26 ms·

Hacking Subaru: Tracking and controlling cars via the admin panel

548 points by ramimac 2y ago

like_any_other 2y ago
> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. Assuming it's possible to not agree to it - does that completely disable the system, or is everyone with a Subaru just one warrant away from getting locked in their car until the police can come to arrest them? Does the car still store (I'm charitably assuming it doesn't transmit) location data, so all your friends can retroactively be identified and arrested as well, even if you never agreed to any tracking? (To get ahead of the usual retort - haha yes, phones also track this data, therefore let's not fix any problems unless we can fix all of them at the same time. But actually let's use the other problems as an excuse to do nothing.)
- aftbit 2y ago
  I was lucky to have the DCM in my 2019 Outback (which is responsible for cellular communication and thus this whole STARLINK thing) replaced with a bypass box under the warranty program related to the end of 3G service. My car was trying to go online 30 times an hour or something like that, draining the battery enough that it needed to be replaced after just 4 years. They don't have enough new DCMs so they were willing to replace it with a bypass box instead, which seems even better to me. So at least my Subaru cannot connect to the cloud anymore. I'm sure it still stores location and telemetry data for insurance fraud reasons though.
  - bongodongobob 2y ago
    That's avg time to replace a battery.
    - aftbit 2y ago
      Hmm really? My Camry made it nearly 10 years, and my Civic still had a good battery 6 years in when I sold it. Regardless, the battery and DCM were both tested by Subaru. The battery tested bad, and the DCM tested for a high parasitic draw. I drove the car daily, and the battery would die if I didn't drive it for 4 days. I didn't just make this up either, search "DCM parasitic draw" on Google for more. Subaru even sent me a letter outlining my options for repairs.
      - tedmielczarek 2y ago
        I've heard about this being a known issue with cars from other manufacturers, so I can believe it. It's interesting that nobody thought to include a way to let the vehicle know it should stop trying to communicate to handle a potential end-of-service situation like this. It's fairly common for people to keep cars for more than a decade, they're a really expensive necessity for many.
      - bongodongobob 2y ago
        Maybe I'm used to harsher weather in the Midwest.
        deleted 2y ago
        [deleted]
      - anotherhue 2y ago
        That's a known issue. Reports all over the subaru forums. I tried to measure it myself with my little multimeter and now I don't have a working multimeter. One suggestion I tried that seemed to work was to not keep the key close to the car, since that'd not physically possible for me I wrap it in an ESD bag. Haven't had much issue since, but no promises.
      - vel0city 2y ago
        Lots of places will say an average car battery's life is somewhere around 3-5 years. It is highly dependent on weather. Here where there are regularly long spans of 100F+ days, a battery will have done pretty good to make it five years; many die in 3-4. Same in very cold climates. If you're in a place with good weather all the time they'll last considerably longer.
  - dylan604 2y ago
    > So at least my Subaru cannot connect to the cloud anymore. Sounds like something you can use to justify a higher selling price when the time comes
    - downrightmike 2y ago
      especially those that the insurers are 10x the bill on for previous driving data collection
    - arcanemachiner 2y ago
      I envy your optimism.
      - dylan604 2y ago
        i've been looking at getting a used car, and this is actually one of the considerations for me. no touch screen is another.
      - lazide 2y ago
        You’d be surprised - a lot of younger dudes in particular appreciate things like this, as well as certain types of exhaust modifications and the like ;)
  - mmmlinux 2y ago
    FWIW i never replaced the 3g box in my 2018 subaru, and never have a battery drain issue. the battery did fail about 4 years in to owning the car, but it was a cell failure not a drain issue.
    - pfooti 2y ago
      My Subaru, a 2018 outback, would be completely battery dead if I left it parked for more than a week or so. Happened once at the airport, after which I started carrying a battery pack car starter. The guy at the airport who have us a jump said it happened all the time with Subarus in long term parking.
      - all2 2y ago
        To be fair, this happens on my 05 Outback.
      - doubled112 2y ago
        This isn’t all that uncommon in any vehicle.
        NooneAtAll3 2y ago
        a week? yes it is
    - reginald78 2y ago
      My local mechanic said that there is a firmware update that supposedly fixes the radio drain last time I replaced the battery but I haven't looked into it. He primarily works on Subarus and it sounded like he'd seen that as a root cause of dead battery a lot.
      - Melatonic 2y ago
        Is that firmware update also just replacing the 3G SIM though with a 4G one? In that case it will just fix the issue of it not being able to contact the cloud servers. Also makes me wonder - what if someone has a subaru and lives out in a very remote area where there is no 3G or 4G service? Would that not have the same issue as the cell towers being deprecated for 3G? Seems like (specifically for Subaru owners) this might be a more common type of living situation than other car owners too!
  - bdcravens 2y ago
    I had a similar issue when I connected my electricity provider to my Kia EV6. Presumably it would turn on charging when the price was optimal, but they were pinging it for status so often that the car never went to sleep, and it drained the 12V. Funny enough, the dealership couldn't figure it out; I "fixed" it by changing my Kia credentials.
  - Melatonic 2y ago
    My 2017 hasnt had the battery issue yet (they said only some subarus are supposedly affected). How did you verify how often it was trying to go online? Now very curios in this bypass box as well - I heard just manually removing the 3G SIM (supposedly easy) can also maybe cause battery issues. If the "bypass box" alleviates all potential use of the system that is ideal long term!
  - liveoneggs 2y ago
    my subaru is eating through batteries!
- reaperducer 2y ago
  Assuming it's possible to not agree to it My new car came with something called "Google Built-In," which seems to be the bastard sibling of Google Car Play. During the set up, if you'd like to read the privacy policy, you must scan a QR code on your phone, which opens a web page that does not display on mobile devices. If you'd like to opt-out of anything, you have to create a Google account, then log the car into that Google account, then log into that Google account on your phone, then go hunting for the settings on both the car and in the Google account online. Good luck finding them all. Also, it is not possible to uninstall certain "essential" Google apps from the car. Apparently, YouTube is now an "essential" part of driving.
  - rurp 2y ago
    Yeesh, which care manufacturer is this from?
    - reaperducer 2y ago
      Volvo.
      - onetokeoverthe 2y ago
        The real owner of Volvo is Chinese automaker Geely. The company acquired the Swedish automaker from Ford in 2010 for $1.8Bil. source. https://www.fool.com/investing/how-to-invest/stocks/who-owns-volvo/#:~:text=The%20real%20owner%20of%20Volvo,at%20the%20end%20of%202023 https://www.fool.com/investing/how-to-invest/stocks/who-owns...)
        reaperducer 2y ago
        But at least they're made in South Carolina.
        speed_spread 2y ago
        Only the EX90 it seems is made in SC, possibly just assembled from parts made in China. All other electric Volvos (including Polestar) are straight from China. Gas models and hybrids are still built in Europe but are being phased out.
- mattmaroon 2y ago
  It’s not the Starlink you’re thinking of, that’s Subaru’s name for their in-car infotaimnent system and predates the SpaceX Starlink. So it’s just Subaru. Also I doubt any ad partners can disable your car (outside of vulnerabilities like this). Subaru can but that’s the case with most modern vehicles.
  - jmward01 2y ago
    Any partner that pays enough $$$ can likely do whatever they want. That is obvious by the fact that a year of driving history is displayed. If they didn't want to sell the data/access then they wouldn't be collecting such a long history of it. This is evil. I will avoid being forced to give this information at every possible turn and the companies doing this, and hiding how much they collect, should all be shut down.
    - Melatonic 2y ago
      Its also possible they collect the data just to do it (and surely not to give in rare cases to law enforcement)
    - mattmaroon 2y ago
      That's absurd. Collecting and selling your data and allowing a third party to remotely lock your car are two very different things. I have no doubt car companies sell your data, I am extremely skeptical third parties can buy rights to control your car and if that ever happened, we'd all hear about it really fast.
      - jmward01 2y ago
        Do you honestly think that they have a limit to what they will sell? I could easily imagine them selling this access to companies that repossess vehicles. An 'ownership dispute' fee that prevents your car from starting and grants additional access to the company. As soon as I typed that I couldn't stop thinking that that has to be a real thing they make real money on already. If it isn't then my guess it is only because they haven't thought about it. Companies will do anything they are explicitly allowed to do or have plausible deniability on to make money.
- ChuckMcM 2y ago
  Yeah, that was kind of my takeaway as well. Your car is not your car right? I mean ANYONE AT SUBARU can do this?
- parsimo2010 2y ago
  No, disagreeing does not completely disable anything, as you can call Subaru at any time and tell them that you want to subscribe, and they can enable Starlink remotely. I do not know exactly what is transmitted or stored when you do not have an active subscription, but you are one warrant away from having the police ordering Subaru to track your car. But they would probably try this with your cell provider before they try your car manufacturer.
