you would do yourself some good to learn to differentiate constructive criticism from this sort of mean vitriol. I have no doubt that this is the explanation for the downvotes. there is truly no need to be so abrasive. it only serves to detract from whatever good-faith intentions you had, if any.
“Thanks for the nice write-up. Gotta admit the video still irks me. Like, portrait to landscape mid-recording… Since it was only a minute, think re-recording would be well worth it.”
I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
Your system is broken, FF has supported h265 on every OS for a long time now:
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
> The crazy licensing situation is only relevant to nerds,
Allow me to rephrase: "I can understand why an open source developer, when considering what codec to contribute their time to optimising, might not choose the one that has four required rival patent pools waiting to get rich from their unpaid work"
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
I didn't find this hard to read or understand, though perhaps his writing style just aligns with my own and I do have experience in the methods being used.
What a ludicrous complaint. It's perfectly readable. What possible motivation does one have to broadly proclaim something is "badly" done from an armchair without a modicum of justification? And then follow it up with an AI-whine. It's roiling to me.
I think it's because it critically was missing context. So you're constantly trying to frame and reconcile it while reading. When first reading I thought there was actually a car brand named X -- and it doesn't seem out of the question.
But it makes the content seem awkward and clunky. So a reader going in with the correct context has a very different experience.
Not if you take them (there are two security workers behind this) at their word:
In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerock
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
Up until recently most Isuzus were sold as Holdens. They don't sell passenger cars here because they don't make much of them anymore. At least for export.
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
LLM seems to think it’s Toyota/Lexus based on an open source alternative client[1] documenting the same APIs that appear in the blog post. A cursory glance seems to suggest it’s right and it took less than 2 mins to figure that out.
Almost certainly not. For one, this hack only unlocks the car, it doesn't start it or allow it to actually drive. The reason they're stolen frequently is the same reason the Camry and Accord used to be the top stolen vehicles ~20 years ago: they're best-selling vehicles and thus the parts from them are relatively valuable and have a worldwide market.
I received an email from Toyota asking me to connect to a newly-purchased vehicle in their app. I hadn't actually purchased a Toyota, but I went ahead and installed the app to see what it would do, and I ended up having full access to someone's car. I could see the car's location, lock/unlock it, and even start the engine remotely. I did try to contact Toyota about the issue through various channels and never got a response.
If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.
I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
Yeah, the problem isn't a dearth of technical security expertise, the problem is turning that technical expertise into meaningful organizational changes, which requires a rather different skillset (as far as I can tell: people-skills and managing/navigating bureaucracy). And, further, getting anything done is going to be a constant uphill battle in most organizations because, as you point out, paying for security doesn't [directly] contribute to quarterly revenue targets, and even worse, often times puts you in direct opposition with the people who do contribute [directly] to those targets.
More generally, the vast majority of companies consider IT to be a cost center which means cutting costs (and the corners along with them) and going with the cheapest bidder is just Standard Business Practice(TM).
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!”
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees.
Is it so hard to just offer said hackers a boatload of cash to switch sides?
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
The Toyotas from 2000 can hardly be unlocked even if you insert the key into the lock and turn it. Unless you already did the super-fiddly repair that required you to disassemble and reassemble the doors and latch systems to replace or repair the actuators. Or paid half the value of the car to get your mechanic to do it for you on all five locking doors…
That's more my personal estimation than a Number Backed By Science (tm) but here are my reasons:
1. Enough computer control for reasonable efficiency
2. Largely independent computers
3. No centralized infotainment that controls the entire car (you can swap the radio)
4. Still lots of knobs and dials, no touchscreens
5. Enough computers to get pretty good diagnostics if/when something goes wrong
6. Most of them have lock clickers, maybe trunk, almost nothing else
7. Engines are older, built "heavily" and don't suffer from too much boost / high bearing load
I think the last one is a big one that the closer a car gets to say 2020ish the more you really have to look at how it was built to know what you're getting. It's great to have a two-stage oil pump to reduce pumping losses when an engine doesn't REALLY need 60psi of oil pressure at all times. But GM 6.2L V8s are grenading all over the place to save less than 1mpg and over 100kmi at say 18mpg vs 17mpg that's 5555 gallons of gas vs 5882 gallons or 350 gallons. Even at $5/gallon that's only $1750 in gas vs $10-$20k for a new engine and I can't imagine it's net-reduced emissions as there's absolutely a bunch of emissions encapsulated in that at least $10k price. This is just one example.
