[HN Gopher] Hacking Subaru: Tracking and Controlling Cars via th...
___________________________________________________________________
Hacking Subaru: Tracking and Controlling Cars via the Starlink
Admin Panel
Author : ramimac
Score : 282 points
Date : 2025-01-23 12:22 UTC (10 hours ago)
(HTM) web link (samcurry.net)
(TXT) w3m dump (samcurry.net)
| like_any_other wrote:
| > After reporting the vulnerability, the affected system was
| patched within 24 hours and never exploited maliciously.
|
| So 'only' Subaru, Starlink, their business and advertising
| partners, and law enforcement, can remotely track (and disable -
| don't think you can run from the law!) your car?
|
| > I didn't realize this data was being collected, but it seemed
| that we had agreed to the STARLINK enrollment when we purchased
| it.
|
| Assuming it's possible to not agree to it - does that completely
| disable the system, or is everyone with a Subaru just one warrant
| away from getting locked in their car until the police can come
| to arrest them? Does the car still store (I'm charitably assuming
| it doesn't transmit) location data, so all your friends can
| retroactively be identified and arrested as well, even if you
| never agreed to any tracking?
|
| (To get ahead of the usual retort - haha yes, phones also track
| this data, therefore let's not fix any problems unless we can fix
| all of them at the same time. But actually let's use the other
| problems as an excuse to do nothing.)
| aftbit wrote:
| I was lucky to have the DCM in my 2019 Outback (which is
| responsible for cellular communication and thus this whole
| STARLINK thing) replaced with a bypass box under the warranty
| program related to the end of 3G service. My car was trying to
| go online 30 times an hour or something like that, draining the
| battery enough that it needed to be replaced after just 4
| years. They don't have enough new DCMs so they were willing to
| replace it with a bypass box instead, which seems even better
| to me.
|
| So at least my Subaru cannot connect to the cloud anymore. I'm
| sure it still stores location and telemetry data for insurance
| fraud reasons though.
| bongodongobob wrote:
| That's avg time to replace a battery.
| aftbit wrote:
| Hmm really? My Camry made it nearly 10 years, and my Civic
| still had a good battery 6 years in when I sold it.
|
| Regardless, the battery and DCM were both tested by Subaru.
| The battery tested bad, and the DCM tested for a high
| parasitic draw. I drove the car daily, and the battery
| would die if I didn't drive it for 4 days. I didn't just
| make this up either, search "DCM parasitic draw" on Google
| for more. Subaru even sent me a letter outlining my options
| for repairs.
| tedmielczarek wrote:
| I've heard about this being a known issue with cars from
| other manufacturers, so I can believe it. It's
| interesting that nobody thought to include a way to let
| the vehicle know it should stop trying to communicate to
| handle a potential end-of-service situation like this.
| It's fairly common for people to keep cars for more than
| a decade, they're a really expensive necessity for many.
| bongodongobob wrote:
| Maybe I'm used to harsher weather in the Midwest.
| anotherhue wrote:
| That's a known issue. Reports all over the subaru forums.
|
| I tried to measure it myself with my little multimeter
| and now I don't have a working multimeter.
|
| One suggestion I tried that seemed to work was to not
| keep the key close to the car, since that'd not
| physically possible for me I wrap it in an ESD bag.
| Haven't had much issue since, but no promises.
| vel0city wrote:
| Lots of places will say an average car battery's life is
| somewhere around 3-5 years. It is highly dependent on
| weather. Here where there are regularly long spans of
| 100F+ days, a battery will have done pretty good to make
| it five years; many die in 3-4. Same in very cold
| climates. If you're in a place with good weather all the
| time they'll last considerably longer.
| thejazzman wrote:
| or maybe even more importantly, a garage
| MisterTea wrote:
| Depends on the battery and how it was (ab)used. I have
| seen batteries last only 3 years or as long as 7.
| dylan604 wrote:
| > So at least my Subaru cannot connect to the cloud anymore.
|
| Sounds like something you can use to justify a higher selling
| price when the time comes
| downrightmike wrote:
| especially those that the insurers are 10x the bill on for
| previous driving data collection
| mmmlinux wrote:
| FWIW i never replaced the 3g box in my 2018 subaru, and never
| have a battery drain issue. the battery did fail about 4
| years in to owning the car, but it was a cell failure not a
| drain issue.
| pfooti wrote:
| My Subaru, a 2018 outback, would be completely battery dead
| if I left it parked for more than a week or so. Happened
| once at the airport, after which I started carrying a
| battery pack car starter. The guy at the airport who have
| us a jump said it happened all the time with Subarus in
| long term parking.
| all2 wrote:
| To be fair, this happens on my 05 Outback.
| doubled112 wrote:
| This isn't all that uncommon in any vehicle.
| reginald78 wrote:
| My local mechanic said that there is a firmware update that
| supposedly fixes the radio drain last time I replaced the
| battery but I haven't looked into it. He primarily works on
| Subarus and it sounded like he'd seen that as a root cause
| of dead battery a lot.
| Melatonic wrote:
| Is that firmware update also just replacing the 3G SIM
| though with a 4G one? In that case it will just fix the
| issue of it not being able to contact the cloud servers.
|
| Also makes me wonder - what if someone has a subaru and
| lives out in a very remote area where there is no 3G or
| 4G service? Would that not have the same issue as the
| cell towers being deprecated for 3G? Seems like
| (specifically for Subaru owners) this might be a more
| common type of living situation than other car owners
| too!
| bdcravens wrote:
| I had a similar issue when I connected my electricity
| provider to my Kia EV6. Presumably it would turn on charging
| when the price was optimal, but they were pinging it for
| status so often that the car never went to sleep, and it
| drained the 12V. Funny enough, the dealership couldn't figure
| it out; I "fixed" it by changing my Kia credentials.
| Melatonic wrote:
| My 2017 hasnt had the battery issue yet (they said only some
| subarus are supposedly affected). How did you verify how
| often it was trying to go online?
|
| Now very curios in this bypass box as well - I heard just
| manually removing the 3G SIM (supposedly easy) can also maybe
| cause battery issues. If the "bypass box" alleviates all
| potential use of the system that is ideal long term!
| reaperducer wrote:
| _Assuming it 's possible to not agree to it_
|
| My new car came with something called "Google Built-In," which
| seems to be the bastard sibling of Google Car Play.
|
| During the set up, if you'd like to read the privacy policy,
| you must scan a QR code on your phone, which opens a web page
| that does not display on mobile devices.
|
| If you'd like to opt-out of anything, you have to create a
| Google account, then log the car into that Google account, then
| log into that Google account on your phone, then go hunting for
| the settings on both the car and in the Google account online.
| Good luck finding them all.
|
| Also, it is not possible to uninstall certain "essential"
| Google apps from the car. Apparently, YouTube is now an
| "essential" part of driving.
