Hyundai wants loniq 5 customers to pay for cybersecurity patch in baffling move

https://www.neowin.net/news/hyundai-wants-ioniq-5-customers-to-pay-for-cybersecurity-patch-in-baffling-move/

by duxup • 11 months ago

250 172 11 months ago

neowin.net

neilv• 11 months ago

Maybe a better link:

https://www.theverge.com/news/757205/hyundai-ioniq-5-securit...

themafia2• 11 months ago

Also frustrating but for different reasons:

in 2023 over the “Kia Boyz” attacks that allowed thieves to bypass a vehicle’s security system using a USB cable.

The USB cable happened to have the right size to engage the starter mechanism. Any physical object with similar dimensions could have been used. It really undercuts how absolutely terrible the Kia security design was around that component.

Terr_4• 11 months ago

In some vehicles, their "software fix" literally did nothing but move thieves from smashing a window to screwdriver'ing the driver door lock.

More work for the thieves, but hardly a fix to inspire confidence.

OutOfHere3• 11 months ago

I guess this means Hyundai goes on the blacklist too.

wiradikusuma• 11 months ago

I understand that development costs are not free, and there's extra hardware involved, but IMO they should take this as marketing cost.

lokar2• 11 months ago

Yeah, I considered an ionic the last time I was getting a car. Now I’ll never again consider them.

inferiorhuman6• 11 months ago

The Kia Boys stuff, child labor, and ICCU failures weren't enough? The Ioniq 5 absolutely looks like a compelling car but from my POV Hyundai seems hell bent on snatching defeat from the jaws of victory.

charcircuit2• 11 months ago

That's easy to say when you aren't the one footing the bill.

antonvs3• 11 months ago

It’s easy to say as a customer with alternatives.

Phelinofist• 11 months ago

It is easy to say as a customer that already paid money in return for a working/safe/functional car.

yccs27• 11 months ago

Not even a marketing cost, a delayed engineering cost to fix a fault in the product.

akamaka• 11 months ago

This seems like a clickbait title because I’ve never hear of a hardware upgrade being called a “patch”.

OhMeadhbh2• 11 months ago

I don't think the patch is hardware. The hardware they're talking about is the "Gameboy like device" that runs the exploit.

echoangle• 11 months ago

The Verge now reports that Hyundai is offering a security patch for this issue through software and hardware upgrades to Ioniq 5 customers.

You do a hardware upgrade on the car to patch the vulnerability.

4ndrewl• 11 months ago

"The term "patch" came from early use in telephony and radio studios, where extra equipment kept on standby could be temporarily substituted for failed devices." - from https://en.m.wikipedia.org/wiki/Patch_cable

But yeah, the term patch just seems weird in this article. Why not just "upgrade" or "fix"?

throwaway2909• 11 months ago

"Service"?

wucke13• 11 months ago

I'm not so sure, I thought "patch" originated from hole punching cards to program stuff. A software patch was literally a patch of tape that hides an errorneously punched hole in such a card.

The term patch-cable seems to be way younger.

jjani• 11 months ago

They're swapping out hardware, which is why they're asking money for this to compensate the labor costs. Not saying this justifies it, but the title is misleading.

jader2012• 11 months ago

Agree the title is a bit misleading, but addressing what sounds like an exploit still feels like a patch of sorts.

But yeah, “patch” usually implies software vs. hardware.

Either way, agree with other comments that Hyundai should just eat the costs if it prevents theft due to an exploit.

Having said that, given what the car costs, the fee doesn’t seem completely unreasonable.

GlacierFox2• 11 months ago

Given what the car costs, you'd think they'd do this out of courtesy.

antonvs3• 11 months ago

Starting MSRP of US$42,600? Seems like there’s some room there to cover manufacturer mistakes.

mirzap3• 11 months ago

It doesn't matter. If a customer buys faulty hardware, it's the seller's responsibility to replace it with working hardware. If the breaks had a manufacturing defect, you wouldn't expect the customer to pay for the replacement.

throwaway2909• 11 months ago

I bet the stock car is 100% secure in Korea.

