Disgruntled Ex-Employee Remotely Disables 100 Cars
hansamurai writes "Over one hundred cars equipped with a Webtech Plus blackbox were remotely disabled when a former employee of dealership Texas Auto Center got hold of his employer's database of users. Webtech Plus is repossession software that allows the dealership to disable a car's ignition or trigger the horn to honk when a payment is due. Owners had to remove the battery to stop the incessant honking. After the dealership began fielding an unusually high number of calls from upset car owners, they changed the passwords to the Webtech Plus software and then traced the IP address used to access the client to its former employee."
Can someone explain this article to me using a car analogy?
To get Wired more traffic.
He couldn't reprogram it to make all of the cars play jingle bells?
I read TFA and all I got was this lousy cookie
car takes you!
More power to people who show the world what trojan horse like hardware means.
this makes front page of slashdot, why?
Because it makes the idiots who claim this kind of backdoor would never be misused look bad. Why are you protesting so much, anyway?
How long until the police/feds/intelligence/etc get to start using this on civilians?
that no pointed haired types work for the company that made my pacemaker.
As soon as you fire an employee, change the password! You never know what they can access and how they feel about you. Why take the chance?
Second link to Wired today. I smell something fishy...
If you're going to play around with your ex-employer's systems like that, you don't do it from your own home. You go interstate, to a 'net cafe, and do it from there! Sheesh. Kids these days.
At least Slashdot got it right unlike Wired who states it was an act of "hacking". WTF Wired, it wasn't a hack. It was as simple act of intrusion without authorization. Nothing special or fancy was required to do so.
Life is not for the lazy.
If not that job, go find another what did he achieve doing this may be getting pounding in the ass in Federal Prison. Now he cannot get anymore job anywhere.
I would definitely be interested in buying a car that can be triggered to shutdown or start blaring its horn remotely! Is there anyway to buy one with a built-in bomb?
When things get complex, multiply by the complex conjugate.
When are bosses going to learn to stop taking away their gruntles??
Cwm, fjord-bank glyphs vext quiz
What back door. The ex-employee had the password. He went in the *front* door.
It's not a back door if you forget to change the locks.
The real question is, why is there *one* password for all the cars? Shouldn't it be one password for each employee who has access to log into the "car disabling" server which then sends the lockdown signal using a trusted certificate?
They shouldn't have to change the passwords at all, just delete the employee's user account.
Can you be Even More Awesome?!
Non-maroons who do stuff like this, do it from net cafes using a chain of anonymous proxys, and they do not get caught.
It's just the maroons like this one that you hear about.
I can't wait for the same story about "Smart Meter" electric meters being installed around the country.
Or about the first zero day flaw in their wireless access allowing anyone to shut off your power.
I have been reading /. for a couple years now as anon coward, and I have seen a huge decline in conversation recently. I am not trolling, I am concerned. I enjoy the tinfoil hat banter, I enjoy the uninformed but concerned banter, and I also enjoy the informed and willing to share banter. /. has sparked my wonder, concern and inquisitiveness....Where has this gone? It seems like it's flooded with negative non-informed slander. I want it back...I understand that as an anon coward, I don't have pull, but I will miss something in my life, if it comes to another .com that I regular.
Car owners honking mad: Cops charge man with remotely disabling cars
"Omar Ramos-Lopez, 20, is charged with breach of computer security, a state jail felony for which he faces up to two years behind bars."
Too bad they can't charge him once for each car whose computer-security system he disabled. If he "faced up to 202 years behind bars" he would be much more willing to plea-bargain it down to 23 months.
OK, seriously, I say his punishment (after a stint in jail) should be that for the next 5 years there should be a 50/50 chance of his car not starting on a given day. OK, that won't happen. But hopefully the judge can be a bit creative with this guy.
Perhaps Toyota should review which Engineers have been fired lately.
Honk if you're Hacked!
Science advances one funeral at a time- Max Planck
They don't ask for it, the bank makes it a requirement of the loan. This way if a payment isn't on time, they can turn the car off to force the issue. You aren't going to find it on a car from a dealer, financed by a normal bank. It is for high risk situations.
...is the perfect example (and with car analogy indeed) of why DRM and remote product (de)activation is doomed to failure.
<sarcasm>
Of course its hacking! how else could someone do that???
Next you're going to say that someone guessing a Facebook password isn't hacking!!!
</sarcasm>
What, American!?? (ducks for cover)
> Never buy a vehicle with OnStar.
