Apparent hackers behind Kia ransomware attack demand millions in Bitcoin

https://www.thedrive.com/tech/39309/the-apparent-hackers-behind-kias-ransomware-attack-are-demanding-millions-in-bitcoin

by ourmandave • 5 years ago

225 281 5 years ago

thedrive.com

arcticbull8• 5 years ago

I mean how else would ransomware authors demand payment? Classical solutions are too easy to trace. This is one of the worst byproducts of crypto. Turns out permissionless means people you don’t want using the system, using the system for things you don’t want them doing. Who’d have thought.

sn_master2• 5 years ago

Monero. Its designed to be far less tracable than BTC and many exchanges exist online that trade XMR for BTC. I am surprised BTC still has this large presence in the blackmarket.

arcticbull8• 5 years ago

XMR has too little plausible deniability at the onramp and offramp, and is getting delisted from exchanges. Like any money laundering business the process relies on plausible deniability. Think Los Pollos Hermanos.

Monero markets itself to criminals. Bitcoin to speculators and ancaps. You can hide your BTC gains by saying you made some leveraged trades in Malta. You can’t hide your Monero gains. Ironically it’s what makes it better at its job that makes it less useful.

You really want to toe the line.

capeterson3• 5 years ago

I am surprised BTC still has this large presence in the blackmarket.

The people buying goods online are not usually very tech savvy, so you lose a lot of potential customers by requiring a difficult-to-acquire cryptocurrency. Those selling the goods usually know what's up though, so they're still going to be doing the BTC->XMR->BTC->exchange swap in order to hide their identity.

edit: You would be surprised how dumb some people are online though. Nowadays folks are a bit wiser, but the original silk road got taken down because they used hotmail, lol.

8note• 5 years ago

I'd imagine this is the primary usecase of bitcoin?

Existing transactions cover other usecases just fine

user-the-name2• 5 years ago

Cryptocurrency is basically the one thing that has allowed ransomware to thrive.

Grim-444• 5 years ago

I guess I don't really understand what the plan is, since all bitcoin transactions have a permanent record that are publicly viewable by all. You can't hide bitcoin, every transaction they were involved in is recorded. If they ever want to turn the bitcoin back into real currency they need to go through an exchange to convert it, and the gov can just ask the exchange for the info / bank account of the person associated with the bitcoin.

user-the-name2• 5 years ago

You can tumble bitcoins. You can use decentralised and/or dodgy exchanges to change bitcoin into other cryptocurrencies, and then back after breaking the trail.

rdsubhas• 5 years ago

Answer: No jurisdictive boundary.

When you transfer to a bank account, it cannot move out of the country's jurisdiction without triggering multiple regulatory touchpoints. It's not easy to cash the money out overseas.

But when you transfer bitcoin, it's done once to a virtual ID. The person receiving doesn't need any online account. You can't trace anything here. It's just "sending from wallet id X to wallet id Y". wallet id Y is just a cryptographic key known to the sender and receiver. Yeah so this "virtual ID" is replicated across the network, but who cares. It doesn't point to anyone yet.

After this single step, there is no jurisdiction. The hacker can travel and cash it anywhere in the world outside jurisdiction of the host country's law enforcement.

bradleyjg2• 5 years ago

I’m as anti-Bitcoin as the next guy, but I still don’t see how it enables all these ransomware attacks. If the federal government were serious about pursuing this why not just follow the public, immutable transfer record and indict and sanction everyone associated with any entity along the way?

Not being able to do business with any business that does business in the United States is a pretty big deal. Not to mention your executives not being able to travel anywhere with an extradition treaty.

runeks• 5 years ago

It will probably end up this way.

“All outputs in the Bitcoin transaction with hash <...> are illegal to redeem.”

This, however, means that criminals (who don’t care about the law) can still use these segregated Bitcoin to transact between themselves — as long as miners aren’t punished by including the illegal transactions in new blocks.

chrischen2• 5 years ago

For the doubters of bitcoin arguing the lack of utility here it is. Hackers may be illegal but they are still part of the global economy, providing the service of enforcing security compliance.

seaman1921• 5 years ago

I agree, so are terrorists - more power to them, right!

