White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
I'm assuming he means AWD.
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
4WD vehicles are often part-time 4WD, meaning they can be switched between 4WD and RWD or FWD.
AWD vehicles are full-time AWD because part-time AWD is unnecessary given that the drivetrain delivers power where it's most needed.
The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype. That means the extra wheels cannot be triggered seamlessly. A 4FW has distinct driving modes whereas an AWD uses clutches to bounce between modes as needed.
Bluey has a couple lines about this distinction. In Australia, even small children have opinions on 4WD v AWD.
AIUI, you lose energy because the power/torque has to go through an extra differential, transfer case, etc, before reaching the rear wheels.
Going from the engine through the transmission to the front wheels is already a 'fixed cost', but the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay if you don't need to.
True for a FWD v RWD car decisions, but in an AWD are not the rear differential and driveshaft still turning whenever the rear wheels are turning? Even the clutch packs should still be rotating even if disengaged. The fact that there is no power through them doesn't mean they aren't generating losses.
It sounds like the savings are more in construction costs than fuel savings.
https://en.wikipedia.org/wiki/Six-wheel_drive
So nwheels x n driven wheels.
AWD - clutch packs. Best for nasty conditions on road, IMHO.
I'm guessing that maybe a distinction between offroad capable cars and non-capable cars is useful for liability reasons. Or something else.
Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.
Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.
Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage as power is always going to all wheels.
4WD is a permanent thing, or at least always on when you engage it. The system locks all the wheels to the same spin speed.
4WD is for off-road use. All tires rotate at the same speed.
What does this mean?
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Evil.
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Somebody make this happen.
I read comments that this may still not be ideal, as when you take it a dealer service (especially during the warranty period), all the collected data is cached locally and may eventually get uploaded to the proverbial mothership at that time. If you can/could tell it to stop collecting generally, then there's nothing to upload, antenna or not.
Not sure how valid this thinking is, but it is worth considering as a 'threat model'.
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
[1] https://en.wikipedia.org/wiki/Vehicle_inspection_in_the_Unit...
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
You realise that in the EU cars have a SIM in, and an emergency button? This is since 2018, see: 112 eCall regulation.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
1. Enough computer control for reasonable efficiency
2. Largely independent computers
3. No centralized infotainment that controls the entire car (you can swap the radio)
4. Still lots of knobs and dials, no touchscreens
5. Enough computers to get pretty good diagnostics if/when something goes wrong
6. Most of them have lock clickers, maybe trunk, almost nothing else
7. Engines are older, built "heavily" and don't suffer from too much boost / high bearing load
I think the last one is a big one that the closer a car gets to say 2020ish the more you really have to look at how it was built to know what you're getting. It's great to have a two-stage oil pump to reduce pumping losses when an engine doesn't REALLY need 60psi of oil pressure at all times. But GM 6.2L V8s are grenading all over the place to save less than 1mpg and over 100kmi at say 18mpg vs 17mpg that's 5555 gallons of gas vs 5882 gallons or 350 gallons. Even at $5/gallon that's only $1750 in gas vs $10-$20k for a new engine and I can't imagine it's net-reduced emissions as there's absolutely a bunch of emissions encapsulated in that at least $10k price. This is just one example.
BTW I'm not advocating for any policy or that anyone should be forced to do anything. I'm just personally more excited about keeping older (fuel injected, computer controlled, efficient) cars running well than I am about spending a bunch of money on a new car that's got a lot of engine "innovation" in it where all the kinks haven't been worked out yet.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
>Android from Firefox 137 using hardware only.
https://developer.mozilla.org/en-US/docs/Web/Media/Guides/Fo...
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
Surprisingly, in my experience h264 produces higher quality (better VMAF) for the same bitrate.
My theory is all the codec-optimisation attention went to h264 because of the crazy licensing situation of h265
You probably used the wrong settings. Netflix said "AV1 streaming sessions achieve VMAF scores that are 4.3 points higher than AVC and 0.9 points higher than HEVC sessions" 9 months ago: https://netflixtechblog.com/av1-now-powering-30-of-netflix-s...
It's a one minute video, would it have been so hard to redo it.
Edit: raining downvotes, well fuck me, I guess you all prefer sloppy shit.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Did it have an alarm system?
No wonder the ratbag kids these days are running around with them - they're only like $400 on Aliexpress and Temu. The world of "all keys lost" shenanigans is a wild one. There's cat-and-mouse games between Autel and automakers and users trying to "block" certain regions and users from leveraging the all-keys-lost features to try to cut down on auto theft, but where there's a will, there's a way, and Autel's just running a shitty Android app on an Android 8 tablet...
Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.
I don't see any indication here that's the case - opening the doors is very different than being able to start the engine and drive off.
At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.
Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.
If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this
Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.
One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.
In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.
Brown said everyone needed a better stereo in the 1990s. Factory radios were lousy. But the aftermarket stereos that people bought to replace the factory-issued ones could easily transfer from one car to the next. For example, if thieves steal the factory stereo from a Volkswagen Jetta, they're going to need a buyer with a Volkswagen Jetta, and all a thief can offer is the stereo the owner had to begin with.
Factory stereos got good (and complicated). Aftermarkets got cheap.
I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.
I'm not so sure about that - I used to have some fancy cars in the past and I've heard many stories from people saying they've been followed to car parks, home, or had only the keys stolen from their home and nothing else - fancy high end cars are almost always stolen "on order" and not by opportunistic thieves. These are the kinds of people who will research what is needed to take your car before they come to your home.
