6 ms·

Hackers crack Subaru's connected services to access data, door locks and more

80 points by gmays 2y ago

Dxtros 2y ago
It’s great this was patched, but would love an open source way to remote start my car, without paying for subaru’s subscription.
- foolfoolz 2y ago
  you can buy hardware for this over radio. just google your model, year, and remote start kit. some of these have 400ft range. i bet most of your remote starts are within that range anyway https://www.12volt.solutions/products/2018-subaru-crosstrek-plug-and-play-remote-start-kit-push-button-start?variant=32819969523815&country=US&currency=USD&utm_medium=product_sync&utm_source=google&utm_content=sag_organic&utm_campaign=sag_organic&srsltid=AfmBOorTIU1hvuuDjNv6PzTP4Tx4G-7Leo_LghQACW1bXu9d7EZ9R7OHQPM&gQT=1 https://www.12volt.solutions/products/2018-subaru-crosstrek-...
amiga386 2y ago
The article Jalopnik based its piece on (and didn't even link to): https://samcurry.net/hacking-subaru https://samcurry.net/hacking-subaru Previous HN discussion on that: https://news.ycombinator.com/item?id=42803279 https://news.ycombinator.com/item?id=42803279
edm0nd 2y ago
Sam Curry is a beast and I'm constantly amazed at how many vulns he finds each year. He's super talented and also gives great talks!
lintimes 2y ago
Reminder that Subaru have terrible data privacy terms: https://foundation.mozilla.org/en/privacynotincluded/subaru/ https://foundation.mozilla.org/en/privacynotincluded/subaru/ Opt out here if you own one of their cars with connected services: https://subarucustomersupport.powerappsportals.com/Consumer-privacy/ https://subarucustomersupport.powerappsportals.com/Consumer-...
- ziddoap 2y ago
  Reminder that literally every car company has terrible data privacy terms. https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/ https://foundation.mozilla.org/en/privacynotincluded/article... Subaru, despite being awful with privacy, is actually on the upper end of the spectrum. Tesla, Nissan, Hyundai, Cadillac, GMC, Buick, Chevrolet, Kia, Acura, Honda, Mercedes-Benz, Audi, Lincoln, Ford, Lexus, Toyota, Volkswagen, Dodge, Chrysler, Jeep, and Fiat all ranked worse.
  - natch 2y ago
    Tesla did not rank worse. The article could not find anything bad to say about Tesla's actual practices, so they scrounged some stuff up like "having AI means Tesla bad" and put in the Tesla statement that removing connectivity stops your ability to get software updates — well, yeah... They neglected to mention that any data Tesla collects does not identify you — even better than that, it does not even identify the specific vehicle. They do have the ability to go back and forensically get data for a specific car in special situations (accidents needing investigation for example) but they are so far ahead in privacy it's a joke that the article tried to portray it otherwise.
    - ziddoap 2y ago
      >having AI means Tesla bad That's not what was said. "They neglected to mention that any data Tesla collects does not identify you" and "They do have the ability to go back and forensically get data for a specific car in special situations" Are contradicting each other. Anyways, lets take Tesla out of the mix. The overall point is that every car company sucks.
      - natch 2y ago
        I've found one company that does not suck in this department, so, the point is questionable. >Are contradicting each other. Zero knowledge proofs, cryptographic hashes, etc. I don't claim to know what they're doing but it's not necessarily a contradiction.
lostmsu 2y ago
Now do the same for Toyota so I could replace their shitty app with my own. Why can't automakers hire 1 descent UX designer? If they can't afford it, they could band up and hire one.
TheRealPomax 2y ago
Is it even "crack" when what you're actually doing is "just reading plain text requests and responses"? Maybe if you squint the whole "trying to find a valid email address" is cracking, but that's a bit like calling poking at doors to see which one swings open and then walking through it "forced entry".
aliljet 2y ago
I am so curious about taking over running the services that perform this for my car? Shouldn't I be able to issue commands to my car myself?
- CursedUrn 2y ago
  You can't even control the services yourself on a Windows PC anymore, let alone something embedded like a car.
willvarfar 2y ago
How can a car brand famed for its reliability have such awful styling (this is subjective, but it seems to be sentiment that many share with me) and now such poor software etc? Such as shame.
- rconti 2y ago
  Huh. I had to look it up, because I never would have put Subaru at the top of the reliability charts; experience and anecdotes would put it in the lower tier of Japanese automakers (granted, still well above average). But CR says #1 .. for now! Historically, their history of head gasket issues, cam seal issues, ringlands on turbo cars, the continued use of timing belts, and other issues would definitely not have one placing Subaru at the top of perceived reliability rankings. https://www.consumerreports.org/cars/car-reliability-owner-satisfaction/who-makes-the-most-reliable-cars-a7824554938/ https://www.consumerreports.org/cars/car-reliability-owner-s...
  - ben7799 2y ago
    A lot of those are distant memories of old designs. Head gaskets have been a non-issue for a decade or more now and timing chains replaced belts a similarly long time ago. Many of those issues were relevant to the EJ series of engines, which were used in various forms on almost every Subaru model for a very long time, but today pretty much every car uses the FB or FA series of engines.
    - SpecialistK 2y ago
      They're also vehicles that are often driven hard and tuned, especially the WRX and BRZ.
    - rconti 2y ago
      Thanks, good to know. In the early 2000s the story was "we fixed the headgasket issues from the 90s!" which seemed to mostly be "we put in thicker coolant so hopefully it'll be less of an issue". So I feel it was reasonably to remain skeptical- it takes a long time for cars to get the miles needed for problems to surface. Our 08 Impreza (my wife's 3rd Subaru) still used timing belts. It had cam seal issues at 175k miles but the head gasket held up -- though not all did. Good to know they finally went to timing chains.
rkagerer 2y ago
Can you even buy a car today without all this cloud crap, and with a few buttons and dials remaining?
- ge96 2y ago
  me personally I like buying older sporty cars edit: what's not great is the old infotainment ha, today had a playlist queued via bluetooth, stopped working like great, "suffered" from the radio ads
  - lamp_book 2y ago
    They make these Bluetooth-FM transmitters that you can plug in to the cigarette lighter. Not the best sound quality but reliable.
    - ge96 2y ago
      That's cool relevant to the Taylor swift post recently ha