The system should be more or less hard-wired so that it notifies you when the microphone activates for any reason. But as a consumer, I might be willing to accept the possibility of listening in for the added level of safety. I'd be a helluvalot MORE likely to do so if they needed a warrant to listen, but even so, it's good to have an added level of redundancy in your safety systems. Keeping a cellphone, being able to get to a cell phone, the cell phone working where you are, and knowing who to call and how to report your position, are all single points of failure. You can work around some of them--e.g. calling 911 instead of the local police--but the more redundancies, the better.
This is doubly true if you have a family, in which case you're buying not for your own safety, but for that of other people. To my mind, that's a greater responsibility.
The real danger, of course, is warrantless recordings, mass recordings, and data-mining.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
The new "smart meters" being installed on homes not only do power monitoring but also do remote control, often over a wireless mesh network. How long until this ability is abused or repurposed?
This makes it to the front page of Slashdot so that you can summarize it with a car analogy.
Or maybe it's a trick and you're supposed to summarize it with a computer analogy. Could go either way.
Let q be a radix > 1. I am in ur base-q, killing 10 d00ds.
it wasn't a hack. It was as simple act of intrusion without authorization.
One could argue semantics in that he was authorized, but he was incorrectly authenticated. IE he used an authentication that wasn't his, and then did what that authentication entitled him (was authorized) to do. Authorization worked perfectly. This is a case of an "authentication failure", but in the sense that the authentication process didn't do it's job, but in a way that allowed when it should have denied. (in contrast to the usual interpretation, denied when it should have allowed)
I work for the Department of Redundancy Department.
How would they stop bruteforcing of this? Does it lock out connections to the car after x many failed attempts, and if so, that is an exploit in itself. This is begging for a whole new level of wardriving...
Now three.
FAQs are evil.
Or do what Arizona does where all the dealer has to do (other than a few formalities) is ask you to return the car, OR ELSE.
Since the OR ELSE in Arizona is a class 6 felony!
Facing up to 2 1/4 years in prison and being a felon for not turning it in makes having repo woman/man kinda redundant (surprisingly they exist, even though a dealer can have the police get the car back for free).
P.S. I'd HATE that law if I was a repo company employee or owner! Less reason to be used, and people in prison don't drive cars and felons have trouble getting them, so bad for repeat business. I can see how the deadbeats were unable to stop such a law, but surprised the repo companies didn't pay someone off to have it not pass or get repealed. There's big money in that business.
Also surprised the repo companies didn't get behind lobbying to make the remote black boxes illegal (have a "consumer protection" front lobby against it). No need to hire a repo company when all you need is a remote shutoff box and a tow truck.
As far as I know AZ is the only state with the law making it a felony to not return a car, although others make it a crime to "conceal collateral" (IL felony (*), CA misdemeanor).
P.P.S.:
(*) IL is probably the state with the most things defined as felonies I have seen. Not NY or CA or UT or anywhere else you'd expect (except maybe FL, but you don't even need to be convicted of a felony - they took people off the voter rolls in 2004 for felonies "committed" in 2007 - plus that state seems to be in a race with TX to see how pro-execution they can be.)
Just because it CAN be done, doesn't mean it should!
Dear Mr. Goosnarp:
I regret to inform you that the dealership no longer requires your services. Please don't assume that we believe you are without value as an employee and a human being, it's just that your particular skillset is not what we really need right now. Although you consistently exhibit a very high level of originality, and your computer skills easily surpass anyone else currently in our employ, we need somebody who pays more attention to the small details (cough) IP addy (cough).
We wish you well in your future endeavors, and would be delighted to supply a positive recommendation to any prospective employers who may contact us...as long as you don't do anything stupid.
Sincerely,
Your Former Boss
I've calculated my velocity with such exquisite precision that I have no idea where I am.
My sister is like that... Willing to remove all risk from her life and put control in the hands of other people for the safety of her kids. That's all well and good, but I don't need someone having the ability to remotely disable my automobile regardless of my distance from the person with their finger on the button. Sure, responsibility for my family is is important, but I don't need the specter of a nanny snooping in and judging me because I want to listen to some Middle Eastern music.
Life is risk. When you shed risk, it's usually at a price.
Sig not found.
In Europe, sure. In the US, where Auto companies have done everything in their power to kill public transportation and regulate people with out cars to the status of second or third class citizens, not so much.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
after all the payment is completed. This means they still have control of your vehicle even though the card is yours legally.
