Flaw in Kia’s web portal let researchers track, hack cars
Flaw in Kia’s web portal let researchers track, hack cars
Bug let researchers track millions of cars, unlock doors, and start engines at will.
internet connection is not a thing a car should even have
They can bring some nice benefits like remote starting in cold (or hot) climates, but there needs to be much better design to minimize the exploitability of these systems.
It's not a thing a car should require, and even for nice-to-have value-add features, it should be tightly secured, not only from external access but from the manufacturer.
The comical part was that anyone could go through a completely vanilla registration workflow and become a registered dealer. What the hell were they thinking?
I was gonna say they still need the fob for the car to actually drive it, but saw it mentioned in the article. I don't have a Kia (used to, but traded it in because of the immobilizer shit), but my car right now has an app to remote-start, but the car itself won't let you drive it if you don't have the fob on you while sitting in the driver's seat.
The group’s web-based Kia hacking technique doesn’t give a hacker access to driving systems like steering or brakes, nor does it overcome the so-called immobilizer that prevents a car from being driven away, even if its ignition is started. It could, however, have been combined with immobilizer-defeating techniques popular among car thieves or used to steal lower-end cars that don't have immobilizers.
But yes, that's just bad security.
It's still mindboggling that Kia sells any cars without immobilizers.
I get they're cheap cars and the way they're cheap is to skimp on everything but uh, maybe that's not the right place to skimp?
2FA where one of the factors is Bluetooth to the fob might be OK, assuming the Bluetooth link is secured in some way.