Hacker News Reader

Comment by acqq | Hacker News Reader

Do you think it's good when every thief-kiddie gets an easy recipe to open most of the cars soon after some academics used some advanced high tech to analyze the physical structure of the chip and reverse engineer the circuits?

Leaving "bad guys" having to repeat the feat until they can use the weakness should buy some time for everybody.

View on HN

No, I think it's good when manufacturers recall the cars and fix their exploitable entry systems.

The level of exploitability changes immensely if the codes are published, since it was far from trivial to get them: the capability to analyze the silicon chips is far from everywhere. Not giving codes buys some time to all the owners of all the cars, probably counting millions.

The problem is that unless you publish the vulnerability and prove to the public that it exists, the manufacturers have little incentive to spend money on a recall and the vulnerability continues to spread in the criminal community.

Publishing the vulnerability also allows other white hats to propose a possible work around that owners could implement before dealers have a permanent fix, e.g. physically removing part of the management interface from the vehicle, or just to know not to park such vehicles in high crime areas in unsecured parking lots because the car could be more easily stolen.

Whatever. My car (which is definitely not high end) has a key fob which has been known exploitable for years, and Toyota have done absolutely nothing at all in that time to recall, help or even inform me. Manufacturers don't give a damn. It's time they took this seriously.

Why do you think VW would do anything when you admit your own car manufacturer hasn't done anything, despite that information being out for years?

Reply on news.ycombinator.com