- SoftTalker 2y ago
  If there's a warrant for your arrest, you're not going to avoid it by the police not having remote access to your car locks.
- xp84 2y ago
  You’re going beyond the capabilities demonstrated for us here. Whether or not those types of abilities could be built if they wanted to, here is what the author demonstrated: - ez employee account takeover - as the admin panel employee you can look up the customer’s billing account info and location history, make any changes to the customer account that a customer service employee can - you can also add an arbitrary account as an authorized user for any customer - so you can now log into the regular “Subaru owner” mobile app as that account and that’s how the car-impacting parts of this vulnerability were actually performed. That means you can activate key fob type commands and see the tracking information available through that app. The reason I point this out is that you said “remotely disable” and “lock you in your car” - and those are both things such an app can’t do. There’s no “disable car” button in those apps. If it’s anything like my GM car, it takes like 30 seconds for the car to act on each command you send. So you could lock someone out but if they have a key it’ll be easy for them to unlock it before you can re-lock it. And if it’s in motion you can’t stop it from the app. And finally cars don’t support locking in. They are all designed with handles that will open mechanically with either one or two pulls. Worst it can do to stop you is sound your alarm.
niij 2y ago
How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?
- willis936 2y ago
  I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling the antenna cable is the right move. Fun fact on car GPS: it actually feeds back through carplay so your navigation gets worse without it. What I have yet to figure out is if the network connection is given to the car through carplay.
  - stn8188 2y ago
    This is absolutely my biggest concern for when I inevitably am forced to replace our aging vehicles. The unfortunate reality of living in the Northeast is that it's near impossible to find decent (not rusted) older cars for sale. Sure, I'm within the 99.9999% of Americans who have nothing to hide, but that unequivocally does not justify the physical capability of remote monitoring or control.
    - _yb2s 2y ago
      Why not just take a weekend to fly to where used cars are unrusted, and drive one back? Also, there are quite a few well made older cars that are fully galvanized and don’t rust. I know a few people in the Northeast still driving 1980s Volvo 740s, still unrusted after nearly 40 years of salty roads. 1987 and later had the best rustproofing. I believe many older Audis also are galvanized.
      - potato3732842 2y ago
        The best galvanization was in the 80s when the OEMs were scrambling in the "surprise, lead just got banned" era (lead acts like an anode, think of it like a lesser version of a high zinc primer). That said, it's not the thick hot dip you see on I beams or on bolts at the hardware store and a modern car with modern coatings and attention to corrosion is still better. Of the three continents that produce a lot of cars the Europeans still take corrosion more seriously than anyone else.
netsharc 2y ago
Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?
- Mountain_Skies 2y ago
  Back when I used to do AppSec, these types of issues were extremely common. Software developers and their managers would argue endlessly about them not being real vulnerabilities, which meant I had to put together a proof of exploitability. And since these were interdepartmental fights, office politics get involved. Just one of the dozen or so reasons why I stopped doing AppSec and went back to development.
  - _joel 2y ago
    That seems like a culture issue rather than an appsec issue?
    - dboreham 2y ago
      It's the toxic culture that creates the security issues. Because people who won't listen to others end up doing stupid things.
    - bagels 2y ago
      If most of your customers are like this, does the distinction matter?
    - solatic 2y ago
      I left security work for a similar reason. In most companies, Security isn't there to collaboratively build more reliable and dependable products that protect customer privacy, bringing in a useful perspective of how things can go wrong, similar to QA's role. Instead, Security is there to be the internal police, who treat engineers (and other employees) like criminals, and get recognition and rewards for stopping the company from shipping. The way the vast majority of companies treat Security is deeply dysfunctional and soul-killing to anyone who wants to bring a glass-half-full mentality to work. And in an industry where it has become practically an expectation for people to jump ship after ~4 years, that's too much of a career risk to take. (side note: QA has exactly the same problem.)
plagiarist 2y ago
I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.
- inetknght 2y ago
  > I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. Moreover, not just millions of dollars in aggregate, but millions of dollars per individual customer whose privacy was violated.
  - TheJoeMan 2y ago
    If I collected this much information about a single individual, I would go to jail for stalking. But with the wonders of technology, I can stalk "at scale"!
- neeeeeeal 2y ago
  This is the way. What legitimate interest could Subaru have in maintaining this much data about their customers?
  - genewitch 2y ago
    The most charitable guess I can make is that they use it to improve their driver assist, lane keeping, pacing, and that sort of thing. location and g force and direction when the automated system shuts off and returns control to the driver, that sort of thing. I don't agree with it, but that would be my guess. I own a Subaru that does this, so I'm not happy about it, but what can I do? That's rhetorical.
  - ndileas 2y ago
    Unfortunately, selling it to repo men is a widely accepted practice.
chatmasta 2y ago
For those who might not read the article, note that “Starlink” is not the SpaceX service. It’s an internal name for a Subaru customer service web app.
- wolrah 2y ago
  > It’s an internal name for a Subaru customer service web app. It's actually the name of Subaru's connected infotainment system: https://www.subaru.com/vehicle-info/subaru-starlink.html https://www.subaru.com/vehicle-info/subaru-starlink.html
  - dboreham 2y ago
    Strictly it's a "telematics system" rather than infotainment.
yapyap 2y ago
Buying a car that is connected to the internet sounds horrific.
- jeroenhd 2y ago
  You'll have a hard time avoiding it if you buy a new car: https://foundation.mozilla.org/en/privacynotincluded/categories/cars/ https://foundation.mozilla.org/en/privacynotincluded/categor...
  - t0bia_s 2y ago
    Don't buy a new one. Buy old one and remove all tracking devices if necessary.
    - y-c-o-m-b 2y ago
      Previous Subie owner here (03 WRX, 04 Impreza, 03 Outback). I've been looking for an older one (2004-2013) for the last 6 months. The amount of people that don't know or don't disclose leaking differentials, leaking transmissions, and head-gasket issues (despite claiming they've been "fixed") is staggering. With one car I inspected, me and two other buyers came to see it at the same time; I think the seller orchestrated that intentionally. Well too bad for him, I inspected underneath and it was a leaking mess from every section. To which I quickly pointed out to the other buyers. We all walked away lol. Of course you can have these issues with newer models also, but they're so prevalent with the older ones.
  - quesera 2y ago
    Wow, thanks for that link! I've been wishing for something exactly like this. Mozilla Foundation's "Privacy Not Included" product review site https://foundation.mozilla.org/en/privacynotincluded/ https://foundation.mozilla.org/en/privacynotincluded/
bilekas 2y ago
> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.
- jeroenhd 2y ago
  > Number 1 why you need a car connected to the internet all the time To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot. > And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will. Legally speaking, I believe that depends on your local privacy laws. Practically speaking, car makers (and government agencies) love these features for troubleshooting and tech support, or for flagging crashes before any authorities or local press have time to arrive (think Tesla). Don't ask them about finding your stolen car, though. Then the data may suddenly not be available.
  - bilekas 2y ago
    > To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot I really hope this was sarcastic. How did we ever manage to find our cars before IoT cars …
    - rtkwe 2y ago
      You can also do other stuff like start the climate controls so the car is comfortable before you reach it on hot or cold days.
      - bilekas 2y ago
        These things could certainly be convenient, de-icing while you're having breakfast etc but surely you don't need my location data recorded for those services ? Maybe if there was a list of options I could select from then I guess it's fine.
mavdi 2y ago
Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.
- Cumpiler69 2y ago
  [flagged]
  - kccqzy 2y ago
    I've heard of this claim so often that I assume it to be true, though personally I've only had the fortune to work in better environments where my Indian colleagues aren't nepotistic. I suspect this might be related to the hiring bar: if a company only hires the top talent perhaps this would not be an issue.
    - gedy 2y ago
      Unfortunately I think it depends on the number and position of Indian folks. Small numbers where you deal with people individually, I've not seen issues and it's nice to work with Indian devs. In larger numbers or when in charge of hiring, there seems to be a prevalent issue of Indian cultural norms and favors kicking in and it can happen fast.
      - tonyedgecombe 2y ago
        Monocultures are almost always bad, if nothing else they are a signal that you aren't hiring on merit.
        Cumpiler69 2y ago
        >Monocultures are almost always bad Depends on the culture, the size of the team, the product you're working on and the target demographic.
ziddoap 2y ago