New Economic Perspectives
Will he be incarcerated for this carnage?
When I submitted it I made a particular point to remove the references to "hacking".
Reviewing just the first hour of video games.
...By creating a gui interface in Visual Basic...
I noticed people here talking about how OnStar has similar capabilities. What about the Ford Sync system Ford is putting in all their vehicles now. Does that have similar capabilities to OnStar, or is it more just a media player/phone system deal?
this makes front page of slashdot, why?
Well for one thing it's going to be easy for everyone to do car analogies! Then there's the whole "non-existent data security in the retail market" aspect. Next up is the question, is this a service accessible from the web? Oh also, how can I tell/find out if one of these boxes is wired into my new car? There seems to be plenty of geek mileage available, more so for anyone that's ever been late with a car payment...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
It's always the "disgruntled ex-employee" that gets the headlines. Why oh why do we never hear of all the good being done by the many gruntled people of the workforce?
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
You friend is stupid, too- overpaying by almost 4x the market rate, and with an interest rate that high, it's going to be years before she pays it off. Last year I got a loan at 4.9%...
Please help metamoderate.
OnStar can't keep you locked in your car -- there is ALWAYS a manual override.
You can request that the Remove Vehicle Slowdown feature is disabled. Apparently, they can disable it over the air, but to re-enable it, you need to take it into a dealership, so they can't just re-enable it if the police demand them to.
OnStar claims that their software has been modified so that the driver is ALWAYS notified when the microphone is activated remotely.
Even if this doesn't satisfy you, you can always unplug the OnStar unit without affecting the rest of the car.
My g'father-in-law had his installed by a Medicare-approved provider with no battery backup and no generator. Be happy to provide specifics on request via e-mail. Is there a Medicare reg which requires a BBS or backup generator? Sure would like to know...
There is nothing wrong with yr Internet. Do not attempt to adjust the picture. We are controlling the transmission - NSA
>url:http://news.cnet.com/2100-1029_3-5109435.html>
Absolutely not true: If your car radio was on while the FBI snooped, the only indicator was a little light in the radio saying that "Car Recovery Mode" was disabled - NOT that the microphone was active. If the radio was off, it would beep - not to tell you the microphone was active, but again that "Car Recovery Mode" was disabled.
I have no idea on the Medicare regulations, etc, etc, only that in this case power was out, the O2 concentrator was unable to provide oxygen. Our interest was in patient care, not the equipment approval process. But good to know, too.
Sometimes I wonder if some system like this that can affect so many people with a bogus login, why isn't the access controlled with more than just a username/password combo?
If I were running a car dealership and knew that all it took was one password and someone could crack in, kill all my customers' cars and cause me a lot of potential lawsuits, I'd make damn sure that everyone with any access to this system would have a SecurID keyfob at the minimum, preferably an online/offline authenticator such as the Aladdin eToken NG-USB. Of course, only a few employees would have access to the kill switch, and there would be a documentation trail showing that it has been past the contracted time for nonpayment and the time has come to send in the repo man. Of course, the software would have a sanity checker that would limit the amount of cars shut down at any one time unless it was someone like the owner of the dealership doing the work. This way, a booted employee would do little to no damage unless they physically stole another employee's smartcard (which would be fairly easy to get detected, especially if the card is used for opening a door lock, or clock in and out.)
This is a sore point of mine, but why is username/password access the only thing protecting a lot of very sensitive services? It's 2010, shouldn't we have some sort of smart card standard by now, so client SSL certificates are easy to use, and widely accepted by websites? Perhaps a SIM card that holds the private key, and the cellphone acting as a trusted PINpad and screen, and this works regardless if the phone is a "dumb" phone like a RAZR, or a smartphone running Android, Windows Mobile, or OS X?
This guy must be an idiot to get traced to his IP address.
Don't they have free wifi Cafes in Texas?
Any dealership I've been has a free wifi in their service waiting lounge. He's out of work, plenty of time to grow a beard, buy (ok Steal) some sunglasses, a black cowboy hat, and sit in their own waiting lounge and beat them with their own stick.
Sig Battery depleted. Reverting to safe mode.
“Omar was pretty good with computers,” says Garcia.
You heard that? "Pretty good with computers" ... that must really mean something, especially coming from a (car dealership) manager.
Then, of course, we have this little gem:
Then police obtained access logs from Pay Technologies, and traced the saboteur’s IP address to Ramos-Lopez’s AT&T internet service
So he accessed the website (using his password, no hacking required here) from his home? Without even bothering with Tor?