| rurp wrote:
| Yeesh, which care manufacturer is this from?
| reaperducer wrote:
| Volvo.
| onetokeoverthe wrote:
| The real owner of Volvo is Chinese automaker Geely. The
| company acquired the Swedish automaker from Ford in 2010
| for $1.8Bil.
|
| source.
|
| https://www.fool.com/investing/how-to-invest/stocks/who-
| owns...)
| reaperducer wrote:
| But at least they're made in South Carolina.
| speed_spread wrote:
| Only the EX90 it seems is made in SC, possibly just
| assembled from parts made in China. All other electric
| Volvos (including Polestar) are straight from China. Gas
| models and hybrids are still built in Europe but are
| being phased out.
| chupy wrote:
| Volvo EX40, fully electric is made in Belgium and it does
| not seem that it will be phased out soon.
| mattmaroon wrote:
| It's not the Starlink you're thinking of, that's Subaru's name
| for their in-car infotaimnent system and predates the SpaceX
| Starlink.
|
| So it's just Subaru.
|
| Also I doubt any ad partners can disable your car (outside of
| vulnerabilities like this). Subaru can but that's the case with
| most modern vehicles.
| jmward01 wrote:
| Any partner that pays enough $$$ can likely do whatever they
| want. That is obvious by the fact that a year of driving
| history is displayed. If they didn't want to sell the
| data/access then they wouldn't be collecting such a long
| history of it. This is evil. I will avoid being forced to
| give this information at every possible turn and the
| companies doing this, and hiding how much they collect,
| should all be shut down.
| Melatonic wrote:
| Its also possible they collect the data just to do it (and
| surely not to give in rare cases to law enforcement)
| mattmaroon wrote:
| That's absurd. Collecting and selling your data and
| allowing a third party to remotely lock your car are two
| very different things. I have no doubt car companies sell
| your data, I am extremely skeptical third parties can buy
| rights to control your car and if that ever happened, we'd
| all hear about it really fast.
| ChuckMcM wrote:
| Yeah, that was kind of my takeaway as well. Your car is not
| your car right? I mean ANYONE AT SUBARU can do this?
| parsimo2010 wrote:
| No, disagreeing does not completely disable anything, as you
| can call Subaru at any time and tell them that you want to
| subscribe, and they can enable Starlink remotely.
|
| I do not know exactly what is transmitted or stored when you do
| not have an active subscription, but you are one warrant away
| from having the police ordering Subaru to track your car. But
| they would probably try this with your cell provider before
| they try your car manufacturer.
| niij wrote:
| How do you disable this in a Subaru? Can you tell Subaru to turn
| it off or is there a low-effort way to disable it (fuse pull)?
| willis936 wrote:
| I can't speak for Subaru, but I did this on my Toyota last
| weekend (cell radio, not space radio). The fuse pull on Toyota
| DCM affected other systems (GPS, microphone). I got a hold of
| the service manual, identified the cell antenna cables, and
| simply unplugged them. Now "simply unplugging them" required
| ripping apart quite a few things and dealing with some
| annoyingly deep bolts, but it wasn't too terrible.
|
| Pulling the antenna cable is the right move.
|
| Fun fact on car GPS: it actually feeds back through carplay so
| your navigation gets worse without it. What I have yet to
| figure out is if the network connection is given to the car
| through carplay.
| stn8188 wrote:
| This is absolutely my biggest concern for when I inevitably
| am forced to replace our aging vehicles. The unfortunate
| reality of living in the Northeast is that it's near
| impossible to find decent (not rusted) older cars for sale.
| Sure, I'm within the 99.9999% of Americans who have nothing
| to hide, but that unequivocally does not justify the physical
| capability of remote monitoring or control.
| UniverseHacker wrote:
| Why not just take a weekend to fly to where used cars are
| unrusted, and drive one back?
|
| Also, there are quite a few well made older cars that are
| fully galvanized and don't rust. I know a few people in the
| Northeast still driving 1980s Volvo 740s, still unrusted
| after nearly 40 years of salty roads. 1987 and later had
| the best rustproofing. I believe many older Audis also are
| galvanized.
| potato3732842 wrote:
| The best galvanization was in the 80s when the OEMs were
| scrambling in the "surprise, lead just got banned" era
| (lead acts like an anode, think of it like a lesser
| version of a high zinc primer).
|
| That said, it's not the thick hot dip you see on I beams
| or on bolts at the hardware store and a modern car with
| modern coatings and attention to corrosion is still
| better.
|
| Of the three continents that produce a lot of cars the
| Europeans still take corrosion more seriously than anyone
| else.
| tedmielczarek wrote:
| Since Volvo was mentioned in the parent comment, did you
| know that if you buy a new Volvo you can get two free
| plane tickets to Gothenburg + one night's hotel stay to
| go pick it up at the Volvo factory? You can drive it
| around Europe for a while and then they will ship it back
| to the US for you. AFAIK it doesn't cost extra, it just
| adds some lead time as well as time waiting for your car
| to get to you after you fly home:
| https://www.volvocars.com/us/l/osd-tourist/
| zhengyi13 wrote:
| Our family did nearly exactly this when I was a child in
| the 80s, just subbing in Volkswagen and Dusseldorf IIRC.
| It was some months later when the car actually arrived on
| the west coast of the US, but my parents seemed to think
| it worthwhile.
| UniverseHacker wrote:
| Just as a warning- one needs to be willing to dish out
| the cash for one of these high end 80s European cars:
| they can sometimes cost hundreds of dollars. Really nice
| examples can cost more than their value by weight as
| scrap steel. And, although most are still going strong,
| it's possible some only have another 30-40 years of
| usable life left before needing major repairs, possibly
| even sooner if they have over a million miles already. A
| good running used engine or transmission for one can
| easily cost over $100- so one should also budget for that
| down the road as well.
|
| I just didn't want to get anyones hopes up on here,
| thinking they could easily afford one on a software
| engineer salary.
| Gormo wrote:
| > I'm within the 99.9999% of Americans who have nothing to
| hide
|
| Let's not encourage the "nothing to hide" arguments here --
| the reality is that almost _everyone_ has plenty to hide.
| UniverseHacker wrote:
| Does it actually never connect with the antenna disconnected?
| Most wireless receiving devices I've used will generally
| still work a bit with no antenna.
| connicpu wrote:
| In the case of starlink, it's completely useless without
| the phased array antenna because the signals are highly
| directional.
| aftbit wrote:
| Wrong Starlink. Subaru's is cellular based, not space.
| Meneth wrote:
| Subaru Starlink is not the same as SpaceX Starlink.
| connicpu wrote:
| Well that's highly confusing. I'm surprised there wasn't
| a trademark dispute.
| willis936 wrote:
| The screen shows a no signal symbol. I seriously doubt that
| a cell protocol could lock with just an exposed coax. The
| truly paranoid could stuff a piece of foil in the coax
| connector to short it to ground.