Is anyone aware of a list of affected models posted anywhere? All 2015+ models? Obviously the ability to pull up account history, previous owners, etc. is applicable to anyone with a Subaru. But I'm curious if location history shows up for people that have Subarus and never registered Starlink/never used the app. The author says: >but it seemed that we had agreed to the STARLINK enrollment when we purchased it. But it's not clear to me whether "it" refers to purchasing Starlink or purchasing the vehicle.
- Cerium 2y ago
  Purchasing the vehicle.
godber 2y ago
This claims to bypass the telematics functionality: https://www.autoharnesshouse.com/69018.html https://www.autoharnesshouse.com/69018.html > Note for customers retaining OEM headunit: This adapter can also be used for those wishing to remove/disable the OEM Subaru Telematics functions. This is done to eliminate the tracking cabability that Subaru has built into these vehicles. If this is you, we will need to add an additional part to this adapter to re-enable the bluetooth microphone. Please purchase the option 2 adapter near the bottom of this page for this situation.
- godber 2y ago
  The info on that page seems a bit contradictory, but maybe I need more coffee.
- bityard 2y ago
  Is there anything like this for Toyota DCM? We bought a second-hand 2021 Highlander and thus did not sign any contract allowing our family to be tracked by Toyota. I went on a hunt recently for information on neutering the DCM but have thus far only found speculation and contradictory info.
  - willis936 2y ago
    Yeah it's bad out there. Don't do what the yahoos hacking up their harnesses have done. The Toyota DCM I'm familiar with has 3 coax antenna lines coming in. The outer 2 are cell and the inner is GPS. Pull the cell antenna cables out of the DCM and you should be good to go. Best to hunt down your vehicle's service manual and verify the procedure first.
- LandoCalrissian 2y ago
  Awesome, thank you. Seems pretty straight forward.
t0bia_s 2y ago
Imagine that manufacturer can do that without any hacks and your knowledge about data collecting. Now imagine that you sell those cars to foreign countries that your government consider as enemy. I'm curious when there will be some ban of car brand, like TikTok.
- deleted 2y ago
  [deleted]
- longtimelistnr 2y ago
  Isn't this already in place? I thought this is exactly why Chinese EV's haven't flooded the market yet.
  - reaperman 2y ago
    That’s likely more caused by the current 100% import tariff on Chinese EV’s.
- TechDebtDevin 2y ago
  Chinese cars cannot connect to the cloud in the USA.
rjmunro 2y ago
> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. How did they verify the never exploited maliciously part? Did the person who's password they changed ever notice that their password didn't work any more and report the problem?
- arrowleaf 2y ago
  Assuming `samwcurry@gmail.com` belongs to the same person who owns samcurry.net, they changed their own password.
  - nkurz 2y ago
    I don't think that's correct. See the section in the article "Enumerating Employee Emails" which finishes "The jdoe@subaru.com (redacted) email was valid! We went back to the reset password endpoint and hit send."
- amatecha 2y ago
  Right, especially considering the Subaru Starlink service has apparently existed since 2014 or so[0], I have to wonder how long these vulnerabilities have been present. [0] https://web.archive.org/web/20140719230852/https://www.subaru.com/engineering/starlink.html https://web.archive.org/web/20140719230852/https://www.subar...
high_na_euv 2y ago
What a shitshow!
blackeyeblitzar 2y ago
A shocking thing about Subaru cars with Starlink (their infotainment system and connected service for things like remote start) is how deep the violation of privacy is. For example they share your location data with Sirius XM by default, unless you go deep in their menus to realize it’s even happening and opt out. They bury the consent in fine print that you fly through at the dealership. Truly a despicable company.
- oremolten 2y ago
  all car companies do this since around 2011.(in the us) they also immediately sell all this data to car insurance companies. many apps on your phone that use location data for anything are mostly using an APK that includes a couple car insurance companies code that also just directly shares that with them. (they made the location APK for app makers to have an easy to use location data tool)
  - iforgot22 2y ago
    Also cell carriers collect and give out live location data on customers
tadhgpearson 2y ago
I love the variety of tooling and joining the dots to complete this attack: dns + scanning + human factors research + html bypass on the admin site itself...
panki27 2y ago
This is even worse than the VW data leak reported around a month ago. [1] [1] https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo...
- naitgacem 2y ago
  Did you perhaps forgot to edit and add the link? I'm interested in hearing about that
  - TechDebtDevin 2y ago
    I hope you speak German.
    - jazzyjackson 2y ago
      If you download the .mp4 you will notice it is 'deu-eng-fra', there is an English overdub available as a separate audio track.
- interloxia 2y ago
  Discussion at the time https://news.ycombinator.com/item?id=42524422 https://news.ycombinator.com/item?id=42524422 https://news.ycombinator.com/item?id=42547864 https://news.ycombinator.com/item?id=42547864
_huayra_ 2y ago
FYI for Subaru owners, you can opt out and have your data deleted anywhere in the US (not just California): https://www.subaru.com/support/consumer-privacy.html https://www.subaru.com/support/consumer-privacy.html It'll take ~6 months or so, but they will send you a confirmation email.
- jcomis 2y ago
  fwiw I have done this and received no confirmation or anything after more than 6 months. I keep submitting, maybe its working, but it doesnt seem to actually result in a confirmable change. for sure my retailer, which are 3rd parties according to that page, still has 100% access to the data, as they were able to tell my car was in another state when I called recently. seems pretty troubling
  - nyokodo 2y ago
    > I have done this and received no confirmation or anything after more than 6 months Sue them, make it a class action.
    - gruez 2y ago
      That's not how lawsuits work. You can't sue just because you don't like something. You have to prove harm. "not getting confirmation" hardly counts, especially if said confirmation isn't required by law.
- rozab 2y ago
  It would be cool if the researcher could have tested this before reporting
  - _huayra_ 2y ago
    I would guess that opted-out cars like mine are still "in the system", as I can still do all the MySubaru app stuff like un/lock, start, etc.
simonlc 2y ago
Question, if you can remote start a subaru with starlink, does that mean I could start my car from the command line during winter??? I don't pay for starlink, never really looked into it, but it sounds cheaper than installing a remote start system lol.
- warkdarrior 2y ago
  https://github.com/G-Two/subarulink https://github.com/G-Two/subarulink
  - prh8 2y ago
    that still requires an active subscription unfortunately
    - simonlc 2y ago
      I'm guessing the subscription activates some sim card? I wonder if that's activated anyway and still tracks you if you don't sign up...
      - Shocka1 2y ago
        Based off what we've seen at this point it would be worthwhile to try.
ben7799 2y ago
I have a 2013 Outback Limited that is basically right before all this stuff got really stupid and weird. It's a great car other than it's not very fast and it gets really bad gas mileage. Amazing in the snow. I have had it since December 2012, so I've had plenty of service visits where I got newer loaners. (I special ordered my car to basically load it but not have Starlink, not have the Sunroof, but have the leather seats and the HK upgraded stereo.) Every time I have gotten a newer Subaru as a loaner it strikes me that they are worse cars for all this new stuff. The user interface is horrible in the new ones. In a lot of cases they have a skeumorphic interface up on the touch screen that mimics the physical controls in my car! The actual physical controls are about 100x faster to operate and you quickly learn where the buttons are without looking. I had an Ascent Onyx loaner last summer.. the entire touch screen UI looked like it was barely operating above 10fps. Just gross. Lots of the UI is black and white as well, not even tasteful grayscale. The Onyx I had also had the upgraded HK stereo and that is not as good as the one in my car as well, it sounded noticeably worse. The electric steering on the new Subarus is terrible as well. My old Outback is not exactly a sports car but getting out of new one back into mine it feels like you're getting into a Porsche or something when you feel the hydraulic steering. Engine/Turbo lag on a lot of the new ones is gross as well. This is of course even worse! My car only has 120k miles on it, I plan to keep it for another 4 years and then maybe give it to my kid when he gets his license. Somehow I doubt Subaru will have a competitive vehicle by then. For me to consider another one they'd really need to have an EV Outback/Forester/Ascent or a Hybrid version that gets at least 40mpg. And they need to fix all this horrible infotainment stuff in a way that the car operates better than a kids toy and actually drives well like an older Subaru. Also they need to get off the whole stupid thing with giant rims. It's supposed to be a Subaru, it needs to have tires appropriate to going relatively fast on dirt roads.
- DwnVoteHoneyPot 2y ago
  In addition to your comments, I think Subaru's all-wheel drive system has been switched to electrical instead of mechanical, making it worse. There are roller tests on youtube which show Subaru AWD being outperformed by Ford AWD systems.
sc68cal 2y ago
This really reinforces my aversion to internet connected cars. They used one to kill Michael Hastings.
dantillberg 2y ago
