4 ms·

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their busines

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. So 'only' Subaru, Starlink, their business and advertising partners, and law enforcement, can remotely track (and disable - don't think you can run from the law!) your car? > I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it. Assuming it's possible to not agree to it - does that completely disable the system, or is everyone with a Subaru just one warrant away from getting locked in their car until the police can come to arrest them? Does the car still store (I'm charitably assuming it doesn't transmit) location data, so all your friends can retroactively be identified and arrested as well, even if you never agreed to any tracking? (To get ahead of the usual retort - haha yes, phones also track this data, therefore let's not fix any problems unless we can fix all of them at the same time. But actually let's use the other problems as an excuse to do nothing.)

aftbit 2y ago
I was lucky to have the DCM in my 2019 Outback (which is responsible for cellular communication and thus this whole STARLINK thing) replaced with a bypass box under the warranty program related to the end of 3G service. My car was trying to go online 30 times an hour or something like that, draining the battery enough that it needed to be replaced after just 4 years. They don't have enough new DCMs so they were willing to replace it with a bypass box instead, which seems even better to me. So at least my Subaru cannot connect to the cloud anymore. I'm sure it still stores location and telemetry data for insurance fraud reasons though.
- bongodongobob 2y ago
  That's avg time to replace a battery.
  - aftbit 2y ago
    Hmm really? My Camry made it nearly 10 years, and my Civic still had a good battery 6 years in when I sold it. Regardless, the battery and DCM were both tested by Subaru. The battery tested bad, and the DCM tested for a high parasitic draw. I drove the car daily, and the battery would die if I didn't drive it for 4 days. I didn't just make this up either, search "DCM parasitic draw" on Google for more. Subaru even sent me a letter outlining my options for repairs.
    - tedmielczarek 2y ago
      I've heard about this being a known issue with cars from other manufacturers, so I can believe it. It's interesting that nobody thought to include a way to let the vehicle know it should stop trying to communicate to handle a potential end-of-service situation like this. It's fairly common for people to keep cars for more than a decade, they're a really expensive necessity for many.
    - bongodongobob 2y ago
      Maybe I'm used to harsher weather in the Midwest.
      - deleted 2y ago
        [deleted]
    - anotherhue 2y ago
      That's a known issue. Reports all over the subaru forums. I tried to measure it myself with my little multimeter and now I don't have a working multimeter. One suggestion I tried that seemed to work was to not keep the key close to the car, since that'd not physically possible for me I wrap it in an ESD bag. Haven't had much issue since, but no promises.
    - vel0city 2y ago
      Lots of places will say an average car battery's life is somewhere around 3-5 years. It is highly dependent on weather. Here where there are regularly long spans of 100F+ days, a battery will have done pretty good to make it five years; many die in 3-4. Same in very cold climates. If you're in a place with good weather all the time they'll last considerably longer.
      - thejazzman 2y ago
        or maybe even more importantly, a garage
    - MisterTea 2y ago
      Depends on the battery and how it was (ab)used. I have seen batteries last only 3 years or as long as 7.
  - giantg2 2y ago
    Eh, I think 6 years is kind of average. My previous one lasted 10-11 years. My current one is 8. I had two others that were 4-5 years and still going strong. This was in a location that gets reasonably hot in the summer and reasonably cold in winter. If it's only lasting you 3-4 years, then it's a shitty brand, the battery was abused, or it wasn't maintained.
- dylan604 2y ago
  > So at least my Subaru cannot connect to the cloud anymore. Sounds like something you can use to justify a higher selling price when the time comes
