7 ms·
Hyundai wants loniq 5 customers to pay for cybersecurity patch in baffling move
- mihaaly 1y agoCar manufacturers seems to be determined to discourage people from buying their car.
- neilv 1y agoMaybe a better link: https://www.theverge.com/news/757205/hyundai-ioniq-5-security-upgrade-fix-game-boy-device-attacks https://www.theverge.com/news/757205/hyundai-ioniq-5-securit...
- themafia 1y agoAlso frustrating but for different reasons: > in 2023 over the “Kia Boyz” attacks that allowed thieves to bypass a vehicle’s security system using a USB cable. The USB cable happened to have the right size to engage the starter mechanism. Any physical object with similar dimensions could have been used. It really undercuts how absolutely terrible the Kia security design was around that component.
- Terr_ 1y agoIn some vehicles, their "software fix" literally did nothing but move thieves from smashing a window to screwdriver'ing the driver door lock. More work for the thieves, but hardly a fix to inspire confidence.
- TylerE 1y agoThis is why, back when I owned a Jeep, I never locked it. Figured if someone wanted the 85 cents in change that badly I'd rather they not take a knife to my (plastic) windows.
- anonym29 1y agoThe "Kia Boyz" saga was primarily motivated by theft of the vehicle itself, not the contents of the vehicle.
- Terr_ 1y agoRight, and even un-sexy and inexpensive vehicles get targeted these days, because they can be used as tools to commit other crimes, not just a commodity to be resold or scavenged.
- charcircuit 1y agoA stolen car being a tool is why it is a commodity to be resold.
- Terr_ 1y agoYou're confusing "a commodity to the thief, perhaps someday a tool to to whoever receives stolen goods" versus "a tool to the thief." The first is used in daily commutes, the second is used once as a battering-ram/getaway car before being abandoned in a ditch.
- themafia 1y agoThe thing I did not expect is that most of these criminals will gladly connect their phone to the cars entertainment system so they can play their music while they do this. They can then brag about the number of thefts they've engaged in by the number of Kia vehicles listed in their phones bluetooth connection list. The surprise is that the police don't seem to understand how to incorporate these facts into their tactics.
- Terr_ 1y agoKnowing folks with this problem, I've been looking into some way of adding some kind of "pulling or removing the door handle without first disabling the alarm triggers the alarm" circuit... but the necessary disassembly is a pain.
- OutOfHere 1y agoI guess this means Hyundai goes on the blacklist too.
- EverydayBalloon 1y ago[dead]
- userbinator 1y ago[flagged]
- mindslight 1y agoSure, that could be a decent legal regime. The first step to enabling it would be releasing the source code and system documentation for the product they've sold, so that it's even possible for anyone else besides themselves to fix it. Until then it's a black box the company has chosen to retain responsibility for. And frankly regulators should be making sure they support the 20-40 years of useful life we generally expect from automobiles.
- thfuran 1y agoI think you significantly overestimate people’s expectations for automobiles.
- mindslight 1y agoI'm not talking about individuals' expectations for how long they personally will use a given vehicle, but rather societal expectations for how long a given vehicle will live across all tiers of the market. The cell phone made-to-be-ewaste model shouldn't be allowed to infect capital assets costing 100x as much.
- thfuran 1y agoYes, and the scrappage rate is about 4.5%. A 40 year old car is not the norm.
- Dylan16807 1y agoAt 4.5% loss per year, you'd still have 16% of cars running at 40 years. That's pretty normal.
- 1y ago
- wiradikusuma 1y agoI understand that development costs are not free, and there's extra hardware involved, but IMO they should take this as marketing cost.
- yccs27 1y agoNot even a marketing cost, a delayed engineering cost to fix a fault in the product.
- lokar 1y agoYeah, I considered an ionic the last time I was getting a car. Now I’ll never again consider them.
- inferiorhuman 1y agoThe Kia Boys stuff, child labor, and ICCU failures weren't enough? The Ioniq 5 absolutely looks like a compelling car but from my POV Hyundai seems hell bent on snatching defeat from the jaws of victory.
- moepstar 1y agoI'd add dealerships to the list. I've had to "experience" those once for our testdrive of said Ioniq 5. Well, never again. "Dubious" is the most friendly word i have for the one that is next to us. And: the car itself is priced at least 10-15k€ too high for what it is.
- inferiorhuman 1y agoI watched the Rich Rebuilds review of the Ioniq 5N recently and while I'm underwhelmed by Hyundai as a company I'll disagree with you and Rich about Hyundai pricing these $10-15k too high. Pretty much the only competition is the Model 3 (Performance), and by that metric Ioniq pricing is spot on. Sure the iD.4 exists but VW really flubbed the software on that. And if you're eyeing the 5N over the regular 5, it did the Pike's Peak climb faster than the Tesla (and on a single charge IIRC). Compared to the Tesla, the Hyundai has an actual interior with physical controls, an 800V charging system, panels that actually line up, and a far bigger dealer/support network. These are things that cost money and even without those things Tesla isn't making a ton of money. Of course I'm in California so EVs are more expensive to run than ICE cars so it's all moot.
