Hacking Kia: Remotely controlling cars with just a license plate

by speckx • 2 years ago

630 352 2 years ago

Does Kia have a bug bounty like Tesla does? Tesla paid out 200k and a Tesla a few months ago.

daghamm2• 2 years ago

Almost all vehicle manufacturers have bug bounty programs of some kind (open or closed) but I seriously doubt Kia is one of them.

BTW, the Tesla bug from April is really scary. $100K is peanuts for the ability to remotely control the engine from an adjacent vehicle.

pwagland• 2 years ago

Any source for this issue, I could not find any reference, but am not doubting that it exists.

voxadam• 2 years ago

From https://www.hyundaiusa.com/us/en/vulnerability-disclosure:

  In submitting reports, please note that although Hyundai Motor America sincerely
  values vulnerability reports, we do not provide monetary compensation (“bounties”)
  or non-monetary remuneration in exchange for submitted reports. This program is
  only meant to facilitate the responsible reporting and resolution of cybersecurity
  vulnerabilities.

Note: Kia is owned by Hyundai.

omoikane• 2 years ago

Kia America Vulnerability Disclosure Policy:

https://www.kia.com/us/en/vulnerability.html

   Please also note that we do not award bounties for reporting vulnerabilities.

myself2482• 2 years ago

"thanks to a simple website bug AND TELEMATICS HARDWARE in the vehicles that had absolutely no relevance to their ability to get from point A to point B"

josefritzishere• 2 years ago

Can we stop connecting cars to the internet now?

bell-cot• 2 years ago

Why would any of the decision makers want to do that? It's not like 99.9% of consumers appear willing to pay 10 cents more for an unconnected car.

squidgedcricket• 2 years ago

The only way a connected car would be cheaper is if money is made from the data sent over the connection. Clearly that's the case right now.

Up-front NRE, per unit HW, perpetual cloud backend maintenance. There's a lot of cost to connect a car to the internet. It should be a luxury option that I can decline to have installed.

barbazoo4• 2 years ago

I'm trying to imagine time when I would want my car to be connected to the internet. Hard to come up with, other than remote locking, that's it for me. Not sure that's worth the attack surface.

What I do find useful is the car having "cellular connectivity" to make emergency calls. But that doesn't require internet connectivity.

supportengineer2• 2 years ago

Tesla does it very well. My Tesla connects to my home wi-fi. When it's parked in the driveway it can download and install firmware updates. They are somewhat frequent. Other than major UI changes, I have been happy with the way they add features and ensure stability.

With the app it's very useful to be able to find out the location of the car, the status of the doors and windows, the current mileage, and be able to control the climate (Dog Mode, etc), warm up on cold mornings, cool down in summer. You can also get important notifications (i.e. Climate mode on for a long time, Door/Window is open, etc )

You might knock the remote climate feature but if you have dogs/kids/elderly it really improves their quality of life.

There's another recent feature which supports streaming music such as Apple Music, without your phone needed. This is convenient and useful.

Tesla charges $9.99 USD a month for this which I find to be extremely reasonable. ( I am an SRE and I know what it takes to maintain scalable secure infrastructures )

briffle• 2 years ago

My 2015 vehicle has remote start on the remote. Its very handy in cold and hot extremes to start a few min early, and then let it warm up or cool down.

My 2020 Subary only does remote start if you pay the monthly fee for their access (confusingly called Starlink), and requires the 'subaru app'

I hate it.

https://www.subaru.com/subaru-starlink/starlink-safety-and-s...

smeej• 2 years ago

This is why I keep my mechanic in business repairing my '07 Prius.

I'm starting to wonder if I'm the only one left in the world who would rather the internet not eat me alive.

krunck• 2 years ago

Yes, we can still modify our cars as we please. Maybe it won't be legal. But we are able to. And we should.

maxwell• 2 years ago

On the contrary—preventing modification of cars is illegal in my state.

supportengineer2• 2 years ago

At least have a hard toggle switch mandated just like the button for emergency flashers.

sxcurity• 2 years ago

Stop connecting vehicles to the internet pls & thanks

yupyupyups• 2 years ago

Ok, I wont.

carabiner• 2 years ago

Thanks.

AdamJacobMuller• 2 years ago

If it's done well, there are some useful features there.

App unlock, remote start + remote temperature control. All very useful.

