I could care less about cars, but this thing has hacked glucose pumps and led to a St Jude's pacemaker recall, so fuck em. People can have their toys back after manufacturers of literally everything are better regulated. Until then, it's a weapon.
I'm not here to present my thesis, and even if I were then proving something doesn't exist would be a stupid waste of time as absence of evidence is not itself evidence. I've already presented multiple specific breaches caused after the availability of Flipper Zero. You have Zero legs to stand on in this argument.
I figure half the purpose of these sorts of devices is to prove just how insecure certain systems are to bring about change. Governments rarely have a good grasp on this sort of thing though. It's not like banning the device will make anyone more secure.
While this is seems a bit incompetent, it is easier for them to make technology less available than to fix the underlying issues here. They might set out to do both, but solving the underlying issues will take more time.
At least they're trying to do the right thing, and they're making an effort to deal with a problem that affects real people. Good on them.
This is like banning usb cables so Hyundai/Kia cars won’t be stolen, instead of forcing the car manufacturer to just install an actual immobilizer on affected vehicles. Seeing Hyundai/Kia do everything but install immobilizers is infuriating as well. They’re rolling out software updates, giving out wheel locks, installing cages on the ignition panel, etc. Literally everything but fix the problem.
If USB cables were used almost exclusively for illegal and just generally anti social behavior.
I'd never heard of this thing, and it does sound fun, but this was the use case list from the paragraph calling it a "humble hobbyist device" doesn't come across as very defensible:
People can use them to change the channels of a TV at a bar covertly, clone simple hotel key cards, read the RFID chip implanted in pets, open and close some garage doors, and, until Apple issued a patch, send iPhones into a never-ending DoS loop.
But also agreed on fuck those car companies that just don't care and would rather weaponize the government than try to fix anything (without a subscription fee of course). Anti social behavior forced Kia to change their shitty grift of a product so 🤷
exclusively for illegal and just generally anti social behavior.
Except they aren’t. These devices are used for various non-illegal purposes and are actually helpful for pentesters so we can learn about potential vulnerabilities on wireless systems before they can be exploited by bad actors. The same way a usb cable is useful for transferring data and at the same time can be used for illegal stuff (like literally any hack where you connect to a device via usb). The worst part (and the article mentions it), is that it doesn’t even work on security systems on cars built since the 90’s. So they’re banning something that isn’t even a problem in the first place.
I totally get and agree this is a dumbfuck response to the problem they allege to be fixing, and hopefully their committee it whatever concludes the same, but the article didn't mention any redeeming values for the device as you did
but the article didn't mention any redeeming values for the device as you did
This means the writer has a bias of negativity towards the device and now you are arguing that's it's a good thing it is being banned.
You would vote to ban dihydrogen monoxide if you found it has been consumed by every murderer in existence and also has been found at every school shooting too
It won't stop theives from being able to obtain them. And it's a legit tool, should we ban all usb because they can be used to steal Hyundai and Kia cars?
It's obvious there are flaws to car manufacturers theft protection. Shit watch LPL, lock noob, Bosnian Bill (hope you're doing well brother) and you will see most locks are a fucking joke.
There are Defcon vids on YouTube that go over how cars can be hacked yet manufacturers are still using these systems
This device is probably not what a professional car thief would use. It may be used sometimes by someone messing around, but it's a tool made for an introduction into different types of penetration (testing). It doesn't do anything as well as a more dedicated device would, and it's also not as customizable. If a car is vulnerable to this then it's vulnerable to a lot more things. Also, if someone really wants to steal your car they don't need this device specifically.
More like hide the problem so no one knows about it. This is the entire locksmith ideology, security through obscurity and that has been working out great hasn't it?
I don't have any faith in our incompetent government to do anything right if it costs corporations money.
Pick an issue. Literally any issue. Canada isn't on the morally right side (with the exception of supporting Ukraine's war for freedom).
People are fine. Landscape is amazing. Government at all levels needs to be gone. We'd be better off with actual criminal mobs running everything. They'd at least be competent
It's a multi faceted blame. Yes, you blame the hardware that's helped used to commit the crime, then you blame the people using it to commit the crime, then you blame the people still allowing it to be done. Look at America for example. People use guns to kill children in schools. Then you blame the person for committing the crime, then you blame the politicians who refuse to make it harder to get a gun
The problem is where does the line end? I can use a Mason jar, metal bits, and some simple household chemicals to make a shrapnel bomb like they used in the Boston Bombing. Should we ban Mason jars? I can additionally buy a dozen consumer drones and then attach those shrapnel bombs and fly them into a crowd at eye level - making the Boston Bombing look tame in comparison.