Last year, I submitted a "right to know" request to Subaru, and they sent the following back. I've reformatted it for legibility. Basically asserts they'll do and sell whatever they want (except another car to me). > Subaru may collect the following personal information about a consumer: > Categories of personal information: > Identifiers: Consumer records, Commercial information, Internet or Other Electronic Network Activity, Audio recordings, Vehicle geolocation, Professional or employee-related information, Inferences, Sensitive personal information > Categories of sources from which the personal information is collected: Retailers, i.e. authorized Subaru dealerships , Provided by consumer or vehicle, Third parties > Business or commercial purpose for which Subaru collects or sells personal information: To provide services to the consumer, To market goods and services to consumers, To provide marketing by third parties for third party goods and/or services, To comply with legal obligation > Categories of third parties with whom the personal information is shared: Business service providers, Contractors, Retailers, Corporate parent and affiliates, Third party providers of goods and/or services, Entities required to comply with the law > Categories of personal information sold: Identifiers for third party marketing of goods or services., Consumer records for third party marketing of goods or services > Categories of personal information disclosed for business purpose: Identifiers are disclosed to service providers, contractors, and third parties., Consumer records are disclosed to service providers, contractors, and third parties., Commercial information is disclosed to service providers, contractors, and third parties., Internet or other electronic information is disclosed to service providers, contractors, and third parties., Vehicle geolocation is disclosed to service providers., Inferences are disclosed to service providers and contractors., Sensitive personal information is disclosed to service providers and contractors.
- Melatonic 2y ago
  Good to know Seems pretty blanket wide legalese. The part about audio recordings seems a bit troublesome however
  - cmgbhm 2y ago
    The non troublesome use-case is clicking the starlink button and taking to their support. Having bought a Subaru, I really tried to see where the consent is in the process. In my case, I think it’s the account establishment process that the dealer did.
stuff4ben 2y ago
As a DevSecOps/SRE whatever, I just gotta give props to the Subaru team for getting it patched within 24 hours. While it's just a small internal admin dashboard without real customer usage, the fact they acknowledged and fixed the issue so quickly speaks well of at least that part of Subaru IT.
therealfiona 2y ago
That's it... I'm not buying a car with any internet connection unless I can rip it out. And every day that's going to get harder. Guess I'll stick with old Kai Vans...
t1234s 2y ago
Having developed back end portals like this one for much smaller companies I find it hard to believe that there is an open endpoint to reset a password without any type of verification. What goes wrong in development that this type of crap makes it to production?
- duxup 2y ago
  It's weird, is there no feedback of any kind in these companies? All outsourced maybe? I don't get it. That would be a huge red flag and a fairly easy to understand / sell red flag.
  - t1234s 2y ago
    Even if it was outsourced is there zero quality control?
    - anarticle 2y ago
      Outsourcing means you want to impose an upper limit on the cost of the feature/software. Quality control may cost more, so yes! The acceptance criteria are: service portal needs to work so employees can do xyz. The design is terrible but "works"! Having to rearc after these terrible designs would cost more, so you can see where this is going...
    - iforgot22 2y ago
      Probably QA is only going to make sure the features work. They aren't pen-testers. At best, they might try some unexpected inputs that trigger a security vuln.
- deleted 2y ago
  [deleted]
- deleted 2y ago
  [deleted]
- rogerhoward 2y ago
  I joined a startup with a product in production for a dozen or so major customers (US universities), public facing, with a slick new front and backend the team had been working hard on. I brought along a young engineer friend who had a pet interest in pentesting, so his first task before getting up speed as a dev was a security review. He and I sat down on day one to poke around, mainly to get oriented, not expecting much l. Popped up Chrome's devtool network panel, refreshed the login page. One of the first XHR rows was to an endpoint named “getKeys” The return object was the root keys for the AWS prod account. This crap is incredibly common. Maybe not that egregious, but close enough.
deleted 2y ago
[deleted]
yellow_lead 2y ago
No bounty for such a big vulnerability is unbelievable.
1970-01-01 2y ago
Excellent write-up! However a much better title would have been "Hacking Subaru: FEEL THE FREEDOM" https://trademarks.justia.com/owners/subaru-of-new-england-inc-2006774/ https://trademarks.justia.com/owners/subaru-of-new-england-i...
deleted 2y ago
[deleted]
renewiltord 2y ago
All this is pretty cool. It's a pity there's no way to just extract it yourself for yourself. I like all these features and have an older Subaru.
jcgrillo 2y ago
Yet another example of why I don't own or drive vehicles from this stupid century.
tomohawk 2y ago
Is there a way to prevent the car from connecting to this service?
- bryceacc 2y ago
  scroll down to see the DCM removal https://www.subaruoutback.org/threads/disconnected-cars-non-starlink-lte-options.527915/ https://www.subaruoutback.org/threads/disconnected-cars-non-...
rurp 2y ago
There are a striking number of stories in this thread of incompetence and unethical behavior on the part of Subaru, and it makes me sad that the company has turned into such a wreck. Maybe they were always run this way but older technology didn't allow them to be quite so scummy. I bought a Subaru in the aughts that I absolutely loved and had assumed my next car would be from the same company. But when I test drove and looked into a new model I was shocked at how many terrible changes had been made, and I didn't even uncover half of what is in this thread. I'm not holding my breath, but hopefully the bad press affects sales enough to make the people running this company care and alter their behavior. The mechanical cars themselves are still nice to drive, but the terrible interfaces, obscene amount of spying, and intrusively unethical behavior really kill the experience.
- dangus 2y ago
  IMO Subaru has been one of the most overrated car brands for decades. Sure, these data privacy issues are rampant across the automotive industry. It really isn’t just Subaru. But really what I’m talking about is the entire product. I have no idea why people like them so much: - Some of the worst exterior styling of any brand - Cheap interiors that are so ugly - Their history is riddled with major powertrain issues especially for how well-regarded they are - Historically horrific gas mileage compared to competitors as a tradeoff for symmetrical all-wheel-drive that realistically very few of their buyers need. - Their gas mileage isn’t bad anymore but they haven’t even released any hybrids yet, meanwhile every competitor under the sun has hybrids all over the place - Their current infotainment system is god awful with horrendous graphics and the climate controls are stuck inside it I think the only positive thing I can say about the brand is the they’re the last company selling a non-euro-luxury station wagon in the US, but really it’s basically a similar stance as a typical crossover SUV so you might as well buy one of those (or just get yourself a used E Class wagon and end up with a much better car).
yearolinuxdsktp 2y ago
Luckily, in right to repair states, Such as Massachusetts, Subaru chose to disable Starlink altogether instead of making Support documentation available under the law.
motza 2y ago
Would the remote 'stop' stop a moving car? It's scary to think that someone could have easily used this basic exploit to stop all the affected vehicles on the road.
amatecha 2y ago
tfw your car is also an always-online computer running proprietary software you have no control over ... and that software is written by people who think you can block login with a modal overlay, and who make a public-facing API call that resets a password with nothing more than the account's email address...
sirjaz 2y ago
Well this is why there should be a custom local app that is not web accessible. Desktop apps and CLIs have there advantages, and this is one.
blendo 2y ago
Did users have to explicitly sign up for Starlink in order to enable tracking? Or is that the default behavior for all new Subarus? And, can this tracking be deactivated? I have a Mazda, and it required a phone call to Mazda to get it disabled.
- blendo 2y ago
  “SOA does not collect any vehicle-generated data unless the vehicle is associated with an active STARLINK subscription service. To sign up for the STARLINK service, you must have a MySubaru account.” https://www.subaru.com/support/privacy-policies/vehicle-privacy-notice.html https://www.subaru.com/support/privacy-policies/vehicle-priv... So looks like you’re only tracked if you are signed up with Starlink, having first obtained the prerequisite MySubaru account.
- Izikiel43 2y ago
  Can you share more info on Mazda?
beezle 2y ago
Slightly off topic: How are recent Mazda's in regard to all of this stuff? They were not included in that Mozilla privacy expose and I have a CX on my short list for this spring.
- Izikiel43 2y ago
  Idk, but I love my cx5
- akimbostrawman 2y ago
  They are above greed so they don't do that unlike literally everybody else pinky promise.... Do people seriously believe any tech corporations is above surveillance capitalism.
james4151 2y ago
[dead]
pards 2y ago
> it seemed that we had agreed to the STARLINK enrollment when we purchased it. Related to the GM ban https://news.ycombinator.com/item?id=42734260 https://news.ycombinator.com/item?id=42734260
dml2135 2y ago
I live in the city so I've never owned a car, but would like to get one at some point. I'd want at least a plug-in hybrid, if not full electric, and absolutely no internet connectivity or tracking (or at least something that can be physically removed). Is there even a single (new) car that fits this criteria?
monomial 2y ago
Good god. This is why I will continue to repair my older car until it's completely infeasible to do so. Then what? Are there internet communities out there actively working on disabling all this nonsense? Can't imagine buying a car like this without knowing I can physically disable the cell modem.
Chengdavid 2y ago
[dead]
thomas4151 2y ago
[dead]