80 points by gmays 2y ago

It’s great this was patched, but would love an open source way to remote start my car, without paying for subaru’s subscription.

foolfoolz 2y ago
you can buy hardware for this over radio. just google your model, year, and remote start kit. some of these have 400ft range. i bet most of your remote starts are within that range anyway https://www.12volt.solutions/products/2018-subaru-crosstrek-plug-and-play-remote-start-kit-push-button-start?variant=32819969523815&country=US&currency=USD&utm_medium=product_sync&utm_source=google&utm_content=sag_organic&utm_campaign=sag_organic&srsltid=AfmBOorTIU1hvuuDjNv6PzTP4Tx4G-7Leo_LghQACW1bXu9d7EZ9R7OHQPM&gQT=1 https://www.12volt.solutions/products/2018-subaru-crosstrek-...

amiga386 2y ago

The article Jalopnik based its piece on (and didn't even link to): https://samcurry.net/hacking-subaru https://samcurry.net/hacking-subaru Previous HN discussion on that: https://news.ycombinator.com/item?id=42803279 https://news.ycombinator.com/item?id=42803279

edm0nd 2y ago

Sam Curry is a beast and I'm constantly amazed at how many vulns he finds each year. He's super talented and also gives great talks!

lintimes 2y ago

Reminder that Subaru have terrible data privacy terms: https://foundation.mozilla.org/en/privacynotincluded/subaru/ https://foundation.mozilla.org/en/privacynotincluded/subaru/ Opt out here if you own one of their cars with connected services: https://subarucustomersupport.powerappsportals.com/Consumer-privacy/ https://subarucustomersupport.powerappsportals.com/Consumer-...

