Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
This distinction (although I know it) has never made logical sense to me.
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
I don't think most people here have it right. From my understanding the main difference is that 4WD can be manually turned off (meaning going to 2WD mode). AWD is always on.
Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.
Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.
Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage as power is always going to all wheels.
4WD is a permanent thing, or at least always on when you engage it. The system locks all the wheels to the same spin speed.
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
Many countries have very broad cybercrime laws - like prohibitions on "gaining unauthorised access to a computer system". And in some countries, even when you're in the right going to court can be a costly and time-consuming endeavour.
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
Based on my experience in this industry, every brand does this, has done this, and is currently building out a replacement for their current system that does this in a slightly different way.
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
> Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
They mean someone who's extremely passionate about this could identify the car brand or exact model in question just by listening to the sound the lock makes from the posted video. You know, like the experts who can identify a wine by smelling it, or a violin just by listening to it.
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Is there an online database for instructions on how to disconnect your car from the cloud?
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Usually the most practical thing to do is to remove the antenna. The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.
In a few years, new cars probably won’t pass inspection or be allowed insurance if their internet access is disabled and not fixed by an authorized technician in a timely manner.
Most US states don't have a safety inspection. [1]
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
And in the UK you have to report every modification(including this one) to your insurer, or your insurance is null and void. The MOT(annual test) couldn't care any less about any of this or any modifications - as long as your car can pass a set of(very basic) tests, it's legal to use on the road.
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
I do realise. That by itself is worrysome. But now car manufacturers tie legallly required functions like the enmergency buttons with bloated platforms of "convenience" functions that users can not disable completely.
Correct me if I'm wrong, but I think I've read somewhere that it can be a SIM-less phone that abuses emergency call flow in 3GPP. GSM specs have special accomodations for 911/112 type calls that don't require a SIM(that sometimes ironically lead to normal calls working fine and just emergency calls failing).
Yes, you don't (in most countries) need a SIM for 112/911, and even when you do have one, you are allowed to use other carriers for such calls, even when you ordinarily shouldn't be able to roam onto them.
Toyota and its luxury brand, Lexus, use the ForgeRock Identity Platform (specifically OpenAM and OpenIDM) to manage customer identities and backend authentication for their connected car and telematics services.
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
Your system is broken, FF has supported h265 on every OS for a long time now:
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
you would do yourself some good to learn to differentiate constructive criticism from this sort of mean vitriol. I have no doubt that this is the explanation for the downvotes. there is truly no need to be so abrasive. it only serves to detract from whatever good-faith intentions you had, if any.
“Thanks for the nice write-up. Gotta admit the video still irks me. Like, portrait to landscape mid-recording… Since it was only a minute, think re-recording would be well worth it.”
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
Difference is that now you develop the hack once and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong. Picking a lock is work you have to do for every vehicle, plus it looks pretty sketchy.
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
Your comment just tells me that a modern 7 series BMW or a Cayenne is now prime candidate for a similar hack. Couple of weeks for motivated hackers and now they can steal a luxury car and ship it to Africa / Middle East ? Six digits payout for couple weeks of work + cost of LLM subscription.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
High end luxury car lifts to order are sometimes literally that- a target car is tracked and when parked and left for some short period it gets lifted up into a truck with a Faraday cage and driven away.
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
Now I am not sure if it makes any easier. I was aware of cars getting lifted and put into a shipping container in mere hours. My train of thought was that now you can remote unlock and remote start so that a threat actor can get in at night or even daylight and drive away. If you remove the owner's profile from the car through the API, you delay the response by some time while customer support + police get the necessary info to start tracking the car which is already in an aluminium lined container on a ship headed off to another continent.
For theft to order by crews of good field workers and yard mechanics there's no real need for them to worry about hacking / remote access of high end cars - they can just mechanically lift / tow and isolate and leave the nerd stuff as a problem for down the line.
One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.
In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Car thieves destroy undrivable cars and just sell parts and scrap metals.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.
Exactly. Someone like the author isn't going to steal my car, so unless I'm targeted by a three letter agency it's not something worth worrying about.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
Brown said everyone needed a better stereo in the 1990s. Factory radios were lousy. But the aftermarket stereos that people bought to replace the factory-issued ones could easily transfer from one car to the next. For example, if thieves steal the factory stereo from a Volkswagen Jetta, they're going to need a buyer with a Volkswagen Jetta, and all a thief can offer is the stereo the owner had to begin with.