MeinBlutIstBlau• 5 years ago

In a way it reinforces that the status quo has some kinks that could be adjusted every now and then. I'm not saying it's good. It's just a feature of humanity.

chrischen2• 5 years ago

The anti-American terrorists were making money off opium and yes, this was part of the global economy for better or for worse. Just because we ignore illegal things like prostitution, drugs, extortion, and such doesn't mean they do not affect the prices of legal things associated with them.

IF Kia pays the ransom, then they are arguably playing a willing part of the economy of Bitcoin.

Judgmentality4• 5 years ago

I've tried multiple times, including contacting the corporate branch of the automaker and talking to multiple dealers, scouring the forums, and everything else in an attempt to disconnect my car from their online services (in theory, depending on the automaker, the hackers can completely brick your car).

My car isn't from Kia, but this is not unique to Kia. I eventually personally found the microcontroller and shorted the modem myself, after doing extensive work to figure out how to do it without breaking anything else.

avmich• 5 years ago

Wonder how much it would cost to hire an engineer with required skills to solve this issue :) . Seems like demand is here...

neolog2• 5 years ago

Would you post a picture of how to do it?

Judgmentality4• 5 years ago

https://www.vwvortex.com/threads/killing-carnet-how-to-find-...

https://drive.google.com/file/d/0B-0IaQ-frKqPb3l4MnFKZlF1SVh...

mullingitover• 5 years ago

I would wager that this is by design - if you stop making payments on your car, they basically have lojack built in that would help them repossess it. That's why they make it nearly impossible to disable.

xadhominemx2• 5 years ago

No, that is not why. It is something you just made up. Thanks.

reaperducer• 5 years ago

I eventually personally found the microcontroller and shorted the modem myself

I would think that breaking the antenna would be easier.

Or are they not that large anymore since car bodies have so much plastic in them these days and not so much metal to interfere with the signal?

ska3• 5 years ago

I eventually personally found the microcontroller and shorted the modem myself,

(perhaps silly?) question - why not just disable the antenna or put it in an appropriate faraday cage?

Judgmentality4• 5 years ago

It's a cellular antenna, like you'd find in your smartphone. And if I remember correctly it's soldered to the microcontroller, in a tight space with lots of wires (not to mention any potential metal contact points).

The antenna on the body of the car is for XM/FM/AM radio and is only a receiver. It's not connected to the cellular modem in any way at all as far as I can tell (apart from being attached to the same car).

It'll vary for each manufacturer, but in my case shorting the modem was trivial once you knew which pins to connect.

rectang• 5 years ago

Internet anonymity won't last forever. When it proves impossible to prevent escalating economic damage, the pressure to identify culprits and hold them criminally responsible will prove inexorable.

teclordphrack2• 5 years ago

So, is that like 1 bitcoin now?

vmception9• 5 years ago

Not an impossible future:

The bitcoindollar, negotiated by nation states with hacking syndicates to price all their contracts in bitcoin, forcing nation states to continually purchase bitcoin and is a key demand driver of bitcoin, and vital to diplomacy and hegemonic peace.

replace bitcoin with petro. same thing

userbinator4• 5 years ago

As we noted previously, it means that many Kia owners may be unable to remotely unlock their vehicles or warm them up during an especially nasty winter storm hitting much of the country this week.

Cars had remote unlock and start decades ago (if not OEM, then aftermarket systems were and still are widely available), with zero dependence on what appears to be the company's servers. The only advantage I can fathom for being able to unlock and start a car over the Internet instead of only by being within radio range seems more oriented towards attackers and other user-hostile scenarios ("your car has now become a subscription, please pay to unlock it"). Have we gone backwards...?

14• 5 years ago

This is what I was thinking as well. It is frustrating to see and make me feel less sympathetic to Kia’s situation

joe_the_user• 5 years ago

The amazing thing is realizing that despite the increasing dangers and actual disasters involved, more and more things are going to be put on the Internet.

The equation everywhere is "the cost of the security is always too high because the failure of security is always an unusual situation and something that usually works and is cheaper will win in the marketplace."

Have we gone backwards.

Yes, expect more of this.

faeriechangling4• 5 years ago

What's described in the article is not a security problem. It's an availability problem. I would argue consumers DO care about the availability and I see lots of cloud based systems with local fallbacks.

