty famous open source stories from such. So it's not far fetched at all for the most part. Though this is in US law, not Canada as related to the news story.
      • hn_acker 3y ago
        > There was a point in the US where encryption was barred from export based on arms export laws. Are there any US court cases that suggested treating encryption as something covered by the Second Amendment? It would be more strange than putting malware under the Second Amendment. I can appreciate the gotcha of "if the US government defines encryption as arms then the second amendment applies" to disincentivize such a definition, but the government could simply call encryption something other than "arms" and thus avoid the Second Amendment. I think the general consensus in the US is that encryption falls firmly under the First Amendment. It's not as if the First and Second Amendments are necessarily mutually exclusive with respect to any given tool, but I think case law is such that the Second Amendment doesn't apply to encryption.
• keiferski 3y ago
  Philosophy warning: I don't know if there is a term for it, or if a philosopher/etc. has written about this phenomenon, but: a noticeable trend to me is what I'll call "the replacement of ethical expectations with specific, written down laws." Rather than expecting a human being to behave in certain ways intrinsically (i.e., normative ethics) we tend to assume they will behave in the worst way possible, and then pass laws to supposedly prevent that behavior from manifesting. This scenario is a great example of this phenomenon. Instead of discussing how car theft is fundamentally an unethical behavior, the discussion is about preventing some thing from being sold or existing, whether that be insecure vehicles or Flipper Zeroes. It's designing the playground so that kids can't get hurt, not teaching them how to play responsibly. My theory is that this is a consequence of relativism and the general cultural exhaustion Western society seems to have with enforcing any sort of religious or ethical norms. I really don't like the way this is going, because the end result is a world where limitations are hardwired into the environment, while at the same time you have zero ethical expectations of your fellow humans. It's very Hunger Games / Battle Royale, at a less hostile level. Edit: just to clarify a point here. I'm not saying that there was no theft in the past, or that having ethical expectations instead of laws will somehow reduce all theft. I'm commenting more on the fact that the "new method" results in a different kind of world than the previous one (see the paragraph before this one.) It's a subtle point, but hopefully one I communicated well enough.
  • sokoloff 3y ago
    What would "enforcing any sort of religious or ethical norms" look like in a society that used those methods to effectively prevent the exploitation of vehicle owners by car thieves?
    • keiferski 3y ago
      The obvious answer would be to harshly punish theft via jail time/etc., but that's sort of not my point, and I don't think that's actually the root issue. Because it's more that stealing cars is apparently an acceptable activity for a lot of people to do. By acceptable, I mean socially, to friends, to family members, to themselves. That seems like a major societal failing to me, much moreso than "this car isn't designed with the optimal security system."
• karaterobot 3y ago
  I agree that Flipper shouldn't be banned in Canada, but I think the headline won't help them make their case. For many reasons, it's easier for people to support banning a device they don't personally care about than it is to call for millions of cars on the road to be made illegal, or for instituting new regulations on an industry with entrenched lobbyists. If the option you are presenting is to ban the Flipper (easy, painless) or turn the auto industry on its head (hard, painful) guess what they're going to do? The option you want to present is between going through a lot of work to ban a device that is ultimately harmless, and not doing any extra work and letting it go.
  • alfnor 3y ago
    You mean like how fentanyl is a banned substance so nobody sell- oh wait...
• greesil 3y ago
  This could be solved easily by insurance companies
• iwontberude 3y ago
  Or maybe we don’t ban anything?
• uconnectlol 3y ago
  correct, someone says something right for once. also vehicle theft will happen no matter what since they have physical access to your vehicle. scammy, scummy, corporate pitches like "you just press this button and it opens for you" with zero research on how to implement that securely (even thought it was known in the 70s), which just make the hacker be able to press a button and open it, are not anyone's problem aside from the clout chasing consumer "who doesn't have time" to research any "sophisticated tech" he buys, and the corporation. consumers should know by now that "smart tech" = a teenager can hack it.
• bitslayer 3y ago
  In Richard Feynman's book, "Surely You're Joking Mr. Feynman!" he tells the story of his exploits in safe cracking. And the eventual "solution" that the bosses come up with... not to make their safes safer, but to ban Feynman.
• moose44 3y ago
  Is this not the same argument with gun control?
