Slashdot Mirror
Nissan Leaf HVAC-Hack Vulnerability Disclosed (bbc.com)
GWBasic writes: Some of Nissan's Leaf cars can be easily hacked, allowing their heating and air-conditioning systems to be hijacked, according to [Troy Hunt,] a prominent security researcher. .... Mr Hunt said the root of the problem was that the firm's NissanConnect app needed only a car's vehicle identification number (VIN) to take control. That means that pranksters could pretty easily run down a Leaf's battery via Nissan's app just by cycling through VIN numbers, which, the article points out, typically vary only in the last few digits for same-region Leafs, and for an electric car that's a big deal -- you can't just get a quick jump and be on your way. For now, Hunt says, the only thing owners can do is disable the remote-control feature completely.
I've been driving for nearly 30 years and I have yet to come up with a reason why my car needs to be on the internet. Or my DVD player. Or TV. Or refrigerator. Or light bulbs. They all seem to work just fine in standalone mode.
Modern app appers know that ONLY apps can app apps, so if they used apps instead of a LUDDITE HVAC system, this wouldn't be hackable!
Apps!
Let me Google that for you:
http://www.mattcastruccinissan.com/blog/how-to-jumpstart-a-nissan-leaf/
You can jump a Nissan Leaf if you want.
.
It appears that is the only way the car manufacturers will sit up and pay attention to the need for security in their vehicles.
You mean an app used utterly lame security and used something readily available?
Well, I'm totally shocked.
No, wait, the other one where I pretty much expect all of this crap to be broken by design.
Almost without fail, if you can control it from your smartphone, chances are good that someone else can.
No thanks.
Lost at C:>. Found at C.
In the summer!!!
Tell my wife and kids I loved them!!
SJW's don't eliminate discrimination. They just expropriate it for themselves.
You mean cycle through the one single VIN stencilled into the windscreen of your mortal enemy's Nissan Leaf, right? I think even the most inept developer of all time should be able to write an algorithm that's better than O(n)...
How is this any different than a regular ICE car having remote start? Those have been pitched as "get the car warmed up inside and out before stepping outside!" deals for ages now.
That's a perfectly accepted use case now. The problem is the app/IoT side. Currently, it uses your keyfob to "authenticate" the request.
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
Why would you have a remote control feature on a car enabled at ALL?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
this does not bug me, much - the Nissan EV apps's remote HVAC feature is nice for warming up the car in the morning while it is still attached to the home charger. You can heat the interior without impacting the traction battery. Little known fact: heating a LEAF that's been parked outside in freezing weather has a greater impact on the battery (driving range) than cooling the same vehicle in the summer.
Why would you have a remote control feature on a car enabled at ALL?
Convenience.
First it was the locks and a panic button.
Then it was remote starters and automatic door opening.
Now it's the thermostat.
If Google is successful, it will soon also support the command "go pick up the pizza I ordered."
Yep. It's completely a non-problem when I go out to my car after work and it won't run. Oh, wait, your were trolling, right? Right? Maybe you didn't have time to put forth a more compelling argument because you are too busy adding security to an app that has access to certain controls on my car, though I can't possible see why any rational person in the world would have expected that SOME form of authentication/authorization would be included in a product that I paid money for. After all, I usually invite the neighborhood kids to come turn on the air conditioning and heated seats in my car whenever they get the urge. 'Cause, why wouldn't I, right? Such a non-problem.
So they've created a feature that allows you to remotely run the heater or a/c indefinitely while nobody is occupying the vehicle? Seems to me that one of the first things done when designing this would to implement a timer and/or an occupancy sensor. Preheating/cooling the interior on a cold/hot day is great, and sometimes you just want to run into a store with your dogs in the back without leaving the engine on, but both of these scenarios should be rather brief in duration. Allowing the system to discharge the battery to the point of leaving you stranded is just piss poor design. Security flaw aside, I see no good argument for allowing your car to be used as an unattended fridge or oven for extended periods of time.
Because it's really convenient to be able to start the air conditioning remotely, so that the car is already cool when you get in it. This is especially important with electric cars, where the power to cool the car down initially will then be drawn from the grid, not the battery.
I have seen those and can understand its appeal. Especially if it's limited against moving the car out of park.
Picture yourself on a 20 degree day starting your car by remote and having the heat start while you sit in your warm living room enjoying your first cup of coffee.
Because it's more efficient to heat or cool an electric car directly off of wall current than to do so using the battery (which incurs an efficiency loss in the transition to and from chemical energy). And every watt hour used while plugged in that doesn't have to be used while driving increases the effective range. Combine the two, and it makes a lot of sense for electric cars to offer scheduled or remote controlled climate settings.
Why would you have a remote control feature on a car enabled at ALL?
If Google is successful, it will soon also support the command "go pick up the pizza I ordered."
How? Sit in the parking lot flashing lights and honking horn until somebody notices and drops the pie in the driver's seat?
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Some of them are rather silly, like my car came with the ability to open the windows remotely. Discovered it by accident after the button must have gotten held down by another key in my pocket and wondered who else in the family had been messing with my car in the garage the night before. Then after it happened while the car was parked outside (fortunately in a good area and not on a rainy day) I went to the dealership to have them disable that "feature" and other silly remote crap that I have no use for.
Assuming you have the thing plugged in. Around these parts, we don't generally provide plugins for them greenie cars and it gets pretty hot in the summer..
Ah, what the heck, anybody who's drivin' one of them new 'lectric cars is begging to have issues and is deservin' to have their AC hacked into...We all drive the big oil swillin SUV's and 4WD Trucks round the ranch anyway and usually have a chain to pull them greenies to the nearest plugin...
the only thing owners can do is disable the remote-control feature completely.