When IKEA introduced cloud devices, IKEA hardly a company known for high prices or using expensive stuff in their products, they had local fallbacks. Their product is competing with the reliability of less expensive devices controlled with a light switch. Locks are another case where if you reinvent the wheel and get significantly less reliability people will be mad.

siculars• 5 years ago

This is more or less exactly the scenario that played out in Texas this week, Feb 14-19 2021. All the players (gov, regulators, power generators) decided that it was too expensive to weatherize the network for a 0.1% chance event.

Yet... here we are. Entirely predictable.

faeriechangling4• 5 years ago

If Kia's don't have a local override using a key or fob (?) it's just a simple misapplication of technology. Even where you are would want to control locks from the internet, security concerns be damned, you need a high availability way to open the lock locally.

New technologies aren't nessecarily robust against misapplication

ocdtrekkie2• 5 years ago

Current Kia models even at the base level have both keyfob and phone app remote start, the former obviously doesn't depend on their services.

jgilias2• 5 years ago

I wonder if there are any car manufacturers boasting a 'dumb car' lineup. The current trend is pretty worrying. And sadly, it seems to get even worse with EVs. For some reason car manufacturers seem to want to market their EVs as 'smart-cars'. Which I find cringe worthy.

crocodiletears3• 5 years ago

It's likely a similar situation to televisions. Large fleet acquisitions may have the option to request telematics be disabled on their vehicles.

Never operated a fleet, though - so that's my speculation.

navaati• 5 years ago

There kinda is: Renault has Dacia.

LinuxBender• 5 years ago

I've been told a couple of times that Tesla have an off menu option for no network connectivity but I have no idea if this is true or too what degree.

sneak• 5 years ago

We have indeed gone backwards. Most homes and businesses have LANs, and yet almost every app works in a client/remote-server model, adding dozens of SPOFs where there need not be any.

rixed2• 5 years ago

Most LANs have firewalls that only accept the model of a distant central server, though.

chki• 5 years ago

The only advantage I can fathom for being able to unlock and start a car over the Internet instead of only by being within radio range seems more oriented towards attackers and other user-hostile scenarios

Your car might be parked further away than the radio distance, especially if you're living in a big city with few parking spaces. There are also a lot of scenarios where you are not at home but want to preheat your car anyways.

bartman• 5 years ago

Yes, exactly. I‘m very happy my Hyundai has this feature as city parking more often than not means walking a few minutes to my car. Being able to pre heat, check the battery level, etc remotely is a feature I would not want to miss.

grawprog• 5 years ago

The whole idea of an internet connected car that constantly 'phones home' without any easy way to bypass or disable is kind of mind boggling to me.

I don't understand why after this people weren't in an uproar.

https://www.nytimes.com/2017/09/11/business/tesla-battery-ir...

When Tesla decided generously to temporarily grant residents fleeing a hurricane an upgrade that allowed full usage of their battery.

People's lives were literally in the hands of an optional, upsold firmware softlock.

The fact that it's come to that is completely appalling. When the manufacturer of your car has the power to save your life because if they didn't they'd suffer bad publicity is disgusting.

And the fact is, the only reason why hackers are able to gain access to vehicles, the only reason for any of it is because companies have decided cars need to be a service provided by them so they can keep making money after the initial purchase.

People buy cars so they can travel freely without relying on others. Making cars reliant on a third party server for something as basic as the ingition goes against the entire premise of owning a car.

ChuckNorris89• 5 years ago

People's lives were literally in the hands of an optional, upsold firmware softlock

People's lives are literally in the hands of optional firmware softlock all the time in medical devices that you can find in hospitals. If the hospital doesn't pay for x feature or for support technicians to service them, then some people could actually die.

Saving lives or not, you can't blame a company for not giving you for free features you haven't paid for.

pie420• 5 years ago

That's a really silly and wrong way of looking at it. Tesla has down society and you a great service by including additional capacity in your car above what you payed for. If they choose to let you have it for free, pat on the back for them. If not, then it is no different at all from someone dying in a Ford Focus that was only front wheel drive where all-wheel drive would have saved their lives.

prostoalex2• 5 years ago

allowed full usage of their battery.

I thought on the checkout page Tesla was pretty explicit that they were selling a 75 kWh model with discounts thrown in for artificially software-restricted 60 kWh version.