  • alfnor 3y ago
    And same counter-argument: those who are more likely to abuse tools are less likely to care about the legal status of said tool (they will illegally import or DIY the tools).
• superkuh 3y ago
  Stop computerizing vehicles. Computerized vehicles are so bad in so many ways.
• nicklo 3y ago
  This is not a tenable position. Most cars are older than these devices- and even big tech co's like Apple were late to patch flipper vulnerabilities. I was on a plane last month and someone was flipper-jamming DOS-ing via continual bluetooth connection requests and completely bricked all iOS devices in range for the 4 hour flight. These sort of devices are nuisances with very low positive utility, and there is plenty of precedence for banning them.
• macromagnon 3y ago
  There's a conflict of interest on the part of car manufacturers, if insurance just pays out and they get to do another sale, they're happy that your car got stolen. Also, I agree with the main point of the article, but it shouldn't be so easy for any 16yo Tom, Dick or Harry to buy a gadget and start stealing cars. If it's so easy to make with off the shelf parts, then let the 'security experts' create their own. Consumers need to be educated about keeping their keys away from doors/in a faraday cage.
  • rjmunro 3y ago
    If insurance pays out often enough that this might actually work as a sales tactic, they don't get another sale, everyone goes to another manufacturer because insurance is so expensive. Also most car dealers make more profit from ongoing maintenance and servicing than selling you a new car.
• kube-system 3y ago
  Banning either is silly. Locks on things in the physical world can only be a deterrent because physical objects are subject to much easier brute force attacks than a problem in the digital world is. If you forced automakers to make their digital keys more secure, it wouldn't improve security, because you could still winch the whole car on to a rental trailer in 30 seconds. The Kia Boys notwithstanding, basically all cars that are stolen these days are either stolen with the keys, or towed.
  • fragmede 3y ago
    Replay and CANbus attacks are easy enough that I don't think that's the case. https://m.youtube.com/watch?v=vIrqKRIUCiE https://m.youtube.com/watch?v=vIrqKRIUCiE https://m.youtube.com/watch?v=E3lkT9Fa1lA https://m.youtube.com/watch?v=E3lkT9Fa1lA
    • kube-system 3y ago
      Those are way harder than this: https://www.youtube.com/watch?v=Hgs3LCp1F3I https://www.youtube.com/watch?v=Hgs3LCp1F3I And in major metro areas of the US, crime rings targeting newer cars for export, have just started using tow trucks.
• ryukoposting 3y ago
  Banning Flipper in an effort to prevent car theft is like banning blank keys in an effort to prevent burglaries.
  • deleted 3y ago
    [deleted]
• tinted_knight 3y ago
  Yeah, let 99% of honest people suffer to prevent the potential risk from the actions of 1%. Why bother with educating and raising people, why rethink the work of the police and the state. Let's just ban.
• davej 3y ago
  Ultra Wideband (UWB) is the solution for keyless entry and regulators should make it a requirement that new cars use it if they want to support keyless entry. Tesla just rolled out an OTA update to support UWB. It uses Time-of-Flight (ToF) Measurement to calculate distance which is much more secure than simply using signal strength.
• hanniabu 3y ago
  Why don't cars have security ratings just like they have safety ratings? Surely publicizing failing scores across the board would encourage them thi improve so they can advertise as being better than the rest.
• deleted 3y ago
  [deleted]
• smalu 3y ago
  It is funny since there are devices other than Flipper Zero which are designed specifically for stealing cars with key-less systems AKA "SOS opening" and they come in GameBoy-like enclose. Keywords - "SOS Autokeys Bulgaria".
• deleted 3y ago
  [deleted]
• 14 3y ago
  Here is my favorite YouTube lawyer Ian Runkle a Canadian firearms and criminal defence lawyer discussing the flipper zero. This guy is very enjoyable to watch in all his videos highly recommended. https://m.youtube.com/watch?v=djqKqr-qh8c https://m.youtube.com/watch?v=djqKqr-qh8c
• tonymet 3y ago
  If you arrest and convict car thieves you may be accused of discrimination. If you ban FlipperZero you can pretend to be addressing the problem with no such risk
• crorella 3y ago
  If anything they should promote the commercialization of these type of devices so the cars and other tech products get safer. They are just trying to hide the real issue.