548 points by ramimac 2y ago

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. Assuming it's possible to not agree to it - does that completely disable the system, or is everyone with a Subaru just one warrant away from getting locked in their car until the police can come to arrest them? Does the car still store (I'm charitably assuming it doesn't transmit) location data, so all your friends can retroactively be identified and arrested as well, even if you never agreed to any tracking? (To get ahead of the usual retort - haha yes, phones also track this data, therefore let's not fix any problems unless we can fix all of them at the same time. But actually let's use the other problems as an excuse to do nothing.)

aftbit 2y ago
I was lucky to have the DCM in my 2019 Outback (which is responsible for cellular communication and thus this whole STARLINK thing) replaced with a bypass box under the warranty program related to the end of 3G service. My car was trying to go online 30 times an hour or something like that, draining the battery enough that it needed to be replaced after just 4 years. They don't have enough new DCMs so they were willing to replace it with a bypass box instead, which seems even better to me. So at least my Subaru cannot connect to the cloud anymore. I'm sure it still stores location and telemetry data for insurance fraud reasons though.
- bongodongobob 2y ago
  That's avg time to replace a battery.
  - aftbit 2y ago
    Hmm really? My Camry made it nearly 10 years, and my Civic still had a good battery 6 years in when I sold it. Regardless, the battery and DCM were both tested by Subaru. The battery tested bad, and the DCM tested for a high parasitic draw. I drove the car daily, and the battery would die if I didn't drive it for 4 days. I didn't just make this up either, search "DCM parasitic draw" on Google for more. Subaru even sent me a letter outlining my options for repairs.
    - tedmielczarek 2y ago
      I've heard about this being a known issue with cars from other manufacturers, so I can believe it. It's interesting that nobody thought to include a way to let the vehicle know it should stop trying to communicate to handle a potential end-of-service situation like this. It's fairly common for people to keep cars for more than a decade, they're a really expensive necessity for many.
    - bongodongobob 2y ago
      Maybe I'm used to harsher weather in the Midwest.
      - deleted 2y ago
        [deleted]
    - anotherhue 2y ago
      That's a known issue. Reports all over the subaru forums. I tried to measure it myself with my little multimeter and now I don't have a working multimeter. One suggestion I tried that seemed to work was to not keep the key close to the car, since that'd not physically possible for me I wrap it in an ESD bag. Haven't had much issue since, but no promises.
    - vel0city 2y ago
      Lots of places will say an average car battery's life is somewhere around 3-5 years. It is highly dependent on weather. Here where there are regularly long spans of 100F+ days, a battery will have done pretty good to make it five years; many die in 3-4. Same in very cold climates. If you're in a place with good weather all the time they'll last considerably longer.
- dylan604 2y ago
  > So at least my Subaru cannot connect to the cloud anymore. Sounds like something you can use to justify a higher selling price when the time comes
  - downrightmike 2y ago
    especially those that the insurers are 10x the bill on for previous driving data collection
  - arcanemachiner 2y ago
    I envy your optimism.
    - dylan604 2y ago
      i've been looking at getting a used car, and this is actually one of the considerations for me. no touch screen is another.
    - lazide 2y ago
      You’d be surprised - a lot of younger dudes in particular appreciate things like this, as well as certain types of exhaust modifications and the like ;)
- mmmlinux 2y ago
  FWIW i never replaced the 3g box in my 2018 subaru, and never have a battery drain issue. the battery did fail about 4 years in to owning the car, but it was a cell failure not a drain issue.
  - pfooti 2y ago
    My Subaru, a 2018 outback, would be completely battery dead if I left it parked for more than a week or so. Happened once at the airport, after which I started carrying a battery pack car starter. The guy at the airport who have us a jump said it happened all the time with Subarus in long term parking.
    - all2 2y ago
      To be fair, this happens on my 05 Outback.
    - doubled112 2y ago
      This isn’t all that uncommon in any vehicle.
      - NooneAtAll3 2y ago
        a week? yes it is
  - reginald78 2y ago
    My local mechanic said that there is a firmware update that supposedly fixes the radio drain last time I replaced the battery but I haven't looked into it. He primarily works on Subarus and it sounded like he'd seen that as a root cause of dead battery a lot.
    - Melatonic 2y ago
      Is that firmware update also just replacing the 3G SIM though with a 4G one? In that case it will just fix the issue of it not being able to contact the cloud servers. Also makes me wonder - what if someone has a subaru and lives out in a very remote area where there is no 3G or 4G service? Would that not have the same issue as the cell towers being deprecated for 3G? Seems like (specifically for Subaru owners) this might be a more common type of living situation than other car owners too!
- bdcravens 2y ago
  I had a similar issue when I connected my electricity provider to my Kia EV6. Presumably it would turn on charging when the price was optimal, but they were pinging it for status so often that the car never went to sleep, and it drained the 12V. Funny enough, the dealership couldn't figure it out; I "fixed" it by changing my Kia credentials.
- Melatonic 2y ago
  My 2017 hasnt had the battery issue yet (they said only some subarus are supposedly affected). How did you verify how often it was trying to go online? Now very curios in this bypass box as well - I heard just manually removing the 3G SIM (supposedly easy) can also maybe cause battery issues. If the "bypass box" alleviates all potential use of the system that is ideal long term!
- liveoneggs 2y ago
  my subaru is eating through batteries!
reaperducer 2y ago
Assuming it's possible to not agree to it My new car came with something called "Google Built-In," which seems to be the bastard sibling of Google Car Play. During the set up, if you'd like to read the privacy policy, you must scan a QR code on your phone, which opens a web page that does not display on mobile devices. If you'd like to opt-out of anything, you have to create a Google account, then log the car into that Google account, then log into that Google account on your phone, then go hunting for the settings on both the car and in the Google account online. Good luck finding them all. Also, it is not possible to uninstall certain "essential" Google apps from the car. Apparently, YouTube is now an "essential" part of driving.
- rurp 2y ago
  Yeesh, which care manufacturer is this from?
  - reaperducer 2y ago
    Volvo.
    - onetokeoverthe 2y ago
      The real owner of Volvo is Chinese automaker Geely. The company acquired the Swedish automaker from Ford in 2010 for $1.8Bil. source. https://www.fool.com/investing/how-to-invest/stocks/who-owns-volvo/#:~:text=The%20real%20owner%20of%20Volvo,at%20the%20end%20of%202023 https://www.fool.com/investing/how-to-invest/stocks/who-owns...)
      - reaperducer 2y ago
        But at least they're made in South Carolina.
        speed_spread 2y ago
        Only the EX90 it seems is made in SC, possibly just assembled from parts made in China. All other electric Volvos (including Polestar) are straight from China. Gas models and hybrids are still built in Europe but are being phased out.
mattmaroon 2y ago
It’s not the Starlink you’re thinking of, that’s Subaru’s name for their in-car infotaimnent system and predates the SpaceX Starlink. So it’s just Subaru. Also I doubt any ad partners can disable your car (outside of vulnerabilities like this). Subaru can but that’s the case with most modern vehicles.
- jmward01 2y ago
  Any partner that pays enough $$$ can likely do whatever they want. That is obvious by the fact that a year of driving history is displayed. If they didn't want to sell the data/access then they wouldn't be collecting such a long history of it. This is evil. I will avoid being forced to give this information at every possible turn and the companies doing this, and hiding how much they collect, should all be shut down.
  - Melatonic 2y ago
    Its also possible they collect the data just to do it (and surely not to give in rare cases to law enforcement)
  - mattmaroon 2y ago
    That's absurd. Collecting and selling your data and allowing a third party to remotely lock your car are two very different things. I have no doubt car companies sell your data, I am extremely skeptical third parties can buy rights to control your car and if that ever happened, we'd all hear about it really fast.
    - jmward01 2y ago
      Do you honestly think that they have a limit to what they will sell? I could easily imagine them selling this access to companies that repossess vehicles. An 'ownership dispute' fee that prevents your car from starting and grants additional access to the company. As soon as I typed that I couldn't stop thinking that that has to be a real thing they make real money on already. If it isn't then my guess it is only because they haven't thought about it. Companies will do anything they are explicitly allowed to do or have plausible deniability on to make money.
ChuckMcM 2y ago
Yeah, that was kind of my takeaway as well. Your car is not your car right? I mean ANYONE AT SUBARU can do this?
parsimo2010 2y ago
No, disagreeing does not completely disable anything, as you can call Subaru at any time and tell them that you want to subscribe, and they can enable Starlink remotely. I do not know exactly what is transmitted or stored when you do not have an active subscription, but you are one warrant away from having the police ordering Subaru to track your car. But they would probably try this with your cell provider before they try your car manufacturer.
SoftTalker 2y ago
If there's a warrant for your arrest, you're not going to avoid it by the police not having remote access to your car locks.
xp84 2y ago
You’re going beyond the capabilities demonstrated for us here. Whether or not those types of abilities could be built if they wanted to, here is what the author demonstrated: - ez employee account takeover - as the admin panel employee you can look up the customer’s billing account info and location history, make any changes to the customer account that a customer service employee can - you can also add an arbitrary account as an authorized user for any customer - so you can now log into the regular “Subaru owner” mobile app as that account and that’s how the car-impacting parts of this vulnerability were actually performed. That means you can activate key fob type commands and see the tracking information available through that app. The reason I point this out is that you said “remotely disable” and “lock you in your car” - and those are both things such an app can’t do. There’s no “disable car” button in those apps. If it’s anything like my GM car, it takes like 30 seconds for the car to act on each command you send. So you could lock someone out but if they have a key it’ll be easy for them to unlock it before you can re-lock it. And if it’s in motion you can’t stop it from the app. And finally cars don’t support locking in. They are all designed with handles that will open mechanically with either one or two pulls. Worst it can do to stop you is sound your alarm.