ziddoap 2y ago
Reminder that literally every car company has terrible data privacy terms. https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/ https://foundation.mozilla.org/en/privacynotincluded/article... Subaru, despite being awful with privacy, is actually on the upper end of the spectrum. Tesla, Nissan, Hyundai, Cadillac, GMC, Buick, Chevrolet, Kia, Acura, Honda, Mercedes-Benz, Audi, Lincoln, Ford, Lexus, Toyota, Volkswagen, Dodge, Chrysler, Jeep, and Fiat all ranked worse.
- natch 2y ago
  Tesla did not rank worse. The article could not find anything bad to say about Tesla's actual practices, so they scrounged some stuff up like "having AI means Tesla bad" and put in the Tesla statement that removing connectivity stops your ability to get software updates — well, yeah... They neglected to mention that any data Tesla collects does not identify you — even better than that, it does not even identify the specific vehicle. They do have the ability to go back and forensically get data for a specific car in special situations (accidents needing investigation for example) but they are so far ahead in privacy it's a joke that the article tried to portray it otherwise.
  - ziddoap 2y ago
    >having AI means Tesla bad That's not what was said. "They neglected to mention that any data Tesla collects does not identify you" and "They do have the ability to go back and forensically get data for a specific car in special situations" Are contradicting each other. Anyways, lets take Tesla out of the mix. The overall point is that every car company sucks.
    - natch 2y ago
      I've found one company that does not suck in this department, so, the point is questionable. >Are contradicting each other. Zero knowledge proofs, cryptographic hashes, etc. I don't claim to know what they're doing but it's not necessarily a contradiction.

lostmsu 2y ago

Now do the same for Toyota so I could replace their shitty app with my own. Why can't automakers hire 1 descent UX designer? If they can't afford it, they could band up and hire one.

TheRealPomax 2y ago

Is it even "crack" when what you're actually doing is "just reading plain text requests and responses"? Maybe if you squint the whole "trying to find a valid email address" is cracking, but that's a bit like calling poking at doors to see which one swings open and then walking through it "forced entry".

aliljet 2y ago

I am so curious about taking over running the services that perform this for my car? Shouldn't I be able to issue commands to my car myself?

CursedUrn 2y ago
You can't even control the services yourself on a Windows PC anymore, let alone something embedded like a car.

willvarfar 2y ago

How can a car brand famed for its reliability have such awful styling (this is subjective, but it seems to be sentiment that many share with me) and now such poor software etc? Such as shame.

rconti 2y ago
Huh. I had to look it up, because I never would have put Subaru at the top of the reliability charts; experience and anecdotes would put it in the lower tier of Japanese automakers (granted, still well above average). But CR says #1 .. for now! Historically, their history of head gasket issues, cam seal issues, ringlands on turbo cars, the continued use of timing belts, and other issues would definitely not have one placing Subaru at the top of perceived reliability rankings. https://www.consumerreports.org/cars/car-reliability-owner-satisfaction/who-makes-the-most-reliable-cars-a7824554938/ https://www.consumerreports.org/cars/car-reliability-owner-s...
- ben7799 2y ago
  A lot of those are distant memories of old designs. Head gaskets have been a non-issue for a decade or more now and timing chains replaced belts a similarly long time ago. Many of those issues were relevant to the EJ series of engines, which were used in various forms on almost every Subaru model for a very long time, but today pretty much every car uses the FB or FA series of engines.
  - SpecialistK 2y ago
    They're also vehicles that are often driven hard and tuned, especially the WRX and BRZ.
  - rconti 2y ago
    Thanks, good to know. In the early 2000s the story was "we fixed the headgasket issues from the 90s!" which seemed to mostly be "we put in thicker coolant so hopefully it'll be less of an issue". So I feel it was reasonably to remain skeptical- it takes a long time for cars to get the miles needed for problems to surface. Our 08 Impreza (my wife's 3rd Subaru) still used timing belts. It had cam seal issues at 175k miles but the head gasket held up -- though not all did. Good to know they finally went to timing chains.

rkagerer 2y ago

Can you even buy a car today without all this cloud crap, and with a few buttons and dials remaining?

ge96 2y ago
me personally I like buying older sporty cars edit: what's not great is the old infotainment ha, today had a playlist queued via bluetooth, stopped working like great, "suffered" from the radio ads
- lamp_book 2y ago
  They make these Bluetooth-FM transmitters that you can plug in to the cigarette lighter. Not the best sound quality but reliable.
  - ge96 2y ago
    That's cool relevant to the Taylor swift post recently ha