Hyundai wants loniq 5 customers to pay for cybersecurity patch in baffling move

Agree the title is a bit misleading, but addressing what sounds like an exploit still feels like a patch of sorts.

But yeah, “patch” usually implies software vs. hardware.

Either way, agree with other comments that Hyundai should just eat the costs if it prevents theft due to an exploit.

Having said that, given what the car costs, the fee doesn’t seem completely unreasonable.

It doesn't matter. If a customer buys faulty hardware, it's the seller's responsibility to replace it with working hardware. If the breaks had a manufacturing defect, you wouldn't expect the customer to pay for the replacement.

Swapping software, pentesting, testing, QA, CI/CD pipelines, image caches aren't free either. Can we then start making more money as software developers to patch CVEs? We clearly should consider holding ourselves to a lower standard. Your requests are getting 5xx errors? Pay me more to fix it, not my problem that your requests is failing.

Why would the price/cost of hardware replacement be treated differently from the price/cost of software replacement?

Check out Slate trucks. I want that too and this seems to be perfect. Has windows you roll down even. Fingers crossed it actually launches.

https://www.slate.auto/en

There will always be at least a basic screen in new cars in the US because of backup camera requirements.

We have a Volkswagen e-Up, it's basically that. Analog cluster, a very small radio screen that also displays the world's smallest reverse camera view, and a dashboard mount for your phone. It's a fantastic little car, I honestly like it more than our 400bhp Volvo XC60.

Nobody will sell you one for cheaper than a whole package.

See also ‘smart’ tvs vs digital signage displays aka dumb tvs.

If you get the base level, expression trim of the Dacia Spring then you get an EV without an infotainment system: https://www.dacia.co.uk/hybrid-and-electric-range/spring-cit...

Agreed. I'd actually like to buy an EV, but so far there are no candidates which meet my minimum requirements, which are pretty much what you said + serviceable by any mechanic with aftermarket parts + using Na-ion, not Li-ion batteries. And it shouldn't be super ugly like most new cars are today (e.g. Rivian, VW ID Buzz).

Though I'm pretty sure you can't even legally make such a car anymore, at least in Europe, where certain "smart" features are required for new cars. Perhaps a manufacturer of such an EV could put all of that into one box which the user can simply pull out and discard.

Such car will not comply with legislation. Or are you talking about car with all sort of tracking systems and driver's assists but no infotainment?

Anyway, that is not what majority want to buy. Even more, a car is not what majority want to buy in the USA. SUV/trucks are desirable.

That’s illegal in the EU, 911 eCall requires an always-on cellular connection with an attached device that records your location. Would you please think of the children?

The UN has regulations? Who does it have authority over? Who enforces its regulations?

The story has a bad spin yes. But it’s just as much of a controversy if they had require people themselves pay the cost if they found out the cars where shipped with defective breaks. It’s a product error not wear and tear or user error, they should eat the costs, but the cybersecurity framing of it is being used to attempt to push the cost to the consumer.

Also frustrating but for different reasons:

> in 2023 over the “Kia Boyz” attacks that allowed thieves to bypass a vehicle’s security system using a USB cable.

The USB cable happened to have the right size to engage the starter mechanism. Any physical object with similar dimensions could have been used. It really undercuts how absolutely terrible the Kia security design was around that component.

Yeah, I considered an ionic the last time I was getting a car. Now I’ll never again consider them.

That's easy to say when you aren't the one footing the bill.

Not even a marketing cost, a delayed engineering cost to fix a fault in the product.

More than likely

They’re talking about something like this https://www.thedrive.com/tech/34817/this-25000-game-boy-is-m...

No, some dedicated hardware device, about five years old, that looks like a Game Boy.

The flipper firmware is only about six months old, and it is still not as convenient and distributed.

The actual firmware exploit is the same idea.

> Having terrible security just helps sales!

Until it’s banned by regulators or made uninsurable…

My 2021 Ioniq 5 does not have keyless entry at all. You need to press the button to open the door.

Also be aware that homologation means there is no one-sized-fits-all, canonical vehicle for all markets but many variations for different markets with variations in security and safety features. Some markets get proper security measures while others get screwed.

I don't think the patch is hardware. The hardware they're talking about is the "Gameboy like device" that runs the exploit.

"The term "patch" came from early use in telephony and radio studios, where extra equipment kept on standby could be temporarily substituted for failed devices." - from https://en.m.wikipedia.org/wiki/Patch_cable

But yeah, the term patch just seems weird in this article. Why not just "upgrade" or "fix"?

There are two aspects. "Charge" and "costs/who pays". When someone can start a Kia with a USB cable, the owner pays for that. Kia may have a fee for replacing something, but that doesn't factor in the calculus of "there's a reason these people are buying our product, and we assess they will continue to do so."

Note that Kia offered a maximum of $6,125/$3,375 for totaled/damaged vehicles.

The previous formula:

"You take the population of vehicles in the field (A) and multiple it by the probable rate of failure (B), then multiply the result by the average cost of an out-of-court settlement (C). A times B times C equals X. This is what it will cost if we don't initiate a recall. If X is greater than the cost of a recall, we recall the cars and no one gets hurt. If X is less than the cost of a recall, then we don't recall."

Stealing cars is illegal in the UK, however you do it. Just having this "gameboy-like device", in your pocket is "going equipped", and you're going to get arrested on its discovery about your person outside of your abode. No ifs, no buts.

The UK has lots of new cars (plenty of cheap financing around for lease, PCP and HP deals), and there is a low-level epidemic of thefts of vehicles that end up in shipping containers and heading out of the country within hours. [0]

Car insurance is also so high in the UK at background levels that if you end up owning a highly desirable and very easy to steal car (the Range Rover a few years ago, for example), the costs being added to price in the risk of your car ending up in a container heading to the Middle East don't seem - as a percentage - particularly high.

The fact UK has great shipping throughput to the Middle East, Africa, and so on, is both a boon economically, but also it makes great cover for all sorts of shenanigans.

[0] https://www.containerlift.co.uk/cracking-the-code-uk-police-...

From the wording of the press release it sounds like they view it as an optional add-on specifically for UK customers who want additional security:

Recently, evolving security threats, including the use of unauthorised electronic devices to bypass vehicle locking systems have become more prevalent in the UK. This is an industry-wide issue and Hyundai is providing appropriate responses in line with industry practices.

As part of the Company’s commitment to supporting our customers, we are able to offer a subsidised software and hardware upgrade for a customer contribution of £49.

Rather because some people parked their Teslas on public roads and later found them vandalized.

This is a great question. Have been in insurance for 20 yrs now. Cannot phantom why f.e. insurers don’t hold manufacturers responsible for losses due to cloned car keys with inadequate protection. I do know that insurers are generally very hesitant to start legal procedures, especially those that end up in the news. Say, Volkswagen and Stellantis are formidable adversaries as well as national champions, so there is some presumption that getting your right might be difficult. And the bar as I understand it is not technical SOTA, but more something like acceptable practice, so the manufacturer could argue “hey everyone has shitty protection, so suck up the loss”. Perhaps the newest European legislation will help raise the bar / even the playing field.

Given that many door locks and other portable locks are laughably bad and can be opened with sometimes simple shimmering, or at most basic picking tools, that would mean insurance companies could already have sued Master locks for instance. So at least, bad security is probably not enough for it.

From there, making customer pay to fix bad security doesn't sound like a significant step.

What’s wrong with the comments?