| numpad0 wrote:
| (note: Subaru trademark "STARLINK"(2012) predates and is
| unrelated to SpaceX trademark "Starlink"(2017))
| bityard wrote:
| Would you be willing to share the details of this either
| publicly or privately? (My email is in my profile.) I'm
| trying to do the exact same thing on my 2021 Highlander and
| have not been able to find any info. I found threads where
| people have asked how to do this on forums and reddit, but
| the responses are ALL along the lines of, "first, get a sheet
| of tinfoil, then shape it into a hat..." etc etc.
| aftbit wrote:
| It depends on the car, but yes, you can pull a fuse. The
| component is called the DCM. If you do that though, you'll lose
| the front speakers and the microphone, which are routed through
| the DCM to support STARLINK-based cellular calls (like OnStar).
| The better solution is to disassemble the dash and replace the
| DCM with a bypass box, or yoink the cellular antenna cables as
| others have said. That's a bit of work for sure. I was lucky to
| have it done by Subaru under warranty service, in response to
| the 3G cell shutdown causing the DCM to malfunction and drain
| the battery.
|
| Here's a chart of DCM fuse location by vehicle:
|
| https://www.subaruoutback.org/threads/dcm-fuse-location-2020...
| netsharc wrote:
| Hah, them being able to bypass the 2FA by commenting-out the
| line:
|
| $('#securityQuestionModal').modal('show');
|
| is... mind-boggingly stupid of whoever got the job to write that
| Starlink web-app.
|
| OTOH, the hacker hijacked a Starlink employee's account to get
| in, isn't that over the line in terms of "ethical
| hacking"/legality standpoint?
| Mountain_Skies wrote:
| Back when I used to do AppSec, these types of issues were
| extremely common. Software developers and their managers would
| argue endlessly about them not being real vulnerabilities,
| which meant I had to put together a proof of exploitability.
| And since these were interdepartmental fights, office politics
| get involved. Just one of the dozen or so reasons why I stopped
| doing AppSec and went back to development.
| _joel wrote:
| That seems like a culture issue rather than an appsec issue?
| preisschild wrote:
| Or not requiring ANYTHING to authenticate in your
| forgetPassword endpoint, but being able to set a new password
| directly instead of sending a randomly generated per email /
| send a one time token to reset the password yourself via email
| insane_dreamer wrote:
| This one was especially egregious.
| bean-weevil wrote:
| It may well be over the line, but it sounds like subaru is
| grateful for the report, so nothing will come of it. Definitely
| not a risk I would take.
| _joel wrote:
| Glad they had unit and integration tests to make sure that an
| unauthenticated user couldn't reset passwo... oh, wait...
| plagiarist wrote:
| I wish that keeping this much data was a liability. I want
| companies to be liable for damages in the millions of dollars if
| they share an entire year's worth of location data without
| express permission from the vehicle owner. HIPAA for "just" PII.
| inetknght wrote:
| > _I want companies to be liable for damages in the millions of
| dollars if they share an entire year 's worth of location data
| without express permission from the vehicle owner._
|
| Moreover, not just millions of dollars in aggregate, but
| millions of dollars per individual customer whose privacy was
| violated.
| TheJoeMan wrote:
| If I collected this much information about a single
| individual, I would go to jail for stalking. But with the
| wonders of technology, I can stalk "at scale"!
| neeeeeeal wrote:
| This is the way. What legitimate interest could Subaru have in
| maintaining this much data about their customers?
| genewitch wrote:
| The most charitable guess I can make is that they use it to
| improve their driver assist, lane keeping, pacing, and that
| sort of thing.
|
| location and g force and direction when the automated system
| shuts off and returns control to the driver, that sort of
| thing. I don't agree with it, but that would be my guess.
|
| I own a Subaru that does this, so I'm not happy about it, but
| what can I do?
|
| That's rhetorical.
| ndileas wrote:
| Unfortunately, selling it to repo men is a widely accepted
| practice.
| mschuster91 wrote:
| The same thing all car manufacturers are after... AI. And I'm
| not joking this time.
|
| Cars have become a commodity, especially since China made
| their first vehicles that didn't get outright banned in
| Europe for being too unsafe to be roadworthy, and even some
| nominally "entry level" cars have more horsepower under the
| hood than a 1990s 7-series BMW (138 kW). Strict requirements
| on emissions, fuel consumption and crash safety have all but
| eliminated differences in optics (the amount of shapes is
| finite). So the only thing left to differentiate other than
| build quality (where China is _rapidly_ catching up) is
| assistance systems... and there, AI is the hot craze, and AI
| only works when it has insane amounts of data to gobble up.
| TheCondor wrote:
| Are you new?
|
| That stuff is probably more valuable than many of us want to
| admit. There is the maybe more noble value: training data for
| maps, traffic analysis AI, engineering duty cycle data,
| things like that. Then there are the other uses, for example
| various surveys and studies are needed for new roads or
| signal changes, can this kind of data proxy for that? We
| would be talking about cutting millions of dollars out of
| some of these projects and months or even years off a
| timeline. Then the ad-tech, where do you put billboards and
| signage? Where do you build a shop? Probably other uses we
| aren't even thinking about.
| chatmasta wrote:
| For those who might not read the article, note that "Starlink" is
| not the SpaceX service. It's an internal name for a Subaru
| customer service web app.
| wolrah wrote:
| > It's an internal name for a Subaru customer service web app.
|
| It's actually the name of Subaru's connected infotainment
| system: https://www.subaru.com/vehicle-info/subaru-
| starlink.html
| yapyap wrote:
| Buying a car that is connected to the internet sounds horrific.
| jeroenhd wrote:
| You'll have a hard time avoiding it if you buy a new car:
| https://foundation.mozilla.org/en/privacynotincluded/categor...
| t0bia_s wrote:
| Don't buy a new one. Buy old one and remove all tracking
| devices if necessary.
| quesera wrote:
| Wow, thanks for that link! I've been wishing for something
| exactly like this.
|
| Mozilla Foundation's "Privacy Not Included" product review
| site
|
| https://foundation.mozilla.org/en/privacynotincluded/
| bilekas wrote:
| > I didn't realize this data was being collected, but it seemed
| that we had agreed to the STARLINK enrollment when we purchased
| it.
|
| This is mind blowing to me.. Number 1 why you need a car
| connected to the internet all the time ? And how you're not
| required to sign at least 10 forms to confirm you understand that
| ALL of your travel data will be recorded and distributed at will.
| jeroenhd wrote:
| > Number 1 why you need a car connected to the internet all the
| time
|
| To open the car with an app (programming against Bluetooth is
| harder than calling a web API), or honk the horn if you lost it
| in a large parking lot.
|
| > And how you're not required to sign at least 10 forms to
| confirm you understand that ALL of your travel data will be
| recorded and distributed at will.