BTW I'm not advocating for any policy or that anyone should be forced to do anything. I'm just personally more excited about keeping older (fuel injected, computer controlled, efficient) cars running well than I am about spending a bunch of money on a new car that's got a lot of engine "innovation" in it where all the kinks haven't been worked out yet.
To add to sibling comment, the "Great Recession" (2007-09) also had a huge impact on the global auto industry. GM and Chrysler both filed for bankruptcy in 09 for example. This downturn in the car industry made many car companies far more conservative and a significant number of "fun"/unique cars were removed from the market and never really replaced, alongside big reductions in R&D spend for new products.
Sales also plummeted at major European and Japanese automakers during this period - Toyota recorded its first loss in decades etc.
Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
Many countries have very broad cybercrime laws - like prohibitions on "gaining unauthorised access to a computer system". And in some countries, even when you're in the right going to court can be a costly and time-consuming endeavour.
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
Based on my experience in this industry, every brand does this, has done this, and is currently building out a replacement for their current system that does this in a slightly different way.
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
Better locks also increase the time to break them. More time == more chances to be disturbed and have to go away and also an incentive to move on to the next house, bike, etc. In the case of bicycles I also advice to lock them close to much better bikes with similar locks: chances are that the thief will invest those 30 seconds to break the lock of the better looking bike.
locks exist to prove unwanted entry more than they exist to prevent it. They prevent "casual" attackers as in they also prevent opportunistic attackers. They increase the level of premeditation necessary which in turn increases the risk for the attacker due to having much less of a sustainable defense.
ultimately, nearly everything can be destroyed in such a way as to gain whatever access to anything that you want.
A trustless society is a pipedream, but security theater creates an emphasis that limits plausible deniability. an attacker can no longer claim they targeted something they believed no one cared about, or that wasnt a big deal. For example, the level of theater involved in the TSA does not exist to catch every possible threat to aircraft. It exists so if anyone is dumb enough to smuggle a weapon through it and get caught then security can arguably gun them down on the spot. without the theater, the social contract is less obvious, and the plausible deniability for the attacker is stronger
This distinction (although I know it) has never made logical sense to me.
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
It's more of an industry wide thing:AWD means all wheel drive even when the vehicle has more than 4 wheels. So in the case of a vehicle with more than 4 wheels, 4 wheel drive would indicate four of the wheels are driven and the remainder are idlers. For instance 6x4 would indicate six wheels with four driven wheels.
You seem to be talking about something different. The conversation is about vehicles with four wheels and the differences between 4WD and AWD in that context. Perhaps you're saying that there is no difference?
But 6x4 notation is handy when you have six wheels, sure.
There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.) But I have yet to ever see a 4WD that could be "switched" to FWD.
The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype. That means the extra wheels cannot be triggered seamlessly. A 4FW has distinct driving modes whereas an AWD uses clutches to bounce between modes as needed.
Bluey has a couple lines about this distinction. In Australia, even small children have opinions on 4WD v AWD.
> There are plenty of AWDs that operate as FWD 90% of the time, only engaging the rear as needed. (I am told this is for fuel efficiency but the logic escapes me.)
AIUI, you lose energy because the power/torque has to go through an extra differential, transfer case, etc, before reaching the rear wheels.
Going from the engine through the transmission to the front wheels is already a 'fixed cost', but the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay if you don't need to.
>> the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay
True for a FWD v RWD car decisions, but in an AWD are not the rear differential and driveshaft still turning whenever the rear wheels are turning? Even the clutch packs should still be rotating even if disengaged. The fact that there is no power through them doesn't mean they aren't generating losses.
It depends. With conventional AWD (like all Subarus), you are correct that there is significant energy loss due to the AWD because there is a drivetrain to the rear wheels, even if it is not delivering power.
Many hybrids, however, have AWD and they work by having a second, small electric motor that powers the rear wheels only when needed. That means no physical drivetrain to the rear wheels, so no energy loss. That's why a hybrid Toyota RAV4 AWD gets about 15% better gas mileage than the smaller and lighter hybrid Subaru Crosstrek AWD.