"Pretty good", but not good enough.
Is this in violation of the Repo Man's code?
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
My sister is like that... Willing to remove all risk from her life and put control in the hands of other people for the safety of her kids.
You'd be amazed how many people are. "For the chillllldruuuun!!!" is one of those arguments that you just can't win because you either get painted as someone who'd understand if they had kids or someone who's sympathetic towards kiddie fiddlers, at which point any chance of a sensible discussion just goes out the window.
It's the modern-day equivalent to witch hunting.
Driving Rights Management in this case!
----------------------------------- My Other Sig Is Hilarious -----------------------------------
These guys are predatory lenders. They make loans they KNOW you can't repay with the intent of leaving you with nothing but debt. I say this because they want you to default. They make money when you do. You'd have to be stupid or desperate to agree to this, but there are enough of the latter that I have little sympathy for the lenders (and that's even though I realize there are plenty of people who are both).
It's usury, pure and simple. I don't consider it an honest business. If some of their deadbeat clients are bastards, I consider it about half of what the usurers deserve.
For the record, I have never had anything repossessed, nor have I missed any payments. I did accidentally bounce a check (due to having forgotten to carry a one in my check ledger)--a small donation to charity, of all things. The $75 overdraft charge was swiftly paid off and I learned my lesson: avoid debt if at all possible, because your lenders own you. If you cross the zero net worth line, they'll multiply your debt with punitive fees and imprison you financially. I also keep cash reserves now, for just such occasions, though I've never tried to zero an account since then, nor shall I.
>>Life is risk. When you shed risk, it's usually at a price.
That price is freedom.
Bloody hell, so even cars have DRM now? The world is going to hell.
I'm happy to say i have always bought cars for cash, never had any kind of credit on them...
Although this meant that i've always had cars which were several years old rather than a new one, with careful selection this can actually bring big advantages...
I tend to buy cars which were well looked after, so aside from my first ever car (which was extremely rusty and had bits dropping off the bodywork) my cars have been very reliable, and i avoid the teething troubles that sometimes plague new cars.
Also if you buy at the right time, the car may have finished depreciating and depending on the type, might actually start to increase in value as a classic.
The only thing i miss out on, is some of the fancy features on newer cars, and even that's not always the case - if you buy a highend car from 10 years ago it might even have features not present on a lowend car from today...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
to convince you to file bankruptcy for.
Really, many people will file bankruptcy because for many it
1) Holds this silver bullet mythical like properties
2) Punch the reset button
3) Stick it to "the man" - whomever that may be.
One of my ex college buddies; as in I don't associate much if at all with him anymore; did the #3 route. Worse this seems to be the prevalent mindset these days among a lot of people. They don't care that other people have to foot the bill because they won't see them.
I am not sure where you came off with the 1K value, but this page http://www.bankruptcylawinformation.com/index.cfm?event=dspStats suggests differently.
* Winners compare their achievements to their goals, losers compare theirs to that of others.
I could export huge databases of all the prices, clients, profits, documents, deals etc. of my company. They don't really put limits on that somehow.
Moreover just today the admin told me his password when I asked him to help me out with some permission issue...
Well...
Too bad I'm an honest individual :( (mostly)
o hai
Pull the battery? There's this thing under the hood called the fuse box--pull the horn fuse. On my Saturn, at least, the horn has its own fuse. I know, because one night, it started honking all by itself.
You save only 59 seconds over 8 miles by going 75 instead of 65. Do you really have to pass that guy? Do the Math!
This *is* hacking, in any other worldview other than a comp techies. I'm a geek heavily into comp sec, and that's one of the words I'd use to describe it to a non-tech. Or perhaps "cracked", but that still carries the risk of not being understood.
Emotions! In your brain!
this is by definition DRM for vehicles. Where's razor1911?
