Unlocking any car from X brand in most of the world

Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.

White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...

Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.

It seems ridiculous that there would be consumer demand to unlock a car from a phone in the first place. The tech crowd will just complain that it should be easier to do a better job securing web services. But what is the point of all this infrastructure and complexity? So you can be just a little bit more lazy. This sort of tech is both a vulnerability and a waste of human resources and ingenuity.

These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.

You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.

Evil.

I'm always confounded by how bad most car security seems to be. I've given this about 5 seconds of thinking, and wouldn't it be pretty simple to do a local app-car setup step that generated a private key stored in the app and stored the public key in the car, requiring all commands to be signed with the private key in order to be accepted? There's no reason why the car manufacturers server should even be allowed to send commands to the car just based on a user account anyway.

“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.

The follow up/linked article at the bottom is worth a read too as it's the 'world-wide' part of it. Definitely a great read from both Sam and Shubs

https://samcurry.net/forgerock?ref=shubs.io

I think automaker failed security the moment its cars connected to the internet

The fact that cars can be controlled over the net at all is itself absurd. Especially in today’s cybersecurity scenario..

Toyota and its luxury brand, Lexus, use the ForgeRock Identity Platform (specifically OpenAM and OpenIDM) to manage customer identities and backend authentication for their connected car and telematics services.

Warning: The video in the article contains VERY loud bleeps.

I love a good old fashioned hacker story in the morning :)

Any guesses to what brand the two cars are in the garage? They look like Nissan.

Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.

This is a Rav4

I drive a 1999 Mitsubishi Eclipse GS-T Turbo ... sweet car.

Why GPT-5.6? Was this done before the release of GPT-6, or is there some difference in restrictions between the two?

I'm glad I bought a Corolla LE that does NOT have remote start. I still have to insert the key to start the engine. So much more secure.

For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.

> Reconstructing the requests, we found that a lot of these APIs needed no authentication beyond the hardcoded API keys sitting in the JavaScript bundle.

I've heard so many horror stories starting like this.

"there were no servlets (or resources) registered against paths that included the path traversal within them. [..] We were incredibly annoyed by this"

That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.

The byline says “security researcher”, but I didn’t find any mention of disclosure to the platform security team in the blog post. What gives?

Admin password/credentials compiled into a JavaScript SPA bundle, freely accesible to the internet. Twice. Classic rookie mistake.

Somebody’s going to get themselves hauled off to jail in a car from another manufacturer to make sure they’re locked on the way. Australia has zero tolerance for this.

All this talk about door locks makes me laugh. A door lock on a car can only ever be as secure a the window inches above it. No matter how high tech your lock, any idiot with a rock can get inside within seconds.

Car ignitions, actually starting a car a driving it away, are a totally different thing.

I knew it was going to be Toyota as soon as I saw the title, their software from top to bottom is a total clown show.

Can anybody guess what automaker?

And this, kids, is why we're not getting a "connected" car.

Is there literally no market for a single lineup of "non-bling" cars as far as IT goes? I haven't met a single person, even non-geeks, who like this shit. Ok, some might like a big screen for navigation. But they don't like the system powering it becoming obsolete 3 years later.

I do understand that selling your customers' data is lucrative, but of all the car makers, not a single one thinks there's a market for an alternative?!! I don't understand.

I'm also slightly worried about HN's "solution": buy cars old enough not to be enshittified. Sure, I get the instinct, but there's a limit on how long that'll work. Much better would be to be politically engaged and work for a better future where this shit is illegal.

Hyundai

Imagine what K.A.R.R could do with that.

It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.

IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.

I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.

[dead]

[flagged]

Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.

Ear raping beep in the video, why the fuck would anyone ever do this? Just mute the fucking part instead of whatever the fuck this is...