The disadvantage of the electric motor approach is that it cannot deliver as much power to the rear wheels as a conventional physical AWD drivetrain can. That said, probably only an issue in deep mud or snow.
^ this. 4wd is used on offroads and locks all wheels together, transfering equal power to all wheels. AWD varies power using different technologies, from a simple Haldex that transfers power back when front wheels slip to complex sensor controlled individual wheels. Some are front-biased (generally but not exclusively cheaper ones), some are rear-biased (mainly in sports cars) and some are true AWD, depending on the needs and expected pricing of the vehicle.
Not quite, no. It only locks all the wheels together if you also have axle lockers.
You might have something like a Series Landrover transfer box where in 4WD mode the front and rear axles are locked together and in 2WD mode only the rear axle is driven.
But does that make a Defender, RRC, or Disco with LT230 transfer box which has a lockable diff AWD or 4WD? The centre diff supplies power to both front and rear all the time, but can be locked in slippy conditions otherwise if one wheel spins *none* of the wheels get drive - the axle and centre diff will both spin.
Then what about the later Borg-Warner transfer box in later Range Rovers, where you still have a centre diff and epicyclic gearbox to set high and low range, but there's no diff lock - there's a massive viscous coupling that turns it into a ridiculously stiff LSD.
I doubt that there was ever a “legal” definition of AWD vs 4WD.
But in modern times, technology has most definitely blurred the distinction. Higher-end Jeeps also have a “full-time 4WD” that sounds an awful lot like an AWD system that can also do 4WD stuff.
So, eh, it’s probably not a good idea to argue too much about broad categories anymore. Individual systems must be compared
> Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
They mean someone who's extremely passionate about this could identify the car brand or exact model in question just by listening to the sound the lock makes from the posted video. You know, like the experts who can identify a wine by smelling it, or a violin just by listening to it.
I wouldn't know, and don't want to investigate. I try to stay generic, grammatically it's fine. I'm sure it can be grating to some but I'm not using this as a trigger word.
I was just going to comment about how GPT-Astra, Claude, and Gemini Argon all pointed to Toyota/Lexus based on context cluses, API markers, Lexus RX in the video, and deduction based on the author's previous posts and these being the remaining manufacturers to not be explored by them.
I do wish my new car had a physical key for practical reasons (having a place to put it and thus remember to bring it with me is an underrated feature of car ignitions) but I don't think there is anything that fundamentally makes it impossible for CANBus attacks to work against cars with proper keys.
I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?
Vehicles with factory remote start still require the key to drive the car. None of the "remote start over the internet" vulnerabilities found to date allow anyone to drive the car.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
I've pondered how "secure" the old OnStar system was. It was apparently just some level of in-band signalling/modem communication on top of AMPS (or CDMA).
I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.
The authors do this kind of stunt hacking all the time, they look at shit that has no security contact, no bugbounty, and they hack them without permission for clout
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Are door locks actually intended to deter professional thieves though? I thought they were intended to add enough friction to deter crimes of opportunity.
I think they are meant to comply with the requirement of some insurer that the house must be able to be locked. That's it. The professional thieves in the US don't even bother picking the lock, they break down the door and are in.
>only attempt if you know that you're doing, so as to avoid damaging it
If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).
The lock on my front door merited a 15 minute video from the LockPickingLawyer. He could pick it, but it required some time and tools that the average lock picker wouldn't have available. 15 minutes has to be a record for him, but still it's only 15 minutes.
> The nicest (and second most expensive) place I have lived at had the worst locks.
That's because in nice places, locks are vestigial. There are no criminals around, so they'll never be tested. And few criminals try to pick locks. They just smash a window or kick a back door open.
I bought myself an Autel key programmer and boy was it funny to add in my own keys arbitrarily with no authentication to my own car.
No wonder the ratbag kids these days are running around with them - they're only like $400 on Aliexpress and Temu. The world of "all keys lost" shenanigans is a wild one. There's cat-and-mouse games between Autel and automakers and users trying to "block" certain regions and users from leveraging the all-keys-lost features to try to cut down on auto theft, but where there's a will, there's a way, and Autel's just running a shitty Android app on an Android 8 tablet...
