Hacker News Reader

Obligatory story: I bought a Camaro when the new ones first came out (2009). I ran into some issues with the radio, found out via forums I was 3 firmware versions behind and then slowly found out car dealers were ill-prepared to be software vendors. They had no idea about the radio updates and their system showed nothing for me against my VIN. This was a common enough experience across the country that one of the coders working on the radio started giving the updates out via email. Which is how I wound up sitting in my car with two USB sticks full of C#. Put the first one in, turn the key, updates. Then open the driver's side door to reset the process (yes, seriously) and put the second USB stick in.

Before that experience I used to laugh off the idea of a weaponized mp3 file or people taking control of cars remotely. Now I think about that auto-boot USB port and the fact my driver's side door is a toggle to God-knows-what.

One of my coworkers had some weird bluetooth bug fixed by firmware in her car. Being the hacker she is, she found the firmware, installed it per instructions.... and it bricked the car!

She brought it to the dealer, who initially claimed it had to be done by the dealer, which to their dismay wasn't true. They had no idea what to do, and my coworker ended up talking to the tech, looking at the screens they figured it out -- another bug that froze the update process if the battery was below some level. They charged the battery, everything finished, and the car was back.

She ended up getting a part time gig with them helping folks with these problems, which may become a bigger thing.

Kudos to that dealer for being able to admit their shortcomings and then grab a talent when they see one, instead of knee-jerk scorn for a customer showing they didn't know about their stuff.

My 2015 pickup has a stereo/setup that can get Satellite radio, GPS signals for the mapping program (not activated on mine), regular radio, and a 4G LTE hotspot.

But what really, really annoys me, is I have to push buttons on the screen to update/fix the time.. How the hell does it not have NTP, or get a radio signal, etc?

Our 2011 Lexus CT200h (no longer with us I'm sad to say) would set time via GPS. I don't understand why every car doesn't do this (especially if it has navi, which requires the GPS chipset regardless).

Especially since the GPS signal has the time in it... likely it is to avoid issues with people claiming it is running fast/slow, or changing timezones.

Only the GPS time value has never had any leap seconds applied to it. So it's almost 20 seconds ahead of UTC. Which is probably "good enough" for a clock in a car.

GPS includes the offset between GPS time and UTC so that receivers can convert to UTC if they want to.

This offset is limited to 255 seconds though.

https://en.wikipedia.org/wiki/Global_Positioning_System#Leap...

> This offset is limited to 255 seconds though.

Given that leap seconds have been added at a rate of approximately 1 every 1.6 years, we are still good for another 376 years.

Don't forget that they can be negative leap seconds too! It hasn't happened yet but it is expected.

It seems unlikely that the GPS receiver is hardwired directly to the clock display in the dashboard. There's probably some code running somewhere in the middle. So it should be easy enough to make the leap second correction there, and to keep it up to date through routine updates.

The Mazda infotainment system can similarly be updated via a USB stick. In the Mazda case, it's JavaScript code running in Opera on top of Linux. The code is written by Johnson Controls. Enterprising hackers (of the good sort) have made available a variety of customizations.

Do you know a good place to learn more about this? I'd love to see what might be available for my Mazda.

http://mazda3revolution.com/forums/2014-2017-mazda-3-skyacti...

Over 6000 posts. Have fun. :-)

Someone put together an app which allows you to select the hacks you want, then generates a few scripts that you write to a USB drive. You then put that in the car and turn it on, and it patches the system:

http://mazdatweaks.com

You can brick the system, so be careful. I haven't touched my system yet, and I wouldn't do so w/o understanding exactly what each of these hacks do.

Awesome, looks like a lot of fun reading to be had. Thanks!

Sounds a lot like my wife's car. Interesting . . .

Yowza. I don't see how all mfgrs don't move to Tesla's update model. Knowing how things go it'll probably be 10 years before we're there.

The answer is Dealers. Their dealers would sue them if they lost all the revenue they get from updating customers vehicles. On the flipside, it would save the manufacturers a ton of money because they wouldn't be paying dealers to perform these updates when they're under warranty. This also explains why Tesla has to do OTA updates... no dealers.

Most Tesla customers live nearish to a Tesla repair center. So it's not like Tesla is forced to do OTA, but it sure is convenient to have the frequent updates that OTA enables.

Probably because they would have to support tens of models and tens of millions of vehicles. Big car companies contract their head units out per body style, so one company may design the 2008-2012 head units and another 2013-2016. They likely have wildly different sensors, firmware update formats, etc.

Bigger car companies prefer stability over features and don't design everything in-house like Tesla. Their shareholders also expect them to turn profits, which leads to risk adversion and slower product cycles.

The head units can also be vastly different by region - which doesn't really make much sense to me. Sure in US you have satellite radio which is unheard of elsewhere, but that's about it. I have a 2010 Prius and the US model has a DVD for navigation, where as the EU model has a HDD and needs to go to a dealer for €€€ updates.