drm turns what should be a clean exchange of goods into a means of control
it rankles anyone with a sense of the principles of liberty and freedom
it is doomed to failure, in any mode, simply because it pisses off those who are now controlled simply because they engaged in commerce: it sullies your brand image. it makes people hate any company that engages in drm
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Everyone knows, that if you pull something like that off, you do it from the computer of your most hated boss. E.g. use it as a non-logging proxy and delete the proxy software afterwards.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
whenever there is a power imbalance: little guy versus organization, things like desperation can move idiots to sign really stupid contracts. therefore, if the contract itself is abusive and usurious, it does not matter that you signed the contract, what matters is that one side of the contract, the one with more power, agreed to put someone in a financially abusive situation
i can make a contract that says "if you are a day late, i get your firstborn", and some idiot will still sign that contract. because people are idiots. but the observation does not end there: evil is worse than stupid
making abusive contracts is a form of preying on the weak and helpless and stupid. the weak and helpless and stupid must be protected by society, not because they deserve it, but because the assholes who prey on them get even more powerful, and pretty soon they're enforcing abusive terms on average intelligence folks of average means
so for a well functioning society, you need to punish the usurious, you need to punish those who make up abusive terms. they are far far worse than complete idiots
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
http://en.wikipedia.org/wiki/General_Motors - see the infobox on the right, under "Owners"
They ARE the Feds.
Oh no the laughing man strikes again !!!
Here's a study: http://download.journals.elsevierhealth.com/pdfs/journals/0002-9343/PIIS0002934309004045.pdf ("Medical Bankruptcy in the United States, 2007: Results of a National Study")
"92% of these medical debtors had medical debts over $5000, or 10% of pretax family income. The rest met criteria for medical bankruptcy because they had lost significant income due to illness or mortgaged a home to pay medical bills. Most medical debtors were well educated, owned homes, and had middle-class occupations. Three quarters had health insurance."
So while the medical debt is not necessarily sky-high, losing your job due to illness means that you are screwed on all your debts. Car, house, etc.
Also, further down: "Out-of-pocket medical costs averaged $17,943 for all medically bankrupt families" ... this means that these families successfully paid A LOT of money (~$13K) before declaring bankruptcy and ending up in an average of ~$5K of medical debt. These are not the people that ran up huge consumer debts and declared bankruptcy. These are the people that paid every bill until they just had no money left.
Thats what she said.
That works fine in the "surprise, you're fired!" (or not re-hired) situation. But not so much in the case where the worker knows it's coming. This can be many cases of (masculine gender used for simplicity):
The worker is the one to leave. He hates his boss/job/life and a few weeks before handing in his notice he sabotages key systems.
The worker knows his contract is almost up, and is likely to not be renewed
The worker has seen many others being "let go" in similar positions and feels the winds of unpleasant change.
The worker has already had a pre-firing "talk with the boss" and knows they're not happy with him, and that termination is likely upcoming
etc etc
There are plenty of cases where termination is foreseeable, so an unhappy work has plenty of time to do something bad. Heck, in the case of TFA he'd already stolen a co-worker's credentials, so disabling his account is useless.
this makes front page of slashdot, why?
because just about EVERYTHING that you buy will soon have a processor/wireless in it, and problems like this are going to increase exponentially. we must be smarter about the safeguards we require, as well as being smarter about what we accept in our products. in this case the car was simply disabled. what happens in 25 years with auto-piloted cars or whatever.
this is important.
>> The system should be more or less hard-wired so that it notifies you when the microphone activates for any reason
> Absolutely not true
"Should" need not mean "is." Should refers to things which, according to the value system of the speaker, ought to be.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
Would you mind, horribly, assisting someone whose primary concern is the health of his g'father-in-law? How might I find out about getting Medicare to admit such a thing might be needed? Regret not in Washington (accustomed to finding Washington information and translating it to Orygun with our definately-not-standard state health care plan), but your advice would be appreciated.
There is nothing wrong with yr Internet. Do not attempt to adjust the picture. We are controlling the transmission - NSA
Or even better, sit in the lobby of a competing dealership and make it look like corporate espionage :).
Life has many choices. Eternity has two. What's yours?
how does a corp translate an ip (which in the case of your average human. is prolly in an isp's dhcp pool) into a name?
Amen to that. I just don't get the Yanks - I live in New Zealand, where health care is hevily subsidised / free (depending on some simple rules) and there is NO WAY you'll go bankrupt due to illness.
Health, education, security MUST all be "socialized"
Why was the parent modded down?
Yes you need to pay for the car in which it is understood but repo men/women are not the good guys either.
Its a dangerous and very difficult job but they will do anything to get a car ethical, legal, or what not and they do not have sympathy with the owners.
It sucks to lose your job or be caught up in an ARm scam, which can cause you to default. But without a car the victim ... yes victim is screwed. Can't get a job without a car and you can not a car without a job.
http://saveie6.com/
This should be 5.This is the sort of comment which used to be seen a long time ago on /. - erudite , useful and interesting.
Wanted : A Signature.