Toronto man uses AirTags to track stolen SUV to Dubai [video] | Hacker News Reader

Toronto man uses AirTags to track stolen SUV to Dubai [video]

youtube.com

118 pointsjustin66133 comments

Not really surprising, even if you sell your car honestly it can end up in the Middle East.

> Texas Plumber suing dealership after his car was used by terrorists in Syria, with his companies logo and phone number still on it

https://www.nytimes.com/2015/12/15/us/texas-plumber-sues-car...

I understand this is getting off the main point, but...

If you don't want your vinyl lettering on the truck to be the new owner's choice...uh, remove it yourself before selling it?

> As the paperwork was being completed, Mr. Oberholtzer’s son started peeling off the decal on the truck that showed the phone number and name of the company, but the salesman told him to stop because it would harm the paint and said it would be removed later, the lawsuit said.

Seems like they tried but were reassured that the dealership would do it.

Sort of...hand peeling while the paperwork is being signed is pretty late in the process. Doing it right requires a heat gun, or solvents, or a removal wheel, etc.

> Doing it right requires a heat gun, or solvents, or a removal wheel, etc.

Or a can of spray paint to over names, logos, and contact information. :)

I'm thinking that would decrease the sale or trade-in value :) It also doesn't help all that much with the raised nature of vinyl letters.

When should they do it? Before a deal is reached? What if no deal is reached?

Do without your advertising for a while, or risk selling it with the advertising intact. I just think it's weird to sue a buyer for not removing it when you left it there.

> I just think it's weird to sue a buyer for not removing it when you left it there.

Even when the buyer is a dealership who insisted on removing the stickers themselves?

What other parts of the deal should the plumber expect them not to fulfill? If not a lawsuit what’s the correct recourse when someone doesn’t uphold their side of a deal?

Not sure about plumbers but I know for auto transportation (and by my understanding any cargo hauling) identifying markings are required for commercial operation. If an auto transport truck is being traded in when is the appropriate time to remove those stickers?

> What other parts of the deal should the plumber expect them not to fulfill?

All the other ones that are similarly not written in the contract.

I don't find it that hard. Once you decide to sell the vehicle, you're likely going to do so. If not to the first dealership...to somebody in the near future. Removing the lettering removes whatever value the advertising has, but does not remove the ability to use the truck in the meantime. If it's a huge concern, you get a few magnetic temporary signs to tide you over and maybe to use on the new vehicle until you're ready to drop it off for lettering. You already signed up for some time without lettering on the new vehicle, so is it really that big a deal?

Yes, even then. It's a burden-and-benefit situation. The benefit is to the plumber, so the plumber should not trust the other party to take on the burden.

(Or, put more simply, "who cares the most about it"?)

Absolutely before the papers are being signed.

How does that work exactly? Negotiate time to take the truck somewhere and prepare it for sale?

Doing it at all requires those things too!

They said it would ruin the value but did it? Did the people using it as a war machine car about the decals or any paint damage?

While I agree with your general point, I don’t think anyone would reasonably expect their used vehicle to be sold for terrorist uses in another country.

If I had a business would want to remove the company info even or especially if it's sold locally (local relative to the business).

The plumber tried to remove the stickers but the dealership insisted they would do it instead.

I know someone that had a HVAC business with several trucks, and sold an old van to a handyman who had done some work for him. The business got a call a year later from someone complaining about a door or something "they'd" installed... Which of course turned out to be the handyman still having the original logo and phone number on the side. I think the deal was he was supposed to remove the logo, but of course hadn't yet. They finally got him to take it off, but the lesson definitely was don't sell a vehicle with your company logo still on it.

Lawsuit was settled for an undisclosed sum:

https://www.usnews.com/news/articles/2017-01-09/plumber-whos...

Car theft is unbelievable in parts of Canada - been up there a few times in the last few months for work (near Montreal), and the hotel I stay at gave me one of the steering-wheel lock bars when you arrive - I have never seen that before anywhere else I have traveled - they also suggested I run out and put it in, even before I finished the check-in paperwork - they said cars sometimes disappear minutes after guests arrive.

...and this wasn't even a bad area, felt completely safe walking around there day and night without even a hint of worry.