niij 2y ago

How do you disable this in a Subaru? Can you tell Subaru to turn it off or is there a low-effort way to disable it (fuse pull)?

willis936 2y ago
I can't speak for Subaru, but I did this on my Toyota last weekend (cell radio, not space radio). The fuse pull on Toyota DCM affected other systems (GPS, microphone). I got a hold of the service manual, identified the cell antenna cables, and simply unplugged them. Now "simply unplugging them" required ripping apart quite a few things and dealing with some annoyingly deep bolts, but it wasn't too terrible. Pulling the antenna cable is the right move. Fun fact on car GPS: it actually feeds back through carplay so your navigation gets worse without it. What I have yet to figure out is if the network connection is given to the car through carplay.
- stn8188 2y ago
  This is absolutely my biggest concern for when I inevitably am forced to replace our aging vehicles. The unfortunate reality of living in the Northeast is that it's near impossible to find decent (not rusted) older cars for sale. Sure, I'm within the 99.9999% of Americans who have nothing to hide, but that unequivocally does not justify the physical capability of remote monitoring or control.
  - _yb2s 2y ago
    Why not just take a weekend to fly to where used cars are unrusted, and drive one back? Also, there are quite a few well made older cars that are fully galvanized and don’t rust. I know a few people in the Northeast still driving 1980s Volvo 740s, still unrusted after nearly 40 years of salty roads. 1987 and later had the best rustproofing. I believe many older Audis also are galvanized.
    - potato3732842 2y ago
      The best galvanization was in the 80s when the OEMs were scrambling in the "surprise, lead just got banned" era (lead acts like an anode, think of it like a lesser version of a high zinc primer). That said, it's not the thick hot dip you see on I beams or on bolts at the hardware store and a modern car with modern coatings and attention to corrosion is still better. Of the three continents that produce a lot of cars the Europeans still take corrosion more seriously than anyone else.

netsharc 2y ago

Hah, them being able to bypass the 2FA by commenting-out the line: $('#securityQuestionModal').modal('show'); is... mind-boggingly stupid of whoever got the job to write that Starlink web-app. OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

Mountain_Skies 2y ago
Back when I used to do AppSec, these types of issues were extremely common. Software developers and their managers would argue endlessly about them not being real vulnerabilities, which meant I had to put together a proof of exploitability. And since these were interdepartmental fights, office politics get involved. Just one of the dozen or so reasons why I stopped doing AppSec and went back to development.
- _joel 2y ago
  That seems like a culture issue rather than an appsec issue?
  - dboreham 2y ago
    It's the toxic culture that creates the security issues. Because people who won't listen to others end up doing stupid things.
  - bagels 2y ago
    If most of your customers are like this, does the distinction matter?
  - solatic 2y ago
    I left security work for a similar reason. In most companies, Security isn't there to collaboratively build more reliable and dependable products that protect customer privacy, bringing in a useful perspective of how things can go wrong, similar to QA's role. Instead, Security is there to be the internal police, who treat engineers (and other employees) like criminals, and get recognition and rewards for stopping the company from shipping. The way the vast majority of companies treat Security is deeply dysfunctional and soul-killing to anyone who wants to bring a glass-half-full mentality to work. And in an industry where it has become practically an expectation for people to jump ship after ~4 years, that's too much of a career risk to take. (side note: QA has exactly the same problem.)

plagiarist 2y ago

I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.

inetknght 2y ago
> I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. Moreover, not just millions of dollars in aggregate, but millions of dollars per individual customer whose privacy was violated.
- TheJoeMan 2y ago
  If I collected this much information about a single individual, I would go to jail for stalking. But with the wonders of technology, I can stalk "at scale"!
neeeeeeal 2y ago
This is the way. What legitimate interest could Subaru have in maintaining this much data about their customers?
- genewitch 2y ago
  The most charitable guess I can make is that they use it to improve their driver assist, lane keeping, pacing, and that sort of thing. location and g force and direction when the automated system shuts off and returns control to the driver, that sort of thing. I don't agree with it, but that would be my guess. I own a Subaru that does this, so I'm not happy about it, but what can I do? That's rhetorical.
- ndileas 2y ago
  Unfortunately, selling it to repo men is a widely accepted practice.

chatmasta 2y ago

For those who might not read the article, note that “Starlink” is not the SpaceX service. It’s an internal name for a Subaru customer service web app.

wolrah 2y ago
> It’s an internal name for a Subaru customer service web app. It's actually the name of Subaru's connected infotainment system: https://www.subaru.com/vehicle-info/subaru-starlink.html https://www.subaru.com/vehicle-info/subaru-starlink.html
- dboreham 2y ago
  Strictly it's a "telematics system" rather than infotainment.

yapyap 2y ago

Buying a car that is connected to the internet sounds horrific.

jeroenhd 2y ago
You'll have a hard time avoiding it if you buy a new car: https://foundation.mozilla.org/en/privacynotincluded/categories/cars/ https://foundation.mozilla.org/en/privacynotincluded/categor...
- t0bia_s 2y ago
  Don't buy a new one. Buy old one and remove all tracking devices if necessary.
  - y-c-o-m-b 2y ago
    Previous Subie owner here (03 WRX, 04 Impreza, 03 Outback). I've been looking for an older one (2004-2013) for the last 6 months. The amount of people that don't know or don't disclose leaking differentials, leaking transmissions, and head-gasket issues (despite claiming they've been "fixed") is staggering. With one car I inspected, me and two other buyers came to see it at the same time; I think the seller orchestrated that intentionally. Well too bad for him, I inspected underneath and it was a leaking mess from every section. To which I quickly pointed out to the other buyers. We all walked away lol. Of course you can have these issues with newer models also, but they're so prevalent with the older ones.
- quesera 2y ago
  Wow, thanks for that link! I've been wishing for something exactly like this. Mozilla Foundation's "Privacy Not Included" product review site https://foundation.mozilla.org/en/privacynotincluded/ https://foundation.mozilla.org/en/privacynotincluded/

bilekas 2y ago

> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

jeroenhd 2y ago
> Number 1 why you need a car connected to the internet all the time To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot. > And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will. Legally speaking, I believe that depends on your local privacy laws. Practically speaking, car makers (and government agencies) love these features for troubleshooting and tech support, or for flagging crashes before any authorities or local press have time to arrive (think Tesla). Don't ask them about finding your stolen car, though. Then the data may suddenly not be available.
- bilekas 2y ago
  > To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot I really hope this was sarcastic. How did we ever manage to find our cars before IoT cars …
  - rtkwe 2y ago
    You can also do other stuff like start the climate controls so the car is comfortable before you reach it on hot or cold days.
    - bilekas 2y ago
      These things could certainly be convenient, de-icing while you're having breakfast etc but surely you don't need my location data recorded for those services ? Maybe if there was a list of options I could select from then I guess it's fine.

mavdi 2y ago

Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.

Cumpiler69 2y ago
[flagged]
- kccqzy 2y ago
  I've heard of this claim so often that I assume it to be true, though personally I've only had the fortune to work in better environments where my Indian colleagues aren't nepotistic. I suspect this might be related to the hiring bar: if a company only hires the top talent perhaps this would not be an issue.
  - gedy 2y ago
    Unfortunately I think it depends on the number and position of Indian folks. Small numbers where you deal with people individually, I've not seen issues and it's nice to work with Indian devs. In larger numbers or when in charge of hiring, there seems to be a prevalent issue of Indian cultural norms and favors kicking in and it can happen fast.
    - tonyedgecombe 2y ago
      Monocultures are almost always bad, if nothing else they are a signal that you aren't hiring on merit.
      - Cumpiler69 2y ago
        >Monocultures are almost always bad Depends on the culture, the size of the team, the product you're working on and the target demographic.

ziddoap 2y ago

Is anyone aware of a list of affected models posted anywhere? All 2015+ models? Obviously the ability to pull up account history, previous owners, etc. is applicable to anyone with a Subaru. But I'm curious if location history shows up for people that have Subarus and never registered Starlink/never used the app. The author says: >but it seemed that we had agreed to the STARLINK enrollment when we purchased it. But it's not clear to me whether "it" refers to purchasing Starlink or purchasing the vehicle.