• glitchc 3y ago
  I've always disliked keyfobs. They felt like an insecure replacement for keys, especially after so much effort went into tumblers and other security measures designed to prevent hot-wiring. It's extremely difficult if not impossible to hot-wire a modern car. And yet we throw all of that innovation away for what, convenience?
• flanbiscuit 3y ago
  My car has keyless entry but does not have the push button to start. You still need to put in the physical key and turn the ignition. My car has been broken into but without damage. They rummaged through stuff and took some random things but we keep nothing of value in the car. I'm not sure how they broke in but I've seen videos[1] online on how a tow service can get your car door open using an air-wedge. Maybe they did that, maybe they used something that repeated the key fob signal, not sure. But I'm glad that my car still needs a physical key. I'm not looking forward to the day when I need to get a new car and all that is available is keyless start. I'd happily go back to needing a key for everything, even the doors. 1. https://www.youtube.com/watch?v=nEMzTDiXC6A https://www.youtube.com/watch?v=nEMzTDiXC6A
  • rootusrootus 3y ago
    There is very little distinction between your physical key and a pushbutton. When you turn the key, it's just pushing a button internally that does the same as a button you'd hit with your finger. Few cars these days have any kind of direct connection between the ignition key and the starter.
    • flanbiscuit 3y ago
      Maybe I'm misunderstanding how the push button works because I've never owned a car that had one, but I thought the whole thing was that the key fob just needs to be near the car in order for the button to actually do anything. And these car thieves are repeating signals from key fobs that are inside the owners' homes. At least with a physical key, it needs to be present and inserted into the ignition to start the car, you can't use any technology to help there. Of course there are other ways to steal a car, but it at least deters these modern techniques.
• cubefox 3y ago
  There is a real danger of "victim blaming" here. A similar thing occurred recently for the South Korean car makers Kia and Hyundai, which experienced soaring car thefts in the US due to relatively low car security standards and the high US crime rate. Some US American journalists, politicians [0] and judges [1] blamed the car makers for the steeply rising car thefts. However, these manufacturers come from a country where there are much fewer car thefts than in the US and where these cars didn't cause a comparable theft problem. The people blaming Kia and Hyundai would have been well-advised to identify at least as a major part of the problem the US-specific crime rate, not just the South Korean car manufacturers which weren't sufficiently adapted to to this crime. It's kind of similar to a young naive woman from South Korea doing her vacation in the US, and walking home at night, alone through a dark park in a shady neighborhood. A thing she could expect to safely do in South Korea. But in the US, the worst thing happens. Who is to blame? The women may bear some part of the responsibility by wrongly assuming the US is as safe as South Korea. But I think it's clear the main fault lies with the US criminals, not the victim. People easily get used to things like that and don't notice it. Until they travel to a country where very different things are normal, and get a culture shock. [0] https://www.cbsnews.com/amp/news/hyundai-kia-stolen-car-thefts-states/ https://www.cbsnews.com/amp/news/hyundai-kia-stolen-car-thef... [1] https://www.reuters.com/business/autos-transportation/hyundai-kia-must-face-insurers-lawsuits-over-vehicle-thefts-2023-11-16/ https://www.reuters.com/business/autos-transportation/hyunda...
