2 ms·

Is it really so much better than an RF keyfob that it's worth connecting your car to the Internet for?

toomuchtodo 2y ago
Yes, I accept the risk and threat model. RF fobs are compromised frequently as well. Unless you rip the cellular module out of my vehicles, I will find it, and someone is just going to break the window if they want in. Edit: Non connected cars for the risk adverse, connected cars for those with the risk appetite. The market will self sort, even if telematics requires more regulatory oversight (they do!). https://www.google.com/search?q=fob+relaying+theft+attack https://www.google.com/search?q=fob+relaying+theft+attack
- roywiggins 2y ago
  Of course, with this Kia attack, it didn't matter if you had never used or activated the feature, it was still vulnerable. With keyfobs you can just not use it or destroy it if you are worried about relay attacks. Connecting every car to the Internet at all times just in case their owners might want to activate a remote start feature at some point is nuts.
- potato3732842 2y ago
  >Yes, I accept the risk and threat model. >Edit: Non connected cars for the risk adverse, connected cars for those with the risk appetite. The market will self sort, even if telematics requires more regulatory oversight (they do!). Seems contradictory. What risk are you actually accepting if we're all forced to kick in for some regulator that protects you from the majority of the risk?
  - toomuchtodo 2y ago
    DHS, CISA and NHTSA already exist to provide cyber regulatory mechanisms at the intersection of automotive and telematics or other software/connected scope. If an entity ships shit, apply punitive punishment to the offender (NHTSA forces software updates as recalls today, but can do much more). Software and connectedness is not going away [1] [2], so secure software development, actual QA, and real change management must be strongly encouraged through incentives. "The beatings will continue until the security posture improves." [1] https://www.techradar.com/pro/security/hackers-are-increasingly-targeting-industrial-systems-with-brute-force-cisa-warns https://www.techradar.com/pro/security/hackers-are-increasin... [2] https://www.cisa.gov/news-events/alerts/2024/09/25/threat-actors-continue-exploit-otics-through-unsophisticated-means https://www.cisa.gov/news-events/alerts/2024/09/25/threat-ac...
- almostnormal 2y ago
  Risk/threat I would accept. Leaking data - to telcos by constantly being connected to some cell tower and explicitly to the manufacturer whatever they decide to transmit - is the part I don't like. I don't even carry a phone for that reason.

Yes, I accept the risk and threat model. RF fobs are compromised frequently as well. Unless you rip the cellular module out of my vehicles, I will find it, and someone is just going to break the window if they want in. Edit: Non connected cars for the risk adverse, connected cars for those with the risk appetite. The market will self sort, even if telematics requires more regulatory oversight (they do!). https://www.google.com/search?q=fob+relaying+theft+attack https://www.google.com/search?q=fob+relaying+theft+attack

roywiggins 2y ago
Of course, with this Kia attack, it didn't matter if you had never used or activated the feature, it was still vulnerable. With keyfobs you can just not use it or destroy it if you are worried about relay attacks. Connecting every car to the Internet at all times just in case their owners might want to activate a remote start feature at some point is nuts.
potato3732842 2y ago
>Yes, I accept the risk and threat model. >Edit: Non connected cars for the risk adverse, connected cars for those with the risk appetite. The market will self sort, even if telematics requires more regulatory oversight (they do!). Seems contradictory. What risk are you actually accepting if we're all forced to kick in for some regulator that protects you from the majority of the risk?
- toomuchtodo 2y ago
  DHS, CISA and NHTSA already exist to provide cyber regulatory mechanisms at the intersection of automotive and telematics or other software/connected scope. If an entity ships shit, apply punitive punishment to the offender (NHTSA forces software updates as recalls today, but can do much more). Software and connectedness is not going away [1] [2], so secure software development, actual QA, and real change management must be strongly encouraged through incentives. "The beatings will continue until the security posture improves." [1] https://www.techradar.com/pro/security/hackers-are-increasingly-targeting-industrial-systems-with-brute-force-cisa-warns https://www.techradar.com/pro/security/hackers-are-increasin... [2] https://www.cisa.gov/news-events/alerts/2024/09/25/threat-actors-continue-exploit-otics-through-unsophisticated-means https://www.cisa.gov/news-events/alerts/2024/09/25/threat-ac...
almostnormal 2y ago
Risk/threat I would accept. Leaking data - to telcos by constantly being connected to some cell tower and explicitly to the manufacturer whatever they decide to transmit - is the part I don't like. I don't even carry a phone for that reason.