Can you link me to that update stuff? I have a 2010 Camaro and the BT is super buggy.

It was a long time ago, but I got it from the Camaro5 forums. Try asking at http://www.camaro5.com/forums/forumdisplay.php?f=29

Can you please share that c# code?

Got it from this thread 7 years ago (!) http://www.camaro5.com/forums/showthread.php?t=31235

I suspect the driver door isn't a special toggle and is instead just an easy way to trigger a transition to a known state.

I've posted this before, but it's relevant so I'll post it again. Not sure if this has changed since I last posted, but it's a hell of a warning sign on how they practice:

So, I'm an Australian. We don't have OnStar but I've heard about it via the net. I keep getting emails for 2 different people's OnStar accounts to my Email address... and OnStar won't do anything about it.

I have a pretty short Gmail address because I signed up early (6 characters), and Gmail's autocorrect/fuzzy email receiving means I get emails for all sorts of people that have mistyped their email and mine is "close" to what they typed.

To give you an idea of how bad this OnStar situation is:

- The emails have all the personal details inside each one. Name, home address, car make/model and various ID/registration details, home phone number, etc.

- It gives me full access to the cars maintenance records via monthly emails with EVERYTHING in the email relating to the car, INCLUDING LETTING ME EDIT IT via a link.

- It gives me a link directly to their OnStar account, and the password is the persons postcode, WHICH IS IN THE EMAIL. There's quicklinks to access the full account, change vehicle details, remotely access various aspects of the vehicle's features, etc.

- I can send directions to their GPS from my browser, which comes up on their screen.

- ... lots lots more "could" be done if I was inclined.

I've emailed OnStar support about it a few times, they don't reply. The closest I get to any form of reply is an automatic message telling me to call them on a "toll free number" (not free for me to call from here!)

PS, Mr Buchner, your 'tires' on your GMC Terrain are low and your oil needs changing urgently. It's overdue by months.

Here's what I do in these situations:

1) determine the email pattern for gm employees, usually it is something like john.doe@gm.com 2) find the head of every major department related to my issue as well as the CEO and add their addresses to an email 3)provide documentation of all attempts to correct the issue and if you use outlook, request read receipts just to be 'that person', send an email highlighting your multiple attempts to correct this, how you are willing to escalate it to x,,y, or z. Media, government agency, etc. if it is not dealt with appropriately. 4) success

I've received gift cards, emails from CEO's apologizing, finally got removed (after 6 months of emails to regular staff trying to stop it) from an automated Dell email invoicing the wrong company, etc.

Oh brother, I know your pain. I too have a 6 character gmail address because I signed up in 2004 when it was in beta and I too get email for all sorts of people (both accidentally and because people just give out my email address as a fake when they sign up for something stupid).

It can be fun too though, like when someone signs up for a dating site with your email and you can login to what is effectively your account.

I had the same problem as you with a large bank... kept getting emails with someone else's balance in them. I kept responding and trying to get the bank's attention, but nothing. Eventually I tweeted at them publicly with a description of the problem and that got them to clear it up pretty quickly. ;)

WOW! I was also an early adopter of Gmail and have a six-letter gmail address as well that I got all sorts of emails that were from other people (but with the same name as mine). In inspecting the raw email content, the "To:" field is correctly spelled with my gmail address but the email content have been nothing to do with me: someone else's group invite, account registration that was clearly not me, flight confirmation emails, hotel booking confirmation emails, bills, work related emails and etc. You name it.

Is this a widespread issue with Gmail?

Yes. Heaven help you if you have an extremely common firstname.lastname combination where there are multiple spellings of the first name. Once you're in someone's address book, it's nearly impossible to get them to delete you if they're not tech-savvy. So every time someone intends to email Jon.Smith@gmail.com they send it to John.Smith instead.

There are companies that have been emailing me contracts for years now. I've gotten multiple divorce records, tax returns, all sorts of confidential information. I guess that's what all those legal disclaimers in the footer are for, because someone could do a ton of damage with the information I've gotten.

Those legal disclaimers in the email footers are not binding.

(I am not a lawyer.)

I'm part of some family's mailing list. They seem to go on fun vacations each year.

Some woman has a gmail account that seems to be [first initial][middle initial][last name]@gmail.com, but she wound up on her synagogue's leadership mailing list as [first initial][last name]@gmail.com, which is my email address.

Until somebody finally listened to my responses of "These aren't the droids you're looking for", I was privy to lots of intriguing drama.

yep, I also have a 6 letter gmail address and I get a ton of stuff. It's a nightmare. I have utility bills, at some point I was on a mailing list for some real estate company, I even got people complaining to me about their broken A/C units. Several cable accounts with multiple providers in multiple US states are registered on my account and there is nothing I can do about it because the companies don't give a damn or the support people received the worst training.