Cerium 2y ago
Purchasing the vehicle.

godber 2y ago

This claims to bypass the telematics functionality: https://www.autoharnesshouse.com/69018.html https://www.autoharnesshouse.com/69018.html > Note for customers retaining OEM headunit: This adapter can also be used for those wishing to remove/disable the OEM Subaru Telematics functions. This is done to eliminate the tracking cabability that Subaru has built into these vehicles. If this is you, we will need to add an additional part to this adapter to re-enable the bluetooth microphone. Please purchase the option 2 adapter near the bottom of this page for this situation.

godber 2y ago
The info on that page seems a bit contradictory, but maybe I need more coffee.
bityard 2y ago
Is there anything like this for Toyota DCM? We bought a second-hand 2021 Highlander and thus did not sign any contract allowing our family to be tracked by Toyota. I went on a hunt recently for information on neutering the DCM but have thus far only found speculation and contradictory info.
- willis936 2y ago
  Yeah it's bad out there. Don't do what the yahoos hacking up their harnesses have done. The Toyota DCM I'm familiar with has 3 coax antenna lines coming in. The outer 2 are cell and the inner is GPS. Pull the cell antenna cables out of the DCM and you should be good to go. Best to hunt down your vehicle's service manual and verify the procedure first.
LandoCalrissian 2y ago
Awesome, thank you. Seems pretty straight forward.

t0bia_s 2y ago

Imagine that manufacturer can do that without any hacks and your knowledge about data collecting. Now imagine that you sell those cars to foreign countries that your government consider as enemy. I'm curious when there will be some ban of car brand, like TikTok.

deleted 2y ago
[deleted]
longtimelistnr 2y ago
Isn't this already in place? I thought this is exactly why Chinese EV's haven't flooded the market yet.
- reaperman 2y ago
  That’s likely more caused by the current 100% import tariff on Chinese EV’s.
TechDebtDevin 2y ago
Chinese cars cannot connect to the cloud in the USA.

rjmunro 2y ago

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. How did they verify the never exploited maliciously part? Did the person who's password they changed ever notice that their password didn't work any more and report the problem?

arrowleaf 2y ago
Assuming `samwcurry@gmail.com` belongs to the same person who owns samcurry.net, they changed their own password.
- nkurz 2y ago
  I don't think that's correct. See the section in the article "Enumerating Employee Emails" which finishes "The jdoe@subaru.com (redacted) email was valid! We went back to the reset password endpoint and hit send."
amatecha 2y ago
Right, especially considering the Subaru Starlink service has apparently existed since 2014 or so[0], I have to wonder how long these vulnerabilities have been present. [0] https://web.archive.org/web/20140719230852/https://www.subaru.com/engineering/starlink.html https://web.archive.org/web/20140719230852/https://www.subar...

high_na_euv 2y ago

What a shitshow!

blackeyeblitzar 2y ago

A shocking thing about Subaru cars with Starlink (their infotainment system and connected service for things like remote start) is how deep the violation of privacy is. For example they share your location data with Sirius XM by default, unless you go deep in their menus to realize it’s even happening and opt out. They bury the consent in fine print that you fly through at the dealership. Truly a despicable company.

oremolten 2y ago
all car companies do this since around 2011.(in the us) they also immediately sell all this data to car insurance companies. many apps on your phone that use location data for anything are mostly using an APK that includes a couple car insurance companies code that also just directly shares that with them. (they made the location APK for app makers to have an easy to use location data tool)
- iforgot22 2y ago
  Also cell carriers collect and give out live location data on customers

tadhgpearson 2y ago

I love the variety of tooling and joining the dots to complete this attack: dns + scanning + human factors research + html bypass on the admin site itself...

panki27 2y ago

This is even worse than the VW data leak reported around a month ago. [1] [1] https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo...

naitgacem 2y ago
Did you perhaps forgot to edit and add the link? I'm interested in hearing about that
- TechDebtDevin 2y ago
  I hope you speak German.
  - jazzyjackson 2y ago
    If you download the .mp4 you will notice it is 'deu-eng-fra', there is an English overdub available as a separate audio track.
interloxia 2y ago
Discussion at the time https://news.ycombinator.com/item?id=42524422 https://news.ycombinator.com/item?id=42524422 https://news.ycombinator.com/item?id=42547864 https://news.ycombinator.com/item?id=42547864

_huayra_ 2y ago

FYI for Subaru owners, you can opt out and have your data deleted anywhere in the US (not just California): https://www.subaru.com/support/consumer-privacy.html https://www.subaru.com/support/consumer-privacy.html It'll take ~6 months or so, but they will send you a confirmation email.

jcomis 2y ago
fwiw I have done this and received no confirmation or anything after more than 6 months. I keep submitting, maybe its working, but it doesnt seem to actually result in a confirmable change. for sure my retailer, which are 3rd parties according to that page, still has 100% access to the data, as they were able to tell my car was in another state when I called recently. seems pretty troubling
- nyokodo 2y ago
  > I have done this and received no confirmation or anything after more than 6 months Sue them, make it a class action.
  - gruez 2y ago
    That's not how lawsuits work. You can't sue just because you don't like something. You have to prove harm. "not getting confirmation" hardly counts, especially if said confirmation isn't required by law.
rozab 2y ago
It would be cool if the researcher could have tested this before reporting
- _huayra_ 2y ago
  I would guess that opted-out cars like mine are still "in the system", as I can still do all the MySubaru app stuff like un/lock, start, etc.

simonlc 2y ago

Question, if you can remote start a subaru with starlink, does that mean I could start my car from the command line during winter??? I don't pay for starlink, never really looked into it, but it sounds cheaper than installing a remote start system lol.

warkdarrior 2y ago
https://github.com/G-Two/subarulink https://github.com/G-Two/subarulink
- prh8 2y ago
  that still requires an active subscription unfortunately
  - simonlc 2y ago
    I'm guessing the subscription activates some sim card? I wonder if that's activated anyway and still tracks you if you don't sign up...
    - Shocka1 2y ago
      Based off what we've seen at this point it would be worthwhile to try.

ben7799 2y ago

I have a 2013 Outback Limited that is basically right before all this stuff got really stupid and weird. It's a great car other than it's not very fast and it gets really bad gas mileage. Amazing in the snow. I have had it since December 2012, so I've had plenty of service visits where I got newer loaners. (I special ordered my car to basically load it but not have Starlink, not have the Sunroof, but have the leather seats and the HK upgraded stereo.) Every time I have gotten a newer Subaru as a loaner it strikes me that they are worse cars for all this new stuff. The user interface is horrible in the new ones. In a lot of cases they have a skeumorphic interface up on the touch screen that mimics the physical controls in my car! The actual physical controls are about 100x faster to operate and you quickly learn where the buttons are without looking. I had an Ascent Onyx loaner last summer.. the entire touch screen UI looked like it was barely operating above 10fps. Just gross. Lots of the UI is black and white as well, not even tasteful grayscale. The Onyx I had also had the upgraded HK stereo and that is not as good as the one in my car as well, it sounded noticeably worse. The electric steering on the new Subarus is terrible as well. My old Outback is not exactly a sports car but getting out of new one back into mine it feels like you're getting into a Porsche or something when you feel the hydraulic steering. Engine/Turbo lag on a lot of the new ones is gross as well. This is of course even worse! My car only has 120k miles on it, I plan to keep it for another 4 years and then maybe give it to my kid when he gets his license. Somehow I doubt Subaru will have a competitive vehicle by then. For me to consider another one they'd really need to have an EV Outback/Forester/Ascent or a Hybrid version that gets at least 40mpg. And they need to fix all this horrible infotainment stuff in a way that the car operates better than a kids toy and actually drives well like an older Subaru. Also they need to get off the whole stupid thing with giant rims. It's supposed to be a Subaru, it needs to have tires appropriate to going relatively fast on dirt roads.