Yeah, I saw a TikTok of a person installing a electronic kill switch in the car so that the fuel pump wouldn't run. It was a 2020 Lexus SUV, and I was baffled since it was in Toronto. Didn't realize car theft has become that bad in the city.

I had a hidden physical switch installed in my 95' civic to do the same thing in Miami since they were so likely to be stolen.

how the hell do you steal a 2020 vehicle without the key? I thought thats the whole point of the sophisticated FOBs (that cost $500 for a replacement). I thought the only way you could steal a late model car was with a tow truck.

My understanding is that a tool is used to boost the the signals between the car and key fob so the thieves can simulate them being very close -- close enough to unlock and subsequently start the car.

Once the door is unlocked though there are any number of ways to get the car moving, especially if you have access to the ODB2 port.

My key fob can be put into a battery-saving mode which disables wireless communication unless a button is pressed. My vehicle also supports a song-and-dance to disable all proximity-based sensing, at which point you need to hold the key fob against the ignition panel to start the car.

This is incredibly inconvenient and I don't know anyone who does either of these, though.

I've got a great solution. How about requiring the users insert a hard to reproduce physical key-like object in a slot before the car will start?

Objections to how fobs would weaken security were made before they were introduced and fell on deaf ears - I'm not certain why car companies would start listening now.

I want my physical keys and knobs and buttons on the console back - half the electronics in cars seem to add negative value.

Yes! I hate touch screens in cars. I hate that they are so much more difficult to use and require so much more attention. I guess they're only possible because the car does half the driving for you now, picking up whilst you're distracted trying to turn on the windscreen demister or whatever.

Wafer locks used in car doors are actually inherently easy to lockpick because the tolerances can't be that high. Wafer locks are used because they allow you to insert the key upside down and still unlock it.

Ah, I've got a solution to that too! I'm going to call it two factor authentication. Basically it uses a secondary digital key as well that communicates in parallel with the physical widget.

Huh that's pretty clever, requiring both would make it pretty foolproof.

they already solved this with DNS, how about a certificate chain? so (at the very worst) you can revoke the certificate on the stolen car. But also allow lost keys to be replaced by reprogramming them from a dealer certificate (which could also be revoked, and have a TTL). No, I dont want the car to require an internet connection to start, but I think its reasonable to say "to enable anti-theft, your car must resync at least every 6 months to update certificates. If not, it will be easier to steal and you can pay into a higher insurance pool".

Facial recognition might be easier

How hard would it be to have the fob recognize it hasn't moved in x minutes and turn itself off? If it's in your pocket it would stay active, and the user experience would be exactly what it is today, while stopping night-time relay attacks.

Sounds about on par with my old Saturn that you could probably start with a screwdriver. But at least I can get new keys made for $5 each.

Guessing with a Flipper Zero (https://news.ycombinator.com/item?id=39084137)

There are relay attacks where you boost the signal from 50 feet away. Think someone pulls up outside your house with a giant antenna attached to a clandestinely made device, unlocks the car and drives it straight into a shipping container.

A lot of cars are vulnerable to "all keys lost" programming through the OBD2 port. You show up with an Autel box, smash a window/jimmy the door, pair a blank fob to the car and drive it away.

Shit, I'm to hire a thief to make me a new key. Sounds cheaper and faster than the dealer. ;)

The video puts only slight pressure on Canadian Pacific, and major pressure on the federal government...

But if Canadian Pacific was told they have stolen property & continued to ship it - why are they not held responsible? And if exact storage container was spotted, why didn't the railway police try harder to trace the shipper?

Canadian Pacific is not in the business of verifying who has legal title.

Resolving theft is the government’s job, moving stuff is Canadian Pacific’s job.

The onus lies on the government to have sufficient personnel and processes to have the stolen item recovered quickly.

It's clearly stated in the video that the reason the police didn't go after the stolen SUV was because it was in the jurisdiction of the CP rail police[1]. So resolving theft literally is Canadian Pacific's job (more specifically the job of their private police force[2]).

[1] https://youtu.be/A3eG8ZbeXeQ?t=167

[2] https://en.wikipedia.org/wiki/Canadian_Pacific_Kansas_City_P...