Daybreak blue (for defensive action) was for a long time a specific model selection, basically Sol 5.6. Later it became a toggle available for any 5.6 model. Last time I checked it wasn’t available for 6+.
Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Car thieves destroy undrivable cars and just sell parts and scrap metals.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.
Brown said everyone needed a better stereo in the 1990s. Factory radios were lousy. But the aftermarket stereos that people bought to replace the factory-issued ones could easily transfer from one car to the next. For example, if thieves steal the factory stereo from a Volkswagen Jetta, they're going to need a buyer with a Volkswagen Jetta, and all a thief can offer is the stereo the owner had to begin with.
The switch of car sound systems from a discrete unit that used a standard DIN form factor and connections to an integrated part of the dashboard from the mid '90s onward (and now into the complex "infotainment" system) kinda killed it as well. You can't just grad a single box out the dash and run. Does mean that car stereos are either un-upgradable, or require 3rd party kits to replace chunks of the facia nowadays though.
Exactly. Someone like the author isn't going to steal my car, so unless I'm targeted by a three letter agency it's not something worth worrying about.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
>>so unless I'm targeted by a three letter agency it's not something worth worrying about.
I'm not so sure about that - I used to have some fancy cars in the past and I've heard many stories from people saying they've been followed to car parks, home, or had only the keys stolen from their home and nothing else - fancy high end cars are almost always stolen "on order" and not by opportunistic thieves. These are the kinds of people who will research what is needed to take your car before they come to your home.
Your comment just tells me that a modern 7 series BMW or a Cayenne is now prime candidate for a similar hack. Couple of weeks for motivated hackers and now they can steal a luxury car and ship it to Africa / Middle East ? Six digits payout for couple weeks of work + cost of LLM subscription.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
High end luxury car lifts to order are sometimes literally that- a target car is tracked and when parked and left for some short period it gets lifted up into a truck with a Faraday cage and driven away.
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
Now I am not sure if it makes any easier. I was aware of cars getting lifted and put into a shipping container in mere hours. My train of thought was that now you can remote unlock and remote start so that a threat actor can get in at night or even daylight and drive away. If you remove the owner's profile from the car through the API, you delay the response by some time while customer support + police get the necessary info to start tracking the car which is already in an aluminium lined container on a ship headed off to another continent.
Difference is that now you develop the hack once and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong. Picking a lock is work you have to do for every vehicle, plus it looks pretty sketchy.
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
> At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
In modern vehicles with remote start, "starting the engine" leaves the immobilizer engaged.
If you have a car with factory remote start, try this yourself -- try remote starting the car, then getting in without the keys and driving away. You can't.
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
I do realise. That's by itself is worrysome. But now car manufacturers tie legallly required functions like the enmergency buttons with bloated platforms of "convenience" functions that users can not disable completely.
Yes, you don't (in most countries) need a SIM for 112/911, and even when you do have one, you are allowed to use other carriers for such calls, even when you ordinarily shouldn't be able to roam onto them.
The specs do have that, but I used to work at a major mobile telco which didn't implement that part of the spec. The argument was that people would use emergency calls to test phones without a SIM. That may well have changed, but you can't assume that the spec will always be implemented in the network.
Is there an online database for instructions on how to disconnect your car from the cloud?
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Usually the most practical thing to do is to remove the antenna. The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
> The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
I read comments that this may still not be ideal, as when you take it a dealer service (especially during the warranty period), all the collected data is cached locally and may eventually get uploaded to the proverbial mothership at that time. If you can/could tell it to stop collecting generally, then there's nothing to upload, antenna or not.
Not sure how valid this thinking is, but it is worth considering as a 'threat model'.
The seems to be recent proof that smart TVs actually do this caching. If a shitty TV from walmart does it you can safely bet it is implemented in your 50K car.
In a few years, new cars probably won’t pass inspection or be allowed insurance if their internet access is disabled and not fixed by an authorized technician in a timely manner.
Most US states don't have a safety inspection. [1]
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
And in the UK you have to report every modification(including this one) to your insurer, or your insurance is null and void. The MOT(annual test) couldn't care any less about any of this or any modifications - as long as your car can pass a set of(very basic) tests, it's legal to use on the road.