Sometimes it's funny because people send me Mails trying to recover their account but I tell them to speak to the companies because I have no way of verification that I'm actually turning over something to the right party, so I don't do it.

widespread enough that there's an xkcd about it:

https://xkcd.com/1279/

I have a 7-letter gmail address. Middle initial (I don't use my first name), last name. Every so often I'll get information mailed to me that's supposed to reach Terry Myname in Illinois, Tim Myname in Iowa, Tammy Myname in Florida, Todd Myname in Wisconsin, etc. A lot of times it's just mundane (oooh, I could cancel someone's Bath & Body Works order!) but on occasion it's legal paperwork.

I do at least try to get the important ones sorted out -- I reply with "it appears you're trying to reach [name] in [city] but you've actually reached [me] in [my city]. If you have a phone number for [name], you should give them a call and ask for their correct e-mail address." On occasion that even works :D

Same here, also on a 6 character gmail address.

I regularly get people applying for loans, who send me A LOT of personal information, because of a typo in a spam mail. Contacting the responsible loan company, who looks pretty fake and shady, didn't lead to any success.

Once had a gentlemen in his 70ies contact me about my profile on a dating site for seniors and get lots of car advertisement addressed to someone with my initials, who sometimes does eBanking, is 40+ years married to a wife whoms father died 3 years ago, etc. etc.

Needless to say, I love mail filters.

Unrelated to OnStar but similar issue here. I have a common name @ gmail from 2004 and get all sorts of information.

A MetLife VP keeps sending me confidential financial stuff. Several other people around the world too, bank stuff, car stuff you name it.

I've stopped trying to "fix" the situations and just mark them as spam and move on.

Your concern is valid and it's not lost on manufacturers. I am familiar with one manufacturer whose vehicles will have a bus level firewall in some new vehicles released later this year. Of course, eventually all vehicles will have it. Vehicle development cycles are usually multiple years so it takes time to roll this stuff out.

You might say an internet connected head unit should just be disconnected from the vehicle bus, and there's some merit to that. But, customers want to be able to control the volume from their steering wheel or the head unit should control the subwoofer amp in the back of the vehicle, or change vehicle settings from the head unit display... so the head unit needs to be on the bus to do all of these things.

The goal is to limit what the head unit has access to on the bus. For example, there's no reason the PCM (powertrain control module) should be allowed to receive anything other than high level configuration information from the head unit (switching between standard and sport mode driving profiles for example).

Do you know who makes the bus level firewall? Do you mind sharing the manufacturer's name?

I'm sorry, I can't share the manufacturer or the firewall they're using. But I don't want to be unhelpful... I know that Bosch makes a CGW module that has firewall functionality:

http://www.bosch-mobility-solutions.com/en/products-and-serv...

History shows that car manufacturers have not given near enough thought to the security of access to a vehicle.

Here's how GM could beat Tesla, along with why it won't happen. GM could just take a look at what Tesla is doing, and do all of the same things, then do certain key things better. From a sheer resources and capability standpoint, GM could beat the pants off of Tesla. I think Tesla is counting on: 1) GM and other big automakers being too set in their ways and 2) GM and other big automakers getting some key things very, very wrong. Security is probably a key example.

It's an oft-cited insurgency move to use the big power's culture against itself.

Here's how Blackberry could beat Apple, along with why it won't happen. Blackberry could just take a look at what Apple is doing, and do all of the same things, then do certain key things better. From a sheer resources and capability standpoint, Blackberry could beat the pants off of Apple. I think Apple is counting on: 1) Blackberry and other big phone makers being too set in their ways and 2) GM and other big phone makers getting some key things very, very wrong. Security is probably a key example. It's an oft-cited insurgency move to use the big power's culture against itself.

To be fair, Blackberry (RIM) was not bigger than Apple on the day of the iPhone announcement. Also, RIM was kind of forced to build something like the iPhone by Verizon according to Losing the Signal by Jacquie McNish https://smile.amazon.com/Losing-Signal-Extraordinary-Spectac...

To be honest, there is some truth in the ideas behind the point though. RIM always liked to control everything, and at most give Enterprises control, but not end users. Apple targeted consumers, and relied on consumers to push into enterprise for them. IIRC, it was actually some time before iOS even supported basic enterprise features (like company control and reset for company devices, etc).

Yeah, I can see that, but GM and Tesla are so different in size that the comparison is a bit problematic.

RIM knew who their market was, and frankly should have been fine if there hadn't been a hype panic. Heck, their top market cap was a year after the iPhone.

I cannot help but think of a world where there was an actual "consumer" Blackberry device. I think the Bold form factor with the Passport keyboard UI and advances would have been a pretty nice machine. It was even thick enough for a really good camera and battery. I can even see the shooting video commercial tag line "Live Life in Widescreen" with snark about vertical video.