I couldn't imagine buying a car without carplay now.

rwmj• 2 years ago

Sorry no. App unlock is a stupid anti-feature, do people genuinely think it's better than pressing a keyfob?

Remote start is very useful in very cold climates, but guess what, it doesn't need a phone, an app or the internet. My friend in a snowy part of Japan had a radio keyfob that did this literally 10 or more years ago. As long as you were within about 100 ft of the car you could switch it on and turn on the heaters.

AyyEye3• 2 years ago

It's never well done.

FriedPickles• 2 years ago

Unlock via Bluetooth is perfectly viable without internet connection (unless you mean unlocking it for someone else?). Remote start and temp control should probably work from a few hundred feet away. If only phones had a longer range local radio, perhaps something like Zigbee. Maybe WiFi direct?

whiplash451• 2 years ago

It just doesn’t have to be the internet.

lowkj• 2 years ago

CarPlay doesn't use your car's internet, it uses your phone's internet. That's part of the whole beauty of it.

natch6• 2 years ago

Why do you give CarPlay credit for those features? No need for CarPlay for any of those. What do you get from CarPlay that you don't get from a connected car without CarPlay?

morkalork• 2 years ago

If the car manufacturer can remote unlock and start your car for you, it can be abused by a hacker in same way. It's the exact same argument against backdoors in encryption for the government, if a backdoor works for them, it'll work for hackers too.

CatWChainsaw2• 2 years ago

Well aren't you a precious little princess. I have none of that. It's very unlikely my early 2000s car will ever be attacked in this manner. I am going to maintain that car as long as possible. Enjoy your ticking time bomb.

kkfx2• 2 years ago

Well... There is no reason to have a middleman like the OEM, so the car could be connected just with the formal owner (i.e. with a personal subdomain o dyndns), FLOSS stack under users control and some hard limits (like you can't act on the car if it moving and so on).

Rebelgecko3• 2 years ago

I would guess 99.9% of car owners who use the app would not set up a personal subdomain or manage a FLOSS stack

johnsutor• 2 years ago

With the advent of "Kia Boys" and now this, it's a miracle people still buy Kias.

thrtythreeforty2• 2 years ago

They have the best EV architecture on the planet currently; despite all the hacking issues, I'm still considering an EV6 for my next vehicle. Probably with a yanked cell radio fuse...

solarpunk• 2 years ago

can you explain what you mean by ev architecture?

speedgoose2• 2 years ago

In addition to the privacy and security issues, they also have a substandard infotainment still running Android 4.

hypeatei2• 2 years ago

Cars are essential to living in America except for a few cities. Car manufacturers can basically do whatever they want.

There was a recent YouTube video with a car thief that basically showcased a "special" tablet that could get any car started in a minute by plugging into the OBD port. Pretty shitty security model if it relies on no tablets getting out.

moe_sc• 2 years ago

Do you have a link to the video?

myself2482• 2 years ago

If someone's already inside the car, I expect them to be able to hotwire it eventually.

The trouble is when manufacturers extend the CAN bus out to the smart headlights or something, and it's the same bus that the body control sits on, so they can just send a door-unlock message...

mass_and_energy2• 2 years ago

I wonder how many LEAs knew of this and used it to bypass having to get a warrant, instead of responsibly disclosing it for the benefit of public safety.

bena2• 2 years ago

The warrant is still necessary, evidence obtained through illicit means is generally not acceptable.

bobbylarrybobby• 2 years ago

Technically you don't need a warrant if you just ask for the data and it's handed over. You only need a warrant if someone doesn't want to hand over the data.

alistairSH• 2 years ago

True, but parallel construction/evidence laundering is a thing.

like_any_other2• 2 years ago

The article isn't clear, but it sounds like the cars were already being tracked, only now also "unauthorized" people could track them (when before, only Kia and car dealers could track your car).

Why is it okay for Kia/manufacturers to spy on our cars, and only a problem when others do it? This attitude is pervasive in reporting on hacks like these - the initial spying by corporations is always given a pass (or rather, it is implied that's not even "tracking", as the title implies the tracking happened only after the hack).

datax2• 2 years ago

Almost all modern cars have a way of providing or grabbing location data, however most manufactures do not "Spy" on your car by default, this would violate CCPA, colorados privacy act, GDPR... ETC. The users need to opt-in to telematics data. For example in Hyundai case when you create a "Blue link" account and accept their terms of service you are connecting whatever vehicle you have verified on your account to their telematics system, and subsequently opting in to tracking.

