Many people believe it’s handy – and neat – that they can unlock their vehicle remotely, even start its engine (as to warm it up). They have not perhaps considered that if they can unlock their vehicle remotely – and start (or stop) – its engine remotely, then someone else might be able to as well.
More than just might, in fact.
This just got confirmed (again) by Harness, a software company, that says it discovered a “flaw” in an (unnamed) automaker’s “dealership portal” that “exposed the private information and vehicle data of its customers” that “could have allowed hackers to remotely break into any of its customers’ vehicles.”
According to an article in Tech Crunch,:
“Eaton Zveare, who works as a security researcher at software delivery company Harness, told TechCrunch the flaw he discovered allowed the creation of an admin account that granted ‘unfettered access’ to the unnamed carmaker’s centralized web portal. . . With this access, a malicious hacker could have viewed the personal and financial data of the carmaker’s customers, tracked vehicles, and enrolled customers in features that allow owners – or the hackers – to control some of their cars’ functions from anywhere.”
The story seems to imply that this is an isolated flaw rather than a built-in (and general) design feature. In fact, every late-model vehicle is susceptible to being hacked because every late-model vehicle is designed to be remotely accessed. Let’s start there.
To begin with every late model vehicle has wireless systems that control such things as the locking and unlocking of doors without keys or other physical interfaces – as well as many other vehicles functions besides. This includes even those that do not have the commonly available smartphone-as-key systems that can be used to lock/unlock the vehicle’s doors from as far away as another state or the other side of the country (as opposed to from 20 yards away) because all vehicles made since about a decade or so are connected vehicles.
What that means is they have invisible tethers connecting them via wireless that works very much like the way your smartphone works. You have the physical phone in your possession but control over the phone can be asserted by whoever – whatever – you “agreed” to allow electronic access.
The word is air-fingers bracketed to reflect the fact that you probably “agreed” without really knowing what you “agreed” to when you signed the User Agreement that came with the car, just like it came with your phone. The Catch 22 is you can’t use the phone unless you “agree” and the same goes for your car. The latter’s systems are smartphone-emulating and so get regular updates whether you asked for them or not and also send out data about the vehicle and you, too – whether you like it or not. All of this just kind of happened, without most of us noticing – because we weren’t supposed to notice it. Just like the wild hog who doesn’t notice the fence being built around the pail of food left outside for him. He only notices when the gate is closed and of course, by then, it is too late.
It has been too late – as regards cars – for at least a decade now. Remote access (for them, not just you) is a reality, not a dread possibility. Your vehicle – if it is one made within the last decade or so – is already remote-controlled even when it is not externally controlled. There is now an accelerator pedal and it is not the same thing as a gas pedal. The latter term is an etymological relic from the time when your right foot was connected to the engine’s throttle via the pedal, which worked a cable apparatus that opened and closed the throttle. Engine speed increased or decreased accordingly. Cars made since about a decade ago have accelerator pedals that send data about how hard you’re pushing down on the pedal, which connects to nothing; the vehicle’s computer receives the data and increases or decreases engine speed, simulating a connection that no longer exists.
The same goes for moving the gear selector from Park to Drive or Reverse. You are merely sending data to the computer, which engages the selected gears . . . or not. In some vehicles made during the past decade or so, the computer will insolently countermand you, if you do something like crack the door open while trying to back up to see using your eyes rather than a back-up camera what you’re backing up toward. The computer will put the transmission in Park if you do that. Implicit in this is that it could put it in Park at any time – as well as permanently – whenever the computer decides to and that computer, remember, is connected. Just one over-the-air “update” and you are parked, whether you want to be or not.
Same goes for throttle control, which you are allowed the illusion of controlling. At any time, the whoevers and whatevers who actually do control it could send an “update” slowing you to no more than whatever the speed limit is – or to zero speed. A hacker could just as easily do the same in reverse – as in sending an “update” that causes the computer to floor it and how are you going to stop it? Even the brakes in cars made over the last decade or so are under the control of the computer and thus not really under your control.
Put another way, throttle and brakes and other such can be controlled by someone or something else. The Tech Crunch article focuses on hackers but leaves out that the vehicle manufacturers (and the government they work with now) don’t have to hack anything to remote-control your car.
Because they already do.
. . .
If you like what you’ve found here please consider supporting EPautos.