If an ICE brand sold two trims of the same vehicle - the cheaper one with the smaller tank or worse fuel economy, is it as appalling and aren't they endangering the drivers of the budget version?

ttt0• 5 years ago

I'm sorry, but what the fuck? Who asked for this?

perryizgr82• 5 years ago

I certainly agree with what you're saying. However, isn't this standard in many devices nowadays? Your iPhone can run any set of instructions, but it is artificially restricted to the subset found in Apple app store. It's the same thing in the car.

rixed2• 5 years ago

In general it can be assumed that any apparition of software in any piece of hardware is just a case of practical implementation of "organised scarcity".

I wonder how long before there is a large enough backlash from customers that "works fully offline" becomes a marketing label.

PartiallyTyped2• 5 years ago

Am I the only one that remembers cars getting hijacked *while driving* because core systems were connected with the entertainment system [1]?

The whole 'lets smartify everything', 'control everything' or even 'collect usage information' is exhausting. We have collectively given up our freedom in the name of 'comfort' and often for features that nobody really needed but became mainstream.

[1] https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...

PenguinCoder• 5 years ago

Yes, it has indeed gone backwards. I refuse to pay for the remote start 'subscription'. Utter stupidity.

chrisseaton12• 5 years ago

Cars had remote unlock and start decades ago

Do you mean buttons on key fobs? That's not what this is about. This is apps on phones that let you access the car. Why would you want to do that? Range of the signal, additional functionality (you can see the fuel level for example), and you don't need to have your key fob to use it.

faeriechangling4• 5 years ago

Not having your key fob is huge for... Well... Accessibility by multiple definitions of the word. ADHD for instance makes it very easy to forget your keys and very easy to remember your phone.

userbinator4• 5 years ago

This is apps on phones

There's still no need to make it go out through the Internet and back again --- even Bluetooth has more than adequate range.

In fact, I'd argue that the limited range is a benefit, because it prevents some hacker anywhere else in the world from manipulating your car.

ska3• 5 years ago

Have we gone backwards...?

Sort of. A lot of this is pushed by fleet sales, where it makes more sense (to the customer).

justapassenger• 5 years ago

Battery life is partially a reason. If your car would be online 24h, it’d drain 12V battery faster. And you cannot trust iOS or Android not to kill your app in the background, when it’s waiting for the car to be awake to communicate. Servers can queue that for you.

PragmaticPulp• 5 years ago

Key fobs still work with or without internet access. No dependence on the company's servers.

This would only break the mobile app's ability to unlock the car, for example if you misplace your keys.

darkerside• 5 years ago

Pragmatic indeed. Wish this appropriate reaction were closer to the top.

jtsiskin• 5 years ago

Although I imagine there’s a nonzero amount of people who have lost their keys already, and have been relying on the app rather than pay for a replacement.

midasuni• 5 years ago

The “s” in IoT stands for security

loosetypes• 5 years ago

Is it not the same with most aspects of software as consumption reaches economic critical mass?

Systems designed by and for users lose control to business interests.

Leading to streaming over media ownership, as we become renters in every domain.

Movies, shows, music, video games. “To improve the consumer experience” reads ever closer to “with DRM we can charge subscriptions in perpetuity (telemetry’s just a bonus!)”.

Why would I want or require internet to play a single player computer game? At least with cars, perhaps we’ll begin to see some pushback.

krageon2• 5 years ago

Have we gone backwards

Yes, I think this is a reasonable conclusion from your priors.

tunnuz• 5 years ago

Honest question, is it a big deal not being able to start your car remotely?

hanche• 5 years ago

Not for me. (I own a Kia Soul, electric.) Many owners use a similar feature to get their car to warm up at a specific time, though. I haven’t used it myself, though, being too disorganized to know ahead of time when I want to use the car. But I find it very useful to be able to keep an eye on the charging status, so I can return to the car when the battery is full enough.