Maybe you live in a country where car thieves hack into cars left and right. Maybe you live in a country where thieves just tow your car in the middle of the day and don't care about your locks at all. Do you expect car maker to ship you free fixes against every scenario? Security is a spectrum. Make your police better if you don't like it.

/controversial opinion

ponector3• 11 months ago

There is nothing faulty in the hardware, why they should replace it?

Following the same logic: old phones, even iphones can be hacked. Should manufacturers replace the hardware?

TheDong3• 11 months ago

I've been holding my breath ever since spectre/meltdown for a free cpu upgrade to make up for the slower performance that the mitigations cause.

It's intel's bug, they promised a certain processor speed, shouldn't it be their responsibility to replace it since their own security oversight resulted in the hardware not working as advertised?

Did you expect the same from intel/amd when those bugs came out? Is it different from this situation?

quantumcotton• 11 months ago

What if, the software is significantly more robust than Dodge Chevy Honda or Kia. But! Check this out what if you were offered an additional layer of security? You can choose it or not. It's an option. I didn't see these being easier to steal than a car using a canbus.... If it is. Sure free upgrade. But if this is improving a system that is already less vulnerable than 50% of vehicles. I can see why they'd charge.

agilob• 11 months ago

Swapping software, pentesting, testing, QA, CI/CD pipelines, image caches aren't free either. Can we then start making more money as software developers to patch CVEs? We clearly should consider holding ourselves to a lower standard. Your requests are getting 5xx errors? Pay me more to fix it, not my problem that your requests is failing.

florbnit2• 11 months ago

Pay me more to fix it, not my problem that your requests is failing.

If you are employed in a position where there is a defect in the product then you are already being paid. Imagine going to a restaurant and you get an uncooked frozen steak, and when you tell the waiter they tell you that since the cook will need to spend more time on it you now have to pay extra.

sorokod• 11 months ago

Why would the price/cost of hardware replacement be treated differently from the price/cost of software replacement?

OhMeadhbh2• 11 months ago

Hunh. I know what I'm doing this weekend... Scanning ionic VINs to see if they're vulnerable. I bet I could train YOLO to recognize ionics from a drone camera at 50 ft.

JKCalhoun• 11 months ago

Love to see a 3rd party step in with a lower-cost replacement.

topato• 11 months ago

Jesus, when did commenters on neowin get so stupid? Thank God I'm back to the safety of HN....

Weren't they a slightly subversive tech site a decade or so ago?

dyauspitr• 11 months ago

What’s wrong with the comments?

axiolite• 11 months ago

Perhaps the guy suggesting that you: "cut off your balls"

mihaaly• 11 months ago

Car manufacturers seems to be determined to discourage people from buying their car.

petronic2• 11 months ago

“Gameboy-like device” - are they referring to Flipper Zeros with the firmware to exploit RF rolling codes?

https://www.rtl-sdr.com/flipperzero-darkweb-firmware-bypasse...

technick2• 11 months ago

More than likely

hecturchi• 11 months ago

No, they don't. You need to read the article. It says such devices cost $20k.

asymmetric• 11 months ago

They’re talking about something like this https://www.thedrive.com/tech/34817/this-25000-game-boy-is-m...

Shorel• 11 months ago

No, some dedicated hardware device, about five years old, that looks like a Game Boy.

The flipper firmware is only about six months old, and it is still not as convenient and distributed.

The actual firmware exploit is the same idea.

djmips• 11 months ago

Wow, that really is Gameboy-like! This time the reporters weren't wrong.

gbil• 11 months ago

A side question, both this and the VW power unlock payment from the other day, are targeting UK market, so is legislation (lack of it) such in the UK that allows for such practices?

PaulRobinson• 11 months ago

Stealing cars is illegal in the UK, however you do it. Just having this "gameboy-like device", in your pocket is "going equipped", and you're going to get arrested on its discovery about your person outside of your abode. No ifs, no buts.