• breakingrules 3y ago
  [dead]
• peter_d_sherman 3y ago
  Let's suppose that hypothetically the Flipper Zero could be banned... OK, so then what about the (Texas Instruments) TI CC1101 rf (Radio Frequency) Transceiver chip/IC that powers it? Is whoever is going to ban the Flipper Zero also going to ban the TI CC1101 rf transceiver chip? Because if they don't -- then many other clones of the Flipper Zero can and probably will exist in the future... OK, but let's take things a step further... Let's suppose that whoever is trying to ban the Flipper Zero -- is able to ban the Flipper Zero AND the TI CC1101 rf transceiver chip that powers it! OK. So what about all of the other rf transceiver chips that exist? Is whoever is going to ban the Flipper Zero -- going to also ban ALL other transciever rf chips? But let's take things a step further... Let's suppose that whoever wants to ban the Flipper Zero -- also is able to successfully ban ALL transciever rf chips! (Highly unlikely, since many are used in highly popular consumer products including but not limited to Routers, Smart TVs and Cell Phones!) But let's suppose they could pull that one off... OK, so now the next question is (to the party or parties that wish to ban the Flipper Zero!), if you can successfully ban all of the rf transciever chips, then can you ban all non-IC based radio circuits? You know, like analog electronic radio circuits, capacitors, coils, antennas, stuff like that? Can you ban all of it at the same time? ? But let's even go a step further... let's suppose whoever wants to ban the Flipper Zero -- bans it, and also successfully bans all rf transciever IC's, and all analog radio circuits, and all previously analog electronic parts for making a radio circuit... OK, so final question (to whomever would wish to ban the Flipper Zero!): Can you ban all of the electrons, which flow through wires, which could be used in creating radio circuits? To accomplish this, you'd need to ban all batteries, all power lines, and all generators! (Highly unlikely, because power in is various forms creates transactions which in turn create taxes which in turn fuel local, regional, state and country governments!) So -- good luck with all of that! I myself would never use a Flipper Zero for unlawful purposes (if I possesed one), and I would never drive a car which could be rf hacked by a Flipper Zero or other rf device on the other side of things. In other words, both sides of the argument are stupid. A person could probably kill someone else with a pillow, a roll of paper towels, or some other incredibly soft object, "never before did we think that it could be used as a murder weapon" item (George Carlin: "You could probably kill a guy with the Sunday New York times by beating him to death with it if you were so inclined")-- but we don't pass laws banning those items because of an isolated case of misuse! Heck, now that I think about it, someone could probably kill someone else with a single roll of the softest toilet paper -- if they really put their mind to it! But we don't pass laws banning ultra-soft Charmin(tm), now do we? ("A gang of 12 or 13 year old youths used it to murder their parents -- so it must be banned!" :-) ) ? Point is, there are some really stupid arguments being advanced here...
• jedberg 3y ago
  All cars are insecure but what the government should be doing is forcing auto makers to allow customers to install their own security add-ons. Car manufacturers are now locking down the OBDC ports because people were using them to add functionality to the car that they want you to pay for, like 3rd party adaptive cruise control. But this also prevents you from adding your own security. They also fail to encrypt security systems but block you from replacing them with encrypted versions. They claim they do it “for safety”, and while there is some merit to that, they are drawing the line way to far in the “we make money at the expense of your security and customizability” direction.
• happiness_idx 3y ago
  All I am reading is, big corporation should be held responsible but not maladjusted individuals whomst purchased a $50 hacking tool online. Seems like BOTH is the solution here.
• 2OEH8eoCRo0 3y ago
  Hypothetical: Should I be allowed to sell a magical device that unlocks any phone, car, safe, computer, etc?
• alsetmusic 3y ago
  I admired the Flipper Zero, but it's not something I have skills to exploit. Canada banning them ensured my order. It was in the mail on the day that I saw an article about the USA considering a ban. It's on my desk. I have no use for it. But I damn sure made sure I'd get one before I couldn't. What a lousy reason to buy something. It makes me feel shitty about the world.
• fragmede 3y ago
  Can you actually use a FlipperZero to steal a car though? There's aftermarket firmwares which unlocks additional capabilities, but as far as I'm aware, there hasn't been a break in car fob encryption that would actually let you use a FlipperZero to steal a car without having the key in the first place, at which point you could just use the key.
• myself248 3y ago
  If the environment can be presumed to contain at least one wolf, then building houses out of straw and sticks is considered negligent and lazy pigs deserve to get eaten. Responsible pigs who build from brick, sacrificing some profit in the name of security, are celebrated for their sound judgment and foresight. A fairy tale has been telling us this for at least 200 years and probably much longer, history is unclear on how far back it goes. It's amazing seeing this thread take the side of the negligent lazy pig. "But my thousand-dependency framework is mostly made of straw!", they say. "My boss won't give me time to even use sticks, much less brick!", they say. "It has to be this way!", they say.
  • smoldesu 3y ago
    It's not about lazy people versus diligent people, though. The companies are blaming the wolves, and arguing that they don't need to fix the issues since only the wolves threaten us (right now). That is a bad security model, and with or without Flipper Zero it will fail.
