Hacker News Reader

Comment by mindstab | Hacker News Reader

Um isn't this the explanation for the rash of high tech car robberies we've been witnessing ALREADY? This seems old news to the thieves. This is really just preventing the owners of the cars from reading in the paper that their car is freely stealable. It is regardless of weather the owners know it or now tho.

Shameful now they'll move to try and blame these guys when they probably botched the security in the first place.

View on HN

Do you think it's good when every thief-kiddie gets an easy recipe to open most of the cars soon after some academics used some advanced high tech to analyze the physical structure of the chip and reverse engineer the circuits?

Leaving "bad guys" having to repeat the feat until they can use the weakness should buy some time for everybody.

No, I think it's good when manufacturers recall the cars and fix their exploitable entry systems.

The level of exploitability changes immensely if the codes are published, since it was far from trivial to get them: the capability to analyze the silicon chips is far from everywhere. Not giving codes buys some time to all the owners of all the cars, probably counting millions.

The problem is that unless you publish the vulnerability and prove to the public that it exists, the manufacturers have little incentive to spend money on a recall and the vulnerability continues to spread in the criminal community.

Publishing the vulnerability also allows other white hats to propose a possible work around that owners could implement before dealers have a permanent fix, e.g. physically removing part of the management interface from the vehicle, or just to know not to park such vehicles in high crime areas in unsecured parking lots because the car could be more easily stolen.

Whatever. My car (which is definitely not high end) has a key fob which has been known exploitable for years, and Toyota have done absolutely nothing at all in that time to recall, help or even inform me. Manufacturers don't give a damn. It's time they took this seriously.

Why do you think VW would do anything when you admit your own car manufacturer hasn't done anything, despite that information being out for years?

Don't know what the most common attack is. I know that one way to get into some cars that are locked that way is to jam the fob so that when they try to lock it nothing happens.

Reply on news.ycombinator.com