Are we to ban drones? I can use basic household cleaners to make mustard gas, I can get cyanide from regular items, I can take my car and drive it into a group of children waiting for the bus.
If someone wants to commit a crime, they are going to find a way. There's a line where we have to look and say - the costs of living in a free society means that individuals have the capacity to commit crimes. If we get rid of the capacity to commit crimes entirely, we would have also necessarily gotten rid of the free society.
I don't get these arguments. These tools aren't weapons, and limiting legal access to pentesting tools will decrease corp's and individuals' ability to be proactive about security.
These devices can be manufactured relatively easily and making them illegal will essentially mean the only people doing security tests are criminals. Large tech companies, correctly, run bug bounties where independent security researchers can make income by reporting reproducible and exploitable bugs. The concept here is called offensive security and it's extremely important for building better and more secure platforms. This situation will never be improved by limiting legal access to useful testing tools.
The responsibility should be on automakers and other companies that have massively insecure products, not on open source developers who are making products for security researchers.
This is about more than just cars. Anything that uses RFID, NFC, etc, such as an employee badge or even contactless credit/debit card payments, are vulnerable to such an attack.
Regardless of whether it's open source hardware/technology, should we be authorising sales of such prebuilt devices for $170 which can allow the average Joe to break into an office or steal a car?
I'd argue that these devices are so cheap and so capable that it exposes the poor security that is rampant everywhere. Banning them wont stop similar devices from being made and used criminally. Instead this should be a wake up call to everyone about which forms of communication or authentication are largely ineffective.
did you read the article? the flipper can essentially "break into" next-to no cars produced after 1990
Should 'we' be 'authorizing sales' is an interesting choice of words imo also, nothing negative just saying it made me question who the "we" part really is, and if something being sold has thus been authorized by some all powerful body
That said, this is the argument that gun-owning cowards use, so does it fall under the "How do we stop this happening, says only country in the world where this happens regularly" category?
You're talking about outlawing the equivalent of a lock picking set. This tool is used by legitimate security researchers and professional penetration testers all the time. Making this type of hardware less accessible only hurts.
So, rather than hold automakers accountable for not having proper and effective security practices you focus on a tool designed for security professionals.
This take is so unbelievably brain dead I'm surprised these people are able to breathe without machine assistance
Auto makers are really bad about it. CAN Injection has been a thing for a while now. Cars are going IoT, and a flipper will be the least of the vulnerabilities as things progress.
Flipper Zero Multi-tool Device for Geeks
Flipper Zero is a portable multi-tool for pentesters and geeks in a toy-like body. It loves hacking digital stuff, such as radio protocols, access control systems, hardware, and more. It's fully open-source and customizable, so you can extend it in whatever way you like.
Flipper Zero is a portable multi-tool for pentesters and geeks
multi-tool for pentesters
pentesters
Pentester or penetration tester is a cybersecurity professional that can be located on red team (offence) or blue team (defence) and works to determine potential vectors for attack that need to be rectified or exploited, depending on who they're working for and what their goals are for their employer.
Just because what you consider immoral or moral individuals use it doesn't change the inherent nature of the tool to be used for specific circumstances. You'll also notice I didn't put any deterministic language when describing a penetration tester, because regardless of what side of the law they're on they're still cybersecurity professionals, it's just that one side happens to pay better.
A knife can be used to dissect as well as it can be used to mutilate or even vivisect. How a tool is used is determined by the user not the creator.
Complaining that a few people use the item for nefarious purposes when the majority of problematic cases are issues at the developer level for the items being affected (i.e. vehicles) is extremely short sighted. Are you going to restrict all PC's because they can be used for network intrusion?
Are you going to limit access to the internet because the freely available information can teach anyone to create a dirty bomb?
The premise of your outlook is inherently erroneous in my opinion.
I'm not talking about the uses for the tool, I'm talking about how you used the company's own website as a point of reference for the tool's capabilities. They have a profit motive so of course they're not going to advertise unsavory uses for their product, just like your knife companies aren't going to advertise that their product can be used for mutilation.
The irony of you saying I am the one being pedantic is seriously hilarious.
You should probably work on your reading comprehension and critical thinking skills.