  • LeifCarrotson 3y ago
    The argument for the Flipper Zero is that it's an independent building inspector. People are being sold houses where the builder says they're made of brick, and if not for this product, the pigs might live in a house believing it's brick until a wolf blows it down and reveals a thin layer of stucco over straw. The home sellers are saying "but wolves and building inspectors alike can use this tool to blow down houses!" (porcine building inspector use rather crude inspection methods). But it would be irrelevant if the houses were made of brick and not straw.
• wkat4242 3y ago
  Obviously, this is the answer. Make the manufacturers simply recall their cars and fix this easy exploit. However it won't happen because politicians are in the pocket of big industry, and also banning a flipper zero makes them look good with almost no political capital expended (a quick win).
• sitzkrieg 3y ago
  i will lmao if it gets banned. there is no secret sauce to these devices
• _heimdall 3y ago
  We don't necessarily need yet another pile of laws and regulations here. If consumers want secure vehicles they should prioritize buying vehicles that don't offer internet icon necked features. Its crazy that most consumers prioritize convenience and novelty above all else then turn around and demand even more government authority to protect them from features that aren't needed in the first place. I 100% agree with the author's argument that banning security research is a bad idea, but no matter how much research is done we can never guarantee consumers that their vehicle can't be taken over. If you can unlock and start your car from your phone there is always a possibility of attack. Period.
• deleted 3y ago
  [deleted]
• kazinator 3y ago
  I don't agree with the logic of their argumentation. It reads a little bit like this: "Lock-picking tools are based on metal stick technology. If you ban possession of lock-picking tools, you will hamper the entire economy of tools based on metal sticks: everything from screwdrivers to knives to scissors. Instead, you should ban all entrance doors that are not of bank vault pedigree." (Which is not to say that I agree with criminalizing the activities of genuine security researchers, while giving a free pass to bad security. I'm only remarking on the form of argumentation in the article.)
  • Zak 3y ago
    I agree with their logic and would generally agree with its conclusion when applied to other technology, including lock picking tools. As an aside, criminals rarely use those; burglars are more likely to use a crowbar or hammer. Lock picking tools are not banned in most jurisdictions. In some cases, carrying them in public combined with some other evidence of intent to commit burglary could be a crime, but that's also true of a crowbar, hammer, rock, or anything else that could be used to gain entry.
• schaefer 3y ago
  I have a younger brother that recently bought a Kia as his first car. It's been broken into 3 times in less than a of ownership year. Kia sent him a cheep "Club style" steering wheel lock... -- From my perspective, getting stuck with this lemon will significantly compromise his quality of life and finances for years to come. Where are our consumer protections? Kia should be on the hook for fixing the problem or buying back the vehicle at cost.
  • hot_gril 3y ago
    Unfortunately, the only consumer protection for this is in the form of brand reputation. Even before this incident, I would've never bought a Kia (or a Hyundai).
  • ggreer 3y ago
    It's been broken into three times or it's been stolen three times? Because any car is easily broken into. Just smash a window. South Korea's car theft rate is 5.3 per 100,000 per year. In the US it's 282. Canada is 217. Fewer cars had immobilizers a decade ago but theft rates were lower then. The main reason why car theft is higher is because of car thieves.
• sesm 3y ago
  I want to own an insecure vehicle that is also so cheap/old/damaged, that it’s not worth stealing. Should I be allowed to do that?
• jbombadil 3y ago
  There are cars where the security is trivial to bypass. Create a list of those make/models. 1) Raise insurance premium on those models. 2) Force dealers that every time they sell such a car, they must get a signature from the buyer on a piece of paper that says "I recognize that the security of this car is borderline non existent and I will be paying a lot more in insurance because my car is trivial to steal". Grandfather in people who already have such make models or give some time to manufacturers to improve security.
  • Oras 3y ago
    You know there is a manufacturer who doesn’t offer insurance to their own cars. I don’t think it has stoped people from buying https://youtu.be/RCR-5-rf3MM?si=0vFozL7NKMC14NB2 https://youtu.be/RCR-5-rf3MM?si=0vFozL7NKMC14NB2 00:29
    • jbombadil 3y ago
      Lol. I don't think that'd even be an issue. A manufacturer wouldn't be allowed to offer insurance directly to customers in Canada. At least in BC there are mandatory insurance through ICBC. So if the intent of the government is to increase security, make those cars less appealing by making them more expensive.