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
Samsug definitely was (is) trying to slowly replace google. A lot of there stuff runs Tizen but yeah they now more about security than a car maker at least.
I miss my DSMs. I had a couple of 1st gens but always wanted a 2nd gen. When I looked at prices a few years ago I decided I'll never own one unless I have a large exit. I'm only interested in a GSX and prices have gone up way too much.
"there were no servlets (or resources) registered against paths that included the path traversal within them. [..] We were incredibly annoyed by this"
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
299 comments
[ 0.24 ms ] story [ 18.9 ms ] threadIt's a one minute video, would it have been so hard to redo it.
Edit: raining downvotes, well fuck me, I guess you all prefer sloppy shit.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
>Android from Firefox 137 using hardware only.
https://developer.mozilla.org/en-US/docs/Web/Media/Guides/Fo...
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
Surprisingly, in my experience h264 produces higher quality (better VMAF) for the same bitrate.
My theory is all the codec-optimisation attention went to h264 because of the crazy licensing situation of h265
You probably used the wrong settings. Netflix said "AV1 streaming sessions achieve VMAF scores that are 4.3 points higher than AVC and 0.9 points higher than HEVC sessions" 9 months ago: https://netflixtechblog.com/av1-now-powering-30-of-netflix-s...
Allow me to rephrase: "I can understand why an open source developer, when considering what codec to contribute their time to optimising, might not choose the one that has four required rival patent pools waiting to get rich from their unpaid work"
I don't think that's accurate, since the first Apple processors with AV1 support only came out in late 2023 (A17 Pro, M3).
But it makes the content seem awkward and clunky. So a reader going in with the correct context has a very different experience.
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...
[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...
If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.
https://en.wikipedia.org/wiki/Kia_Challenge
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
- Never hard-code credentials (especially in front-end exposed code) - Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
Is it so hard to just offer said hackers a boatload of cash to switch sides?
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
1. Enough computer control for reasonable efficiency
2. Largely independent computers
3. No centralized infotainment that controls the entire car (you can swap the radio)
4. Still lots of knobs and dials, no touchscreens
5. Enough computers to get pretty good diagnostics if/when something goes wrong
6. Most of them have lock clickers, maybe trunk, almost nothing else
7. Engines are older, built "heavily" and don't suffer from too much boost / high bearing load
I think the last one is a big one that the closer a car gets to say 2020ish the more you really have to look at how it was built to know what you're getting. It's great to have a two-stage oil pump to reduce pumping losses when an engine doesn't REALLY need 60psi of oil pressure at all times. But GM 6.2L V8s are grenading all over the place to save less than 1mpg and over 100kmi at say 18mpg vs 17mpg that's 5555 gallons of gas vs 5882 gallons or 350 gallons. Even at $5/gallon that's only $1750 in gas vs $10-$20k for a new engine and I can't imagine it's net-reduced emissions as there's absolutely a bunch of emissions encapsulated in that at least $10k price. This is just one example.
BTW I'm not advocating for any policy or that anyone should be forced to do anything. I'm just personally more excited about keeping older (fuel injected, computer controlled, efficient) cars running well than I am about spending a bunch of money on a new car that's got a lot of engine "innovation" in it where all the kinks haven't been worked out yet.
If you a “burn anything”, no emissions junk to fail diesel, stick to pre 2006
Sales also plummeted at major European and Japanese automakers during this period - Toyota recorded its first loss in decades etc.
White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
I miss the web being less career focused and more crazy
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
ultimately, nearly everything can be destroyed in such a way as to gain whatever access to anything that you want.
A trustless society is a pipedream, but security theater creates an emphasis that limits plausible deniability. an attacker can no longer claim they targeted something they believed no one cared about, or that wasnt a big deal. For example, the level of theater involved in the TSA does not exist to catch every possible threat to aircraft. It exists so if anyone is dumb enough to smuggle a weapon through it and get caught then security can arguably gun them down on the spot. without the theater, the social contract is less obvious, and the plausible deniability for the attacker is stronger
I'm assuming he means AWD.
Suffice to say, in British parlance any vehicle with four driven wheels can be called a "4×4"
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
https://en.wikipedia.org/wiki/Six-wheel_drive
So nwheels x n driven wheels.
But 6x4 notation is handy when you have six wheels, sure.