The entire premise of your argument is 'only criminals use this tool' or 'the majority of users of this tool are criminals' when that is fundamentally and objectively incorrect.
You clearly lack any serious experience in computer science, let alone cybersecurity, and it shows.
I would have expected an OTP type code to unlock a car... Considering how expensive cars are, this is really cheap to implement. Heck, I could buy a yubikey for €25, and I'm sure if a big company wants to buy a million of them, they can do it for a fraction of that cost... A brand new car costs tens of thousands..., it should've been a no brainer to include better security.
I believe you, this world is so weird... For companies that make tens of billions in profit, saving a million dollars on chips is almost a rounding error compared to the benefit to their reputation when their cars are more secure.
Ever since I first met the insanity that are business indicator numbers, I lost my believe in humanity. People knowingly hurt their companies effectiveness and prosperity just to improve those numbers. And they get rewarded for it.
The whole "these can be used for high scale crimes" argument is straight up fearmongering. One or two people have reverse engineered the remote protocol on one or two specific models of Volkswagen car, and, after listening to the car being locked and unlocked several times using a laptop and $500 SDR, can reconstruct a signal to unlock the car. When a cybersecurity professional figures out this is possible at all, it makes the news.
If your car can get broken into by any random script kiddie with a Flipper Zero, sue the car company for gross negligence.
I can buy lockpicks, slimjims, and all sorts of other locksmith tools made specifically to gain access to cars quickly and easily. And I could have been doing so for way, way longer than the Flipper has existed.
It seems like maybe the problem is that automakers were able to widely market vehicles that use wireless protocols that are relatively easy targets for attack. This was never properly secure.
Automakers should absolutely be held to higher standards (in general) than they are, and it's not likely that banning specific devices is going to have any measurable outcome here. It's pretty well known that people buy and sell malware, and people can just... make devices similar to a Flipper with cheaply and readily available hardware.
This is just dumb posturing to avoid holding automakers and tech companies accountable for yet another dumb, poorly thought out, design feature.
And obviously it doesn't stop at cars. It seems pretty clear that snooping on any feature using RFID or NFC tech is only going to become more widespread. Novel idea: what about using... actual keys as the primary method of granting physical access? Lock picking is obviously possible but a properly laid out disc-detainer lock is pretty goddamn hard to bypass even with the proper tools, and that skill can't just be acquired in the same way as with electronic methods of bypass.
I've never understood the way modern cars just unlock without any button press, that seems really insecure. Some organized thieves probably aren't even bothering with lock-picking and ignition hot-wiring these days as older cars would be low value to them. Oh and if a random crackhead really wanted something in the car they would probably just smash the window or pry the door anyway.
A solution would be a 24 hour lockout timer to program new keys. That would prevent mall jackings and be a small incovenience for repair shops to need to keep cars in the garage overnight.
I call it virtue signaling. It's the same idea, just a clearer term for it.
Do those mythical organized thieves really exist? I think 80+% of crimes are crimes of opportunity done by vulnerable people like crackheads, mentally ill, or other low income people.
Well you can address drug addiction and vulnerability to an extent but this is about autotheft? What do drug addicts or vulnerable low income people need 6497 stolen cars for? Those will probably be caught relatively easily anyway if they just drive in the area.
The thing is that they ship these cars overseas as quick as possible and for big money and nearly impossible to recover. You can't do that as some lone Joe looking for your next blow, it's a profitable criminal enterprise with multiple people taking part, to steal the cars, schmooze through the paperwork, get the cars in containers to ship, then receive payment at the other end.
Crimes of opportunity are not need based, they are want based. People take something because they want it and are unconcerned with the potential consequences of taking it. Even the cop quoted in your linked article admitted that 'Cars stolen for the purpose of committing another crime are not what's behind the majority of thefts. '
Nah, flip that around. What's a random crackhead going to do with a stolen car? Vs an already-organized and knowledgeable business like a towing company who wants to add a lucrative side gig. That's who's doing catalytic converter theft, too.
Then what's the manufacturer's excuse for not having them on current models? It would prevent the "one and done" type of attacks, there's at least a chance that any setup gets caught on camera before the car is stolen later?
Ford still does have program timeout, like I said some cars have had it some haven't and I can't and moreover won't try to explain anyone else's feelings.