In this case, I would question why a non governmental entity has a police force.

I'm not an expert but I know there is a long history of railway police having the power of sworn officers. They are effectively quasi-governmental. (Although there is a clear conflict of interest when it comes to choosing to pursue crimes that aren't commercially relevant)

https://en.m.wikipedia.org/wiki/Railroad_police

Perhaps you should instead question why you are commenting authoritatively on a video that you did not watch?

Oh they have a lot more than just a police force. They control a lot of the rail infrastructure and it holds back general transit improvements.

In much of North America the railways are older than the government.

I guess technically? The first Canadian railway was opened in 1836 (while CPR wouldn't be opened until 1885). Canada gained self-governance in 1867 but it was endorsed by the British government and didn't radically change the administrative structure so I feel like your statement is not particularly accurate.

For the rest of the continent: North America is commonly defined as the US, Canada and Mexico - Mexico's first rail system was established in 1837 sixteen years after independence in 1821 and the US's first railroad was built in 1827 just over fifty years after independence.

The CPR was done by 1885. Alberta and Saskatchewan weren't provinces until 1905. The original transcontinental railroad in the US was finished in 1869. Utah didn't become a state until 1896.

These places were very much the frontier when the railroads were built. There was minimal law enforcement provided by the barely-existent territorial governments and the railroads responded by hiring private security (famously Union Pacific hired Pinkerton) and building their own private law enforcement capacity and this was eventually formalized by laws in both countries permitting the practice of railroads having private police.

Much less familiar with the relevant Mexican history.

Per the wiki article I linked, they are actually federal police officers, it's just that Canadian Pacific appoints them:

> They are duly appointed and armed federal police officers that gather their authority in Canada via the Railway Safety Act as well as other acts.

Canadian Pacific is nearly 150 years old, I would bet that the Canadian government didn't want to be on the hook for policing such a massive geographic footprint for a private business, but at the same time did want to ensure that an industry that was vital to national security was secured. The alternative was probably nationalizing the entire business, which they likely also didn't have the stomach for.

I mostly disagree that it's on the Feds to recover stolen property.

If the Canadian Pacific police is contacted, told "Canadian Pacific has my stolen car, these are the case numbers with 2 different police services, and here is the exact container the car is in", I don't see how the right response is do nothing.

Because Canadian Pacific is not a position to verify your claims.

But they are the only ones with physical access to the container. Obviously it requires some cooperation between the two agencies, and the lack of cooperation is what is being criticized.

I think it's perfectly reasonable for CPR not to hand over a shipping container I claim contains my stolen property - but they should stop transporting the goods so they can be offshored.

Canadian Pacific is kind of weird as a company as they have their own police force. They literally get to police themselves for historical reasons, so while it is reasonable for a regular company to not act on reports of theft, it is harder to say that about Canadian Pacific.

Yes, I would say the root problem is the government has outsourced its responsibility to a non governmental entity. Non governments should never have law enforcement authorities.

The historic reason for these powers is that it is often difficult to tell in the moment who has jurisdiction. Especially if it's a moving vehicle that can cross state lines.

Railroad police arrest and detain the suspect(s) and turn them over to whatever locale is determined to have jurisdiction after the fact. At the time those laws came into being, there was no really good way around this.

Rail police is historically codified in Canadian law. It’s a matter of the car being out of the bag for a very long time, rather than CP Rail lobbying the government to have this force in place.

VR (Finnish national railway) has its own police force too, and AFAICT it's kind of mysterious. Only very rarely discussed in the media. Perhaps someone who knows more can comment.

Car thefts are extraordinarily high across Canada, and most police forces have an incredibly laissez-faire attitude about them. Unless police can do a big dog and pony show operation with a lot of fanfare, they don't bother. There have been numerous cases now in the Toronto area where people have found their own vehicle and the police tell them they'll get around to it but stay away. Eventually the car is shipped offshore.

https://www.journaldemontreal.com/2024/01/20/cest-enorme--de...

Everyone treats it like a victimless crime. We're all paying billions in extra insurance while crime rings proliferate and grow in capabilities and violence.

