- cross-posted to:
- cybersecurity@sh.itjust.works
- cross-posted to:
- cybersecurity@sh.itjust.works
You must log in or # to comment.
internet connection is not a thing a car should even have
They can bring some nice benefits like remote starting in cold (or hot) climates, but there needs to be much better design to minimize the exploitability of these systems.
We had remote starters in the 80s, they didn’t need Internet access, they were a completely local wireless solution, just like old wireless garage door openers.
Remote starters that can reach from inside an office building to a distant end of a parking lot are underrated. I had this for about 6 months before the 3g network was shut down. Now, I’m limited to the range of a keyfob.
Not to mention scheduled starts: say, 10 minutes before you have to drive to work, to make brushing snow off a car much faster, or 10 minutes before you leave work so you don’t give yourself a good sear on a random piece of metal in your car in the middle of summer.
Agree on both parts, but the second part can still be achieved from an unconnected car, you just can’t do it remotely
It’s not a thing a car should require, and even for nice-to-have value-add features, it should be tightly secured, not only from external access but from the manufacturer.
The comical part was that anyone could go through a completely vanilla registration workflow and become a registered dealer. What the hell were they thinking?
I was gonna say they still need the fob for the car to actually drive it, but saw it mentioned in the article. I don’t have a Kia (used to, but traded it in because of the immobilizer shit), but my car right now has an app to remote-start, but the car itself won’t let you drive it if you don’t have the fob on you while sitting in the driver’s seat.
The group’s web-based Kia hacking technique doesn’t give a hacker access to driving systems like steering or brakes, nor does it overcome the so-called immobilizer that prevents a car from being driven away, even if its ignition is started. It could, however, have been combined with immobilizer-defeating techniques popular among car thieves or used to steal lower-end cars that don’t have immobilizers.
But yes, that’s just bad security.
It’s still mindboggling that Kia sells any cars without immobilizers.
I get they’re cheap cars and the way they’re cheap is to skimp on everything but uh, maybe that’s not the right place to skimp?
2FA where one of the factors is Bluetooth to the fob might be OK, assuming the Bluetooth link is secured in some way.
