Slashdot Mirror
Disgruntled Ex-Employee Remotely Disables 100 Cars
hansamurai writes "Over one hundred cars equipped with a Webtech Plus blackbox were remotely disabled when a former employee of dealership Texas Auto Center got hold of his employer's database of users. Webtech Plus is repossession software that allows the dealership to disable a car's ignition or trigger the horn to honk when a payment is due. Owners had to remove the battery to stop the incessant honking. After the dealership began fielding an unusually high number of calls from upset car owners, they changed the passwords to the Webtech Plus software and then traced the IP address used to access the client to its former employee."
Can someone explain this article to me using a car analogy?
this makes front page of slashdot, why?
Because it makes the idiots who claim this kind of backdoor would never be misused look bad. Why are you protesting so much, anyway?
or the Brown Note?
If you're going to play around with your ex-employer's systems like that, you don't do it from your own home. You go interstate, to a 'net cafe, and do it from there! Sheesh. Kids these days.
They already are. See the latest OnStar commercials. If they're chasing you and you don't stop, they can either slow your car down, kill it, and/or make it start honking and flashing lights. And they can keep you locked in your car.
They've also been caught using it to spy on people by activating the voice channel.
Never buy a vehicle with OnStar.
Since I RTFA I know that he used someone else's password.
At least Slashdot got it right unlike Wired who states it was an act of "hacking". WTF Wired, it wasn't a hack. It was as simple act of intrusion without authorization. Nothing special or fancy was required to do so.
Life is not for the lazy.
If not that job, go find another what did he achieve doing this may be getting pounding in the ass in Federal Prison. Now he cannot get anymore job anywhere.
I would definitely be interested in buying a car that can be triggered to shutdown or start blaring its horn remotely! Is there anyway to buy one with a built-in bomb?
When things get complex, multiply by the complex conjugate.
When are bosses going to learn to stop taking away their gruntles??
Cwm, fjord-bank glyphs vext quiz
Non-maroons who do stuff like this, do it from net cafes using a chain of anonymous proxys, and they do not get caught.
It's just the maroons like this one that you hear about.
It is a back door. It's a back door installed by the dealer into your car with the assurance that it won't be misused.
The "front door" would be for them to send you a letter when you miss a payment, and send someone over to repossess the car if you continue to miss them, but I guess they feel that the tiny number of people who would try to steal the car justifies inflicting this system on all of their customers.
Well, duh! Because it's easier to remember. And it's better than having a post-it for each car -- just one post-it with the one password will do!
What a fool believes, he sees, no wise man has the power to reason away.
Perhaps Toyota should review which Engineers have been fired lately.
Honk if you're Hacked!
Science advances one funeral at a time- Max Planck
They don't ask for it, the bank makes it a requirement of the loan. This way if a payment isn't on time, they can turn the car off to force the issue. You aren't going to find it on a car from a dealer, financed by a normal bank. It is for high risk situations.
...is the perfect example (and with car analogy indeed) of why DRM and remote product (de)activation is doomed to failure.
No.
The real question is what the blistering hell are remote kill switches doing on cars in the first place?
I'm sure there's an iPhone analogy somewhere here...
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
<sarcasm>
Of course its hacking! how else could someone do that???
Next you're going to say that someone guessing a Facebook password isn't hacking!!!
</sarcasm>
OnStar would interpret such a move as an attack.
THL phish sticks
The real question is, why is there *one* password for all the cars? Shouldn't it be one password for each employee who has access to log into the "car disabling" server which then sends the lockdown signal using a trusted certificate?
They shouldn't have to change the passwords at all, just delete the employee's user account.
No. That's not the real question. It's a stupid ass question because it was answered in article.
Each employee does have an account. His account was even disabled. He used another employee's account.
Man, you got a +5 for "I didn't read the article" - I can understand no one bothering to mod you down, but +5 stupid? Come on...
When information is power, privacy is freedom.
And do you have any evidence that those things have been used when the owner is driving the car (even if wanted by the police) or only when the car is reported stolen?
Sure. Case in Las Vegas. Note that the FBI's use was not deemed illegal/inappropriate, but rather that it denied the user/owner of use during that time.
Or do what Arizona does where all the dealer has to do (other than a few formalities) is ask you to return the car, OR ELSE.
Since the OR ELSE in Arizona is a class 6 felony!