- akamaka 1y agoThis seems like a clickbait title because I’ve never hear of a hardware upgrade being called a “patch”.
- OhMeadhbh 1y agoI don't think the patch is hardware. The hardware they're talking about is the "Gameboy like device" that runs the exploit.
- echoangle 1y ago> The Verge now reports that Hyundai is offering a security patch for this issue through software and hardware upgrades to Ioniq 5 customers. You do a hardware upgrade on the car to patch the vulnerability.
- commandersaki 1y agoThe etymology of patch harkens back to Larry Wall's UNIX patch tool for applying diffs to a source code base.
- ralph84 1y agoThe etymology of patch predates software by hundreds of years.
- antonvs 1y agohttps://www.etymonline.com/word/patch https://www.etymonline.com/word/patch > "piece of cloth used to mend another material," late 14th century. > Electronics sense of "to connect temporarily" is attested from 1923 on the notion of tying together various pieces of apparatus to form a circuit.
- 4ndrewl 1y ago"The term "patch" came from early use in telephony and radio studios, where extra equipment kept on standby could be temporarily substituted for failed devices." - from https://en.m.wikipedia.org/wiki/Patch_cable https://en.m.wikipedia.org/wiki/Patch_cable But yeah, the term patch just seems weird in this article. Why not just "upgrade" or "fix"?
- jjani 1y agoThey're swapping out hardware, which is why they're asking money for this to compensate the labor costs. Not saying this justifies it, but the title is misleading.
- jader201 1y agoAgree the title is a bit misleading, but addressing what sounds like an exploit still feels like a patch of sorts. But yeah, “patch” usually implies software vs. hardware. Either way, agree with other comments that Hyundai should just eat the costs if it prevents theft due to an exploit. Having said that, given what the car costs, the fee doesn’t seem completely unreasonable.
- GlacierFox 1y agoGiven what the car costs, you'd think they'd do this out of courtesy.
- cmcaleer 1y agoIt seems short-sighted to not do this as a courtesy, given the reputational hit from the Kia/Hyundai Boyz saga just a few years ago. Who wants to be a manufacturer with a reputation for making easy-to-steal cars? Who wants to (for a reasonable price) insure cars made by said manufacturer?
- GlacierFox 1y agoExactly.
- jader201 1y agoYeah, definitely. I have a Kia EV6, and just saying that if the same “patch” is offered for it, I won’t think twice about paying $65 for it. I’d also not be super happy they didn’t cover it, but I saw a comment about never buying a Hyundai because of this, and not sure I’d be that upset about it. There’s a line, for sure, but $65 wouldn’t be it, for me.
- OhMeadhbh 1y agoHunh. I know what I'm doing this weekend... Scanning ionic VINs to see if they're vulnerable. I bet I could train YOLO to recognize ionics from a drone camera at 50 ft.
- JKCalhoun 1y agoLove to see a 3rd party step in with a lower-cost replacement.
- topato 1y agoJesus, when did commenters on neowin get so stupid? Thank God I'm back to the safety of HN.... Weren't they a slightly subversive tech site a decade or so ago?
- gbil 1y agoA side question, both this and the VW power unlock payment from the other day, are targeting UK market, so is legislation (lack of it) such in the UK that allows for such practices?
- PaulRobinson 1y agoStealing cars is illegal in the UK, however you do it. Just having this "gameboy-like device", in your pocket is "going equipped", and you're going to get arrested on its discovery about your person outside of your abode. No ifs, no buts. The UK has lots of new cars (plenty of cheap financing around for lease, PCP and HP deals), and there is a low-level epidemic of thefts of vehicles that end up in shipping containers and heading out of the country within hours. [0] Car insurance is also so high in the UK at background levels that if you end up owning a highly desirable and very easy to steal car (the Range Rover a few years ago, for example), the costs being added to price in the risk of your car ending up in a container heading to the Middle East don't seem - as a percentage - particularly high. The fact UK has great shipping throughput to the Middle East, Africa, and so on, is both a boon economically, but also it makes great cover for all sorts of shenanigans. [0] https://www.containerlift.co.uk/cracking-the-code-uk-police-raid-shipping-containers-to-combat-car-theft/ https://www.containerlift.co.uk/cracking-the-code-uk-police-...
- petronic 1y ago“Gameboy-like device” - are they referring to Flipper Zeros with the firmware to exploit RF rolling codes? https://www.rtl-sdr.com/flipperzero-darkweb-firmware-bypasses-rolling-code-security/ https://www.rtl-sdr.com/flipperzero-darkweb-firmware-bypasse...