> most police forces have an incredibly laissez-faire attitude about them

sorry but this just screams "corruption" .. what they tell you is that are busy. Similarly with crooked towing operations across Canada.

The police exist to protect those in power, not solve the problems of the commoners.

Doesn't insurance have the incentive to go after car thefts?

I've never heard of cops listening to e.g. bike theft (I had my bike stolen, didn't even bother) but I would think if you file a claim for a stolen car the insurance company would bother the cops enough for them to look into it.

I don’t think insurers really care either. They just pass the cost on to the insured and because all insurers have the same risk in aggregate, they all raise premiums. We get screwed because we pay more but the insurance companies are doing just fine either way and the police is also happily doing nothing because that’s hard work.

>most police forces have an incredibly laissez-faire attitude about them

Customs too?

Here is how it gets stolen and shipped abroad...

>Have a car with a push-to-start ignition? Here's how it could end up stolen and overseas

https://www.cbc.ca/news/canada/marketplace-car-thefts-1.6396...

The be fair to customs, there is magnitudes more attention to things coming into the country than to things leaving the country. It's an exceptional situation for exports to be checked by customs.

Over the past six months the government has ramped up export checks (given that criminal groups are basically looting the country at this point) but it's still a minor, low risk operation for exporters.

Sad that the reporter didn't ask more pointed questions about why the "I am right here next to the container" photo never led to ANY kind of stoppage of the container. Not at the first port, not at the next two canadian ports before it left. Not at any of the ports on the way to the UAE.

WHY? How is it so impossible to identify a container and stop it? There's something about this story that doesn't make sense re: the "we can't do anything" hands up in the air that this poor guy has had to deal with.

Yet you can bet if they'd caught wind of drugs in the container, they'd be breaking it open there and then.

If they catch you in the port even getting near containers you'll be instantly arrested. But if you report stolen property in one? "not my jurisdiction, sorry"

It sounds almost as if the police exist to protect the property of corporations rather than that of the general public. I know, sounds crazy, right?

Dude should have said he left a million dollars worth of hidden heroin in the car before it was stolen. Then maybe the cops would have cared.

More pointed than receiving the answer of "we don't have jurisdiction"?

If the guy arrived and just started spray painting the container right next to the cop, would the cop say "not my jurisdiction"?

there's a difference between a cop seeing someone vandalize property vs opening and searching a container.

"Government of Canada Announces National Summit on Combatting Auto Theft"

* https://www.canada.ca/en/public-safety-canada/news/2024/01/g...

* https://globalnews.ca/news/10241360/canada-auto-theft-summit...

I'm glad that the consultants and people who stage photo ops get a decent payday, at least.

Associated CBC story from last week:

SUV stolen from Toronto driveway shows up 50 days later – and 11,000 km away

https://news.ycombinator.com/item?id=39012286

I occasionally see Facebook posts about "My car/bike/tractor has been stolen. Make it too hot to handle!" etc. I don't blame them for trying but I would guess in 80% of the cases it's already in a container and on its way to the docks to be shipped to a less law-abiding country by the time they realise.

I would have thought the criminals would have been on high alert for airtags and other devices of the kind. In my mind, I imagine super thieves putting the car in a converted faraday shipping container, using a tool like a HackRF One to detect bugs etc.

I'm assuming that international law doesn't give the aggrieved enough chance of success at a low enough expense to make it practical to pursue legal options. There's no reasonable way to act on this information unless you're John Wick. Once the car is in Dubai it's going to leave the thieves' hands quickly. So, why would they bother scanning for bugs that lead to nothing?

If this is the case I'm thinking of, they basically tracked it on the train to the port in Montreal. They knew where is was the whole time and police just didn't care. So it's not international law, it's disinterested local authorities.

Coke comes in and cars go out and it'd been like that for ages. The port is run by the local mob in a way that makes season 2 of The Wire look like a documentary.

Oh God, what a fantastic show.

Why would they bother when then can just openly ship it by rail and sea? It's clear from these stories the authorities don't care about retrieving the vehicles. Until they do, stealing them is an easy, low risk crime.

Is it even possible for law enforcement to retrieve them once they get shipped in a country like the UAE?

