Top
Best
New

Posted by infosecau 15 hours ago

Unlocking any car from X brand in most of the world(shubs.io)
518 points | 273 commentspage 2
enopod_ 8 hours ago|
I love a good old fashioned hacker story in the morning :)
t1234s 2 hours ago||
Any guesses to what brand the two cars are in the garage? They look like Nissan.
winny314 12 hours ago||
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
chao- 11 hours ago||
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.

Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.

meindnoch 5 hours ago|||
>only attempt if you know that you're doing, so as to avoid damaging it

If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).

kube-system 36 minutes ago||||
> Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door

or sometimes, even just shim it open.

briansm 10 hours ago||||
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.

Literally all of civilization is built on the back of that, and if it erodes then We're doomed.

randomNumber7 7 hours ago||
Looks like we are doomed then.
dabinat 7 hours ago||||
Are door locks actually intended to deter professional thieves though? I thought they were intended to add enough friction to deter crimes of opportunity.
sidewndr46 39 minutes ago|||
I think they are meant to comply with the requirement of some insurer that the house must be able to be locked. That's it. The professional thieves in the US don't even bother picking the lock, they break down the door and are in.
torginus 43 minutes ago|||
Thieves usually just smash the window, because its quicker
mnw21cam 4 hours ago||||
The lock on my front door merited a 15 minute video from the LockPickingLawyer. He could pick it, but it required some time and tools that the average lock picker wouldn't have available. 15 minutes has to be a record for him, but still it's only 15 minutes.
JumpCrisscross 9 hours ago|||
> nicest (and second most expensive) place I have lived at had the worst locks

Did it have an alarm system?

kotaKat 3 hours ago||
I bought myself an Autel key programmer and boy was it funny to add in my own keys arbitrarily with no authentication to my own car.

No wonder the ratbag kids these days are running around with them - they're only like $400 on Aliexpress and Temu. The world of "all keys lost" shenanigans is a wild one. There's cat-and-mouse games between Autel and automakers and users trying to "block" certain regions and users from leveraging the all-keys-lost features to try to cut down on auto theft, but where there's a will, there's a way, and Autel's just running a shitty Android app on an Android 8 tablet...

constantlm 14 hours ago||
This is a Rav4
jibalt 7 hours ago||
I drive a 1999 Mitsubishi Eclipse GS-T Turbo ... sweet car.
driverdan 1 hour ago||
I miss my DSMs. I had a couple of 1st gens but always wanted a 2nd gen. When I looked at prices a few years ago I decided I'll never own one unless I have a large exit. I'm only interested in a GSX and prices have gone up way too much.
alt227 4 hours ago|||
Nice car, but personally the 3000GT is the one for me :)
Ylpertnodi 6 hours ago|||
I do miss my Starion, but not the fines.
cpursley 7 hours ago||
Those things are cool, wife had one when I met her (non turbo). It's a shame they stopped making them.
comex 12 hours ago||
Why GPT-5.6? Was this done before the release of GPT-6, or is there some difference in restrictions between the two?
spockz 9 hours ago|
Daybreak blue (for defensive action) was for a long time a specific model selection, basically Sol 5.6. Later it became a toggle available for any 5.6 model. Last time I checked it wasn’t available for 6+.

Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.

UltraSane 13 hours ago||
I'm glad I bought a Corolla LE that does NOT have remote start. I still have to insert the key to start the engine. So much more secure.
kube-system 34 minutes ago||
Vehicles with factory remote start still require the key to drive the car. None of the "remote start over the internet" vulnerabilities found to date allow anyone to drive the car.
cyphar 9 hours ago||
I do wish my new car (Volvo EV) had a physical key for practical reasons (having a place to put it and thus remember to bring it with me is an underrated feature of car ignitions) but I don't think there is anything that fundamentally makes it impossible for CANBus attacks to work against cars with proper keys.

I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?

UltraSane 5 minutes ago||
The key has a RFID chip in it that is read by the ignition switch.
quantummagic 15 hours ago||
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
ryandrake 13 hours ago||
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
topspin 13 hours ago||
> Why is he protecting the car company

He is not protecting the a car company. He is protecting himself.

charcircuit 11 hours ago||
Both can be true.
eecks 6 hours ago|||
The whole post is so badly written and explained. At least it wasn't AI generated I guess
whycome 1 hour ago|||
I think it's because it critically was missing context. So you're constantly trying to frame and reconcile it while reading. When first reading I thought there was actually a car brand named X -- and it doesn't seem out of the question.

But it makes the content seem awkward and clunky. So a reader going in with the correct context has a very different experience.

robotmay 6 hours ago||||
I didn't find this hard to read or understand, though perhaps his writing style just aligns with my own and I do have experience in the methods being used.
0______0 5 hours ago|||
What a ludicrous complaint. It's perfectly readable. What possible motivation does one have to broadly proclaim something is "badly" done from an armchair without a modicum of justification? And then follow it up with an AI-whine. It's roiling to me.
whycome 59 minutes ago|||
I found it difficult because I didn't realize that X brand is a placeholder. I don't know all the car brands.
eecks 4 hours ago|||
No more than your comment, right? Look there's another comment about the title: https://news.ycombinator.com/item?id=50419520
tintor 8 hours ago||
Manufacturer is not disclosed, but the car in video is RAV4. Lol
3abiton 3 hours ago|
> Reconstructing the requests, we found that a lot of these APIs needed no authentication beyond the hardcoded API keys sitting in the JavaScript bundle.

I've heard so many horror stories starting like this.

More comments...