The UK has lots of new cars (plenty of cheap financing around for lease, PCP and HP deals), and there is a low-level epidemic of thefts of vehicles that end up in shipping containers and heading out of the country within hours. [0]

Car insurance is also so high in the UK at background levels that if you end up owning a highly desirable and very easy to steal car (the Range Rover a few years ago, for example), the costs being added to price in the risk of your car ending up in a container heading to the Middle East don't seem - as a percentage - particularly high.

The fact UK has great shipping throughput to the Middle East, Africa, and so on, is both a boon economically, but also it makes great cover for all sorts of shenanigans.

[0] https://www.containerlift.co.uk/cracking-the-code-uk-police-...

technick2• 11 months ago

I was just looking at a new Hyundai today. Now I've got something more to consider if they aren't willing to stand behind securing their vehicles at their cost.

whirlwin• 11 months ago

Would be interesting to see insurance companies stand on this. Are you expected to pay for the security upgrade or not. Will it be deemed missing as "unpatched - that's your fault".

wjnc• 11 months ago

This is a great question. Have been in insurance for 20 yrs now. Cannot phantom why f.e. insurers don’t hold manufacturers responsible for losses due to cloned car keys with inadequate protection. I do know that insurers are generally very hesitant to start legal procedures, especially those that end up in the news. Say, Volkswagen and Stellantis are formidable adversaries as well as national champions, so there is some presumption that getting your right might be difficult. And the bar as I understand it is not technical SOTA, but more something like acceptable practice, so the manufacturer could argue “hey everyone has shitty protection, so suck up the loss”. Perhaps the newest European legislation will help raise the bar / even the playing field.

makeitdouble• 11 months ago

Given that many door locks and other portable locks are laughably bad and can be opened with sometimes simple shimmering, or at most basic picking tools, that would mean insurance companies could already have sued Master locks for instance. So at least, bad security is probably not enough for it.

From there, making customer pay to fix bad security doesn't sound like a significant step.

birdfood2• 11 months ago

I want a dumb EV. No infotainment system. Just speakers and a way to plug my device into them. Anything critical to the car should be completely air gapped and require an absolute minimum amount of software, preferably zero.

Mistletoe2• 11 months ago

Check out Slate trucks. I want that too and this seems to be perfect. Has windows you roll down even. Fingers crossed it actually launches.

https://www.slate.auto/en

birdfood2• 11 months ago

Yeah I’ve seen these posted here previously! Probably the most appealing new car to me at the moment. Hopefully they take off and we can get them outside the US

bestouff2• 11 months ago

This thing has no autonomy

crooked-v• 11 months ago

There will always be at least a basic screen in new cars in the US because of backup camera requirements.

bestouff2• 11 months ago

Yeah, a basic screen with Android Auto + Carplay (just the video passthrough, not the OS with installable apps) would be perfect.

FireBeyond• 11 months ago

Some cars fulfill this with a screen in the rear view mirror.

gambiting2• 11 months ago

We have a Volkswagen e-Up, it's basically that. Analog cluster, a very small radio screen that also displays the world's smallest reverse camera view, and a dashboard mount for your phone. It's a fantastic little car, I honestly like it more than our 400bhp Volvo XC60.

WayToDoor• 11 months ago

The e-Up is great, but there is still the remote control modem installed by default that lets Volkswagen « Cloud » and the app control the car remotely, and get data such as the GPS location of the car.

baq• 11 months ago

Nobody will sell you one for cheaper than a whole package.

See also ‘smart’ tvs vs digital signage displays aka dumb tvs.

mft_5• 11 months ago

Slate [0] say differently...

[0] https://www.slate.auto/en

grishka• 11 months ago

While this is partially true, digital signage displays are also designed to run 24/7, which also makes them more expensive than regular TVs.

inferiorhuman6• 11 months ago

https://configurator.microlino-car.com/en/edition-microlino?...

aembleton2• 11 months ago

If you get the base level, expression trim of the Dacia Spring then you get an EV without an infotainment system: https://www.dacia.co.uk/hybrid-and-electric-range/spring-cit...

uyzstvqs• 11 months ago

Agreed. I'd actually like to buy an EV, but so far there are no candidates which meet my minimum requirements, which are pretty much what you said + serviceable by any mechanic with aftermarket parts + using Na-ion, not Li-ion batteries. And it shouldn't be super ugly like most new cars are today (e.g. Rivian, VW ID Buzz).