The other day a dude walked up to the cold case in line at a coffee shop, grabbed a coke, and left. This is the level of most crime. There's no mastermind or great tools, just straightforward actions.

The fact that this guy's car was tracked didn't really help him so much did it (police are sadly incompetent)

The vast majority of criminals are not that clever or even particularly smart—not even the high-profile ones. Look at the fall of Sam Bankman-Fried for an example.

All this surveillance, with virtually every car just a bug itself and still the criminals can just easily do these thefts without any effort being made to catch them - what the hell is the point of surveillance society when can’t even be bothered to use it for its limited benefits like returning the car to it’s owner.

> using a tool like a HackRF One to detect bugs etc

The state of the art in vehicle theft is actually far simpler.

They steal the car/bicycle/skid-steer and just leave it in a back alley a few miles away for a week or so, and see if the owner turns up to retrieve it.

How do they know it's the owner reclaiming vs another rival crew?

Does it matter? If the car is gone, they move on.

because that's what was specifically stated, and was the unwritten gist of my question

The video is a proof that you don't need to do any of that, in reality what they do is that they park your car couple of days on a parking lot to see if the car has some location device, if no one comes they move the car.

News story about a bust today...

https://www.cbc.ca/news/canada/toronto/york-police-recover-5...

The amount of property theft and stolen cars in particular in both Canada and the US it's unfathomable. We are talking billions upon billions every year and only a fraction is recovered in a decent state. Many are trashed, dismantled or "exported" like this particular case.

Let's not forget all of this is being paid by those who pay insurance of course, which due to many factors, premiums have sky rocketed in recent years.

With a few exceptions, there has been a general apathy in actually really fighting this type of crime. Most DAs don't really go any extra mile, the judges tend to view these cases as "some kids being dumb", the police use all of this and say "our hands are tied" but in reality the only thing "new" is how society looks and responds at this, because this type of crime and these criminal organizations always existed in some aspect of another.

no there is not general apathy here in California. What is happening is always-on vehicle tracking on new car models, and constant bridge and tollway license plate readers. .. approved by a certain current California Governor and a very large security bureaucracy. It appears to me that the new order is the worst of both worlds -- cars constantly stolen and also ordinary citizens tracked constantly with an interface to surveillance capitalism.

Having license plate readers does not classify as "not general apathy". Every sizable city has one and they are as good as the database of stolens and how many times they are actually active and deployed, ie. police cruising the roads less traveled.

Plus if they found a stolen in the street, they just recover it. Generally speaking they don't wait for someone to get into the car and arrest them, and in most cases police is not allowed to put a tracker on the stolen EVEN with the owner's consent.

Also many thieves swap plates now. A plate reader is just a tool, just having one doesn't make the police department pro-active by itself.

My wife and I watched this over the weekend. It was nice to see that the cops in Canada can be as hapless/impediment as here in the US.

Which organized crime group is involved in this in Toronto? I always see it attributed to organize crime but never any specific actor.

Being a resident of Dubai this is really shocking for me, I always buy imported cars, never knew they were stolen from some poor dude

How does a car have a "clean title" (seen from video) if it's stolen?

Clean UAE title.

Doesn’t it alert you if there is an AirTag in the car and the thief has an iPhone?

I doubt anyone in the theft ring is near the car long enough for that to take effect. What's the minimum amount of time you have to be "followed" by the tag before it starts to alert you? These are not being stolen for joy rides or used to commit a different crime. These are probably taken immediately to the staging location by the thief, and then the thief leaves probably for a different car to steal.

Cars really need to have a fart spray release system or similar deterrent that automatically releases when stolen. As a bonus it would thwart towing companies as well from towing without first attempting to contact the owner.

Cars already have those, but they release auditory rather than olfactory insults when stolen — they're called car alarms. They do sometimes trigger on a false positive and misfire, but the owner can quickly override and fix the problem instantly. Good luck overriding a misfired "fart spray".

> They do sometimes trigger on a false positive

Sometimes?! I live in a suburb near a city and hear a car alarm just about every day. I have never once heard one set off because the car was being stolen.

Car alarms need to be retired. All they do is annoy people on ferry crossings etc.