Of course, if the intruders have the means to disable my car remotely, that is a much more serious issue.

crocodiletears3• 5 years ago

Not really, for most functional adults. But it's offensive you need the OEM's servers to do it.

chrisseaton12• 5 years ago

No. People in this thread are (deliberately?) misunderstanding and (pretending to?) think it means being able to start them at all.

kube-system3• 5 years ago

It would be for me if I recently spent $40,000 for the privilege of doing so.

tyingq2• 5 years ago

I think all the noise from people complaining about it is the bigger deal. That results eventually in the general public learning that Kia has lost control to hackers, which eventually hurts car sales.

yread2• 5 years ago

Perhaps the original article on bleeping computer would be better?

https://www.bleepingcomputer.com/news/security/kia-motors-am...

mensetmanusman• 5 years ago

Looks like BTCs main value is facilitating ransom ware attacks

smabie2• 5 years ago

Not exactly. Tens of billions of dollars worth of BTC changes hands everyday and percentage of transactions associated with ransomware is absolutely minuscule.

gokhan• 5 years ago

But what's the value in it? I'm trading Bitcoin and related ecosystem (from ETH or DEFI nowadays to crypto related securities like MARA, RIOT, CAN, etc. I always hold some crypto) since 2012 and made very good returns compared to the initial investment. But never ever saw a widely adopted use case for any coin other than speculation.

There are always promises, wishful-thinking, hypothetical demand for a use case but it never materializes. Here are some:

BTC: Trade (edit: for goods and services)? No use since price is too volatile. Store of value? Tell me again after this bull run. Besides, what's different than LTC, or even Doge that defines a different value proposition?

DEFI: The infrastructure is there but people just use it to speculate. Never heard a real business borrowing in DEFI to finance, for example, shop renovation. The only use case I can come up with is miners borrowing to buy miner hardware, since returns will be in crypto and will be implicitly hedged against crypto price inflation. Other than that, trading SUSHI or UNI or whatsnext is the only way.

NFT: What happened to CryptoKitties between last bull run and this one? NFT actually guarantees the uniqueness of the outer shell, not what's inside. Rare gaming items might be a use case, but why a game maker would use something it can't control, or fully extract value is beyond me.

yjftsjthsd-h5• 5 years ago

Right, just like physical cash.

quantumhobbit• 5 years ago

Don’t forget the drugs and money laundering.

mbreese• 5 years ago

So, let’s assume the perpetrators get their ransom in Bitcoin... how are they ever going to be able to spend these coins? It’s not like the transactions are anonymous. So what will the rest of the world be able to do about it? Can the target wallets be blocked? Monitored?

vmception9• 5 years ago

the secret that chainanalysis companies wont tell you is that they have no idea if the same physical human still owns the coins they are following.

watching transactions on a blockchain is a wild goose chase that relies on amateurs making stupid mistakes.

lifeisstillgood3• 5 years ago

Huh? Aren't we following addresses (If you have the private key to an account that accepted a ransom, chances are you are the same person (or in cahoots enough to be legally in trouble)

ad31mar• 5 years ago

https://en.bitcoin.it/wiki/CoinJoin

shiado• 5 years ago

https://wasabiwallet.io/

sn_master2• 5 years ago

They can buy Monero with it. Many exchanges exist that convert between the two. Once its in Monero, they can buy BTC again and it's very hard to prove the two are related.

torbital• 5 years ago

Was Kia using BlackBerry's QNX platform?

xyst• 5 years ago

It looks like they are per BB news release: https://www.blackberry.com/us/en/company/newsroom/press-rele...

But I think the ransomware attack is more on the Kia internal servers rather than on the cars themselves. The inability for people to unlock their cars remotely seems to be a side effect rather than a main target of the hacker group.

jonplackett2• 5 years ago

Have there been any attempts to deal with this kind of thing within Bitcoin? Like, could everyone agree to blacklist specific coins that were known to have been paid as random? Would it be plausible for a large government to introduce regulation to demand any proper exchange to refuse coins originating from a ransom? Or is that just impossible?

treeman79• 5 years ago

Isn’t avoiding regulations one of the main points of Bitcoin?

avdlinde• 5 years ago

Maybe, but that doesn't make the question invalid. If a majority decides a subset of coins is invalid or should not be used, wouldn't that work?

jonplackett2• 5 years ago

It doesn't stop a government trying. If an exchange is in their jurisdiction then what choice do they have? It would depend how many governments would enforce it - so probably goes back to the political will question in some comments above.

lifeisstillgood3• 5 years ago

This is probably easier than "normal" money laundering due to the traceability of BTC. But it flounders on the usual problems of money laundering (for example the biggest money laundering locations globally are London and NYC.)