The switch of car sound systems from a discrete unit that used a standard DIN form factor and connections to an integrated part of the dashboard from the mid '90s onward (and now into the complex "infotainment" system) kinda killed it as well. You can't just grad a single box out the dash and run. Does mean that car stereos are either un-upgradable, or require 3rd party kits to replace chunks of the facia nowadays though.
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Are door locks actually intended to deter professional thieves though? I thought they were intended to add enough friction to deter crimes of opportunity.
Daybreak blue (for defensive action) was for a long time a specific model selection, basically Sol 5.6. Later it became a toggle available for any 5.6 model. Last time I checked it wasn’t available for 6+.
Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
I do wish my new car (Volvo EV) had a physical key for practical reasons (having a place to put it and thus remember to bring it with me is an underrated feature of car ignitions) but I don't think there is anything that fundamentally makes it impossible for CANBus attacks to work against cars with proper keys.
I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?
"there were no servlets (or resources) registered against paths that included the path traversal within them. [..] We were incredibly annoyed by this"
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
I didn't find this hard to read or understand, though perhaps his writing style just aligns with my own and I do have experience in the methods being used.
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
Up until recently most Isuzus were sold as Holdens. They don't sell passenger cars here because they don't make much of them anymore. At least for export.
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
Not if you take them (there are two security workers behind this) at their word:
In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerock
Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...
That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
Yeah, the problem isn't a dearth of technical security expertise, the problem is turning that technical expertise into meaningful organizational changes, which requires a rather different skillset (as far as I can tell: people-skills and managing/navigating bureaucracy). And, further, getting anything done is going to be a constant uphill battle in most organizations because, as you point out, paying for security doesn't [directly] contribute to quarterly revenue targets, and even worse, often times puts you in direct opposition with the people who do contribute [directly] to those targets.
More generally, the vast majority of companies consider IT to be a cost center which means cutting costs (and the corners along with them) and going with the cheapest bidder is just Standard Business Practice(TM).
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!”
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
I'm assuming he means AWD.
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.
Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.
Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage as power is always going to all wheels.
4WD is a permanent thing, or at least always on when you engage it. The system locks all the wheels to the same spin speed.
4WD is for off-road use. All tires rotate at the same speed.
At this point, the distinction is gone, because car bards marketing.
(AI something lies)
Suffice to say, in British parlance any vehicle with four driven wheels can be called a "4×4"
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
I miss the web being less career focused and more crazy
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
What does this mean?
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Evil.
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Somebody make this happen.
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
[1] https://en.wikipedia.org/wiki/Vehicle_inspection_in_the_Unit...
[2] https://legiscan.com/LA/text/HB1085/2026
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
You realise that in the EU cars have a SIM in, and an emergency button? This is since 2018, see: 112 eCall regulation.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
https://samcurry.net/forgerock?ref=shubs.io
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
>Android from Firefox 137 using hardware only.
https://developer.mozilla.org/en-US/docs/Web/Media/Guides/Fo...
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
Surprisingly, in my experience h264 produces higher quality (better VMAF) for the same bitrate.
My theory is all the codec-optimisation attention went to h264 because of the crazy licensing situation of h265
You probably used the wrong settings. Netflix said "AV1 streaming sessions achieve VMAF scores that are 4.3 points higher than AVC and 0.9 points higher than HEVC sessions" 9 months ago: https://netflixtechblog.com/av1-now-powering-30-of-netflix-s...
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
I don't see any indication here that's the case - opening the doors is very different than being able to start the engine and drive off.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
0 - https://samcurry.net/hacking-subaru
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.
In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
"tesla relay attack"
[0] https://www.wired.com/story/tesla-ultra-wideband-radio-relay...
Read that part.
Which then allows you to move the vehicle (not start it), as you have physical access. As in the article I linked to.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
Factory stereos got good (and complicated). Aftermarkets got cheap.
Or an amateur with a mallet, a key blank, a file, and an o-ring.
https://en.wikipedia.org/wiki/Lock_bumping
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Did it have an alarm system?
Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
He is not protecting the a car company. He is protecting himself.
A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.
[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...
[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
https://en.wikipedia.org/wiki/Kia_Challenge
Why would they be so circumspect? Presumably the automaker has fixed this by now.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
Not that I expect the argument to go anywhere.
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)