|
| Legally speaking, I believe that depends on your local privacy
| laws. Practically speaking, car makers (and government
| agencies) love these features for troubleshooting and tech
| support, or for flagging crashes before any authorities or
| local press have time to arrive (think Tesla).
|
| Don't ask them about finding your stolen car, though. Then the
| data may suddenly not be available.
| bilekas wrote:
| > To open the car with an app (programming against Bluetooth
| is harder than calling a web API), or honk the horn if you
| lost it in a large parking lot
|
| I really hope this was sarcastic. How did we ever manage to
| find our cars before IoT cars ...
| rtkwe wrote:
| You can also do other stuff like start the climate controls
| so the car is comfortable before you reach it on hot or
| cold days.
| bilekas wrote:
| These things could certainly be convenient, de-icing
| while you're having breakfast etc but surely you don't
| need my location data recorded for those services ?
|
| Maybe if there was a list of options I could select from
| then I guess it's fine.
| dylan604 wrote:
| I could do that with a key fob well before connected cars
| were a thing. People just choose to ignore the most basic
| of information
| willis936 wrote:
| And car manufacturers are incentivized to remove such
| valuable and logical features. Enshittification abounds.
| wildzzz wrote:
| My Subaru supports remote start if you pay for the
| upgraded Starlink plan but if you want to do it from the
| keyfob, you have to buy some module and carry around an
| extra keyfob solely dedicated to remote start. It's a
| little ridiculous. They could have easily just made
| remote start something where you click and hold a button
| or whatever like any other car with that feature on the
| fob.
| nkurz wrote:
| I'm not sure which model you have, but I don't think
| that's true. I think instead it's that unless you pay for
| the remote start upgrade (which as you say includes the
| extra fob) you can't start your car using the normal
| keyfob. But if you have the upgrade, you can also use the
| keyfob if you are close enough. At least, that's how it
| works for our 2018 Outback.
|
| I think I've only used the dedicated remote start fob a
| couple times to test it, but I use the keyfob for remote
| starting frequently. If you want to try, here are some
| 3rd party instructions for which buttons to press to make
| it work: https://www.wheelsjoint.com/how-to-remote-start-
| subaru-outba...
| JumpCrisscross wrote:
| > _could do that with a key fob well before connected
| cars were a thing_
|
| I've started my Subaru in the lot at 6,500' from the top
| of the mountain at 10,500'. A fob isn't going to scream
| over that distance.
|
| (None of this requires tracking, however, much less
| storing a year's location off the car.)
| dylan604 wrote:
| That sounds like an awfully ridiculous thing to do
|
| Just because you can does not mean you should (or
| actually need to)
| reaperducer wrote:
| _You can also do other stuff like start the climate
| controls so the car is comfortable before you reach it on
| hot or cold days._
|
| Also a solved problem. This one since at least the
| 1970's. No internet required.
| rtkwe wrote:
| I'd only really heard of it as an aftermarket feature you
| had to mod onto the vehicle not as a base part of a
| package. At least not in the low market range you can get
| that feature now. Used EVs less than 30k come with that
| feature now.
| reginald78 wrote:
| I can't tell sometimes if people are trolling on HN or
| just young. Many so called great innovations I see are
| just stuff that was available decades ago but didn't
| involve ad tech predators.
|
| You can tell this stuff isn't that interesting to people
| otherwise they'd upcharge you for it instead of using it
| as a pathetic piece of bait for a trap.
| beezle wrote:
| Just as an aside - a friend had their car nicked in NYC this
| winter. He was able to tell the cops the car location from
| some Toyota find my car type thing. The cops said they saw
| nothing on the street so unless he could come and make the
| horn beep infront of a garage - and then get a warrant -
| there was nothing more to do.
|
| He now has a new vehicle.
| bilekas wrote:
| I'm starting to come around to the idea in general actually
| with all the comments promoting the benefits. I still don't
| see why travel locations need to be recorded though. A
| pining service would suffice if it was always connected.
| theonething wrote:
| Is your comment supporting the find my car feature or
| saying it was useless?
| selimthegrim wrote:
| This might say more about the NYPD than Toyota
| reaperducer wrote:
| _a friend had their car nicked in NYC this winter. He was
| able to tell the cops the car location from some Toyota
| find my car type thing. The cops said they saw nothing on
| the street so unless he could come and make the horn beep
| infront of a garage - and then get a warrant - there was
| nothing more to do._
|
| Here's the way it's done with Volvos (from the manual):
| If the vehicle has been stolen or otherwise used without
| permission, the vehicle's owner, police and Volvo
| Assistance can agree to track the vehicle.
| Note This applies even if the vehicle has been
| opened and stolen using the associated remote key.
| The following needs to be done: 1. Contact
| Volvo Assistance and say that you need help tracking the
| vehicle. Tracking begins. 2. File a police report.
| 3. Contact Volvo Assistance again and give them the police
| case number. 4. Volvo Assistance notifies the police
| of the vehicle's location.
| reaperducer wrote:
| _honk the horn if you lost it in a large parking lot._
|
| Solved problem since at least the late 1980's. No internet
| required.
| insane_dreamer wrote:
| Remote start, climate etc from the app all require and always
| on connection (how else?). Tesla has the same thing.
|
| I use the remote app often - quite useful.
| dylan604 wrote:
| Remote start does not require an app nor an always on
| connection. I was able to do this with a key fob in the early
| 00s
| redwall_hp wrote:
| Neither does climate control. If I remote start my Civic
| with its fob, it will heat or cool to the desired
| temperature I left it on. (And it will run the defroster if
| it's below a certain temperature outside.)
|
| Having to think about the climate control is an anti-
| feature in itself, when that's a basic thermostat
| feature...
| insane_dreamer wrote:
| I know how key fobs work, thank you.
|
| I mean the ability to control the car remotely without line
| of sight or being anywhere near it, such as turning on the
| climate to warm up the car while still in a building so
| it's not freezing cold when we get back to the car with the
| kids, or while the car is in the garage, locking the car
| remotely because you're blocks away and aren't 100% sure
| you locked it before you left, opening the windows slightly
| so the car doesn't overheat in hot weather (Subaru doesn't
| do this unfortunately, but the Tesla does). The one thing
| it doesn't do which I wish it did, is roll up the windows
| remotely.
| iforgot22 wrote:
| Maybe it's because I don't live in a cold climate, but
| I've never wanted to do this.
| dv_dt wrote:
| There was a recent HN posting on the US banning Chinese car
| brands from being connected to the internet.
| https://news.ycombinator.com/item?id=42706212
|
| If Chinese companies comply with the ban by providing car
| models without internet connectivity, it's hilarious to me that
| that the nationalist regulation could make Chinese branded
| vehicles more desirable from a security & privacy standpoint.