Cars that unlock without pressing anything or by pressing a button on the door look for the key that is bound to them. It is secure in that only a key programmed to the car can tell the car it is ok to unlock. They keys are authenticated with a rolling code that is synced between a car and key when the key is programmed to the car. Thieves clone the key's signal and then the car has no idea that the fake key is not the real key.
You can't hotwire a modern car. On a modern pushbutton ignition car the starting function is allowed through a security module that makes sure the key is there before starting. Pushing the button only asks permission to start the car and then the module is the one that tells the car to start.
Lock-picking a modern car can be done, but it is far easier to use a wedge and inflatable air bag to pry the door open enough to use a hooked tool to open the door from the inside. Nobody picks automotive locks anymore, a lot of the door locks can be ripped out and bypassed anyways. You can of course just break the glass, but it may sound an alarm. The F150 has a massive theft issue Ford won't bother to address, the alarm can be disabled from outside the car using no tools whatsoever.
Once a thief has access to the inside of the car, they can program a new fake key using specialized software which is usually dealer level software but it can be done using 3rd party software. You can't just ban all non-dealers from having the capability to reprogram keys, that is user-repair hostile and would mean you have to pay whatever the dealer wants to replace a lost or damaged key. Not to mention that thieves will still find a way to access dealer tools and keep on stealing anyways.
A lockout period wouldn't accomplish anything, the original key still gets cloned and can be used to drive the car away. Once the stolen car is taken, the thieves have all the time they want to reprogram a key.
Enhancing security measures by using a more secure key authentication method will only go so far as to preventing theft and will add considerable costs to cars and key replacement. Thieves will catch up to any means of securing cars. A better solution is to improve economic prospects and enforce the current laws effectively to remove incentive to steal cars.
Your points are all valid and I agree with your suggestions. I still think every hour of delay is important to try to track down the car before it gets out of the country...
So compare an easy to steal car with a keyed ignition, with a modern push to start car. I don't drive now but I used to drive the former. It wouldn't sell for much in a used market or criminal market. Being stolen for use in a crime it may be more useful on the other hand. I don't know if thieves looking for easy marks would go for that car over one with more modern tech...
Auto theft for sale in a foreign market or domestic is uncommon and mostly dealing with valuable or rare cars and typically happens within a gas tank of a international boarder. More common is for breaking down and selling parts, but that is still not that typical. Most auto theft is for personal use and to commit crime. The breakdown of types of thefts changes with area, so in America personal use or crime is more common than Europe where chopping or foreign sale is more common.
Most turn-key ignition cars can't be hotwired either, they have immobilizers that require a security chip authentication within the key. Most of the cars that can be hotwired are from before 2005, after that they get rarer. If it has an all metal key, those definitely can be hotwired.
When it comes to tracking, by the time the car is located it is done being used. Most cars do not have any form of tracking that is accessible to law enforcement with cooperation from manufacturers. Modern cars with tracking can have their GPS or cell network disabled by pulling the right fuse with no impact on the drivability of the car. Aftermarket trackers are harder to disable if they are installed correctly and can lead to a faster recovery if the police move fast enough. Once the car is taken and the GPS fuse is pulled, they can keep the car indefinitely without fear of getting caught via tracking. If an aftermarket tracker is used, they just need to have the car in a place that will block the signal for long enough to disable it and then move the car again fast enough. Cops move slow, you can tell the cops where it is right now and they may not attempt recovery for hours.
Since the majority of auto theft is just looking for a car to ditch, in America, the easier to steal the better and it doesn't matter what the car is. F150s and Kia/Hyundai are the most popular now because they are easy to steal and common as dirt but grabbing a 2022 Honda that is left running or grabbing the keys from a driver are popular options.
First blame the thief. But then in the same breath blame the manufacturers that refuse to sell cars with meaningfully working locks. If you understand the tech many car companies keep selling cars that have locks that are about as secure as a zip tie.
I remember one of my seniors at work asking me how open source software manages to develop so much without a direct monetary incentive.
"There’s no lack of resources to give everyone everything they want." <- is the point.
Our civilisation has enough people who like coding, willing to put their spare time into OSS, to be able to get good quality tools for use in all fields.
Now all we need is for all of those people to be given enough spare time without having to worry about things like mortgages, loan payments and basic survival in some cases and everyone can profit (including the companies who would be giving them the spare time).
Oh right, forgot about this little thing. Had my eye it long time ago, but forgot about it. Thanks for reminding me Canada. Should probably read up on Streisand effect.