We can solve money laundering but it needs political will - write your congressman!

yjftsjthsd-h5• 5 years ago

We can solve money laundering but it needs political will - write your congressman!

Is this one of those things that's completely trivial as long as you're willing to completely throw privacy out the window and make life more difficult for completely legitimate transactions, or is it really "just" political will?

fasteddie310032• 5 years ago

I own a 03 Ram 2500 with a 5.9 Cummins engine. It has 250,000 miles and from the forums it can easy get to 1 million miles. There is no infotainment system to show the truck's age, distract you, or break from a bad solider joint. I've fixed everything myself on that truck from the transmission to the axle seals. The vehicle is actually increasing in value because it has a grand fathered in diesel engine. I have no idea why someone would buy a car with so many confusers (AVE for computer) that will only give you grief down the road (literally).

jgilias2• 5 years ago

There's a lot of symmetry with farmers buying 40 year old tractors. For exactly the same reasons. I really hope the pendulum swings the other way if even just a bit. I mean, there are still new dumb-phones being made. So maybe there's hope for dumb-other-things as well.

tsomctl• 5 years ago

Hate to break it to you, but a zener diode on your ECM can fail short, which burns up the pcb trace for the power. And the ECM is glued together, and it's ridiculously hard to open up without damaging it further, and it has a flexible pcb that can split if you flex it too much once you get it open. (I have one sitting 5 feet from me).

grecy• 5 years ago

Get a P-pump for your 5.9 and forget about electronics altogether :)

totalZero3• 5 years ago

Considering that you can get a used one for 70 bucks shipped on Ebay that doesn't sound like much of a problem.

kobalsky• 5 years ago

Liking one specific generation of technology is just being a modern amish. I'm pretty your old truck is an abomination for some old timer. New tech will be tested and bad ideas will be eventually abandoned down the road, this is how it works.

TameAntelope• 5 years ago

His truck is an environmental abomination, and almost certainly not as safe as a more modern vehicle, not to mention the hundreds of hours (thousands?) he's had to pour into understanding his vehicle and performing his own maintenance.

You make trade-offs, which is fine until you pretend like your set of trade-offs is the best set, and everyone else is wrong.

totalZero3• 5 years ago

Liking an older generation of technology makes sense when the newer generation has lost its way.

New tech being abandoned down the road doesn't help any of the poor saps who bought that new tech.

letitbeirie2• 5 years ago

My car is a 2007 and I've kept it around for similar reasons. The one thing that scares me the most about having a car that old is safety. Newer cars are a lot heavier and stiffer, so even cars that are considerably smaller could annihilate mine in an accident.

It's not quite to this extreme, but IIHS did a test (https://www.youtube.com/watch?v=xtxd27jlZ_g) a while back that showed the difference in safety standards between a 1959 Bel Air and a 2009 Malibu. The Bel Air is about 5% heavier.

Probably less of a worry in a 3/4-ton truck though.

jacquesm2• 5 years ago

Remote unlock is the least of the problems here, the real issue is that cars have no business being connected to the vendors servers at all. This could have been entirely solved locally by pairing the car to one or more phones using BT/WiFi. How remote does it have to be, you don't really want to be able to start your car if you're not in WiFi range.

chrisseaton12• 5 years ago

Remote unlock is the least of the problems here, the real issue is that cars have no business being connected to the vendors servers at all.

Why do you think that? It provides valuable functionality that I use, such as journey logging, fuel status, access from an app, and so on. You need an intermediate server run by the vendor. I can't give it my phone's IP address, can I!

cwalv• 5 years ago

Maybe something simpler like a stun/turn server would be enough. Or something with no infrastructure (or recurring fees) at all, only working in my local network (like my printer).

yjftsjthsd-h5• 5 years ago

You need an intermediate server run by the vendor. I can't give it my phone's IP address, can I!

1. Why couldn't you give it your phone's IP?

2. You could just as easily use USB, Bluetooth, or local wifi, none of which require anything other than your phone and your car.

magicalhippo2• 5 years ago

How remote does it have to be

My SO absolutely loves being able to enter a heated (winter) or cooled (summer) car for the drive home from a cafe, restaurant or similar.

Parking for these activities is seldom within direct phone range (BT/WiFi), so would have to be something else.