| reaperman wrote:
| The current 100% tariff on Chinese EV's will negate that
| advantage for American consumers.
| jmward01 wrote:
| In the short term. In the medium term it just means that
| when they finally do break in they will demolish the
| incumbent. This is exactly what happened with the US auto
| industry in the 80. Protecting an industry with tariffs and
| legislation often makes that industry lazy and slow to
| innovate and eventually just kills it because they have
| forgotten how to compete.
| n_plus_1_acc wrote:
| European eCall directive requires a sim card
| devinegan wrote:
| Because it has an SOS feature.
| afh1 wrote:
| All cars in Europe must be connected to the internet at all
| times by law, to determine their location, in case of an
| accident the law states.
|
| https://europa.eu/youreurope/citizens/travel/security-and-em...
|
| In the US a bill was passed requiring driver impairment
| equipment on all vehicles and automatic deactivation of the
| vehicle if the driver is determined to be impaired. Current
| impairment technology monitors head and eye movement and/or
| blood or breath.
|
| https://apnews.com/article/fact-checking-402773429497
| iforgot22 wrote:
| In general, a lot of things in cars are for the law rather
| than the owner. I'm not saying it's a bad thing, just is what
| it is. Emissions is the biggest one.
| hulium wrote:
| > All cars in Europe must be connected to the internet at all
| times by law, to determine their location
|
| The source you link very explicitly contradicts that:
|
| > Your eCall system is only activated if your vehicle is
| involved in a serious accident. The rest of the time the
| system remains inactive. This means that when you are simply
| driving your vehicle, no tracking (registering your car's
| position or monitoring your driving) or transmission of data
| takes place.
| KomoD wrote:
| (Also not in Europe but in the EU, there's a difference)
| mavdi wrote:
| Not surprised. I've had a few interactions with Subaru connected
| services dev team as an external contractor from another car
| company, everyone was everyone else's cousin, friend, homeboy
| from India. Nepotism was rampant, no one wanted to listen to
| advice, a strong culture of corporate antibodies had formed. I'm
| surprised they even got it to work at this level.
| duxup wrote:
| I love my Subaru as far as reliability, all wheel drive
| performance in snow and ice, and such.
|
| But OMG it's consumer tech was dated when I bough it, and it's
| just full of inexplicable issues and caveats and such. Even
| just the limitations and the UX issues are so obvious that it
| sends a message that if they tried to fix them they would
| introduce just as many new issues. I'm at the point where
| despite the car being good, I'm not interested in a new one
| from Subaru.
|
| I just want carplay or android auto whatever similar services a
| given mobile OS provides to do similar things. That's it, every
| time it's something else (even when offering car play) from a
| car maker it is so bad and so naively built that it makes me
| less confidant in that company.
|
| I know, they want my data and all and that's the motivation,
| but man it's just such a downer with every system.... and here
| I am with a good car in most respects and I'm not planning on
| buying from them again.
| ajsnigrutin wrote:
| yep...
|
| there was a tv ad for subaru vehicles a couple of years ago
| (not that long!), and during the ad, they showed the
| infotainment system, where the user pans the map on the
| navigation touchscreen, and the map moves at maybe 1fps! in
| an ad!
|
| I kinda wish they standardized the car interface for tablets
| (like android auto, but more features), where you could just
| buy a tablet and insert it in (like din slots for radio, but
| tablet-sized), and the car would expose some non-critical
| interfaces to the tablet (AC,...), and you could just buy a
| replacement tablet if needed. Cars are made to last 10, 15,
| even more years, while the computers/entertainment devices
| move a lot faster, and that includes the connectivity (many
| cars on the streets today were made before 4g, and 3g is
| mostly dead).
| monitorlizard wrote:
| This is a genuinely good idea for a business that I think
| you should explore further if you have the bandwidth.
| emeril wrote:
| i have such a subaru - the nav is a joke - the whole UX for
| their GUI is bad but the car seems mostly okay
|
| recently got a mazda - seems generally better though I
| think most car interfaces are crap
| oremolten wrote:
| unfortunately the entire global system is designed so that
| more has to be sold than last year. in the US as a publicly
| traded corporation you are legally liable to make more than
| the year before... we're lucky cars even last as long as
| they do now...
| blackeyeblitzar wrote:
| Subaru infotainment is also very controlling. Want to use the
| keypad while you're taking a phone call on the go? No, it
| won't let you if the car is moving. You'll need to use your
| phone's UI. Other CarPlay cars don't do this.
| js2 wrote:
| My 2017 Mazda with CarPlay does something similar. It
| truncates any lists (songs, podcast episodes, contacts,
| etc) that CarPlay displays to 10 items. All it does is
| incentivize folks to use their phone. It's incredibly
| annoying because the Mazda command dial for interacting
| with CarPlay is otherwise excellent and I don't think that
| limiting the list size does anything to reduce distraction.
| eptcyka wrote:
| It is an incentive to use Siri. You can't actually use
| carplay if Siri is disabled.
| blackeyeblitzar wrote:
| I find this restriction weird as well. I would like to
| not have my privacy violated by voice assistants. I just
| want the phone interface to be accessible through the car
| display and to be able to control it through a dial
| ideally.
| blackeyeblitzar wrote:
| I really like the dials some cars come with like BMWs.
| Subaru doesn't have any dials at all unfortunately - just
| a touchscreen with really bad quality. The interface also
| often has buttons with very small size that make it hard
| to operate.
| Melatonic wrote:
| My subaru has a fairly mediocre touchscreen and interface
| but almost all of the things I actually use are manual
| controls. I usually turn the touchscreen off first thing
| when I get in the car (two button presses). My phone
| connects automatically for music and I either control
| through the phone or via dials (like for volume) or
| buttons (like for climate)
| spelunker wrote:
| I have a car from another Japanese manufacturer (Mazda) -
| their connected services app is weird and clunky and was down
| twice this month. And I'm expected to pay $10/month for this
| thing after the first year! Cmon.
| numpad0 wrote:
| I suspect it has to do with slow adoption of CarPlay/Android
| Auto in Japan - everyone still options aftermarket
| infotainment at dealerships and happier about it than with
| phone-based experiences. From a random Google search
| result[1]: > More than three-fourths (79%)
| cite the built-in navigation system. However, this percentage
| has decreased from 81% in 2022 and 82% in 2021. Use of
| Android Auto/Apple CarPlay apps is increasingly the preferred
| system, with 7% of users citing this in 2023, compared with
| 5% in 2022 and 3% in 2021.
|
| That's like 80% CP/AA adoption by 2060.
|
| UI/UX and especially overall experience polish had always
| been a major challenge for Japanese engineering. Everything
| is committee designed in perpetual intra-company tug of war,
| and it shows as a "family sized mega pack" UI consists of
| bunch of snippet codes each with an attention grab dialog to
| prove its worth. That was clearly one of major causes that
| led to total collapse of domestic phone industry and iPhone
| dominance, but I suppose it hasn't affected car infotainment,
| or mass market cars in general.