Manufactures like VW/Audi place an opt out within the vehicle itself so if you opt out of telematics in the vehicle you are in a full privacy mode and the manufacture cannot get the data or override this request. This covers the scenario if other "Users" of the vehicle are driving and would choose to opt out outside of the main users/owner.

So some bake it into your app registration and signup, and some leave it in the vehicle. The gist is you can opt out, and if the manufacturer does not respect that you have grounds to sue, Currently there is a lawsuit against GM/Caddy because a user did not opt-in to Usage Based Insurance, but their information was captured and brokered blocking them from acquiring new insurance.

like_any_other2• 2 years ago

The EFF [1] is less optimistic that all of this spying is opt-in and clearly-stated (instead of buried in legalese), and Wired [2] likewise mentions cases where it's opt-out instead of -in.

[1] https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...

[2] https://web.archive.org/web/20240705093406/https://www.wired...

adgjlsfhk1• 2 years ago

often the opt in is buried in 15 pages of paperwork when you buy the vehicle

dang• 2 years ago

(this was originally posted in https://news.ycombinator.com/item?id=41657833 but we merged that thread hither)

busymom0• 2 years ago

Did you reply to the wrong parent thread?

yieldcrv• 2 years ago

Kia Boys Who Code

bityard• 2 years ago

Well, I am already pretty firmly against buying any car that requires you to create an account online to "activate" the vehicle. But I definitely won't buy another Kia anyway, based on the fact that our last one burned a quart of oil every thousand miles WELL before it hit the 100k mark.

barbazoo4• 2 years ago

car that requires you to create an account online to "activate" the vehicle

I have a 2023 Kia and that's not necessary. You only need the account if you want to use the optional online services.

sahmeepee• 2 years ago

As the article says, you don't need an active subscription to be vulnerable. In this case it seems that if the model supports the features at all, you are vulnerable.

This makes sense, because they want people to be able to subscribe to their services later without having to visit the dealership, so they make it possible to remotely enable the service.

I'm not sure if you can buy a tinfoil hat for a car.

01HNNWZ0MV43FF• 2 years ago

Otherwise it spies on you with no account

raxxorraxor• 2 years ago

That is unusual. They give 7 years warranty compared to European or US cars manufacturers and it often shows why. They are indeed dependable.

alexandersvozil• 2 years ago

i cannot connect to kia anymore, would have bot worked in me

meindnoch• 2 years ago

What if we had laws that required car manufacturers to have software with slightly better quality than the utter syphilitic diarrhea they currently ship?

outworlder• 2 years ago

Hardware companies usually suck at doing software.

diego_moita• 2 years ago

Ok, lesson learned. Thank you.

I have a Kia Niro EV Wind 2024 and just cancelled my account at Kia Connect.

Yes, I felt stupid. But a little less stupid now.

Edit: does anyone know how I could disable Kia's remote access to my car? Is there any antenna I could cover with tin foil or a chip that can be disconnected?

aftbit4• 2 years ago

These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.

bluSCALE4• 2 years ago

Don't feel stupid, feel a little angry. The only thing you could have done to prevent this was not buy a Kia.

sjamaan• 2 years ago

Like the other brands are any better...

EricE3• 2 years ago

It's hardly unique to Kia!

https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...

tptacek8• 2 years ago

This won't have nearly the same impact, but when you're considering how vulnerabilities like this might influence your future purchasing decisions, remember that Kia's decision to omit interlocks from their US vehicles (but not Canadian ones!) led to a nationwide epidemic of Kia thefts so large it fed a crime wave, something a number of US cities are suing Kia over. If you've read about carjacking waves in places like Milwaukee and Chicago: that was largely driven by a decision Kia made, which resulted in the nationwide deployment of a giant fleet of "burner" cars that could be stolen with nothing but a bent USB cable.

wasteduniverse• 2 years ago

Don't anthropomorphize the lawnmower and blame Kia for this, blame the NHTSA for making it legal to skimp out on immobilizers in the first place. Regulations matter!

tptacek8• 2 years ago

Since Kia/Hyundai is the only automotive group to have this problem, I'm going to go ahead continuing to blame them.

cryptonector6• 2 years ago

Lmao, good reference to u/bcantrill.

pengaru• 2 years ago

Volkswagen has entered the chat

adolph2• 2 years ago

If you've read about carjacking waves in places like Milwaukee and Chicago: that was largely driven by a decision Kia made, which resulted in the nationwide deployment of a giant fleet of "burner" cars that could be stolen with nothing but a bent USB cable.