  - downrightmike 2y ago
    especially those that the insurers are 10x the bill on for previous driving data collection
  - arcanemachiner 2y ago
    I envy your optimism.
    - dylan604 2y ago
      i've been looking at getting a used car, and this is actually one of the considerations for me. no touch screen is another.
    - lazide 2y ago
      You’d be surprised - a lot of younger dudes in particular appreciate things like this, as well as certain types of exhaust modifications and the like ;)
- mmmlinux 2y ago
  FWIW i never replaced the 3g box in my 2018 subaru, and never have a battery drain issue. the battery did fail about 4 years in to owning the car, but it was a cell failure not a drain issue.
  - pfooti 2y ago
    My Subaru, a 2018 outback, would be completely battery dead if I left it parked for more than a week or so. Happened once at the airport, after which I started carrying a battery pack car starter. The guy at the airport who have us a jump said it happened all the time with Subarus in long term parking.
    - all2 2y ago
      To be fair, this happens on my 05 Outback.
    - doubled112 2y ago
      This isn’t all that uncommon in any vehicle.
      - NooneAtAll3 2y ago
        a week? yes it is
  - reginald78 2y ago
    My local mechanic said that there is a firmware update that supposedly fixes the radio drain last time I replaced the battery but I haven't looked into it. He primarily works on Subarus and it sounded like he'd seen that as a root cause of dead battery a lot.
    - Melatonic 2y ago
      Is that firmware update also just replacing the 3G SIM though with a 4G one? In that case it will just fix the issue of it not being able to contact the cloud servers. Also makes me wonder - what if someone has a subaru and lives out in a very remote area where there is no 3G or 4G service? Would that not have the same issue as the cell towers being deprecated for 3G? Seems like (specifically for Subaru owners) this might be a more common type of living situation than other car owners too!
- bdcravens 2y ago
  I had a similar issue when I connected my electricity provider to my Kia EV6. Presumably it would turn on charging when the price was optimal, but they were pinging it for status so often that the car never went to sleep, and it drained the 12V. Funny enough, the dealership couldn't figure it out; I "fixed" it by changing my Kia credentials.
- Melatonic 2y ago
  My 2017 hasnt had the battery issue yet (they said only some subarus are supposedly affected). How did you verify how often it was trying to go online? Now very curios in this bypass box as well - I heard just manually removing the 3G SIM (supposedly easy) can also maybe cause battery issues. If the "bypass box" alleviates all potential use of the system that is ideal long term!
- liveoneggs 2y ago
  my subaru is eating through batteries!
reaperducer 2y ago
Assuming it's possible to not agree to it My new car came with something called "Google Built-In," which seems to be the bastard sibling of Google Car Play. During the set up, if you'd like to read the privacy policy, you must scan a QR code on your phone, which opens a web page that does not display on mobile devices. If you'd like to opt-out of anything, you have to create a Google account, then log the car into that Google account, then log into that Google account on your phone, then go hunting for the settings on both the car and in the Google account online. Good luck finding them all. Also, it is not possible to uninstall certain "essential" Google apps from the car. Apparently, YouTube is now an "essential" part of driving.
- rurp 2y ago
  Yeesh, which care manufacturer is this from?
  - reaperducer 2y ago
    Volvo.
    - onetokeoverthe 2y ago
      The real owner of Volvo is Chinese automaker Geely. The company acquired the Swedish automaker from Ford in 2010 for $1.8Bil. source. https://www.fool.com/investing/how-to-invest/stocks/who-owns-volvo/#:~:text=The%20real%20owner%20of%20Volvo,at%20the%20end%20of%202023 https://www.fool.com/investing/how-to-invest/stocks/who-owns...)
      - reaperducer 2y ago
        But at least they're made in South Carolina.