We depend on you to keep the wheels turning!
Our donate button is here.
If you prefer not to use PayPal, our mailing address is:
EPautos
721 Hummingbird Lane SE
Copper Hill, VA 24079
PS: Get an EPautos magnet or sticker or coaster in return for a $25 or more one-time donation or a $10 or more monthly recurring donation. (Please be sure to tell us you want a magnet or sticker or coaster – and also, provide an address, so we know where to mail the thing!)
If you’d like a Baaaaa hat or other EPautos gear, see here!
Guy at work with a 2002 era Monte Carlo can’t roll his windows down because the BCM is only putting out 6 volts. 2 BCM’s later & still only 6 volts.
Instead of a good old fashioned switched circuit, we are at the mercy of out of production computers to allow us to feel the air.
I tried opening up the door to my newer (2001) vehicle with just the key, and not the FOB. Good grief, you would have thought I was breaking into Ft. Knox with the difficulties I had. And then there was the day when my friend was unlocking her new Forester (2024). Not only did the FOB unlock the doors to her car, but the Forester parked next to hers. The “Connected Devices/ Connected Vehicles/ Smart Homes/ Smart Appliances” are beyond creepy. I wish I could go back to a “dumb” vehicle, because in the end, I think it is far wiser to have one of those. I fear, however, that one day owning such devices will not be “allowed”. I am sure, for our “saaaafety”.
Interesting. Thanks for sharing. Why wouldn’t you, “go back to a “dumb” vehicle”?
All mine are.
…It’s, nice.
…What’s stopping you?
Damned Helot…go back to bed and come back when you can be less of an ass. When I can pull money out of the same ass that you are being then perhaps I will.
Hi Helot. What year does a car have to be to be considered “dumb”? I’m guessing a 2001 is relatively “dumb”; a 1961 definitely would be.
Hi Shadow.
On one my cars, if you use the fob to unlock it and don’t open the door it relocks itself. As for unlocking the door with the physical key; was the lock seized or stiff as I’ve not heard of problems with unlocking cars otherwise?
I’m having remote fob issues with the 2018 Grand Cherokee, 6 tries to get it to pop open the door lock. Tried the backup manual key that set off the horn alarm instantly. It’s just grand ain’t it!
There is a sci-fi movie that this is the central plot of basically. The car is remotely piloted to kill the high value occupants. This can be done -today- especially in a Tesla, so its no longer sci-fi. It will eventually be all cars as more and more controls become ‘remote’.
Grr, new verification system annoying! This was suppose to be reply to Landru about “cutting the brake lines” to kill an occupant. Now it can be done steathily and remotely and if you delete the data logs its nearly an untraceable crime.
Do you think that works on a donkey cart?
Idk, prolly, some nano-tech-bullshit? Eh?
I work on stuff like this, and I know it’s possible to build a very secure system which allows online features, for those who want them, but the automakers are either too incompetent to do it right, or they don’t want to yield the control they’d lose when making it secure.
I proposed a system a while ago which would be secure. If you want online features, you need the automaker to send a message to your car, however, you can have your app on your phone generate the message in a way that the automaker can’t generate themselves, and only your phone can unlock the car, no matter how insecure the connection or the automaker’s system (I will describe how this works below). After several rounds of review of my design it was rejected for several reasons. The biggest is that software engineers at automakers aren’t the kind who understand security and they’re pushed to do everything as cheaply as possible. The secondary reason is that the automaker wanted to be in the loop, and my design took them out of the loop. It’s really disappointing. I’m truly disgusted with this industry and I’m working out future career plans right now.
You can skip the rest if you don’t care about how a secure app to unlock your car would work.
You can have secure communication between your phone and the car using cryptography, even if the communication link or automaker systems are insecure. In my design, you would need to “pair” a phone to the car. You’d go into the settings in the infotainment, click a button to add a phone, and it would display a QR code. On the phone, you’d open the automaker app, and scan the QR code. What happened is that the car generated a private encryption key and shared it with the phone, used it to make a public key, and then deleted it. It means the private key doesn’t exist on the car anymore for the automaker to access, but the public key can be used to verify that your phone has the private key.
