Posted by infosecau 15 hours ago
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
Car ignitions, actually starting a car a driving it away, are a totally different thing.
A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.
[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...
If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.
[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
I do understand that selling your customers' data is lucrative, but of all the car makers, not a single one thinks there's a market for an alternative?!! I don't understand.
I'm also slightly worried about HN's "solution": buy cars old enough not to be enshittified. Sure, I get the instinct, but there's a limit on how long that'll work. Much better would be to be politically engaged and work for a better future where this shit is illegal.
In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.