        speed_spread 2y ago
        Only the EX90 it seems is made in SC, possibly just assembled from parts made in China. All other electric Volvos (including Polestar) are straight from China. Gas models and hybrids are still built in Europe but are being phased out.
mattmaroon 2y ago
It’s not the Starlink you’re thinking of, that’s Subaru’s name for their in-car infotaimnent system and predates the SpaceX Starlink. So it’s just Subaru. Also I doubt any ad partners can disable your car (outside of vulnerabilities like this). Subaru can but that’s the case with most modern vehicles.
- jmward01 2y ago
  Any partner that pays enough $$$ can likely do whatever they want. That is obvious by the fact that a year of driving history is displayed. If they didn't want to sell the data/access then they wouldn't be collecting such a long history of it. This is evil. I will avoid being forced to give this information at every possible turn and the companies doing this, and hiding how much they collect, should all be shut down.
  - Melatonic 2y ago
    Its also possible they collect the data just to do it (and surely not to give in rare cases to law enforcement)
  - mattmaroon 2y ago
    That's absurd. Collecting and selling your data and allowing a third party to remotely lock your car are two very different things. I have no doubt car companies sell your data, I am extremely skeptical third parties can buy rights to control your car and if that ever happened, we'd all hear about it really fast.
    - jmward01 2y ago
      Do you honestly think that they have a limit to what they will sell? I could easily imagine them selling this access to companies that repossess vehicles. An 'ownership dispute' fee that prevents your car from starting and grants additional access to the company. As soon as I typed that I couldn't stop thinking that that has to be a real thing they make real money on already. If it isn't then my guess it is only because they haven't thought about it. Companies will do anything they are explicitly allowed to do or have plausible deniability on to make money.
ChuckMcM 2y ago
Yeah, that was kind of my takeaway as well. Your car is not your car right? I mean ANYONE AT SUBARU can do this?
parsimo2010 2y ago
No, disagreeing does not completely disable anything, as you can call Subaru at any time and tell them that you want to subscribe, and they can enable Starlink remotely. I do not know exactly what is transmitted or stored when you do not have an active subscription, but you are one warrant away from having the police ordering Subaru to track your car. But they would probably try this with your cell provider before they try your car manufacturer.
SoftTalker 2y ago
If there's a warrant for your arrest, you're not going to avoid it by the police not having remote access to your car locks.
xp84 2y ago
You’re going beyond the capabilities demonstrated for us here. Whether or not those types of abilities could be built if they wanted to, here is what the author demonstrated: - ez employee account takeover - as the admin panel employee you can look up the customer’s billing account info and location history, make any changes to the customer account that a customer service employee can - you can also add an arbitrary account as an authorized user for any customer - so you can now log into the regular “Subaru owner” mobile app as that account and that’s how the car-impacting parts of this vulnerability were actually performed. That means you can activate key fob type commands and see the tracking information available through that app. The reason I point this out is that you said “remotely disable” and “lock you in your car” - and those are both things such an app can’t do. There’s no “disable car” button in those apps. If it’s anything like my GM car, it takes like 30 seconds for the car to act on each command you send. So you could lock someone out but if they have a key it’ll be easy for them to unlock it before you can re-lock it. And if it’s in motion you can’t stop it from the app. And finally cars don’t support locking in. They are all designed with handles that will open mechanically with either one or two pulls. Worst it can do to stop you is sound your alarm.