• betimsl 3y ago
  Thank God I have an account so I can say this: This is the most funny thing I've read in a while. Thanks for writing it man -- wiping tears.
• speransky 3y ago
  for me the issue us flipper team itself, not a device. they are ruzzianz, buying this device directly or indirectly supports criminal regime
• gepeto42 3y ago
  One of the authors here. Someone just told me we were on the HackerNews front page, made me happy we just went with a static website on GitHub pages. I will go through the comments later, but for now, if you are Canadian, please get in touch with your MPs. I am working with some media as well for additional coverage in the next week, but if you know Canadian journalists that might be interested in this, please get in touch with them, educate them directly if you want or send them to me (my LinkedIn is in the signatures, the first two names in bold = authors). Thanks for helping this story reach more people.
• anigbrowl 3y ago
  The childishness of this headline is something else. People who like 'security tools' feel entitled to demand everyone else exhaust themselves in a never ending security arms race. Here's a compromise; things like Flipper Zero stay legal, but if you get caught with one, you're treated the same way as someone walking around with a crowbar.
  • topspin 3y ago
    I had exactly the opposite reaction. Tools like flipper zero are trivial. Banning these make as much sense as banning the next designer drug. Yet that's the idiocy we default to, and the logical conclusion is the "War On Electronics." Manufacturers have been reckless, featurizing their products and ignoring basic expectations of their customers. It isn't unreasonable to expect that some low life knucklehead can't just toy with your car for a minute using a ~$5 transceiver and drive way without so much as an alarm going off.
    • anigbrowl 3y ago
      I don't disagree with the premise that car manufacturers should do better, but the same people that insist messing around with a Flipper Zero is Serious Business tend to be the same people who say regulation of things like vehicle standards and an unwelcome interference with the free market. I stand by my claim that the headline reflects a childish mindset instead of looking at both sides of the issue.
      • topspin 3y ago
        > the headline reflects a childish mindset The mature mindset being the frictionless acceptance of new laws to empower more minders and more law enforcement to utterly fail at preventing new "crime." Understood.
        • anigbrowl 3y ago
          Don't put words in my mouth. I wrote what I meant, not what you want to project onto it.
• fargle 3y ago
  stupid on stupid. - it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem - but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you for not spending a couple bucks. - i also cringe at the idea that we throw the word negligent around when talking about failing to prevent other peoples crimes. i'm not negligent for not doing enough to prevent the crimes of some other asshole. nor is kia. meanwhile, there's sibling threads here that point out that the us is far to hard on the criminals. so wait - kia and me and other law abiding entities are "negligent", but the asshole who stole the car deserves compasion, etc.? - it's stupid-on-stupid-on-stupid to sit here discussing the problem of car thefts, caused by lack of enforcement of the existing laws against it, and the proposed solutions is making more things illegal (and arguing about which things).
  • grubbs 3y ago
    The last point is a hard one when the perpetrator is a 11 year old kid who watched a TikTok video online on how to steal a Kia/Hyundai.
    • electriclove 3y ago
      Punish the kid’s parents.. (oh wait, there might be a problem here)
      • fargle 3y ago
        not hard at all. where is CPS? obviously someone isn't giving an 11 year-old appropriate supervision at all if they are driving, let alone stealing a car. there absolutely should be consequences for both the parents and the child in this situation. i'm not saying one mistake, send the kid to prison, take away parental rights. but it should be severe enough to matter, including several thousand dollars restitution.
        • 3y ago
• bachmann1234 3y ago
  Seems like most everyone here is ignoring that the flipper is not even an effective tool for car theft. It's capabilities have been exaggerated by staged videos. You would have to get access to the original fob. Activate it near the flipper but out of range of the car. At which point...yes. You get one chance to unlock the original car which you lose if the original fob is used before you get there. Oh and then you gotta start it? I don't know man. I feel like real car thieves use better tools
• GuB-42 3y ago
  > Security tools like Flipper Zero are essentially programmable radios, known as Software Defined Radios (SDRs) The Flipper Zero is not a SDR, it is less capable than that. That's the ironic part, the Flipper Zero is a rather weak hacking tool. It can open car doors, but it is so impractical that it is not much more than a party trick. You have to record the code by pressing the button on the keyfob out of range of the car and in range of the Flipper. You can then open the door to the car, once, and only if the owner didn't open it first. There is a more advanced and maybe practical attack called rolljam, but I don't think the Flipper is capable enough to do that. The only thing is that the Flipper Zero is fun, cheap(ish), and popular, but real thieves already have better tools for their job.
