Hacker News Reader

Comment by kofejnik | Hacker News Reader

are you telling me that I can call some number and if I'm persuasive enough, they will unlock your car remotely and maybe even start the engine? Nice feature

View on HN

Yes, and it rules. So does using the app to start my car on a cold day when I had to park a few blocks away. Convenience always trumps security.

As demonstrated by Justin Long [https://www.youtube.com/watch?v=hVxjQTHLDEY&t=1m41s].

tbere was some good product placement of this feature in die hard 3

The remote start function appeared the in fourth movie, Live Free or Die Hard with the plot revolving around a "fire sale" cyber attack. Die Hard 3 features Sam Jackson and the theft of gold under cover of binary fluid bombs.

My bad - thanks

It is even a part of a plot for some action movie (can't remember which movie though). The cars can be unlocked with social engineering skills.

One of the Die Hards with Bruce Willis and a hacker kiddo exactly that

And then what? You can't actually do anything with the car without the keys. Steal the goods in it? Well most thieves just smash a window rather than relying upon social engineering, presuming that even worked.

OnStar started as a data connection for diagnostics and emergency services -- it reports back various diagnostic details, and gives your location and accident details in a serious event. Once they had the cellular data connection they added utility for things like lock out assistance and remote start, and locating your car (e.g. in a big parking lot).

Smashing a window draws attention, social engineering when done right does not until it's way too late... certainly nobody watching in the parking lot would think twice about a guy on a cellphone getting into "his" car. They would however think twice and may perhaps even alert authorities or take your picture if they saw you smashing a window to get into what's quite probably someone else's car.

So instead you make a traceable call to OnStar, before which you will have amassed all of the personal details to somehow socially engineer them into letting you into the vehicle (not just their names and personal details, but the system also has a code you have to tell them).

This is one of those hysterical overreaches that has no correlation with real world crime at all.

Be that as it may, security breaches occur in complex and presumed safe systems every day - look at how a social engineer used data found from one system (Amazon) to exploit another (Apple) to get further information and cause users havoc last year. Both systems were presumed to have safeguards that kept intruders out. When humans are part of the security equation, in my experience, all bets are off.

In this case, it may (or may not) be a hysterical over-reach, only time will really tell.

Reply on news.ycombinator.com