|
| 1: https://japan.jdpower.com/sites/japan/files/file/2023-11/2
| 02...
| duxup wrote:
| >UI/UX and especially overall experience polish had always
| been a major challenge for Japanese engineering.
|
| I can believe it. The whole issue of "Japanese video game
| companies don't understand the internet" to some extent
| still feels like it is an issue at times.
|
| For a while it felt like we got late 1990s solutions in the
| mid 2010s... it's gotten better-ish in the land of video
| games, but man it's so bad at times still.
| scottbez1 wrote:
| Hmm this is really different than my experience with a 2018
| Crosstrek, so maybe things have changed? When I bought it,
| Subaru was among the earlier CarPlay/Android Auto adopters
| (we specifically ruled out a new model year Prius because it
| lacked it and we couldn't wait a year to replace our totaled
| car just for CarPlay/AA), and other than a very rare issue
| where the head unit screen doesn't turn on, it's been pretty
| rock solid with both phone OSes.
|
| Environmental controls are all physical hardware, CarPlay/AA
| is integrated well, etc; I can't really complain about any UX
| in the car.
|
| The only UX gripe I can think of is that Apple doesn't let
| you use natural touch inputs to pan/zoom a map (instead
| forcing you to tap to bring up on-screen d-pad, then keep
| tapping the tiny button targets while trying to keep an eye
| on the road), but that's entirely on Apple; Android Auto
| allows normal 2 finger pan/zoom, so it's not a Subaru
| problem.
| wildzzz wrote:
| I noticed that too with CarPlay. Trying to pan around in
| Waze is impossible but doing it in Android Auto is very
| easy. The one nice thing about CarPlay Waze is that it
| allows keyboard input, Android Auto (at least in my Subaru)
| only allows for speech to text when searching locations.
| Melatonic wrote:
| I purposesly bought the last Subaru without Carplay/Android
| Auto for this reason - I could upgrade my head unit but I
| like the slightly more oldschool one.
|
| The touchscreen is slow to respond and has few options and
| the only way to really connect a phone is bluetooth or 3.5mm
| . It really just does music and calls. However long term I
| was a lot more confident in phones supporting backwards
| compatiblity for bluetooth vs Subaru keeping carplay/android
| auto up to date - and I plan to keep this thing for a very
| long time
| ellisd wrote:
| Subaru's in-vehicle entertainment technology has long been
| criticized, even before features like CarPlay became
| standard. Take my 2012 WRX, for example--its Bluetooth
| reception was the worst I've ever experienced in a Bluetooth-
| equipped vehicle. Audio feeds would randomly pop and drop out
| during podcasts, even when the phone was within a two-foot
| radius of the deck.
|
| Over the years, I tried multiple iOS and Android phones, but
| nothing improved the situation. Ultimately, the only solution
| was a complete deck replacement. Now, I'm using a "Joying"
| Android head unit with a rip-off version of CarPlay, which
| has finally resolved these issues.
| ziddoap wrote:
| Is anyone aware of a list of affected models posted anywhere? All
| 2015+ models?
|
| Obviously the ability to pull up account history, previous
| owners, etc. is applicable to anyone with a Subaru.
|
| But I'm curious if location history shows up for people that have
| Subarus and never registered Starlink/never used the app. The
| author says:
|
| > _but it seemed that we had agreed to the STARLINK enrollment
| when we purchased it._
|
| But it's not clear to me whether "it" refers to purchasing
| Starlink or purchasing the vehicle.
| Cerium wrote:
| Purchasing the vehicle.
| godber wrote:
| This claims to bypass the telematics functionality:
|
| https://www.autoharnesshouse.com/69018.html
|
| > Note for customers retaining OEM headunit: This adapter can
| also be used for those wishing to remove/disable the OEM Subaru
| Telematics functions. This is done to eliminate the tracking
| cabability that Subaru has built into these vehicles. If this is
| you, we will need to add an additional part to this adapter to
| re-enable the bluetooth microphone. Please purchase the option 2
| adapter near the bottom of this page for this situation.
| godber wrote:
| The info on that page seems a bit contradictory, but maybe I
| need more coffee.
| bityard wrote:
| Is there anything like this for Toyota DCM?
|
| We bought a second-hand 2021 Highlander and thus did not sign
| any contract allowing our family to be tracked by Toyota. I
| went on a hunt recently for information on neutering the DCM
| but have thus far only found speculation and contradictory
| info.
| willis936 wrote:
| Yeah it's bad out there. Don't do what the yahoos hacking up
| their harnesses have done. The Toyota DCM I'm familiar with
| has 3 coax antenna lines coming in. The outer 2 are cell and
| the inner is GPS. Pull the cell antenna cables out of the DCM
| and you should be good to go. Best to hunt down your
| vehicle's service manual and verify the procedure first.
| LandoCalrissian wrote:
| Awesome, thank you. Seems pretty straight forward.
| t0bia_s wrote:
| Imagine that manufacturer can do that without any hacks and your
| knowledge about data collecting. Now imagine that you sell those
| cars to foreign countries that your government consider as enemy.
| I'm curious when there will be some ban of car brand, like
| TikTok.
| longtimelistnr wrote:
| Isn't this already in place? I thought this is exactly why
| Chinese EV's haven't flooded the market yet.
| reaperman wrote:
| That's likely more caused by the current 100% import tariff
| on Chinese EV's.
| TechDebtDevin wrote:
| Chinese cars cannot connect to the cloud in the USA.
| rjmunro wrote:
| > After reporting the vulnerability, the affected system was
| patched within 24 hours and _never exploited maliciously_.
|
| How did they verify the never exploited maliciously part?
|
| Did the person who's password they changed ever notice that their
| password didn't work any more and report the problem?
| arrowleaf wrote:
| Assuming `samwcurry@gmail.com` belongs to the same person who
| owns samcurry.net, they changed their own password.
| nkurz wrote:
| I don't think that's correct. See the section in the article
| "Enumerating Employee Emails" which finishes "The
| jdoe@subaru.com (redacted) email was valid! We went back to
| the reset password endpoint and hit send."
| high_na_euv wrote:
| What a shitshow!
| blackeyeblitzar wrote:
| A shocking thing about Subaru cars with Starlink (their
| infotainment system and connected service for things like remote
| start) is how deep the violation of privacy is. For example they
| share your location data with Sirius XM by default, unless you go
| deep in their menus to realize it's even happening and opt out.
| They bury the consent in fine print that you fly through at the
| dealership. Truly a despicable company.
| oremolten wrote:
| all car companies do this since around 2011.(in the us) they
| also immediately sell all this data to car insurance companies.