When you want to open the door, the app generates that request, uses the private key to “sign” it, and sends it to the automaker to send to your car. Once your car receives it, it can know with 100% certainty that the request came from your phone by checking the signature. You can do this for any feature; remote start, turn on A/C whatever.
The key things are that the automaker doesn’t have the private key that exists only on your phone, so they can’t generate a message your car would trust.
“After several rounds of review of my design it was rejected for several reasons.”
How about this reason:
The CIA, Mossad, Shin Beth, Unit 8200, ADL, APAIC, and most of all Palantir, don’t want a secure system with no back doors any more than they want a cpu, and wifi chip, a 4g chip or a 5g chip that doesn’t have a back door either.
Anyone paying attention can see what the Jews did to Hamas, Hezbollah, Syria and Iran. They turned pagers, radios and even cell phones into bombs that they could use to commit genocide on specific families including their children. Jews are the scum of the earth.
Jews want to be able to control your thoughts, especially now while . They want to know when, where, how and how often you are having “antisemitic” thoughts. The automobile is the perfect tool for accomplishing this for at least some of the time. This is critically important now as the world is waking up to their sadistic genocide of ethnic groups across the planet, from Palestinians to Druze to Allawites to Shiites to Ukrainians and including Russians.
I dunno, you lost me at, “you can have your app on your phone generate the message”.
You guys, and your APPS.
…Why can’t you build sheet without APPS?
It’s like, you’re APP dependent?
HandicAPPED?
Crutches, of APPS?
It’s gross.
That said, I like that you’re working against, ‘The Flow’.
‘The Flow’ don’t like you, you work against it.
I don’t want apps in my car, but lots of silly people do, and if my company is going to build such a thing, then I might as well fight for it to be in service to the driver, and no other master.
Because theyre brainwashed retarded idiots.
See also, below: “chip-encrusted, wheeled cell phones”.
A.k.a. non-durable crap.
Hanging out in the garage yesterday with a couple of buddies and with a slight haze of cannabis smoke hanging in the air, we got to talkin’ cars … and trucks.
C**** said that with the snorkel air inlet on his Tacoma pulling in air from near the top of the windshield, he gets 50,000 miles on an air cleaner.
M*** replied that his 2022 Silverado tells him what percentage of life is left on the air cleaner, the engine oil, and so forth.
I remarked that all that (mostly useless) data barfed up by his Silverado requires sensors and chips and screens which someday will fail.
How I loathe superfluous technology that, after adjustment for its added up-front cost and long-term reliability reduction, amounts to a net value subtraction.
I vehemently disagree with the direction that automotive engineering has taken in the last two decades. These chip-encrusted, wheeled cell phones I shun like rat poison, as I await the glorious ruin and liquidation of those who produce these buffoonish $50K coproliths.
Amen, Jim –
Fundamentally, I don’t “get” the appeal. I do not regard unlocking my truck’s door (or starting its engine) with a physical key to be a burden. The same as regards turning on the headlights and windshield wipers myself – as necessary – rather than relying on “technology” to do those things. What has been gained And what has been lost?
‘What has been lost?’ — eric
Human skill. M*** is having a hip replacement soon. The ortho doc told him that both sides of the joint will be monitored by sensors connected to an AI nanny. Until every dimensional constraint is confirmed to the satisfaction of the AI, the doc literally won’t be allowed to proceed.
Hell, with this nanny tech, I could be a ‘surgeon’ after a couple of days training behind the meat counter.
I was a butcher cutting up meat
My hands were bloody, I’m dying on my feet
I was a surgeon ’til I start to shake
I was a-falling ’til you put on the brakes
— Rolling Stones, You Got Me Rocking
Bonus points for “coproliths”. That is a perfectly magnificent description.
There’s been flaws like this for decades now. Going way back to the first remote door fobs based on KeeLoq, the algorithm was exposed by Russian hackers. That cipher was many things used is lots of cars as well as garage door openers and other remotes.
There’s things to worry about. And having your private information exposed it a serious concern. Here, though, that it’s connected to your car is a potential benefit. Like knowing where it is if it’s stolen.
I’m generally in the camp that I don’t like devices that require an app to use. I put this into the same category when I ask “When do I need an app to use my guitar tuner?” or “Why do I need an app to use my kitchen mixer?”
THAT is the problem.
As far as technology, though, that genie is out of the bottle and there’s no going backwards to the Model T again. The evolution of technology can’t be static. Even before computers humans constantly tinkered.