"A nationwide epidemic of Kia thefts" seems to be a natural consequence of decreased security. However, that carjacking in Milwaukee and Chicago specifically would follow from a nationwide omission of interlocks is not obvious as the vehicles are easily stolen without the need for personal confrontation. What is the connection of Kia interlocks to carjacking in Milwaukee and Chicago?

Terr_2• 2 years ago

However, that carjacking in Milwaukee and Chicago specifically would follow from a nationwide omission of interlocks is not obvious as the vehicles are easily stolen without the need for personal confrontation.

I think parent-poster means that the easily-stolen cars are being used as tools of carjacking, rather than the targets of it. In particular, carjacking that occurs by somehow provoking a victim to stop on the highway shoulder, a location where attackers can't exactly arrive by foot or bus or bike. That way they don't involve a vehicle that might be observed and traced back to them.

An alternate explanation is that they meant to write something like "theft" and accidentally put down "carjacking" instead.

Eumenes• 2 years ago

something a number of US cities are suing Kia over

I can think of nothing more American than suing car manufactures because they're too easy to steal. The US is truly screwed.

tptacek8• 2 years ago

They're being sued because they deliberately made the cars easier to steal in the US than they are elsewhere.

wallaBBB3• 2 years ago

Regarding the Kia Boyz - immobilizers have been mandatory in most of Europe since late 90s, in Canada since 2007. Basically there is something to put on (lack of) regulations as well as on HKMC.

Sohcahtoa82• 2 years ago

In the USA, we believe we don't need regulations, the Free Market(tm) will punish corporations that don't behave in a way that benefits their customers!

Insane to me that so many people believe this...

vasco• 2 years ago

From my understanding immobilizer bypass tools are cheap and plenty.

mass_and_energy2• 2 years ago

We Canucks needs all the features we can get to stop cars from being stolen, without exaggeration a car is stolen in Canada every 5 minutes on average.

SpaghettiCthulu• 2 years ago

Too bad the only thing our current government can think to do is ban the FlipperZero.

emptybits• 2 years ago

Fellow Canuck here. Yes, that statistic is sadly, insanely true. And some background ... https://www.bbc.com/news/articles/cy79dq2n093o

voidmain00013• 2 years ago

I'm about to take delivery of a Toyota Sienna in Canada, and despite it being a minivan, it's a Toyota which are popular to steal right now. I plan to use both a steering wheel and accelerator pedal club. I've watched videos of both devices being rendered futile in less than 60 seconds but I hope that it will deter the less determined thieves. Then, after my kids have thoroughly destroyed the interior, I will hope that it gets stolen.

bnralt• 2 years ago

it fed a crime wave, something a number of US cities are suing Kia over

A large part of the crime wave stems from the policies these cities implemented. Many times from the same leaders who are suing Kia now.

For instance, a friend got their car stolen in D.C. After they caught the guy, they let him go with no consequences, because they said he was under 25 and it was the first time they caught him. D.C. recently put a convicted murderer on the sentencing commission who believes that this kind of "it's not really their fault if they're under 25" thinking should be extended to murders as well.

Local politicians even told us there wasn't a crime wave, and that it was just a fake narrative. Then when that stopped working, they started pointing fingers at everyone else they could.

ethbr17• 2 years ago

It's fair to say that a company which makes cars that can be stolen with only a USB socket bears significant culpability for car thefts.

Anything political doesn't have to be only this reason or only that reason. "Both" is an option too.

   - Kia fucked up, to make more $
   - Some cities have ineffective enforcement

naming_the_user2• 2 years ago

There's a lot of this sort of thing in the UK at the moment which is really baffling to me.

One extreme is the death sentence, sure.

But on the other end it feels as if there are constant stories of career criminals who just do thing after thing after thing. It's not like someone just accidentally gets caught up in multiple assaults/robberies/break-ins etc. At some point you have to just think, okay, there's no rehabilitating this guy, how do we minimise the damage to society.

wesselbindt2• 2 years ago

Canada, a bit more liberal than the US, probably has plenty of cities with such policies in place too. Yet, no crime wave there. These waves were a result of Kia's choices, and quite obviously so.

sidewndr46• 2 years ago

Because car manufacturers have such a clear decision making role in the legal and judicial process of a place like Milwaukee. It can't be that the government simply realized that they aren't legally obliged to deal with any problems the populace have and simply let them eat cake in a 21st century way.