Though I'm pretty sure you can't even legally make such a car anymore, at least in Europe, where certain "smart" features are required for new cars. Perhaps a manufacturer of such an EV could put all of that into one box which the user can simply pull out and discard.

ponector3• 11 months ago

Such car will not comply with legislation. Or are you talking about car with all sort of tracking systems and driver's assists but no infotainment?

Anyway, that is not what majority want to buy. Even more, a car is not what majority want to buy in the USA. SUV/trucks are desirable.

owenversteeg• 11 months ago

That’s illegal in the EU, 911 eCall requires an always-on cellular connection with an attached device that records your location. Would you please think of the children?

dotancohen3• 11 months ago

Which wire to snip?

charles_f• 11 months ago

Does Hyundai consider this as a patch though? I'm wondering if the dealership would present you the bill with a straight face, is that presented as a "more secure" system, or an "additional anti theft device"?

delusional• 11 months ago

From the wording of the press release it sounds like they view it as an optional add-on specifically for UK customers who want additional security:

Recently, evolving security threats, including the use of unauthorised electronic devices to bypass vehicle locking systems have become more prevalent in the UK. This is an industry-wide issue and Hyundai is providing appropriate responses in line with industry practices.

As part of the Company’s commitment to supporting our customers, we are able to offer a subsidised software and hardware upgrade for a customer contribution of £49.

blixtra• 11 months ago

I’ve now had 2 IONIQ 5s stolen in Berlin, the last a couple months ago. Each seemingly using a keyless access hacking device. That’s enough for me to not see a Hyundai or Kia in my future anytime soon. And I very much liked the IONIQ 5. But if I can’t keep one more than 2 years, what’s the point? I’ve lost all trust in those companies, upgrade or not.

king_geedorah2• 11 months ago

If the ignition and door locks in your vehicle were mistakenly designed in such a way that they are trivially shimmed or could be operated by any key it seems absurd to suggest the customer should pay you to replace these mechanisms with ones that are properly secured. This seems roughly analogous to that situation at least to my understanding.

florbnit2• 11 months ago

The story has a bad spin yes. But it’s just as much of a controversy if they had require people themselves pay the cost if they found out the cars where shipped with defective breaks. It’s a product error not wear and tear or user error, they should eat the costs, but the cybersecurity framing of it is being used to attempt to push the cost to the consumer.

king_geedorah2• 11 months ago

This is precisely the point I intended to make with my comment. Perhaps my phrasing was unclear.

nsteel4• 11 months ago

I don't know about the Hyundai Ioniq, but the Kia Niro has no way to permanently disable keyless entry, which would be the obvious, super easy s/w fix. You can disable it each time you lock your car by holding extra buttons on the fob for a few secs, but it's auto re-enabled next time you unlock. It's everything you need to know before you make your smart decision not to buy a Kia. Cheap(er) for a reason.

But looks from their point of view. It's the most stolen car in the UK. The brand doesn't seem to be suffering much. Having terrible security just helps sales!

sokoloff2• 11 months ago

Having terrible security just helps sales!

Until it’s banned by regulators or made uninsurable…

nsteel4• 11 months ago

We are not scared of regulation in the UK. And this car has existed, in the UK, with this flaw, for over 6 years. Quite clearly nobody is interested in doing either of those things you suggest.