- technick 1y agoMore than likely
- hecturchi 1y agoNo, they don't. You need to read the article. It says such devices cost $20k.
- asymmetric 1y agoThey’re talking about something like this https://www.thedrive.com/tech/34817/this-25000-game-boy-is-made-for-stealing-cars-not-playing-tetris https://www.thedrive.com/tech/34817/this-25000-game-boy-is-m...
- Shorel 1y agoNo, some dedicated hardware device, about five years old, that looks like a Game Boy. The flipper firmware is only about six months old, and it is still not as convenient and distributed. The actual firmware exploit is the same idea.
- technick 1y agoI was just looking at a new Hyundai today. Now I've got something more to consider if they aren't willing to stand behind securing their vehicles at their cost.
- whirlwin 1y agoWould be interesting to see insurance companies stand on this. Are you expected to pay for the security upgrade or not. Will it be deemed missing as "unpatched - that's your fault".
- wjnc 1y agoThis is a great question. Have been in insurance for 20 yrs now. Cannot phantom why f.e. insurers don’t hold manufacturers responsible for losses due to cloned car keys with inadequate protection. I do know that insurers are generally very hesitant to start legal procedures, especially those that end up in the news. Say, Volkswagen and Stellantis are formidable adversaries as well as national champions, so there is some presumption that getting your right might be difficult. And the bar as I understand it is not technical SOTA, but more something like acceptable practice, so the manufacturer could argue “hey everyone has shitty protection, so suck up the loss”. Perhaps the newest European legislation will help raise the bar / even the playing field.
- makeitdouble 1y agoGiven that many door locks and other portable locks are laughably bad and can be opened with sometimes simple shimmering, or at most basic picking tools, that would mean insurance companies could already have sued Master locks for instance. So at least, bad security is probably not enough for it. From there, making customer pay to fix bad security doesn't sound like a significant step.
- birdfood 1y agoI want a dumb EV. No infotainment system. Just speakers and a way to plug my device into them. Anything critical to the car should be completely air gapped and require an absolute minimum amount of software, preferably zero.
- Mistletoe 1y agoCheck out Slate trucks. I want that too and this seems to be perfect. Has windows you roll down even. Fingers crossed it actually launches. https://www.slate.auto/en https://www.slate.auto/en
- bestouff 1y agoThis thing has no autonomy
- birdfood 1y agoYeah I’ve seen these posted here previously! Probably the most appealing new car to me at the moment. Hopefully they take off and we can get them outside the US
- inferiorhuman 1y agoHave you seen Telo? https://www.telotrucks.com/ https://www.telotrucks.com/
- esperent 1y agoI've seen this before, and I like the design. It's cute yet functional. It would fit in well on European roads. One thing that stands out to me is the front wheels protrude beyond the body. I don't recall ever seeing that on a consumer road vehicle before, at least one designed after the 1930s.
- charles_f 1y agoDoes Hyundai consider this as a patch though? I'm wondering if the dealership would present you the bill with a straight face, is that presented as a "more secure" system, or an "additional anti theft device"?
- delusional 1y agoFrom the wording of the press release it sounds like they view it as an optional add-on specifically for UK customers who want additional security: Recently, evolving security threats, including the use of unauthorised electronic devices to bypass vehicle locking systems have become more prevalent in the UK. This is an industry-wide issue and Hyundai is providing appropriate responses in line with industry practices. As part of the Company’s commitment to supporting our customers, we are able to offer a subsidised software and hardware upgrade for a customer contribution of £49.
- blixtra 1y agoI’ve now had 2 IONIQ 5s stolen in Berlin, the last a couple months ago. Each seemingly using a keyless access hacking device. That’s enough for me to not see a Hyundai or Kia in my future anytime soon. And I very much liked the IONIQ 5. But if I can’t keep one more than 2 years, what’s the point? I’ve lost all trust in those companies, upgrade or not.
- king_geedorah 1y agoIf the ignition and door locks in your vehicle were mistakenly designed in such a way that they are trivially shimmed or could be operated by any key it seems absurd to suggest the customer should pay you to replace these mechanisms with ones that are properly secured. This seems roughly analogous to that situation at least to my understanding.
- florbnit 1y agoThe story has a bad spin yes. But it’s just as much of a controversy if they had require people themselves pay the cost if they found out the cars where shipped with defective breaks. It’s a product error not wear and tear or user error, they should eat the costs, but the cybersecurity framing of it is being used to attempt to push the cost to the consumer.
- king_geedorah 1y agoThis is precisely the point I intended to make with my comment. Perhaps my phrasing was unclear.
- stavros 1y agoI think the GP is just agreeing.