4WD vehicles are often part-time 4WD, meaning they can be switched between 4WD and RWD or FWD.
AWD vehicles are full-time AWD because part-time AWD is unnecessary given that the drivetrain delivers power where it's most needed.
The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype. That means the extra wheels cannot be triggered seamlessly. A 4FW has distinct driving modes whereas an AWD uses clutches to bounce between modes as needed.
Bluey has a couple lines about this distinction. In Australia, even small children have opinions on 4WD v AWD.
AIUI, you lose energy because the power/torque has to go through an extra differential, transfer case, etc, before reaching the rear wheels.
Going from the engine through the transmission to the front wheels is already a 'fixed cost', but the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay if you don't need to.
True for a FWD v RWD car decisions, but in an AWD are not the rear differential and driveshaft still turning whenever the rear wheels are turning? Even the clutch packs should still be rotating even if disengaged. The fact that there is no power through them doesn't mean they aren't generating losses.
AWD - clutch packs. Best for nasty conditions on road, IMHO.
You might have something like a Series Landrover transfer box where in 4WD mode the front and rear axles are locked together and in 2WD mode only the rear axle is driven.
But does that make a Defender, RRC, or Disco with LT230 transfer box which has a lockable diff AWD or 4WD? The centre diff supplies power to both front and rear all the time, but can be locked in slippy conditions otherwise if one wheel spins *none* of the wheels get drive - the axle and centre diff will both spin.
Then what about the later Borg-Warner transfer box in later Range Rovers, where you still have a centre diff and epicyclic gearbox to set high and low range, but there's no diff lock - there's a massive viscous coupling that turns it into a ridiculously stiff LSD.
But in modern times, technology has most definitely blurred the distinction. Higher-end Jeeps also have a “full-time 4WD” that sounds an awful lot like an AWD system that can also do 4WD stuff.
So, eh, it’s probably not a good idea to argue too much about broad categories anymore. Individual systems must be compared
What does this mean?
All the secrecy seems pointless in the age of AI.
I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Did it have an alarm system?
If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).
or sometimes, even just shim it open.
That's because in nice places, locks are vestigial. There are no criminals around, so they'll never be tested. And few criminals try to pick locks. They just smash a window or kick a back door open.
No wonder the ratbag kids these days are running around with them - they're only like $400 on Aliexpress and Temu. The world of "all keys lost" shenanigans is a wild one. There's cat-and-mouse games between Autel and automakers and users trying to "block" certain regions and users from leveraging the all-keys-lost features to try to cut down on auto theft, but where there's a will, there's a way, and Autel's just running a shitty Android app on an Android 8 tablet...
https://samcurry.net/forgerock?ref=shubs.io
Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
"tesla relay attack"
Read that part.
Which then allows you to move the vehicle (not start it), as you have physical access. As in the article I linked to.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
Factory stereos got good (and complicated). Aftermarkets got cheap.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
I'm not so sure about that - I used to have some fancy cars in the past and I've heard many stories from people saying they've been followed to car parks, home, or had only the keys stolen from their home and nothing else - fancy high end cars are almost always stolen "on order" and not by opportunistic thieves. These are the kinds of people who will research what is needed to take your car before they come to your home.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
0 - https://samcurry.net/hacking-subaru
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
Or an amateur with a mallet, a key blank, a file, and an o-ring.
https://en.wikipedia.org/wiki/Lock_bumping
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
I don't see any indication here that's the case - opening the doors is very different than being able to start the engine and drive off.
> At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
If you have a car with factory remote start, try this yourself -- try remote starting the car, then getting in without the keys and driving away. You can't.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Evil.
You realise that in the EU cars have a SIM in, and an emergency button? This is since 2018, see: 112 eCall regulation.
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Somebody make this happen.
I read comments that this may still not be ideal, as when you take it a dealer service (especially during the warranty period), all the collected data is cached locally and may eventually get uploaded to the proverbial mothership at that time. If you can/could tell it to stop collecting generally, then there's nothing to upload, antenna or not.
Not sure how valid this thinking is, but it is worth considering as a 'threat model'.
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
[1] https://en.wikipedia.org/wiki/Vehicle_inspection_in_the_Unit...
[2] https://legiscan.com/LA/text/HB1085/2026
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.