This couldn't be the same state where they tried to just bribe a foreign company known for exploitative labor practices to set up a facility there could it: https://en.wikipedia.org/wiki/Wisconn_Valley_Science_and_Tec....

xyst3• 2 years ago

Kia is a joke car manufacturer. It’s surprising that they are still able to sell cars and stay in business

roberttod• 2 years ago

I wasn't sure what an "interlock" was, and it's a breathalyzer that prevents the vehicle from starting. Was that a mistake?

Edit: ah! I think you meant engine immobilizer

Dylan168072• 2 years ago

interlock. noun. an arrangement in which the operation of one part or mechanism automatically brings about or prevents the operation of another

Requiring a breath or a specific key signal are both interlocks.

sandos• 2 years ago

How did the insurance companies respond to this? They should have made the cars extremely expensive to insure, no?

incrediblydumb3• 2 years ago

Largely driven? You're forgetting at least one variable

aftbit4• 2 years ago

Wait a moment, the key vulnerability appears to be that anyone could register as a dealer, but also any dealer could lookup information on any Kia even if they didn't sell it or if it was already activated!? That seems insane. What if a dealership employee uses this to stalk an ex or something?

lambada• 2 years ago

A Kia authorised dealer being able to look up any Kia has some very useful benefits (for the dealer, and thus Kia).

If a customer has moved into the area and you’re now their local dealer they’re more likely to come to you for any problems, including ones involving remote connectivity problems. Being able to see the state of the car on Kia’s systems is important for that.

Is this a tradeoff? Absolutely. Can you make the argument the trade off isn’t worth it? Absolutely. But I don’t think it’s an unfathomably unreasonable decision to have their dealers able to help customers, even if that customer didn’t purchase the car from that dealer.

conductr• 2 years ago

Those aren’t the only options. It would be trivial change to allow any dealer to request access to any vehicle and have it tied to the active employees SSO or something similar that at least leave an audit trail and prevents such random access. Allowing anyone to be a dealer is the real oversight. They could put some checks in place also to prevent the stalker situation GP mentioned. It’s always going to be possible but reduces risk a lot if employee just has to ask someone else to approve their access request, even if it’s just a rubber stamp process making sure the vehicle is actually in need of some service

aftbit4• 2 years ago

In my opinion, the better way to design such a thing would be for there to be a private key held in a secure environment inside the car which is used to sign credentials which offer entitlements to some set of features.

So for example, when provisioning the car initially, the dealer would plug into the OBDii port, authenticate to the car itself, and then request that the car sign a JWT (or similar) which contains the new owner's email address or Kia account ID as well as the list of commands that a user is able to trigger.

In your scenario, they would plug into the OBDii port, authenticate to the car, and sign a JWT with a short expiration time that allows them to query whatever they need to know about the car from the Kia servers.

The biggest thing you would lose in this case is the ability for _any_ dealer to geolocate any car that they don't have physical access to, which could have beneficial use cases like tracking a stolen car. On the other hand, you trade that for actual security against any dealership tracking any car without physical access for a huge range of nefarious reasons.

Of course, those use cases like repossessing the car or tracking a stolen vehicle would still be possible. In the former, the bank or dealership could store a token that allows tracking location, with an expiration date a few months after the end of the lease or loan period. In the latter, the customer could track the car directly from their account, assuming they had already signed up at the time the car was stolen.

You could still keep a very limited unauthenticated endpoint available to every dealer that would only answer the question "what is the connection status for this vehicle?" That is a bit of an information leak, but nowhere near as bad as being able to real-time geolocate any vehicle or find any owner's email address just given a VIN.

folmar• 2 years ago

This is quite common in Europe. There is normally no special relationship with the original dealer and the service history is centralised for most manufacturers.

belthesar• 2 years ago

That's not a benefit to me if I can't control how someone gets access to my vehicle, dealership or not. If I want a dealership to be able to assist me, I should have to authorize that dealership to have access, and have the power to revoke it at any time. Same for the car manufacturer. It ideally should include some combination of factors including a cryptographic secret in the car, and some secret I control. Transfer of ownership should involve using my car's secret and my car's secret to transfer access to those features.