| many apps on your phone that use location data for anything are
| mostly using an APK that includes a couple car insurance
| companies code that also just directly shares that with them.
| (they made the location APK for app makers to have an easy to
| use location data tool)
| iforgot22 wrote:
| Also cell carriers collect and give out live location data on
| customers
| tadhgpearson wrote:
| I love the variety of tooling and joining the dots to complete
| this attack: dns + scanning + human factors research + html
| bypass on the admin site itself...
| panki27 wrote:
| This is even worse than the VW data leak reported around a month
| ago. [1]
|
| [1] https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-
| vo...
| naitgacem wrote:
| Did you perhaps forgot to edit and add the link? I'm interested
| in hearing about that
| TechDebtDevin wrote:
| I hope you speak German.
| jazzyjackson wrote:
| If you download the .mp4 you will notice it is 'deu-eng-
| fra', there is an English overdub available as a separate
| audio track.
| _huayra_ wrote:
| FYI for Subaru owners, you can opt out and have your data deleted
| anywhere in the US (not just California):
| https://www.subaru.com/support/consumer-privacy.html
|
| It'll take ~6 months or so, but they will send you a confirmation
| email.
| jcomis wrote:
| fwiw I have done this and received no confirmation or anything
| after more than 6 months. I keep submitting, maybe its working,
| but it doesnt seem to actually result in a confirmable change.
|
| for sure my retailer, which are 3rd parties according to that
| page, still has 100% access to the data, as they were able to
| tell my car was in another state when I called recently. seems
| pretty troubling
| nyokodo wrote:
| > I have done this and received no confirmation or anything
| after more than 6 months
|
| Sue them, make it a class action.
| gruez wrote:
| That's not how lawsuits work. You can't sue just because
| you don't like something. You have to prove harm. "not
| getting confirmation" hardly counts, especially if said
| confirmation isn't required by law.
| simonlc wrote:
| Question, if you can remote start a subaru with starlink, does
| that mean I could start my car from the command line during
| winter??? I don't pay for starlink, never really looked into it,
| but it sounds cheaper than installing a remote start system lol.
| ben7799 wrote:
| I have a 2013 Outback Limited that is basically right before all
| this stuff got really stupid and weird. It's a great car other
| than it's not very fast _and_ it gets really bad gas mileage.
| Amazing in the snow. I have had it since December 2012, so I 've
| had plenty of service visits where I got newer loaners. (I
| special ordered my car to basically load it but not have
| Starlink, not have the Sunroof, but have the leather seats and
| the HK upgraded stereo.)
|
| Every time I have gotten a newer Subaru as a loaner it strikes me
| that they are worse cars for all this new stuff. The user
| interface is horrible in the new ones. In a lot of cases they
| have a skeumorphic interface up on the touch screen that mimics
| the physical controls in my car! The actual physical controls are
| about 100x faster to operate and you quickly learn where the
| buttons are without looking.
|
| I had an Ascent Onyx loaner last summer.. the entire touch screen
| UI looked like it was barely operating above 10fps. Just gross.
| Lots of the UI is black and white as well, not even tasteful
| grayscale. The Onyx I had also had the upgraded HK stereo and
| that is not as good as the one in my car as well, it sounded
| noticeably worse.
|
| The electric steering on the new Subarus is terrible as well. My
| old Outback is not exactly a sports car but getting out of new
| one back into mine it feels like you're getting into a Porsche or
| something when you feel the hydraulic steering. Engine/Turbo lag
| on a lot of the new ones is gross as well.
|
| This is of course even worse! My car only has 120k miles on it, I
| plan to keep it for another 4 years and then maybe give it to my
| kid when he gets his license. Somehow I doubt Subaru will have a
| competitive vehicle by then. For me to consider another one
| they'd really need to have an EV Outback/Forester/Ascent or a
| Hybrid version that gets at least 40mpg. And they need to fix all
| this horrible infotainment stuff in a way that the car operates
| better than a kids toy and actually drives well like an older
| Subaru. Also they need to get off the whole stupid thing with
| giant rims. It's supposed to be a Subaru, it needs to have tires
| appropriate to going relatively fast on dirt roads.
| DwnVoteHoneyPot wrote:
| In addition to your comments, I think Subaru's all-wheel drive
| system has been switched to electrical instead of mechanical,
| making it worse. There are roller tests on youtube which show
| Subaru AWD being outperformed by Ford AWD systems.
| ben7799 wrote:
| They have different AWD systems in different vehicles and for
| some vehicles there is more than one system depending on
| which transmission you purchased. (At least when there was a
| choice)
|
| Mine is electrically controlled (and many Subarus are) but
| it's still connected full time. IME driving other
| electrically controlled non-full time systems what you feel
| in those are the electrically controlled clutch packs
| completely disconnect the rear wheels and the AWD is 100%
| disabled until the traction control system kicks in. Then you
| get a brief moment where the car feels out of control until
| the clutch activates the AWD. The tradeoff is that system
| that completely disconnects the rear wheels results in those
| vehicles (E.x. Honda/Toyota) getting much better fuel economy
| than Subarus as they operate as front-wheel drive almost all
| the time.
|
| I have never been in any Subaru that behaved that way. And a
| roller test is not where it matters anyway. Roller tests are
| contrived. Where you feel the difference between permanent
| AWD and part-time AWD is medium and high speed situations
| where the vehicle starts to lose control. Most people will
| never put any family crossover/SUV into a situation anywhere
| close to the roller tests or hill ascent tests.
|
| All of this seems to become completely meaningless with EVs
| being the future.
| olyjohn wrote:
| The CVT in combination with the terrible traction control
| also kills any chance you have of getting out of a stuck
| situation. Subaru's AWD system is now mostly just marketing.
| So it's basically on part with most AWD systems, because most
| of them really are a joke.
| ben7799 wrote:
| I'm curious which exact model/year you had and how you got
| stuck.
|
| I've never even gotten anywhere near close to getting stuck
| in 12 years.
|
| But I'm not a Subaru offroad enthusiast. It seems like lots
| of people really want to use a Subaru for situations where
| they should have gotten a mountain bike, dirt bike, ATV,
| etc..
| Melatonic wrote:
| I have a CVT in my 2017 H6 Outback and the traction control
| is very easy to turn off. Two buttons and both the traction
| and spin control is off and now it is just AWD with a
| limited slip differential in the back (feels pretty similar
| to my 2006 Outback H6 which had no electronic traction
| control). You can wheelspin all day if you want or feather
| the throttle or whatever - offroad driving has been amazing
| reginald78 wrote:
| We actually own two Outbacks, a 2011 and a 2019. Both my wife
| and I hate the touchscreen system in the 2019, it is full of
| irritating bugs and even the physical climate controls (which
| IIRC were going away for the 2020 model year) have horrible
| indicators of their status compared to the older one.