Some people had real consternation when the internal combustion engine replaced the horse. Were those luddites wrong? I’m guessing a car enthusiast site would disagree with that arc of development. There are upsides and downsides to the modern constantly on-the-go lifestyle that gasoline engines and electricity enabled.
Hi Tyler,
You raise some valid points – but I submit that it isn’t Ludditism to dislike “technology” that offers little meaningful benefit; in other words, “technology” for the sake of “technology.” A Model T was a indeed great leap forward vs. a horse. So also TBI/EFI vs. carburetors. Is it a great leap forward to replace a key inserted into a lock that can be turned to start the engine – vs. pushing a button? The key is a simple piece of metal that can last 50 years or longer, is easily and very inexpensively replaced and very easy to use. A transmitter fob is expensive and much easier to damage, as by running it through the wash. Is it a great leap forward to be able to push a button to start the car?
Is a throttle cable inferior to drive-by-wire? I mean in terms of tangible benefit to the owner? The cable is a simple thing that can be easily replaced if it ever breaks. The electronic components of drive-by-wire not so much.
I’ve had cars that used rods as a linkage to the carb, ones that used a cable to the carb, ones that had a cable to the throttle body and now one that uses a sensor on the pedal, actuator on the throttle body.
The rod linkage worked fine but was kind of a long term maintenance headache. It was fine, though, being on a car that had things like points that needed periodic attention so a little bit of cleaning, lube and adjustment on the throttle linkage wasn’t a big deal. It was a Rube Goldberg affair, though, with all the brackets and stuff to translate your foot movement to the throttle lever.
When that was replaced by a carb’d car with a cable that was better except when the cable broke. It was a fairly easy rig to get it off the road and I was able to use a bike brake cable to get it home. Upside of cable is easier routing, perhaps slightly more immediate response. Downside is breaks easier, prone to corrosion inside the housing and wears out.
That car was replaced by a newer vehicle with EFI, but the throttle worked the same way having a cable that moved the throttle body instead of the carb.
Now that I have a throttle pedal input directly to the ECU instead of moving the TB. No direct connection from the pedal to the throttle body.
In the old EFI there was a throttle position sensor on the side of the throttle body that returned a relative position of the throttle, so the ECU got the same information as it does now. The throttle body now has one device on it, the motor to move the butterfly instead of using a mechanical linkage.
The current way isn’t doing anything fundamentally different. If the throttle position sensor on the old car was adjusted wrong or went bad the engine wouldn’t run either. The ECU still knew if you were asking for idle or 50% or 100% with the cable. That information was stored in some cars just the same as it is now. The only difference is that you’re not physically moving anything with the pedal. But what good is that if the TPS isn’t returning a signal? That said, though, there was a limp mode the ECU could drop into if there was no TPS signal. But EFI will only really run correctly in closed loop with throttle position, air metering (either mass air flow or volume) and O2. How you actually move the butterfly (with a cable or motor) is a very minor variable.
Benefit? There’s actually fewer parts in the chain. It’s more reliable being that the throttle body only has the one electrical connection instead of an electrical and mechanical connection.
The technology delineation is from carb to EFI, not how the pedal works. When they added electronic ignition, electronic fuel injection, etc. the ability to store information came along for the ride.
Sorry, but no. Electronic ignition and fuel injection both started out as analog electronics. And the progression from linkage to cable was purely mechanical with few problems, they occasionally needed lube and eventually wear out, or stick if left unattended for a long time. But whatever repair they seldom needed it was cheap and easy.
Electronic systems with their dozens or hundreds of connections, from the three on a simple potentiometer tps, to the 2-3 on the coolant temp sensor, to the idle air control solenoid with its stepper and feedback, are inferior in almost every way to a simple analog carburetor and a points ignition. They are lower maintenance for the first few years. After that they become expensive time consuming headaches.
The fact that the very first EFI/EI were analog isn’t important. I don’t dispute that, it’s of course correct. Those VW Bosch systems did in fact not have any diagnostic or storage.
But by the mid 1970s the computers already had become digital and included storage and hooks for on board diagnostic. These were actually on carb engines, too. But it remained rudimentary and fairly uncommon.