aftbit 2y ago

I was lucky to have the DCM in my 2019 Outback (which is responsible for cellular communication and thus this whole STARLINK thing) replaced with a bypass box under the warranty program related to the end of 3G service. My car was trying to go online 30 times an hour or something like that, draining the battery enough that it needed to be replaced after just 4 years. They don't have enough new DCMs so they were willing to replace it with a bypass box instead, which seems even better to me. So at least my Subaru cannot connect to the cloud anymore. I'm sure it still stores location and telemetry data for insurance fraud reasons though.

bongodongobob 2y ago
That's avg time to replace a battery.
- aftbit 2y ago
  Hmm really? My Camry made it nearly 10 years, and my Civic still had a good battery 6 years in when I sold it. Regardless, the battery and DCM were both tested by Subaru. The battery tested bad, and the DCM tested for a high parasitic draw. I drove the car daily, and the battery would die if I didn't drive it for 4 days. I didn't just make this up either, search "DCM parasitic draw" on Google for more. Subaru even sent me a letter outlining my options for repairs.
  - tedmielczarek 2y ago
    I've heard about this being a known issue with cars from other manufacturers, so I can believe it. It's interesting that nobody thought to include a way to let the vehicle know it should stop trying to communicate to handle a potential end-of-service situation like this. It's fairly common for people to keep cars for more than a decade, they're a really expensive necessity for many.
  - bongodongobob 2y ago
    Maybe I'm used to harsher weather in the Midwest.
    - deleted 2y ago
      [deleted]
  - anotherhue 2y ago
    That's a known issue. Reports all over the subaru forums. I tried to measure it myself with my little multimeter and now I don't have a working multimeter. One suggestion I tried that seemed to work was to not keep the key close to the car, since that'd not physically possible for me I wrap it in an ESD bag. Haven't had much issue since, but no promises.
  - vel0city 2y ago
    Lots of places will say an average car battery's life is somewhere around 3-5 years. It is highly dependent on weather. Here where there are regularly long spans of 100F+ days, a battery will have done pretty good to make it five years; many die in 3-4. Same in very cold climates. If you're in a place with good weather all the time they'll last considerably longer.
    - thejazzman 2y ago
      or maybe even more importantly, a garage
  - MisterTea 2y ago
    Depends on the battery and how it was (ab)used. I have seen batteries last only 3 years or as long as 7.
- giantg2 2y ago
  Eh, I think 6 years is kind of average. My previous one lasted 10-11 years. My current one is 8. I had two others that were 4-5 years and still going strong. This was in a location that gets reasonably hot in the summer and reasonably cold in winter. If it's only lasting you 3-4 years, then it's a shitty brand, the battery was abused, or it wasn't maintained.
dylan604 2y ago
> So at least my Subaru cannot connect to the cloud anymore. Sounds like something you can use to justify a higher selling price when the time comes
- downrightmike 2y ago
  especially those that the insurers are 10x the bill on for previous driving data collection
- arcanemachiner 2y ago
  I envy your optimism.
  - dylan604 2y ago
    i've been looking at getting a used car, and this is actually one of the considerations for me. no touch screen is another.
  - lazide 2y ago
    You’d be surprised - a lot of younger dudes in particular appreciate things like this, as well as certain types of exhaust modifications and the like ;)
mmmlinux 2y ago
FWIW i never replaced the 3g box in my 2018 subaru, and never have a battery drain issue. the battery did fail about 4 years in to owning the car, but it was a cell failure not a drain issue.
- pfooti 2y ago
  My Subaru, a 2018 outback, would be completely battery dead if I left it parked for more than a week or so. Happened once at the airport, after which I started carrying a battery pack car starter. The guy at the airport who have us a jump said it happened all the time with Subarus in long term parking.
  - all2 2y ago
    To be fair, this happens on my 05 Outback.
  - doubled112 2y ago
    This isn’t all that uncommon in any vehicle.
    - NooneAtAll3 2y ago
      a week? yes it is
- reginald78 2y ago
  My local mechanic said that there is a firmware update that supposedly fixes the radio drain last time I replaced the battery but I haven't looked into it. He primarily works on Subarus and it sounded like he'd seen that as a root cause of dead battery a lot.
  - Melatonic 2y ago
    Is that firmware update also just replacing the 3G SIM though with a 4G one? In that case it will just fix the issue of it not being able to contact the cloud servers. Also makes me wonder - what if someone has a subaru and lives out in a very remote area where there is no 3G or 4G service? Would that not have the same issue as the cell towers being deprecated for 3G? Seems like (specifically for Subaru owners) this might be a more common type of living situation than other car owners too!
bdcravens 2y ago
I had a similar issue when I connected my electricity provider to my Kia EV6. Presumably it would turn on charging when the price was optimal, but they were pinging it for status so often that the car never went to sleep, and it drained the 12V. Funny enough, the dealership couldn't figure it out; I "fixed" it by changing my Kia credentials.
Melatonic 2y ago
My 2017 hasnt had the battery issue yet (they said only some subarus are supposedly affected). How did you verify how often it was trying to go online? Now very curios in this bypass box as well - I heard just manually removing the 3G SIM (supposedly easy) can also maybe cause battery issues. If the "bypass box" alleviates all potential use of the system that is ideal long term!
liveoneggs 2y ago
my subaru is eating through batteries!

reaperducer 2y ago

Assuming it's possible to not agree to it My new car came with something called "Google Built-In," which seems to be the bastard sibling of Google Car Play. During the set up, if you'd like to read the privacy policy, you must scan a QR code on your phone, which opens a web page that does not display on mobile devices. If you'd like to opt-out of anything, you have to create a Google account, then log the car into that Google account, then log into that Google account on your phone, then go hunting for the settings on both the car and in the Google account online. Good luck finding them all. Also, it is not possible to uninstall certain "essential" Google apps from the car. Apparently, YouTube is now an "essential" part of driving.