|
| I'd say the backup camera is a welcome addition for the newer
| one but if the roads are even remotely dirty the camera almost
| immediately becomes totally obscured rendering it useless,
| which around here occurs at least half the year.
|
| Combined with the battery drain issue I will probably not buy
| another one. At the most I'll give them a test drive to see if
| the control system has been returned to some semblance of
| sanity. Unfortunately all new cars seem to be privacy
| nightmares so I'm not sure how I'll avoid that.
| ben7799 wrote:
| The 2024/2025 Ascent is what I had as a loaner that had the
| skeumorphic UI on the screen that looked exactly like an
| older Subaru's physical climate control layout.
|
| It was a major WTF when I first saw it.
| 01100011 wrote:
| I have been stranded twice because of Subaru firmware bugs
| which they knew about and failed to notify me. First one was
| the battery charging bug(which still happens even with the
| firmware fix, just more slowly). The second was the fuel gauge
| bug. This is a 2017 Outback, my second and last Subaru I'll
| ever own.
|
| Regarding Starlink, there's actually a battery drain issue on
| older systems because the 3G modem fails to find a base station
| (because 3G is deprecated) and drains your battery doing
| retries. You can remove the Starlink module, but since the
| Bluetooth microphone and front speakers are routed through it,
| you'll lose that functionality unless you spend $80 for a
| dongle to restore them.
| sc68cal wrote:
| This really reinforces my aversion to internet connected cars.
| They used one to kill Michael Hastings.
| dantillberg wrote:
| Last year, I submitted a "right to know" request to Subaru, and
| they sent the following back. I've reformatted it for legibility.
| Basically asserts they'll do and sell whatever they want (except
| another car to me).
|
| > Subaru may collect the following personal information about a
| consumer:
|
| > Categories of personal information:
|
| > Identifiers: Consumer records, Commercial information, Internet
| or Other Electronic Network Activity, Audio recordings, Vehicle
| geolocation, Professional or employee-related information,
| Inferences, Sensitive personal information
|
| > Categories of sources from which the personal information is
| collected: Retailers, i.e. authorized Subaru dealerships ,
| Provided by consumer or vehicle, Third parties
|
| > Business or commercial purpose for which Subaru collects or
| sells personal information: To provide services to the consumer,
| To market goods and services to consumers, To provide marketing
| by third parties for third party goods and/or services, To comply
| with legal obligation
|
| > Categories of third parties with whom the personal information
| is shared: Business service providers, Contractors, Retailers,
| Corporate parent and affiliates, Third party providers of goods
| and/or services, Entities required to comply with the law
|
| > Categories of personal information sold: Identifiers for third
| party marketing of goods or services., Consumer records for third
| party marketing of goods or services
|
| > Categories of personal information disclosed for business
| purpose: Identifiers are disclosed to service providers,
| contractors, and third parties., Consumer records are disclosed
| to service providers, contractors, and third parties., Commercial
| information is disclosed to service providers, contractors, and
| third parties., Internet or other electronic information is
| disclosed to service providers, contractors, and third parties.,
| Vehicle geolocation is disclosed to service providers.,
| Inferences are disclosed to service providers and contractors.,
| Sensitive personal information is disclosed to service providers
| and contractors.
| Melatonic wrote:
| Good to know
|
| Seems pretty blanket wide legalese. The part about audio
| recordings seems a bit troublesome however
| cmgbhm wrote:
| The non troublesome use-case is clicking the starlink button
| and taking to their support.
|
| Having bought a Subaru, I really tried to see where the
| consent is in the process. In my case, I think it's the
| account establishment process that the dealer did.
| stuff4ben wrote:
| As a DevSecOps/SRE whatever, I just gotta give props to the
| Subaru team for getting it patched within 24 hours. While it's
| just a small internal admin dashboard without real customer
| usage, the fact they acknowledged and fixed the issue so quickly
| speaks well of at least that part of Subaru IT.
| therealfiona wrote:
| That's it... I'm not buying a car with any internet connection
| unless I can rip it out. And every day that's going to get
| harder.
|
| Guess I'll stick with old Kai Vans...
| t1234s wrote:
| Having developed back end portals like this one for much smaller
| companies I find it hard to believe that there is an open
| endpoint to reset a password without any type of verification.
| What goes wrong in development that this type of crap makes it to
| production?
| duxup wrote:
| It's weird, is there no feedback of any kind in these
| companies?
|
| All outsourced maybe?
|
| I don't get it. That would be a huge red flag and a fairly easy
| to understand / sell red flag.
| t1234s wrote:
| Even if it was outsourced is there zero quality control?
| anarticle wrote:
| Outsourcing means you want to impose an upper limit on the
| cost of the feature/software. Quality control may cost
| more, so yes!
|
| The acceptance criteria are: service portal needs to work
| so employees can do xyz. The design is terrible but
| "works"!
|
| Having to rearc after these terrible designs would cost
| more, so you can see where this is going...
| iforgot22 wrote:
| Probably QA is only going to make sure the features work.
| They aren't pen-testers. At best, they might try some
| unexpected inputs that trigger a security vuln.
| yellow_lead wrote:
| No bounty for such a big vulnerability is unbelievable.
| 1970-01-01 wrote:
| Excellent write-up!
|
| However a much better title would have been "Hacking Subaru: FEEL
| THE FREEDOM"
|
| https://trademarks.justia.com/owners/subaru-of-new-england-i...
| renewiltord wrote:
| All this is pretty cool. It's a pity there's no way to just
| extract it yourself for yourself. I like all these features and
| have an older Subaru.
| jcgrillo wrote:
| Yet another example of why I don't own or drive vehicles from
| this stupid century.
| tomohawk wrote:
| Is there a way to prevent the car from connecting to this
| service?
| bryceacc wrote:
| scroll down to see the DCM removal
|
| https://www.subaruoutback.org/threads/disconnected-cars-non-...
| rurp wrote:
| There are a striking number of stories in this thread of
| incompetence and unethical behavior on the part of Subaru, and it
| makes me sad that the company has turned into such a wreck. Maybe
| they were always run this way but older technology didn't allow
| them to be quite so scummy.
|
| I bought a Subaru in the aughts that I absolutely loved and had
| assumed my next car would be from the same company. But when I
| test drove and looked into a new model I was shocked at how many
| terrible changes had been made, and I didn't even uncover half of
| what is in this thread.
|
| I'm not holding my breath, but hopefully the bad press affects
| sales enough to make the people running this company care and
| alter their behavior. The mechanical cars themselves are still
| nice to drive, but the terrible interfaces, obscene amount of
| spying, and intrusively unethical behavior really kill the
| experience.
| yearolinuxdsktp wrote:
| Luckily, in right to repair states, Such as Massachusetts, Subaru
| chose to disable Starlink altogether instead of making Support
| documentation available under the law.
___________________________________________________________________
(page generated 2025-01-23 23:00 UTC)