If you feel like this sound like an asinine level of requirements in order for me to feel okay with this featureset, I'd require the same level of controls for any incredibly expensive, and potentially dangerous liability in my control that has some sort of remote backdoor access via a cloud. All of this "value add" ends up being an expense and a liability to me at the end of the day.

xyst3• 2 years ago

Any stealership shouldn’t be able to lookup information about any active/sold car. These interactions need to have consent (authorization) from car owner. These authorizations should be short lived and can be revoked at any time.

Any of this sound familiar? Yea that’s because it’s a flow (oauth) used by many companies to control access to assets.

Car companies are just not meant to do tech. So common shit like this is ignored.

If these car manufacturers can barely shit out barely usable “infotainment” systems. Why the fuck are they diving into remote access technology?

amluto• 2 years ago

This is absurd. If there was a screen on the infotainment system where you could allow (temporarily!) the local service center of your choice to access your car remotely, fine. Otherwise, no thanks.

lofaszvanitt2• 2 years ago

Security is an afterthought... nobody cares, until shit hits the fan.

dns_snek2• 2 years ago

What if a dealership employee uses this to stalk an ex or something?

Yes, and everyone should remember this the next time these companies and their lobbyist run TV ads telling you that your wives and daughters will be stalked and raped in a parking lot if Right to repair is allowed to pass.

dns_snek2• 2 years ago

For those who seem to believe I'm exaggerating this:

https://www.youtube.com/watch?v=j0sZpKXMUtA&list=PLhFPpjYO-P...

k8sToGo• 2 years ago

What if the internet is used for that?

troyvit• 2 years ago

Yeah for some reason I find it so creepy that Kia ties your license plate number to your car's functionality. I don't know why but I feel like those two things should operate exclusively.

aftbit4• 2 years ago

License plates are incredibly insecure. They are a short, easy to automatically recognize ID that is expensive to change, and it is a crime to drive while they are covered.

poxrud• 2 years ago

That is incorrect, as per the article Kia ties the VIN number to the car’s functionality. The author used a 3rd party service to convert the license plate number to VIN.

mlsu• 2 years ago

There are no new cars on the market today that don't have a slew of connected """features""", right?

Will it ever be possible to have a non-connected car? If so, how? What would it actually take? This is not a ranty rhetorical question -- I'm actually wondering.

MarkusWandel2• 2 years ago

Don't know about 2024, but my 2023 Honda Civic EX-B (Canadian market) is actually pretty old school. Yes, it has the keyless unlock and even a remote engine start button on the keyfob (can be disabled, thankfully - car is parked inside and we have kids!) But no cellular connectivity, no wifi, and all the touchscreen stuff is "extra icing" - all the controls you need are there in physical form except for some radio and cell phone call functions. Yes, the car may be vulnerable to signal boost kind of attacks (to pretend the keyfob is nearby when it's not) and possibly the "pop off a headlight and get into the CANbus" attack. But no cloud dependency and no way for the cloud to reach in and mess things up. Also, the software it does have seems "debugged" based on a year of using it.

gen3• 2 years ago

Your Honda almost certainly has HondaLink, which connects via cellular https://www.honda.ca/en/hondalink/hondalink-2?year=2023&mode... and they're probably selling your location data to databrokers https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...

BossingAround• 2 years ago

In the EU, IIRC, 2024 is the year that EU starts mandating a bunch of stuff in vehicles (most notably, speed limiter IIUIC).

akyuu• 2 years ago

It would be interesting to have a list of modern cars without these kind of connected features, but I haven't found any.

bdcravens2• 2 years ago

Cut the cords to the cellular module

gnopgnip• 2 years ago

You can pull the fuse on a ford maverick and it physically disables the telemetry. You could also opt out and disable it through the settings. Remote start from your keyfob still works. As expected remote start, seeing where you parked, remotely locking the car through the ford app will not work.

cryptonector6• 2 years ago

In the U.S., by 2026, all new cars must have a "kill switch", and that includes a remote operation. The requirement is about preventing drunk driving, but it's being interpreted by many to require a kill switch.

Here's the NHTSA report to Congress about this:

https://www.nhtsa.gov/sites/nhtsa.gov/files/2023-07/Report-t...