rurp 2y ago
Yeesh, which care manufacturer is this from?
- reaperducer 2y ago
  Volvo.
  - onetokeoverthe 2y ago
    The real owner of Volvo is Chinese automaker Geely. The company acquired the Swedish automaker from Ford in 2010 for $1.8Bil. source. https://www.fool.com/investing/how-to-invest/stocks/who-owns-volvo/#:~:text=The%20real%20owner%20of%20Volvo,at%20the%20end%20of%202023 https://www.fool.com/investing/how-to-invest/stocks/who-owns...)
    - reaperducer 2y ago
      But at least they're made in South Carolina.
      - speed_spread 2y ago
        Only the EX90 it seems is made in SC, possibly just assembled from parts made in China. All other electric Volvos (including Polestar) are straight from China. Gas models and hybrids are still built in Europe but are being phased out.

mattmaroon 2y ago

It’s not the Starlink you’re thinking of, that’s Subaru’s name for their in-car infotaimnent system and predates the SpaceX Starlink. So it’s just Subaru. Also I doubt any ad partners can disable your car (outside of vulnerabilities like this). Subaru can but that’s the case with most modern vehicles.

jmward01 2y ago
Any partner that pays enough $$$ can likely do whatever they want. That is obvious by the fact that a year of driving history is displayed. If they didn't want to sell the data/access then they wouldn't be collecting such a long history of it. This is evil. I will avoid being forced to give this information at every possible turn and the companies doing this, and hiding how much they collect, should all be shut down.
- Melatonic 2y ago
  Its also possible they collect the data just to do it (and surely not to give in rare cases to law enforcement)
- mattmaroon 2y ago
  That's absurd. Collecting and selling your data and allowing a third party to remotely lock your car are two very different things. I have no doubt car companies sell your data, I am extremely skeptical third parties can buy rights to control your car and if that ever happened, we'd all hear about it really fast.
  - jmward01 2y ago
    Do you honestly think that they have a limit to what they will sell? I could easily imagine them selling this access to companies that repossess vehicles. An 'ownership dispute' fee that prevents your car from starting and grants additional access to the company. As soon as I typed that I couldn't stop thinking that that has to be a real thing they make real money on already. If it isn't then my guess it is only because they haven't thought about it. Companies will do anything they are explicitly allowed to do or have plausible deniability on to make money.

ChuckMcM 2y ago

Yeah, that was kind of my takeaway as well. Your car is not your car right? I mean ANYONE AT SUBARU can do this?

parsimo2010 2y ago

No, disagreeing does not completely disable anything, as you can call Subaru at any time and tell them that you want to subscribe, and they can enable Starlink remotely. I do not know exactly what is transmitted or stored when you do not have an active subscription, but you are one warrant away from having the police ordering Subaru to track your car. But they would probably try this with your cell provider before they try your car manufacturer.

SoftTalker 2y ago

If there's a warrant for your arrest, you're not going to avoid it by the police not having remote access to your car locks.

xp84 2y ago

You’re going beyond the capabilities demonstrated for us here. Whether or not those types of abilities could be built if they wanted to, here is what the author demonstrated: - ez employee account takeover - as the admin panel employee you can look up the customer’s billing account info and location history, make any changes to the customer account that a customer service employee can - you can also add an arbitrary account as an authorized user for any customer - so you can now log into the regular “Subaru owner” mobile app as that account and that’s how the car-impacting parts of this vulnerability were actually performed. That means you can activate key fob type commands and see the tracking information available through that app. The reason I point this out is that you said “remotely disable” and “lock you in your car” - and those are both things such an app can’t do. There’s no “disable car” button in those apps. If it’s anything like my GM car, it takes like 30 seconds for the car to act on each command you send. So you could lock someone out but if they have a key it’ll be easy for them to unlock it before you can re-lock it. And if it’s in motion you can’t stop it from the app. And finally cars don’t support locking in. They are all designed with handles that will open mechanically with either one or two pulls. Worst it can do to stop you is sound your alarm.