Literally nobody pays attention to car alarms because they are 99.9% false positives. They're a nuisance that do more net harm than good.

An ink bomb in the upholstery sounds like it would be more effective. Once the owner triggers it, the upholstery is permanently stained a neon shade, making it very obvious to everyone that this is a stolen car.

This makes me think back to Mark Rober's porch pirate glitter bomb bit with the fart spray. I can still hear the sound it makes.

https://www.youtube.com/watch?v=h4T_LlK1VE4

Yep! That's exactly where I got the idea from and I really, really, really wish car manufacturers would stop thinking of it as a joke and commercialize it as a security product built into cars. Smash a car, steal a car, get covered in fart spray.

Mark Rober demonstrated MULTIPLE times that the strategy works, this is why I'm suggesting it be actually commercialized and end car smashing/theft once and for all.

So people can have their cars ruined by punks and/or glitches. Great idea!

It's not like they are getting their car back, so why not ruin their day too? Fuck 'em, they're thieves.

Wasn't this proven to be faked?

I thought it wasn't 100% fake but that he used some staged footage, but that it was definitely taken. He's been doing for several years now and continues to "upgrade" the package.

Want to think about the failure modes on that. I had a key fail on my old 1999 Nissan Maxima. It would no longer authenticate to the immobilizer to allow the motor to run (it cuts off either spark or fuel-- can't recall which). That was a pain and required a tow, but at least it wasn't smelly, too.

The smelly part would be useful when the car is towed against the owner's consent though. It should be law to at least attempt to contact the owner and give them 15 minutes before even touching a car that isn't yours. Since the law hasn't enacted this, fart spray (and maybe some sticky goo) would help delay towing companies while simultaneously contacting the owner via some kind of app.

Why? How do 3min load/unload zones work then? This grace period would put a lower bound on parking times and convert “no parking” areas to “at least 15 minutes”.

I don't care, but towing is not the right action to deal with someone who didn't move their car in 3 minutes.

What’s the right action then? Tickets?

Doesn't mention whether he has insurance. surely you would buy insurance after your first car was stolen

Can you buy/own/drive a car in Canada without insurance? Your comment makes it seem so. Can you finance a car and not be required by the finance company to carry full coverage?

When I was a student with a $600 car, I had "PLPD" which was the minimum required liability and nothing else. If my car was damaged or stolen or whatever I was sol, which obviously makes sense when your car is with less than thr deductible.

I assume that is still available. Normally with a new car you would get better insurance than that, either because the financing arrangement forces you too or because you want the coverage.

Everyone in Canada legally driving a car has insurance. You can't drive off the lot without it.

Does that insurance have to cover theft? In the US I have only seen requirements for liability insurance.

You can just carry liability.

That's common if you have an old car that is worth very little.

I've learned there is a few states where you don't even need liability.

I think it was West Virginia.

There was a case a few years ago about a guy from there who was driving through Alberta and got a ticket for no insurance and was trying to fight it as he wasn't required to have insurance in his home state.

Everyone in Canada is required to have liability in order to drive.

That makes sense but how does liability insurance help when your car gets stolen?

> That makes sense but how does liability insurance help when your car gets stolen?

I don't think that it does. Did someone say it did?

You replied to:

> Doesn't mention whether he has insurance. surely you would buy insurance after your first car was stolen

With the observation that everyone in Canada is required to have insurance. But the kind of insurance that is required wouldn’t help in this case.

Ahh, i get your confusion now:)

I was only responding to the quote that asked if they had insurance, not whether or not insurance would help in this case.

I mean to say comprehensive insurance as we have in Australia, that covers theft. What's it called in Canada

Not sure about Canada but in the US we call it “comprehensive” or “full coverage”.

bwhahaha "We've agreed to conceal Andrew's full name and address...." while his very non-obscured face is on screen in nice medium shot. Seriously? Like WTF kind of protection is that. It's one facial rec scan away from having his mom's maiden name, name of first pet, and the street he grew up on away.

That's some hard hitting journalism

I guess they aren't with the times...

While I sort of agree, the "organized crime" ring would have to care enough to convert his face to a name / address, which is much more complicated than finding someone by name.

Reply on news.ycombinator.com