Section 24220, “ADVANCED IMPAIRED DRIVING TECHNOLOGY,” of the Bipartisan Infrastructure Law (BIL), enacted as the Infrastructure Investment and Jobs Act (IIJA), directed that “not later than 3 years after the date of enactment of this Act, the Secretary shall issue a final rule prescribing a Federal motor vehicle safety standard (FMVSS) under section 30111 of title 49, United States Code, that requires passenger motor vehicles manufactured after the effective date of that standard to be equipped with advanced drunk and impaired driving prevention technology.” Further, the issuance of the final rule is subject to subsection (e) “Timing,” which provides for an extension of the deadline if the FMVSS cannot meet the requirements of 49 USC 30111.

Now, I don't see anything in there about a "rmeote switch", and I don't understand how the "remote" bit would work to prevent DUI.

notjulianjaynes• 2 years ago

I wonder how well current adaptive cruise control/collision prevention technology works to help someone safely drive drunk. I don't own a car with these features but once rented a 2021 Nissan for a road trip and just set the cruise control to 70 and it would maintain a safe distance from other cars automatically down to like 20 mph iirc. I didn't, but I probably could have been drunk and driven that car without much issue, not that I am advocating for this.

There's probably already a bunch of data being collected about cars parked at e.g. a bar for a few hours that's being used to train some AI to detect driving behaviors associated with drunk driving or something like that.

EricE3• 2 years ago

Anything in the last 10 years is probably ratting you out already.

https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...

hollow-moe• 2 years ago

depends how wide is your definition of "connected features". all modern vehicles in the EU are required to have the eCall feature which uses cell to send your location in case of a crash. Since the hardware is in there I have absolutely no faith in car makers/govs to not use it for other purposes (now or in the future) https://en.m.wikipedia.org/wiki/ECall

r00fus• 2 years ago

As a Kia owner, this was what I was hoping for immediate term, FTA: "These vulnerabilities have since been fixed, this tool was never released, and the Kia team has validated this was never exploited maliciously."

Kia still has a lot of work to do because of bad decisions, but at least my vehicle isn't ripe for theft/abuse.

seanw444• 2 years ago

but at least my vehicle isn't ripe for theft/abuse.

From this particular vulnerability. If anything, I'd still be concerned.

floatrock• 2 years ago

Yeah, but it shows Kia at least works with security researchers instead of suing them into everythings-fine silence.

randomstring• 2 years ago

The obvious next step is to crawl the whole database of vulnerable Kia cars and create a "ride share" app that shows you the nearest Kia and unlocks it for you.

jshdhehe5• 2 years ago

If you get 10x MoM growth you can lobby for it to be legal next year

nullc• 2 years ago

Something kinda like that was done, TikTok apparently algorithmically identified likely 'drivers' and flooded them with videos instructing and glorifying taking the cars for a joyride... while other platforms did not promote and even took those videos down.

not_a_dane• 2 years ago

How much time would you need to redevelop KIAtool with AI?

jmyeet• 2 years ago

Where's the strict product liability here? Like, if Kia is making a car that's easy to steal and it gets stolen, why isn't that Kia's fault and they're responsible for the damages? We're talking gross negligence here.

There have been demonstrations of hacking cars remotely to gain control of it. You could quite literally kill someone this way. This should 100% be the responsibility of the car maker.

Why do we let these companies get away with poor security? It's well beyond time we hold them financially and legally responsible for foreseeable outcomes from poor security practices.

That doesn't mean any vulnerability incurs liability necessarily. A 0day might not meet the bar for gross negligence. But what if you were told about the vulnerability and refused to upate the software for 2 years because a recall like that costs money? Or what if you released software using versions with known vulnerabilities because you don't want to pay for upgrading all the dependencies?

bdcravens2• 2 years ago

EV6 owner here. Scary stuff, but honestly, I'm not shocked. I feel like the EV6 is one of the better available EVs, but is hindered by Kia, based on the experience I've had dealing with the app and the dealerships.

georgeburdell• 2 years ago

I’ve been telling my friends who want to avoid Tesla that an electric Kia is still a Kia

cryptonector6• 2 years ago

The License Plate to VIN form uses a third-party API to convert license plate number to VIN

I guess that exists to make life easier for police. And because all patrol car laptops nation-wide need this, it really can't be authenticated meaningfully?