Wowfunhappy• 5 years ago

Agreed, those are reasonable additional features. And critically, they aren't necessary for the car to function (so they could, and should, be optional).

fiddlerwoaroof3• 5 years ago

Yeah, I also like the ability of third parties like Teslabout to provide dashboards of your car usage. Personally, I want "personal telemetry" in all my devices: if protocols like Solid ( https://solidproject.org ) were more well-established, they'd be a great way to have this sort of functionality without relying on the vendor to store/process all the data.

choward2• 5 years ago

It could be something you self host on your own server.

sudosysgen• 5 years ago

This could be done via ZigBee, you'd plug in a transceiver to your home local home network your phone could connect to you or access via BT. Or maybe the keyfob itself can act as a ZigBee transceiver?

nwallin2• 5 years ago

I love technology. I think it's great. I think it's the bee's knees.

My house thermostat is failing. Many segments on the display don't work, the programmable bits no longer work, I woke up to a frigid house last week.

I went on amazon.com and looked at thermostats. Internet connectivity galore, fancy phone apps, full color LCD displays, dashboards and logging, the works.

I bought an $18 model that has a weekend/weekday programmable schedule. I know I can't trust these vendors. They care entirely too little about my security.

Some day I may sit down and build myself arduino-based thermostat, but that day is not today.

Jimmc414• 5 years ago

I really hate the fact that it would have been so much cheaper for them to have just quietly paid the $20 million from the outset.

Jerry2• 5 years ago

According to the original article [1] (The Drive one is just a poor rewrite), Hyundai is also affected.

After the publishing of this story, numerous Hyundai and dealership employees contacted BleepingComputer to state that Hyundai was also affected by unexplained outages.
In emails sent by Hyundai Motors America to Kia dealerships on Saturday and seen by BleepingComputer, Hyundai stated that multiple systems were down including their internal dealer site, hyundaidealer.com.

[1] https://www.bleepingcomputer.com/news/security/kia-motors-am...

Clewza313• 5 years ago

Not surprising, since Hyundai acquired a majority stake in Kia in 1998.

cblconfederate• 5 years ago

It's only fitting, bitcoin is decentralized, it wants to kill centralized security/locks

codegeek• 5 years ago

Cars are really going in the wrong direction overall. I do like a car with some tech like power windows, memory seats etc but I do not want to connect it to the internet. I have my smartphone for it already. I want my car to be dumb. Add Key, it works. No key, you are locked out and you can call someone to unlock it for you.

Btw, not to mention that New Cars are becoming too expensive compared to say 15-20 years ago due to all this "tech" while the engines are becoming crappy with plastic (shout out to famous youtuber Scotty Kilmer if anyone knows him :))

marshmallow_12• 5 years ago

i'm not sure how much the tech adds to the price of the car. More likely the price increase is due to much stricter crash safety standards then existed 20 years ago. If crappy plastic makes an engine more reliable, economical, powerful and cheaper, then most people are willing to give up on some durability.

dazc• 5 years ago

The original buyer is covered by the warranty so doesn't care about the plastic parts that will, likely, not wear out in the first couple of years anyhow.

The next sucker down the line though is in for some severe finacial pain.

alfor• 5 years ago

Bad news for Bitcoin and other crypto

If crypto become the payment system for criminals I wonder what will happen with crypto.

SXX• 5 years ago

Crypto would be spectacularly popular then. But majority of criminals totally okay with cash and normal money laundering using temporary companies and banks.

MattGaiser• 5 years ago

Is this a big part of why companies are buying up tons of bitcoin? Insurance against these kinds of attacks?

ramshorst• 5 years ago

Makes me think of Mr. Robot season 1...

Animats• 5 years ago

Next, some attacker figures out how to modify a firmware update to the fleet and stops all the cars until the ransom is paid.

mabbo• 5 years ago

If they were able to do that, I suspect the random would have been much higher.

userbinator4• 5 years ago

Only stop? Make them behave erratically and dangerously...

I'm sure a few "out of control" cars causing mayhem would attract sufficient attention. The question then is whether it'd make the manufacturers reconsider their "always connected" stance, or just cause them to lock down things in a user-hostile fashion even harder.