DwnVoteHoneyPot 2y ago
In addition to your comments, I think Subaru's all-wheel drive system has been switched to electrical instead of mechanical, making it worse. There are roller tests on youtube which show Subaru AWD being outperformed by Ford AWD systems.

sc68cal 2y ago

This really reinforces my aversion to internet connected cars. They used one to kill Michael Hastings.

dantillberg 2y ago

Last year, I submitted a "right to know" request to Subaru, and they sent the following back. I've reformatted it for legibility. Basically asserts they'll do and sell whatever they want (except another car to me). > Subaru may collect the following personal information about a consumer: > Categories of personal information: > Identifiers: Consumer records, Commercial information, Internet or Other Electronic Network Activity, Audio recordings, Vehicle geolocation, Professional or employee-related information, Inferences, Sensitive personal information > Categories of sources from which the personal information is collected: Retailers, i.e. authorized Subaru dealerships , Provided by consumer or vehicle, Third parties > Business or commercial purpose for which Subaru collects or sells personal information: To provide services to the consumer, To market goods and services to consumers, To provide marketing by third parties for third party goods and/or services, To comply with legal obligation > Categories of third parties with whom the personal information is shared: Business service providers, Contractors, Retailers, Corporate parent and affiliates, Third party providers of goods and/or services, Entities required to comply with the law > Categories of personal information sold: Identifiers for third party marketing of goods or services., Consumer records for third party marketing of goods or services > Categories of personal information disclosed for business purpose: Identifiers are disclosed to service providers, contractors, and third parties., Consumer records are disclosed to service providers, contractors, and third parties., Commercial information is disclosed to service providers, contractors, and third parties., Internet or other electronic information is disclosed to service providers, contractors, and third parties., Vehicle geolocation is disclosed to service providers., Inferences are disclosed to service providers and contractors., Sensitive personal information is disclosed to service providers and contractors.

Melatonic 2y ago
Good to know Seems pretty blanket wide legalese. The part about audio recordings seems a bit troublesome however
- cmgbhm 2y ago
  The non troublesome use-case is clicking the starlink button and taking to their support. Having bought a Subaru, I really tried to see where the consent is in the process. In my case, I think it’s the account establishment process that the dealer did.

stuff4ben 2y ago

As a DevSecOps/SRE whatever, I just gotta give props to the Subaru team for getting it patched within 24 hours. While it's just a small internal admin dashboard without real customer usage, the fact they acknowledged and fixed the issue so quickly speaks well of at least that part of Subaru IT.

therealfiona 2y ago

That's it... I'm not buying a car with any internet connection unless I can rip it out. And every day that's going to get harder. Guess I'll stick with old Kai Vans...

t1234s 2y ago

Having developed back end portals like this one for much smaller companies I find it hard to believe that there is an open endpoint to reset a password without any type of verification. What goes wrong in development that this type of crap makes it to production?

duxup 2y ago
It's weird, is there no feedback of any kind in these companies? All outsourced maybe? I don't get it. That would be a huge red flag and a fairly easy to understand / sell red flag.
- t1234s 2y ago
  Even if it was outsourced is there zero quality control?
  - anarticle 2y ago
    Outsourcing means you want to impose an upper limit on the cost of the feature/software. Quality control may cost more, so yes! The acceptance criteria are: service portal needs to work so employees can do xyz. The design is terrible but "works"! Having to rearc after these terrible designs would cost more, so you can see where this is going...
  - iforgot22 2y ago
    Probably QA is only going to make sure the features work. They aren't pen-testers. At best, they might try some unexpected inputs that trigger a security vuln.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
rogerhoward 2y ago
I joined a startup with a product in production for a dozen or so major customers (US universities), public facing, with a slick new front and backend the team had been working hard on. I brought along a young engineer friend who had a pet interest in pentesting, so his first task before getting up speed as a dev was a security review. He and I sat down on day one to poke around, mainly to get oriented, not expecting much l. Popped up Chrome's devtool network panel, refreshed the login page. One of the first XHR rows was to an endpoint named “getKeys” The return object was the root keys for the AWS prod account. This crap is incredibly common. Maybe not that egregious, but close enough.

deleted 2y ago

[deleted]

yellow_lead 2y ago

No bounty for such a big vulnerability is unbelievable.

1970-01-01 2y ago

Excellent write-up! However a much better title would have been "Hacking Subaru: FEEL THE FREEDOM" https://trademarks.justia.com/owners/subaru-of-new-england-inc-2006774/ https://trademarks.justia.com/owners/subaru-of-new-england-i...

deleted 2y ago

[deleted]

renewiltord 2y ago

All this is pretty cool. It's a pity there's no way to just extract it yourself for yourself. I like all these features and have an older Subaru.

jcgrillo 2y ago

Yet another example of why I don't own or drive vehicles from this stupid century.

tomohawk 2y ago

Is there a way to prevent the car from connecting to this service?

bryceacc 2y ago
scroll down to see the DCM removal https://www.subaruoutback.org/threads/disconnected-cars-non-starlink-lte-options.527915/ https://www.subaruoutback.org/threads/disconnected-cars-non-...

rurp 2y ago

There are a striking number of stories in this thread of incompetence and unethical behavior on the part of Subaru, and it makes me sad that the company has turned into such a wreck. Maybe they were always run this way but older technology didn't allow them to be quite so scummy. I bought a Subaru in the aughts that I absolutely loved and had assumed my next car would be from the same company. But when I test drove and looked into a new model I was shocked at how many terrible changes had been made, and I didn't even uncover half of what is in this thread. I'm not holding my breath, but hopefully the bad press affects sales enough to make the people running this company care and alter their behavior. The mechanical cars themselves are still nice to drive, but the terrible interfaces, obscene amount of spying, and intrusively unethical behavior really kill the experience.

dangus 2y ago
IMO Subaru has been one of the most overrated car brands for decades. Sure, these data privacy issues are rampant across the automotive industry. It really isn’t just Subaru. But really what I’m talking about is the entire product. I have no idea why people like them so much: - Some of the worst exterior styling of any brand - Cheap interiors that are so ugly - Their history is riddled with major powertrain issues especially for how well-regarded they are - Historically horrific gas mileage compared to competitors as a tradeoff for symmetrical all-wheel-drive that realistically very few of their buyers need. - Their gas mileage isn’t bad anymore but they haven’t even released any hybrids yet, meanwhile every competitor under the sun has hybrids all over the place - Their current infotainment system is god awful with horrendous graphics and the climate controls are stuck inside it I think the only positive thing I can say about the brand is the they’re the last company selling a non-euro-luxury station wagon in the US, but really it’s basically a similar stance as a typical crossover SUV so you might as well buy one of those (or just get yourself a used E Class wagon and end up with a much better car).

yearolinuxdsktp 2y ago

Luckily, in right to repair states, Such as Massachusetts, Subaru chose to disable Starlink altogether instead of making Support documentation available under the law.

motza 2y ago

Would the remote 'stop' stop a moving car? It's scary to think that someone could have easily used this basic exploit to stop all the affected vehicles on the road.

amatecha 2y ago

tfw your car is also an always-online computer running proprietary software you have no control over ... and that software is written by people who think you can block login with a modal overlay, and who make a public-facing API call that resets a password with nothing more than the account's email address...

sirjaz 2y ago

Well this is why there should be a custom local app that is not web accessible. Desktop apps and CLIs have there advantages, and this is one.

blendo 2y ago

Did users have to explicitly sign up for Starlink in order to enable tracking? Or is that the default behavior for all new Subarus? And, can this tracking be deactivated? I have a Mazda, and it required a phone call to Mazda to get it disabled.

blendo 2y ago
“SOA does not collect any vehicle-generated data unless the vehicle is associated with an active STARLINK subscription service. To sign up for the STARLINK service, you must have a MySubaru account.” https://www.subaru.com/support/privacy-policies/vehicle-privacy-notice.html https://www.subaru.com/support/privacy-policies/vehicle-priv... So looks like you’re only tracked if you are signed up with Starlink, having first obtained the prerequisite MySubaru account.
Izikiel43 2y ago
Can you share more info on Mazda?

beezle 2y ago

Slightly off topic: How are recent Mazda's in regard to all of this stuff? They were not included in that Mozilla privacy expose and I have a CX on my short list for this spring.

Izikiel43 2y ago
Idk, but I love my cx5
akimbostrawman 2y ago
They are above greed so they don't do that unlike literally everybody else pinky promise.... Do people seriously believe any tech corporations is above surveillance capitalism.

james4151 2y ago

[dead]

pards 2y ago

> it seemed that we had agreed to the STARLINK enrollment when we purchased it. Related to the GM ban https://news.ycombinator.com/item?id=42734260 https://news.ycombinator.com/item?id=42734260

dml2135 2y ago

I live in the city so I've never owned a car, but would like to get one at some point. I'd want at least a plug-in hybrid, if not full electric, and absolutely no internet connectivity or tracking (or at least something that can be physically removed). Is there even a single (new) car that fits this criteria?

monomial 2y ago

Good god. This is why I will continue to repair my older car until it's completely infeasible to do so. Then what? Are there internet communities out there actively working on disabling all this nonsense? Can't imagine buying a car like this without knowing I can physically disable the cell modem.

Chengdavid 2y ago

[dead]

thomas4151 2y ago

[dead]