BenjiWiebe• 2 years ago

I don't think the police are using this software. I'm pretty sure they have their own official access to governmental (DMV) records.

emsign• 2 years ago

Looks to me like all cars sold by KIA are still owned by KIA. I'm not worried about that exploit at all, it has been fixed. I'm terrified about how much data about a car and therefore about the "owner" is available to KIA. That's totally insane.

cryptonector6• 2 years ago

Not just KIA. Most if not all major automobile manufacturers track a huge amount of data on the vehicles [and their owners/operators]. For example, many vehicles come with that OnStar thing, and so they have a baseband processor and even LTE as well as a GPS receiver, and it's always on even if you don't pay for the service, which means that the manufacturer gets to know your vehicle's location and all the places you go and the routes you take.

hathawsh• 2 years ago

OTOH, OnStar's remote disable feature is pretty compelling for consumers. It's not hard to find YouTube videos [1] of thieves being thwarted safely.

[1] https://www.youtube.com/watch?v=d9FbBgG2axE

s3p• 2 years ago

It's so funny how people arguing for commonsense ability to disable car cellular are laughed at. See the Kia Niro forum:

https://www.kianiroforum.com/threads/how-to-remove-head-unit...

lofaszvanitt2• 2 years ago

After your phone which is the ultimate oppressor device, now your car is also snitching on you. Nice future ahead of us.

grahamj2• 2 years ago

I question some of this though. I have an older Kia that I’m pretty sure has no cell modem yet the support table shows it can be geolocated.

EricE3• 2 years ago

If you own a car since about 2010 onwards it's probably ratting you out already.

https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...

ThinkingGuy• 2 years ago

If your car's old enough, though, it may be still stuck with a 3G modem that is no longer capable of phoning home.

exabrial• 2 years ago

By law, we need to be able to disconnect cars from the cell network. This is stupid.

divbzero• 2 years ago

By law, we need to be able to disconnect any product whose core functionality does not depend on the network.

grubbs• 2 years ago

Glad my VW only had a 3G antenna built in. No longer works in the US.

vlark• 2 years ago

I just want a car that is as dumb as it can be while meeting all federal regulations to the highest degree. How hard can that be?

CatWChainsaw2• 2 years ago

A day ago Louis Rossman posted on Youtube: Mazda requires $100+ subscription for remote start after filing DMCA takedown of open source program"

https://www.youtube.com/watch?v=1n0AI5aemUY

"I never hear the ancaps and the hardcore libertarians in my comments section... complain about Section 1201 of the DMCA. I wish I did more often."

croes• 2 years ago

Strike two on KIA's car security after the USB cable disaster

nkrisc• 2 years ago

Maybe other manufacturers are also this bad, but I know Kia is this bad. I’m never buying a Kia.

But wait, they patched this! Yeah, but they also shipped it.

theflyingpigeon• 2 years ago

Kia is a terrible brand anyways

schaefer• 2 years ago

My brother owns a Kia, and the constant auto break-ins are negatively impacting his mental health.

grishka• 2 years ago

If I'll ever buy a car, it won't have any network interfaces.

m_kos• 2 years ago

I am impressed that you were able to contact relevant folks at Kia. I tried contacting their security team via Kia's customer service and Twitter and was repeatedly told they don't have anyone working on security, vulnerabilities, etc. My favorite was when they redirected my call to roadside assistance (twice).

gloosx• 2 years ago

Connecticut Kia Boyz here? Imagine in some states it's not a felony to steal Kias if you're under 18, so they do it for fun and even sell them for rides 100$ each.

There is a great Channel 5 documentary on youtube about it, definitely recommend to check it!

xyst3• 2 years ago

Internet connected vehicles are a mistake. Enough time out there and mistakes will get re-introduced. If it’s not Kia, it will be someone else.

You should be able to take out the internet connectivity as a consumer. The fact that this exploit worked even if the consumer wasn’t subscribed is wild.

Car companies just can’t do tech.

mithr• 2 years ago

In Massachusetts, Kia has disabled Kia Connect for all vehicles purchased over the past few years. Any data collected by cars must be made accessible to third-party shops, and Kia opted to disable any data collection (and thus disable Connect entirely) rather than allow that to happen. It doesn't matter where you actually live — as long as you bought in MA, the car's VIN is locked out and no one can do anything about it. You're typically told this at the very end of the sales process, after everything is signed, and it's framed as "oh, by the way, MA has a terrible right-to-repair law that has forced Kia to disable Connect, you should write your state senator."

It's... interesting to see just how easy it is to access this functionality if the VIN check is bypassed.

stainablesteel• 2 years ago

its brought about a lot of shops that can rip the electronic tracking devices out of your car pretty easily too, which is nice in case you don't feel like being someone's datapoint

Hacking Kia: Remotely controlling cars with just a license plate

Related Stories