  • dylan604 3y ago
    > but real thieves already have better tools for their job. there you go, letting logic get in the way of a politician looking to score points
  • happytiger 3y ago
    The idea of banning the flipper is like banning legos because you can build lockpicks out of them — it’s just nonsensical politician logic.
    • dymk 3y ago
      What kind of lockpick can you build out of legos?
      • sgerenser 3y ago
        That’s the joke
      • happytiger 3y ago
        A very, very bad one that might only work with Lego locks. Let me double down… https://ideas.lego.com/projects/40434532-eaa1-4926-8621-362969385481 https://ideas.lego.com/projects/40434532-eaa1-4926-8621-3629...
• tomohawk 3y ago
  Soros funded district attorneys should be banned for refusing to enforce laws.
• tamimio 3y ago
  Banning flipper zero because of car theft is like banning a hammer or screwdriver because is was used to break an all glass window.. going by the same logic, they should ban the USB-A port cables too since it’s what was used to steal most Hyundai/KIA cars, typical Canadian government policies, pretend you fix an issue instead of going to the root causes.
  • Daz1 3y ago
    You might have a point if hammers or screwdrivers had no other purpose other than stealing cars, but they do, so you don't
    • electriclove 3y ago
      So does the Flipper.. so what are you trying to say?
      • Daz1 3y ago
        The function of a hammer does not extend past 'hit thing' or 'pull nail', Obviously this kind of function can't be controlled in its application as people can swing their arms however they feel which makes any sort of restriction on hammers redundant given their utility. Flipper Zero on the other hand is a toy with no/little actual utility that enables users to perform illegal/dangerous tasks like steal cars, that would not otherwise be possible except via less accessible/illegal means. Do you understand now?
    • tamimio 3y ago
      > You might have a point if hammers or screwdrivers had no other purpose other than stealing cars And so is flipper zero.. have another analogy, flipper zero is like Swiss army pocket knife, you can use it open your package box and also kill someone, zipper can be used as a toy -literally- or an IR remote, and can also steal a car, except I don’t think it can steal a car in the first place, it’s too weak, you need an advance SDR/ special antenna, zipper can’t even defeat garage remotes with a rotating keys unless you have an access to the garage unit.
• zzz999 3y ago
  Insecure software should be banned (aka, all software) But I agree that Flipper Zero has no reason to be banned
• gverrilla 3y ago
  It's a problem of insufficient scientific divulgation.
• olliej 3y ago
  Yeah the response of banning flipper zero is absurd, and would be like banning usb connectors in response to Kia’s terrible ignition flaw.
• TecoAndJix 3y ago
  They should ban spark plugs too while they are at it: https://youtube.com/shorts/4M2DmJaoxRk?si=r1K1llFxCtK_KA1j https://youtube.com/shorts/4M2DmJaoxRk?si=r1K1llFxCtK_KA1j
• Pete_arten 3y ago
  I feel like, if cars will significantly improve security, ultimately we the customers will pay the price for it in terms of more expensive cars. But then again I agree that this should be addressed. It's like someone points out a problem, and then you stick your head in the sand and wait for things go away - or just let others deal with your issues. It's simply not the right approach.
• sonzohan 3y ago
  ITT: Security through obscurity is easy. Actual security is hard.
• ivana111 3y ago
  This is the first time since 4 months I contacted honest people through internet, I lost money with scam crypto company, I contacted 3 recovery companies, it turned all of them are scammers, Until I contacted recoverydarek@gmail.com, I sent them all information's about the scam company, then after few hours, they apologies to me and said they couldn't trace the asset, after giving them the information they needed from me it took them only 24 to refund my 150,000 USD back to me. I wrote this review, to thank this company for their honesty and those out there in need of help. DAREK COMPANY is trustworthy.
  • fennecbutt 3y ago
    Wow, first time I've seen crypto bot spam on HN
• RecycledEle 3y ago
  A manufacturers recall would be useful.