- nsteel 1y agoI don't know about the Hyundai Ioniq, but the Kia Niro has no way to permanently disable keyless entry, which would be the obvious, super easy s/w fix. You can disable it each time you lock your car by holding extra buttons on the fob for a few secs, but it's auto re-enabled next time you unlock. It's everything you need to know before you make your smart decision not to buy a Kia. Cheap(er) for a reason. But looks from their point of view. It's the most stolen car in the UK. The brand doesn't seem to be suffering much. Having terrible security just helps sales!
- sokoloff 1y ago> Having terrible security just helps sales! Until it’s banned by regulators or made uninsurable…
- nsteel 1y agoWe are not scared of regulation in the UK. And this car has existed, in the UK, with this flaw, for over 6 years. Quite clearly nobody is interested in doing either of those things you suggest. Plus the UK is about to reintroduce financial incentives for private EV purchase, they want to push sales, not clamp down on crap products.
- hgomersall 1y agoMy 2021 Ioniq 5 does not have keyless entry at all. You need to press the button to open the door.
- nsteel 1y agoDo you mean the button on the door handler or the button on the key fob? The former is their keyless entry and is vulnerable to attack. I was under the impression all Ioniq 5s had this feature, but obviously I defer to your experience.
- hgomersall 1y agoButton on the door handle? I only know about the button on the key fob.
- poemxo 1y agoI don't get why companies don't understand how offensive it is to the customer to nickel and dime them, especially after they're already a converted customer. They could easily eat the $60 cost and spin it as positive PR, Apple-style. It's particularly bad because customers see it as a defect. No one wants to pay full price for defective equipment. The only thing that would make it worse is if this "hack" were reproducible on the flipper zero and they get themselves into another Kia Boys situation.
- Hilift 1y agoThere are two aspects. "Charge" and "costs/who pays". When someone can start a Kia with a USB cable, the owner pays for that. Kia may have a fee for replacing something, but that doesn't factor in the calculus of "there's a reason these people are buying our product, and we assess they will continue to do so." Note that Kia offered a maximum of $6,125/$3,375 for totaled/damaged vehicles. The previous formula: "You take the population of vehicles in the field (A) and multiple it by the probable rate of failure (B), then multiply the result by the average cost of an out-of-court settlement (C). A times B times C equals X. This is what it will cost if we don't initiate a recall. If X is greater than the cost of a recall, we recall the cars and no one gets hurt. If X is less than the cost of a recall, then we don't recall."
- bornfreddy 1y agoThere is also this thing called brand loyalty. After the car manufacturer pulls a stunt like that I will think twice before I buy my next car from them.
- lagniappe 1y agoNobody buys a Kia because of brand loyalty, they do it because that's what they can afford.
- The_President 1y agoCitation for the final paragraph quote "the previous formula" goes to Fight Club.
- mft_ 1y agoHmmm, so recently: ̶ ̶H̶y̶u̶n̶d̶a̶i̶ ̶K̶i̶a̶ ̶V̶o̶l̶k̶s̶w̶a̶g̶e̶n̶ ̶ At this rate, I'll be back to Tesla for any future EV purchase. (Noting that Tesla second-hand prices in Europe seem to have taken a dive over the past while, presumably partly thanks to Elon's shenanighans?)
- mijoharas 1y agoSo, can people tell me what cars with keyless entry systems aren't susceptible to these attacks? I'm somewhat wary of any of them, but it seems like it's a feature of a lot of new cars, and I can't tell what is "safe" to buy. It was a simple signal amplification thing wasn't it? Does anyone know if BYD cars suffer from it for example?
- deadbabe 1y agoThe car stealing device is $20k, could someone do some math to see what kind of ROI a criminal could expect if they use it to steal cars and part them out?
- cookiengineer 1y agoThis is a violation of UN regulation 155/156 where the vendor must provide free fixes and updates in case of safety or cybersecurity violations. I'm mentioning this specifically because the CAN bus is involved, which is mandatory to be safety conform and has to be ASIL-C/D conform. If you cannot guarantee that, you will lose the license. Without conformance to UN Regulation 155/156, the car manufacturer might lose its license for the underlying car platform (not only the downstreamed models), meaning refunding/damages need to be paid for all buyers of cars of that platform. So chances are this can be fought in court, and Hyundai probably has to offer free replacement of that defective part.
- solardev 1y agoThe UN has regulations? Who does it have authority over? Who enforces its regulations?
- lbourdages 1y agoThe vast majority of countries have into their laws that road vehicles must adhere to UN vehicle regulations. That's how enforcement happens - by whatever regulatory authority of the country the vehicle is to be used in. Canada and the US are among the exceptions in that they have their own standards.
- solardev 1y agoI had no idea (as a person in the US). Thanks for the info!