OBD-I allowed the values to be read in real time by a diagnostic computer. By 1980 GM included DTC, diagnostic trouble codes, in the ECU which were stored faults that could be read later and in 1981 all GM cars had ALDL interface for diagnostics.
By the adoption of OBD-II in the early 1990s all EFI engines were storing a fairly deep amounts of historical data as this is required for emissions “ready” to become true.
For those of us burdened with such testing you’ll fail immediately if this condition is not met in the ECU. The intention is you have to have driven a certain number of cycles as in distance and speed and RPM that our overlords say is enough and to prevent you from just pulling the ECU power to reset a check engine from a failed O2 or TPS or AFM/MAF or other deemed “critical” sensor.
There were significant leaps, such as when they started included event data recorders (specification in 2004, first cars showed up around 2006 with them) that cops and insurance could download data and real time over-the-air telemetry such as Onstar and such.
Fact is, back in 78 one could instantly see where the ‘puter nonsense was heading.
The division bell had tolled. One either reacted to the junk being aimed at their rear end with a solid NO or mewlingly acquiesced to the inevitability of ‘puter almighty.
I sold those bullshit apple cumpooter junkpiles to mindless consumer morons while recoiling in horror at their ignorance.
For a month or two at least.
Half century later and golly what progress eh!
When I had my Scion TC, the drive by wire had a delay that made the car feel like it had a carb from the 70-80s smog Era
RE: “I’m generally in the camp that I don’t like devices that require an app to use.”
I’ve often seen ~ you write that, “it isn’t Ludditism”.
So, what is it?
Is there a term?
Hulk-smash-sheet-which-fails-and-is-crappy?
Practical?
…Idk.
Morning, Helot !
I’d describe my view on this as simply not being into gadgetism. Remember the Rube Goldberg thing? A hugely complex way to do something simple? Gadgetism is that plus electronica. It is difficult to improve on the simplicity, ease of use and low cost of a key that is inserted in a lock and turned to start the engine. A key fob and “start” button add marginal convenience at relatively enormous cost vs. a key. I prefer the key because it works just fine and isn’t harmed by running it through the wash and can replaced for $10 at any hardware store.
I think remote locks and fobs did meet a market demand. Being able to unlock all your doors 15 feet away so you, momma, the kids can all get in at the same time or not stand around in the rain is a well established benefit. It’s hard to argue the progression from a key unlocking one door, you reaching across to unlock the others, to electric power locks controlled by the driver to a remote for all of them.
Going the next step to unlocking using an app gets to being contrived need perhaps. The intention would be to unlock them before you’re even close to the car. Unlocking your car from the check out line is pretty lazy. Although if it’s subzero remotely starting it 5 minutes ahead so you get into a warm car is pretty compelling.
Convenience is a slippery slope. The first step of going from a horse to car is clearly an advantage. The next step of enclosing the cabin and adding heat gets a little less of a need and bit more of a want. More comfortable seats and air conditioning take you further along the line from absolute utility to creature comfort. Where you fall on the spectrum from barely more than a tractor to pimped Cadillac is an individual decision. I like my old truck with crank windows, solid axles, leaf springs and manual transmission but when I rent a modern car I gotta admit it’s pretty stark how much more comfortable it is. It would be easy to get used to it.
Michael Hastings’ car was a 2013 model that was introduced in 2011.
Remember the good old days when someone got their brake lines cut in an attempt to kill or injure them? Now with a couple of key strokes the car could kill them through a traffic accident and the data log would show it was an intentional act by the “driver”.
Isn’t technology wonderful.
Pointless „features“ that make cars more expensive and less reliable. In my Merc C class the ignition lock is hidden behind the start/stop button ( that nobody asked for either) so I removed the damn thing and am back the good old ignition „ key“.
On-Star has been this way since its inception. And, QR codes operate the same way. You get access to info represented by the QR code and the QR code controller gets access to your device.
These people are criminally insane.
They’re not insane exactly. But they are evil.
Is murderous the same as being evil?
It depends on how you define “murder”. The Pharisee Dennis Prager is notorious for convincing Christians that it’s not, “Thou Shalt Not Kill” but, rather, “Thou Shalt Not Murder”.
I’ve asked my Christian friends who support this as to what difference it makes to those being killed. And, how does it justify mass killing of innocents? I get mostly blank stares in return.