Slashdot Mirror
Also Hackable: Drive-Through Car Washes
PLAR writes It turns out LaserWash automatic car washes can be easily hacked via the Internet to get a free wash or to manipulate the machines that clean the cars, a security researcher has found. Billy Rios says these car washes have web interfaces with weak/default passwords which, if obtained, could allow an attacker to telnet in and use an HTTP GET request to control the machines. Rios adds that this probably isn't the only car wash brand that's vulnerable.
Embedded system developers suck at all things internet, especially security.
Seems like causing damage to cars or injuring people would be a bigger concern than free car washes. It is a room full of large automated machines after all.
Car?
Wash?
I don't read your sig. Why are you reading mine?
Some things just should never be put "on the Internet."
If you must have remote access, either use a dedicated physical connection (with appropriate anti-tampering/tamper-mitigation measures of course) or tunnel them through a rock-solid VPN, but for goodness sake don't put them "on the Internet."
Yes, companies that run industrial equipment, traffic lights, etc., I'm looking at you too.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
What a pity this wasn't discovered sooner... Skyler White could have asked Saul Goodman to hire his Eastern European hacker again to launder Walt's meth money through that car wash using HTTP GET requests.
A quick Google search for "laswerwash ip address" and the very first link is a PDF of the LaserWash Owner/Operator manual with LOTS of useful information.
Things like default IP address, default port, default passwords, command sequences, etc.
Learning HOW to think is more important than learning WHAT to think.
[anyoldlameexcuse] will void the warranty if they can get away with it.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
comes out clean.
Sudo wax on
Who washes their car in the winter? By the time you've driven it home its dirty again.
If you're controlling something, it should at least be a POST.
I wouldn't be surprised if you aren't joking :) BMW has their own brand of expensive washer fluid, for God's sake.
Where you live maybe. Here we had a high of 84 and a low of 51.
The thing needs to connect to payment services, report usage statistics, request consumables, report self-test results...
But feel free to rage against "the cloud", while it continues to be that thing that lets devices talk to other devices to get work done.
I'm a good cook. I'm a fantastic eater. - Steven Brust
http://en.wikipedia.org/wiki/M... Yes, IIAL (but not your lawyer), and no, going to the wrong car wash doesn't void your warranty. That's silly.
I am a geek attorney, but not your geek attorney unless you've already retained me. This is not legal advice.
He hacked the machinery to make it look as though the car wash was handling ten times the number of customers that it actually was. It even printed out fake activity reports for the IRS.
I would venture that the OP is regurgitating some dealer scare story from the days when BMW made cars with telescoping antennas that would get ripped off by the automated washers.
I am becoming gerund, destroyer of verbs.
The article has a picture of a BMW going through a brush wash. It would void the warranty. BMW says only BMW certified brushless car washes are compatible. Using unauthorized car washes will void the warranty.
Who told you that?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Connectivity != Internet.
Take traffic lights for example:
Long before the Internet was more than just a government/university/defense-contractor environment, traffic lights had 2-way communication.
Were they hackable? Yes, to someone with physical access to the communications wires and by the 70s or 80s, maybe to someone who had access to the telephone-company infrastructure. That meant someone in the same metro area as the traffic lights themselves. But they probably were not hackable by someone sitting in his mother's basement or in a terrorist's cave in East Elbonistan.
That's just one example.
My personal pet peeve is companies that allow more than "harmless" remote control of their HVAC over either the Internet or telephone without routing all remote access through a very secure gateway/vpn/whatever. It's not so bad if they allow people to remotely turn on the lights or change the HVAC from "night/energy-saving" mode to "day/occupied" mode, as that just wastes money. But if I can remotely change the temperature to 40F or 100F or remotely shut down the HVAC completely, or remotely turn OFF the lights, that's a bad idea unless strong security is in place. Over the Internet, strong security typically means a VPN or other extremely-hard-to-hack pathway in.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
We have had functional automated car washes much longer than we have had "the cloud". It is apparently possible.
My guess was that the devs were informed that the existing product WOULD be in the cloud by next week OR ELSE, no doubt because a suit somewhere read an article. And so it is.
You don't know BMW. It would void a warranty if you keep their car in an unapproved or incompatible garage. Only BMW approved soda compatible soda cans are permitted in the drink holders. I would not be surprised if it has a list of approved shoes that are compatible with the damned accelerator pedals.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Are the cameras (to prove that the damage to the car was there before the wash) also hackable?
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
If your dealer is that big of a douchbag
It's a car dealer. Douchebag is redundant.
It's a BMW dealer. Big douchebag is an understatement.
My very first car wash was cloud-based. Sometimes I miscalculated and it got snowed on instead.
Billy Rios sums things up interestingly with this sentence:
The trick with control systems...which is what the computers controlling this car wash are...is that logical actions result in kinetic effects. And you can't reboot physics, or restore solid objects from backup.
For your security, this post has been encrypted with ROT-13, twice.
Multiple BMW owner here, what the fuck are you smoking?
The limited edition "frozen" paints offered on a few M cars in recent years have very specific care instructions, but that's the nature of the beast with a true matte paint finish on a car. They don't have the protection a nice thick layer of clearcoat offers cars with normal modern paint.
Beyond those however they're just a well done normal automotive paint job. My beater 3 series is 13 years old and rarely gets washed, but when a friend got bored and washed/waxed the thing it looked like the paint was in better condition than my two year old Kia.
Nothing else on the car would really care what kind of wash you're doing other than the paint and wheels, so barring a dirty brushed wash scratching the hell out of things what possible way could you even imagine a car wash being able to void a warranty?
I used to get high on life, but I developed a tolerance. Now I need something stronger.