> Yeah, I can see that, but GM and Tesla are so different in size that the comparison is a bit problematic.

Sure, that's why I said the truth was in the ideas, not the statement itself. :)

> Heck, their top market cap was a year after the iPhone.

Sure, Apple added exchange support in early-to-mid 2008[1]. Add to that incomplete coverage of features initially, and the fact that Enterprises don't move as quickly as consumers, and it makes sense. I remember there being some hope RIM could pull off a good touch phone, but it was too later (I judge this by the fact that when they finally delivered a touch phone nobody really cared enough to give it the time of day).

1: http://www.computerworld.com/article/2537517/apple-mac/apple...

They flopped around trying to bolt touch features into their shitty legacy OS.

Then they rolled out a really good OS (bought QNX) but it took too long and delivered too late. By most reviews it was a quality product, but 3 years too late.

They should have bought Palm in 2010 when it was up for sale and built on their existing product.

But they bought QNX that year instead, and released their mediocre tablet a bit year later. Anybody who saw how flubbed that was could see the writing on the wall.

When I worked at a mobile gaming company, we joked about how terrible it was, pretty sure I saw one getting kicked around the office.

I'm not sure what point this find/replace is supposed to be making. That seems like a pretty accurate assessment of how Blackberry could have beaten Apple and why they didn't. Well, except it also needs a find/replace on "security" to something else like "UI."

I think the point is that anybody is theoretically capable of beating anybody else if you assume they can do a clearly better job in all respects. You could replace "GM" with any other entity without making it more or less true, because the statement is so firmly rooted outside of reality.

If there's a practical path to GM doing the same things Tesla is doing that's in line with GM's observed practices and capabilities, that would be much more interesting — but the fact that Bizarro World GM could beat Earth-1 Tesla doesn't tell us much of anything.

I'm not sure what Apple has to do with it exactly, but I thought he was talking about the fact that BlackBerry owns QNX and is marketing it as a vehicle software platform.

The point is GM won't beat Tesla, for similar reasons to why BB and Nokia didn't beat Apple, despite having a number of advantages.

GM is already "beating" Tesla by shipping an actual high quality regular-consumer EV product this year right now that is getting stellar reviews.

I'm just going to say that I think Detroit is having a tech talent shortage right now. I'm having a hell of a time finding embedded software people. Several good people I know moved to CA after the downturn or during the recovery. There are plenty of people, but I think they're mostly happy where they're at and not looking for new jobs, so those positions are really hard to fill.

Not really. GM is too large of a company to take the risks Tesla has been taking. They would likely execute much more poorly on top of this, as they'd likely outsource it to someone and there's no players in this game that are outperforming Tesla.

Stuff like this has been around forever. I once drove a 2007 BMW 7 series which let me unlock/lock my car from my phone. I also got weather data etc. on my dash.

Now it is finally making it to normal cars. My 2014 Passat has it as well. However, I didn't activate it since it is tracking my location.

On the other hand, stuff like Onstar can save lives.

http://www.mercurynews.com/2014/10/14/san-jose-mount-hamilto...

tl;dr of mercurynews: A 28-year-old Campbell woman who spent the night at the bottom of a 500-foot ravine after veering off Mount Hamilton Road was rescued Tuesday morning and flown to a hospital to be treated for her injuries. The General Motors’ OnStar system and Apple’s Find My iPhone service determined users’ location.

The EU is trying to make something like Onstar - "eCall" - mandatory for all new cars. I'm concerned how that's going to turn out.

I can't find the article anymore, but around 2003 or 2004 there was an article on the NYT about law enforcement using OnStar to spy on what people are talking about in the car (on the phone, etc).

maybe this? Cartapping: How Feds Have Spied On Connected Cars For 15 Years

https://www.forbes.com/sites/thomasbrewster/2017/01/15/polic...

>History shows that car manufacturers have not given near enough thought to the security of access to a vehicle

Yeah! No kidding!

I read last year about how Nissan's Leaf API was entirely unauthenticated, all you needed was the VIN to mess with people's climate control.

https://www.troyhunt.com/controlling-vehicle-features-of-nis...

You are probably vulnerable even if you don't subscribe too... There needs to be an "airplane mode" that completely disables wireless communications...

Also a new Volt owner, and I plan to detach the antenna from the OnStar unit in mine. You can't disable it entirely or the car gets angry.

I tried pulling the OnStar fuse from the fuse box and the only change I noticed was that the in-car microphone stopped working! Makes one wonder just how ingrained OnStar tech is in these vehicles.

You guys might appreciate this little how to:

https://www.youtube.com/watch?v=i0dvLuWna9Q

Yeah, I've seen that, thanks. I think the location is different on the gen2.