Posted by infosecau 23 hours ago
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
Not that I expect the argument to go anywhere.
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
Is it so hard to just offer said hackers a boatload of cash to switch sides?
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
I don't see any indication here that's the case - opening the doors is very different than being able to start the engine and drive off.
At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
If you have a car with factory remote start, try this yourself -- try remote starting the car, then getting in without the keys and driving away. You can't.
> At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.
In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.
Brown said everyone needed a better stereo in the 1990s. Factory radios were lousy. But the aftermarket stereos that people bought to replace the factory-issued ones could easily transfer from one car to the next. For example, if thieves steal the factory stereo from a Volkswagen Jetta, they're going to need a buyer with a Volkswagen Jetta, and all a thief can offer is the stereo the owner had to begin with.
Factory stereos got good (and complicated). Aftermarkets got cheap.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
I'm not so sure about that - I used to have some fancy cars in the past and I've heard many stories from people saying they've been followed to car parks, home, or had only the keys stolen from their home and nothing else - fancy high end cars are almost always stolen "on order" and not by opportunistic thieves. These are the kinds of people who will research what is needed to take your car before they come to your home.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
"tesla relay attack"
[0] https://www.wired.com/story/tesla-ultra-wideband-radio-relay...
Read that part.
Which then allows you to move the vehicle (not start it), as you have physical access. As in the article I linked to.
Or an amateur with a mallet, a key blank, a file, and an o-ring.