The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.
"tesla relay attack"
[0] https://www.wired.com/story/tesla-ultra-wideband-radio-relay...
Read that part.
Or an amateur with a mallet, a key blank, a file, and an o-ring.
Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.
I've heard so many horror stories starting like this.
That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.
I highly doubt that modern car ignition locks are not also just sending a start signal via the CANBus. If they had a physical wire to trigger engine start it seems like that would make hotwiring the car easier, since I believe that is how older cars worked?
I do understand that selling your customers' data is lucrative, but of all the car makers, not a single one thinks there's a market for an alternative?!! I don't understand.
I'm also slightly worried about HN's "solution": buy cars old enough not to be enshittified. Sure, I get the instinct, but there's a limit on how long that'll work. Much better would be to be politically engaged and work for a better future where this shit is illegal.
A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.
[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...
If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.
[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...
The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.
Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.
In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
Is it so hard to just offer said hackers a boatload of cash to switch sides?
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).
I really like using my phone as my key for my car. It's nice having less stuff in my pockets.
Remote start is huge where I live. When it's -10C and there's a foot of snow you have to dig out in the morning, you can start your car from the app and then start shovelling. The alternative is a hokey pokey of shovelling yourself a path to the car, getting in, starting it, getting out, resuming shovelling. Not the end of the world but it's very nice. Even if there's no snow it's nice to get the cabin above freezing while you're eating breakfast without putting your boots on.
Mazda charges $10-15/month for their remote unlock/start app.
https://mymazda.com/MyMazda/mazdaConnectedServices.action
I’m not saying physical keys are not needed, but a nice digital solution is one of the things I really wish I had a Tesla. I wish the other car manufacturers would actually invest in good mobile experiences, they’re all such ass.
Or at least as a car owner, this is my risk assessment exercise output.
[1] Yeah, I just pulled this off my ass, don't think there are trustworthy stats either in one direction or the other.
good question. I don't know? There are three things I carry with me literally everywhere: phone, keys, and wallet. Any one of them missing in the morning means I have to hunt around the house to find them before I can leave for work. This would not change if I could unlock my car with my phone (I still need to be able to lock my front door and/or let myself in when I come home again, requiring keys)
That's not to say they make sense. The total amount I spent on having the locksmith let me back in to my apartment that year was significantly less than the cost of putting in a combination lock.
Unlike say etcd where three improves reliability to the best of the three, three locks would decrease reliability to the worst among them.
Modern cars already make it much more difficult to lock your keys in the car than in ye olden days.
And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff. It's not like that "did I lock it" check helps prevent a "someone smashed the window and grabbed something out of it" scenario anyway.
It's completely unnecessary.
Modern cars automatically lock themselves when they sense there are no keys nearby, nobody in the seats, and the doors are closed for x minutes.
Meanwhile, if I'm out in public and a bad update bricks my phone (or cell coverage is down?) I can no longer use my car. The idea that consumers would hope for more entrenchment into the phone ecosystem is absolutely baffling.
I do own a car. Keys in home are always in exact same spot. Phone can we literally anywhere, good I have smartwatch and I can trigger "locate my phone" that way.
I just don't get the idea of unlocking car though app via internet. Neither I get the "keyless entry" (meaning I do not even need to touch the key fob to unlock car) and "start button" (well if you place key in ignition switch then you will not lose it!)
The security drawback is not worth, fixing non-existing problem in the first place.
Misplacing the phone actually. Car keys are either in someone's pocket/bag (then you talk to whoever used the car last) or in a set place in my home. The phone might be wherever I used it last.
So, while I misplace my phone more often, I also find it with less difficulty.
And so can the police, and so can DHS, and so can ICE, and so can Google ad services, and so can the last 50 highest bidders, and so can ...
…And what about the many other things one misplaces about the house? For instance, Wireless mice, TV and various other remote controls, etc.
I just cannot understand why the tech crowd hasn't developed a much-needed Missing Objects protocol.
Think of this. When you lose an object you immediately go to a big button that's hidden and securely bolted down (so you can never lose it) then press it. Like your fob key and car, it activates all these easily-lost items and they start beeping madly so you can find them. Lose the mouse in the couch somewhere and the 'couch' starts beeping. Voilà, one found mouse.
It's crazy that a simple concept like this doesn't exist in practice.
Are there cars that let you drive them without the key?
My car allows me to unlock it with a phone from the other side of the planet. But to actually drive, it requires the key to be inside.
I'm not convinced it is even lazy to use a phone to unlock a car.
Also, there was something sticky with the door lock. If I used the key instead of the fob, sometimes the anti-theft system would not disarm and the only way I found to disarm it was to use the fob to turn that alarm off. Grrrr. Fobs lasted about 3 years and cost $100 to replace/reprogram.
My current car (a Miata) has a key only to unlock the door in the event of a dead battery. It has a pushbutton instead of the traditional ignition key, so the key is pretty useless outside of a dead battery.
All remote unlock is doing is adding an unnecessary insecure remote layer on top of that for convenience.
Not just necessary, but very necessary? I understand it's convenient, but I think you've overstated it a bit. You can always start your car and then go back in the house for a few.
They hook a lot of people now with the first couple years free, then spin around and go for a $150+ a year whammy. We gave up.
you can argue that the security tradeoff is not worth it, but claiming the demand is not there is just silly
> So you can be just a little bit more lazy
Which:
> i can either go back inside to get the keys, or just open the car from the app
I think qualifies, personally. Your house might be way bigger than mine though