Facing up to 2 1/4 years in prison and being a felon for not turning it in makes having repo woman/man kinda redundant (surprisingly they exist, even though a dealer can have the police get the car back for free).
P.S. I'd HATE that law if I was a repo company employee or owner! Less reason to be used, and people in prison don't drive cars and felons have trouble getting them, so bad for repeat business. I can see how the deadbeats were unable to stop such a law, but surprised the repo companies didn't pay someone off to have it not pass or get repealed. There's big money in that business.
Also surprised the repo companies didn't get behind lobbying to make the remote black boxes illegal (have a "consumer protection" front lobby against it). No need to hire a repo company when all you need is a remote shutoff box and a tow truck.
As far as I know AZ is the only state with the law making it a felony to not return a car, although others make it a crime to "conceal collateral" (IL felony (*), CA misdemeanor).
P.P.S.:
(*) IL is probably the state with the most things defined as felonies I have seen. Not NY or CA or UT or anywhere else you'd expect (except maybe FL, but you don't even need to be convicted of a felony - they took people off the voter rolls in 2004 for felonies "committed" in 2007 - plus that state seems to be in a race with TX to see how pro-execution they can be.)
Just because it CAN be done, doesn't mean it should!
Well, duh! Because it's easier to remember. And it's better than having a post-it for each car -- just one post-it with the one password will do!
One post-it to rule them all!
Dear Mr. Goosnarp:
I regret to inform you that the dealership no longer requires your services. Please don't assume that we believe you are without value as an employee and a human being, it's just that your particular skillset is not what we really need right now. Although you consistently exhibit a very high level of originality, and your computer skills easily surpass anyone else currently in our employ, we need somebody who pays more attention to the small details (cough) IP addy (cough).
We wish you well in your future endeavors, and would be delighted to supply a positive recommendation to any prospective employers who may contact us...as long as you don't do anything stupid.
Sincerely,
Your Former Boss
I've calculated my velocity with such exquisite precision that I have no idea where I am.
My sister is like that... Willing to remove all risk from her life and put control in the hands of other people for the safety of her kids. That's all well and good, but I don't need someone having the ability to remotely disable my automobile regardless of my distance from the person with their finger on the button. Sure, responsibility for my family is is important, but I don't need the specter of a nanny snooping in and judging me because I want to listen to some Middle Eastern music.
Life is risk. When you shed risk, it's usually at a price.
Sig not found.
When I submitted it I made a particular point to remove the references to "hacking".
Reviewing just the first hour of video games.
But what happens after the last payment is made?
they already got it - billions of it. Bail-out bux.
whenever there is a power imbalance: little guy versus organization, things like desperation can move idiots to sign really stupid contracts. therefore, if the contract itself is abusive and usurious, it does not matter that you signed the contract, what matters is that one side of the contract, the one with more power, agreed to put someone in a financially abusive situation
i can make a contract that says "if you are a day late, i get your firstborn", and some idiot will still sign that contract. because people are idiots. but the observation does not end there: evil is worse than stupid
making abusive contracts is a form of preying on the weak and helpless and stupid. the weak and helpless and stupid must be protected by society, not because they deserve it, but because the assholes who prey on them get even more powerful, and pretty soon they're enforcing abusive terms on average intelligence folks of average means
so for a well functioning society, you need to punish the usurious, you need to punish those who make up abusive terms. they are far far worse than complete idiots
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Here's a study: http://download.journals.elsevierhealth.com/pdfs/journals/0002-9343/PIIS0002934309004045.pdf ("Medical Bankruptcy in the United States, 2007: Results of a National Study")
"92% of these medical debtors had medical debts over $5000, or 10% of pretax family income. The rest met criteria for medical bankruptcy because they had lost significant income due to illness or mortgaged a home to pay medical bills. Most medical debtors were well educated, owned homes, and had middle-class occupations. Three quarters had health insurance."
So while the medical debt is not necessarily sky-high, losing your job due to illness means that you are screwed on all your debts. Car, house, etc.
Also, further down: "Out-of-pocket medical costs averaged $17,943 for all medically bankrupt families" ... this means that these families successfully paid A LOT of money (~$13K) before declaring bankruptcy and ending up in an average of ~$5K of medical debt. These are not the people that ran up huge consumer debts and declared bankruptcy. These are the people that paid every bill until they just had no money left.