Hacker News Reader

Comment by lrm242 | Hacker News Reader

OnStar provides all sorts of nifty things. Lock your keys in the car? OnStar can unlock your doors.

are you telling me that I can call some number and if I'm persuasive enough, they will unlock your car remotely and maybe even start the engine? Nice feature

Yes, and it rules. So does using the app to start my car on a cold day when I had to park a few blocks away. Convenience always trumps security.

As demonstrated by Justin Long [https://www.youtube.com/watch?v=hVxjQTHLDEY&t=1m41s].

tbere was some good product placement of this feature in die hard 3

The remote start function appeared the in fourth movie, Live Free or Die Hard with the plot revolving around a "fire sale" cyber attack. Die Hard 3 features Sam Jackson and the theft of gold under cover of binary fluid bombs.

My bad - thanks

It is even a part of a plot for some action movie (can't remember which movie though). The cars can be unlocked with social engineering skills.

One of the Die Hards with Bruce Willis and a hacker kiddo exactly that

And then what? You can't actually do anything with the car without the keys. Steal the goods in it? Well most thieves just smash a window rather than relying upon social engineering, presuming that even worked.

OnStar started as a data connection for diagnostics and emergency services -- it reports back various diagnostic details, and gives your location and accident details in a serious event. Once they had the cellular data connection they added utility for things like lock out assistance and remote start, and locating your car (e.g. in a big parking lot).

Smashing a window draws attention, social engineering when done right does not until it's way too late... certainly nobody watching in the parking lot would think twice about a guy on a cellphone getting into "his" car. They would however think twice and may perhaps even alert authorities or take your picture if they saw you smashing a window to get into what's quite probably someone else's car.

So instead you make a traceable call to OnStar, before which you will have amassed all of the personal details to somehow socially engineer them into letting you into the vehicle (not just their names and personal details, but the system also has a code you have to tell them).

This is one of those hysterical overreaches that has no correlation with real world crime at all.

Be that as it may, security breaches occur in complex and presumed safe systems every day - look at how a social engineer used data found from one system (Amazon) to exploit another (Apple) to get further information and cause users havoc last year. Both systems were presumed to have safeguards that kept intruders out. When humans are part of the security equation, in my experience, all bets are off.

In this case, it may (or may not) be a hysterical over-reach, only time will really tell.

I am not sure if you are joking or not, I wouldn't want my car to be opened without keys. Especially after such news

You wouldn't want to be able to open your car door if you lock your keys in it, without needing to worry about whether or not the locksmith is going to mess up your door?

It's a matter of good idea, bad implementation. They push for features, they push for ideas, they push for new, new, new, better, better, better.

But no one thinks about safety and security until something like this happens.

no, I wouldn't. exactly because of f*uckups like these, that always come with features for lazy or stupid. if I ever, ever be forced to buy such pathetic excuse for a car, first thing I'll do is find sim card and burn it. next will be wi-fi module. heck, I'll even pay some garage to turn it off forever.

I am software engineer and that's why I don't want anybody messing up with crucial systems. It's so easy to break things, there were quite a few reports about horrible quality assurance processes in car manufacturers... just NO. I buy car, and I'll be happy with v1.0 of firmware, no updates, thank you

I would use the spare key. Maybe it is me but I don't trust my phone with my car.

Have you accidentally locked a baby in the car in temperatures exceeding 90 or 100 degrees? Judging by the amount of times I hear this on the news, I can show you a whole market of people that find this useful. Calling a locksmith or someone that can break into your car takes time as well as being concerned about potential cosmetic damage. If OnStar can open your car remotely with a single phone call inside of a minute to save a helpless child from being cooked, there's your market. "Will someone please think of the children..."

OnStart opening your care remotely requires more things in the car than preventing the car from locking if the key is inside in the first place would. By the way, I can't lock my car if the key is inside, and the car doesn't have a remote opening feature.

It should not be possible to lock the keys inside the car since you use the keys from the outside to lock it.

On my (2009, no power locks) car, I manually toggle the lock after opening the door and close it. Locked. I did lock myself out of a 2009 car with power locks though, but only because I was borrowing it and no one knew the combo for the keypad.

Buuuuut... we're talking about OnStar remote access, so that's not very applicable. :)

I have never been in a car you can't lock from the inside.

I have not seen a car where I can lock my key inside in... idk 10 years maybe ?

edit : I meant keys inside the car but no one inside.

Yeah, that's what I meant, the last car I was able to do this was a first model Peugeot 205 (25 years old now), even with a 20 year old model, it was already not possible.

One thing I can't understand: a $500 phone can unlock itself with my fingerprint, why can't a $50k car? I'd trust that a lot more than a minimum-wage phone operator somewhere.

All those "nifty" things are potentially available to hackers too though!

Reply on news.ycombinator.com