Plus the UK is about to reintroduce financial incentives for private EV purchase, they want to push sales, not clamp down on crap products.

hgomersall2• 11 months ago

My 2021 Ioniq 5 does not have keyless entry at all. You need to press the button to open the door.

nsteel4• 11 months ago

Do you mean the button on the door handler or the button on the key fob? The former is their keyless entry and is vulnerable to attack. I was under the impression all Ioniq 5s had this feature, but obviously I defer to your experience.

burnt-resistor• 11 months ago

Also be aware that homologation means there is no one-sized-fits-all, canonical vehicle for all markets but many variations for different markets with variations in security and safety features. Some markets get proper security measures while others get screwed.

poemxo• 11 months ago

I don't get why companies don't understand how offensive it is to the customer to nickel and dime them, especially after they're already a converted customer. They could easily eat the $60 cost and spin it as positive PR, Apple-style.

It's particularly bad because customers see it as a defect. No one wants to pay full price for defective equipment. The only thing that would make it worse is if this "hack" were reproducible on the flipper zero and they get themselves into another Kia Boys situation.

Hilift• 11 months ago

There are two aspects. "Charge" and "costs/who pays". When someone can start a Kia with a USB cable, the owner pays for that. Kia may have a fee for replacing something, but that doesn't factor in the calculus of "there's a reason these people are buying our product, and we assess they will continue to do so."

Note that Kia offered a maximum of $6,125/$3,375 for totaled/damaged vehicles.

The previous formula:

"You take the population of vehicles in the field (A) and multiple it by the probable rate of failure (B), then multiply the result by the average cost of an out-of-court settlement (C). A times B times C equals X. This is what it will cost if we don't initiate a recall. If X is greater than the cost of a recall, we recall the cars and no one gets hurt. If X is less than the cost of a recall, then we don't recall."

bornfreddy• 11 months ago

There is also this thing called brand loyalty. After the car manufacturer pulls a stunt like that I will think twice before I buy my next car from them.

The_President• 11 months ago

Citation for the final paragraph quote "the previous formula" goes to Fight Club.

mft_5• 11 months ago

Hmmm, so recently: ̶ ̶H̶y̶u̶n̶d̶a̶i̶ ̶K̶i̶a̶ ̶V̶o̶l̶k̶s̶w̶a̶g̶e̶n̶ ̶

At this rate, I'll be back to Tesla for any future EV purchase. (Noting that Tesla second-hand prices in Europe seem to have taken a dive over the past while, presumably partly thanks to Elon's shenanighans?)

radiator• 11 months ago

Rather because some people parked their Teslas on public roads and later found them vandalized.

barbazoo• 11 months ago

We’re not a very smart species.

mft_5• 11 months ago

...which was a response (along with Nazi symbols on dealerships, etc.) to Elon's political shenanighans.

mijoharas• 11 months ago

So, can people tell me what cars with keyless entry systems aren't susceptible to these attacks?

I'm somewhat wary of any of them, but it seems like it's a feature of a lot of new cars, and I can't tell what is "safe" to buy. It was a simple signal amplification thing wasn't it?

Does anyone know if BYD cars suffer from it for example?

deadbabe• 11 months ago

The car stealing device is $20k, could someone do some math to see what kind of ROI a criminal could expect if they use it to steal cars and part them out?

cookiengineer• 11 months ago

This is a violation of UN regulation 155/156 where the vendor must provide free fixes and updates in case of safety or cybersecurity violations.

I'm mentioning this specifically because the CAN bus is involved, which is mandatory to be safety conform and has to be ASIL-C/D conform. If you cannot guarantee that, you will lose the license.

Without conformance to UN Regulation 155/156, the car manufacturer might lose its license for the underlying car platform (not only the downstreamed models), meaning refunding/damages need to be paid for all buyers of cars of that platform.

So chances are this can be fought in court, and Hyundai probably has to offer free replacement of that defective part.

solardev4• 11 months ago

The UN has regulations? Who does it have authority over? Who enforces its regulations?

lbourdages• 11 months ago

The vast majority of countries have into their laws that road vehicles must adhere to UN vehicle regulations. That's how enforcement happens - by whatever regulatory authority of the country the vehicle is to be used in. Canada and the US are among the exceptions in that they have their own standards.

Hyundai wants loniq 5 customers to pay for cybersecurity patch in baffling move

Related Stories