Now you know one of the answers to the question of why am I scared of self-driving cars...

tyingq2• 5 years ago

It does sounds like they are deep enough in to stop things like replacement car keys, programming replacement body control modules, ECUs, etc. Not as dramatic, but Kia/Hyundai can't hold out long as-is.

irrational• 5 years ago

One of the reasons I chose Home Assistant instead of SmartThings, despite costing more for the initial setup and taking more work to get going, is that SmartThings has to call home to Samsung servers and there are lots of stories of problems people have had when the Samsung servers are down.

toinetoine• 5 years ago

Home Assistant really is amazing. It has integrations [1] for anything you'd want and works on tons of devices. Hosting it locally on an old raspberry pi 3, has been controlling thermostat, lights, and (as of 2 weeks ago) sprinklers.

https://www.home-assistant.io/integrations/

herval• 5 years ago

Liquidity question. If you send a crook a bunch of btc, and they eventually use that btc, isn’t it pretty easy to trace the transactions all the way? How do these people get to liquidate or use these ransom payments without leaving a long papertrail of everything they did with the money?

lftl• 5 years ago

I think they'd usually use one of the non-KYC exchanges to move the money into an anonymous cryptocurrency, and then out to whatever they wanted. I'm not sure why they don't skip the intermediate step and just ask for Monero or whatever. Maybe they think the mark will be more familiar with BTC and thus more likely to deliver?

sedatk• 5 years ago

They use money mules. Hundreds or thousands of regular people who have access to a Bitcoin ATMs with the promise of a small comission. They hire them in forums. They hand over to other proxies and you lose the trace at that point. At least, most of it.

FDSGSG• 5 years ago

Nonsense, nobody does this after they already have bitcoin. Such mules are used when you want to receive and cash out illicit bank transfers into bitcoin.

throwawayboise4• 5 years ago

How can companies not have ransomware in their threat models, with a tested recovery plan and tested offsite backups?

Too many big corps have been victimized to think that it can't happen to anyone. You must assume it will happen, and when it does you must have a plan to recover.

TacticalCoder• 5 years ago

It would be hilarious if, as a consequence of cryptocurrencies (sadly in this case because of a very nefarious use), companies started taking security more seriously.

Somehow I hope that when, say, Toyota sees this someone somewhere pushes for better recovery plan / offline backups, etc.

ht85• 5 years ago

Offsite backup is not enough. I have done consulting on many projects and on every one of them, someone getting access to certain servers would be able to sabotage backups as well.

If your data is important, you should replicate your backups to an append-only storage with a long retention period.

I've been using S3 in "Compliance" retention mode, which coupled with Glacier is cheap, and more importantly lets me sleep at night.

ocdtrekkie2• 5 years ago

You can also do just fine with an LTO tape drive. The main problem is that people want automated convenience and automated convenience can be hacked before people notice.

An LTO backup tape on a shelf might as well be stored in Fort Knox as far as a hacker is concerned.

biolurker1• 5 years ago

They are idiots, they should be asking for monero how can they be so clueless?

qwerty456127• 5 years ago

I would never in my sane mind buy a car which relies on an Internet connection for anything beyond updating maps or loading music.

js4ever• 5 years ago

Is it still through Eternal Blue or is it a new hack?

protomyth2• 5 years ago

Ok, I am a bit confused. Which model Kias connect over the internet? I have a 2017 Kia Niro, and you have to manually run an app to update information if you are so inclined.

Also, I can pay my bill at kmfusa.com right now, so what does the article mean about not being able to pay on the loan?

yread2• 5 years ago

The UVO is only on newer models (depends on the region but it seems 2019+). European 2018 Niro here also without UVO

protomyth2• 5 years ago

Thanks. One part of the article is false, the payments at kmfusa.com are going through.

I will say the standard two e-mails they send aren't being sent. They sent the "Kia Motors Finance Payment Authorization" from speedpay.com, but have not sent the "Thank You - Your Payment Has Been Processed" email from KMFUSA@servicing.kmfusa.com.cname.campaign.adobe.com yet. Odd. Money was taken out of my checking account.

spoonjim• 5 years ago

Can someone with knowledge about Bitcoin explain how the hackers will eventually use this Bitcoin given that it can be traced back to them?

kube-system3• 5 years ago

The same way criminals use cash: they launder it.

tomcooks• 5 years ago

On an unrelated note: What a spamfest of a banner ridden website

Apparent hackers behind Kia ransomware attack demand millions in Bitcoin

Related Stories