In other news, thieves discovered a way to break into garages using drive-by attacks (this happened in the 1980s or 1990s). The only thing owners could do was to disable the remote-control feature completely (or replace it with a different one).
Yes, there are a few environments where you need to be able to turn the heat or AC on before you get into the car. Alaska and Phoenix, Arizona, I'm looking at you. But for everyone else, the risk (upper bound on the probability of a high-cost hack is still too high) outweighs the convenience.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
All this talk about hijacking a car's HVAC system puts me into a cold sweat.
Assuming you have the thing plugged in.
Which, given that these types of cars are pretty much exclusively commuter vehicles, and many workplaces provide plugs these days is pretty likely.
Generally, they're either sat at work, or at home, usually plugged in.
That's the big advantage of an electric car, no range anxiety, unlike with a petrol car. You never have to think about filling it up with petrol, because it just gets plugged in every time you stop.
Your silly is my nice convenience. Open the windows from my office on a hot sunny day. Car isn't a million degrees by the time I get out there. Forget to close my windows and it starts raining? Close them remotely, and I stay dry.
Leaf HVAC is the same thing, and is actually more important for an electric, assuming you're plugged in. You can start the heat or A/C when you're parked, still plugged in. The car gets up or down to your desired temperature while still running on the grid instead of draining your battery. Not having to ride around in a cold/hot car is just a nice perk.
Of course there should be a secret to go with the known value of the VIN. VIN is readable in the windshield, so if you want to get back at someone who's parked like an ass, just start his A/C & kill his battery...
Assuming you have the thing plugged in.
Which, given that these types of cars are pretty much exclusively commuter vehicles, and many workplaces provide plugs these days is pretty likely.
Maybe in California. Here in the Midwest I don't see a single outdoor outlet in my company's parking lot, and if a parking garage has a charging station it typically has only two slots.
That's the big advantage of an electric car, no range anxiety, unlike with a petrol car. You never have to think about filling it up with petrol, because it just gets plugged in every time you stop.
I've never had range anxiety with a regular car, because there are stations everywhere and it takes mere minutes to fill up. Only an idiot could run out of gas in suburbia.
The vast majority of work places do not provide places to plug in your piece of shit electric car.
A real car only takes a minute to refuel. A piece of shit electric takes hours to recharge.
Ah, Nissan didn't take long to put their damage-controlls online.
Thanks for sharing the company's PR perspective with us, AC. But how 'bout we actually discuss the real facts and the real effects, hmm?
Slashdot moderators... I am disappoint.
Welcome to the Panopticon. Used to be a prison, now it's your home.
We drive our Leaf daily in Michigan. Check the forecast. We are in a blizzard.
You have to put snow tires on it, as the Eco tires lack traction. Mileage drops significantly on the Guess-O-Meter due to the cold, though an attached garage would help. We warm ours up on a timer. Blue Tooth is disabled through the console.
I own a Leaf in the desert southwest. Being able to turn on the AC from your phone is fantastic. The difference between getting into an 80 degree car and a 120 degree car is pretty huge.
Nissan Leafs use AT&T 2G modems to connect to the server, so do Ford's Focus Electric and Energi PHEVs. AT&T 2G dies at the end of 2016 so I guess the problem will solve itself eventually.
Why would you have a remote control feature on a car enabled at ALL?
For people who live in properly hot or cold areas, being able to heat or cool your car down to a sensible temprature before getting in is a godsend. Especially if you live in a humid area and need to demist your windows when it gets as low as 16 degrees C.
Also see this informative picture.
I used to drive a manual with a metal gear stick knob, I have the H-pattern permanently burned into my palm as a result.
Calling someone a "hater" only means you can not rationally rebut their argument.
Wow..I have yet to see ANY charging stations anywhere in the city, much less at a parking lot where people work.
I would guess they're pretty much only prevalent out west in CA and the like and maybe in some of the North East states?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
It was actually Troy's brother, Mike who discovered the vulnerability.
Calling someone a "hater" only means you can not rationally rebut their argument.
I am never moving to the southwest.
Snowden and Manning are heroes.
Well because ......... Internet of Shit
https://twitter.com/internetof...
Self Defense - A Human Right www.a-human-right.com
You're assuming the pizza restaurant is staffed. Instead, the pizza is assembled and cooked by a robotic system. Your self-driving car communicates directly with the pizza restaurant main AI, informing it when it arrives, at which point a robotic arm puts the pizza in the car. Meanwhile, sentry guns fire rubber bullets at the hoards of permanently unemployed and desperate humans attempting to loot the pizza restaurant and turn your car to scrap. During all of this, you lounge casually around your living room in the fortified neighborhood you call home, secure in the certainty that what differentiates you from the ravenous hordes is that they are stupid and lazy.
120F cars are not uncommon, even in not the south west. A car sat out on a 75F will be 120F inside in about an hour. On a 100F day it'll be 150F inside in the same time.
That's the big advantage of an electric car, no range anxiety, unlike with a petrol car.
No one gets range anxiety when they can fill up anywhere on their route in less than five minutes.
(Is this one of those things where you think that if enough people repeat it enough it will become true? Those approaches hardly ever work).
I'm a minority race. Save your vitriol for white people.
I've never seen a plug anywhere for electric cars to charge up. I've heard some employers out in California provide them and maybe a few other places but even there I hear complaints about not enough charging ports. Does your employer have a port for every single electric car?
The best part is really you're not turning the car on, just the heater. I can't wait until the range gets up to around 300 miles and charging stations become normal. Until then I'll just keep dreaming.
When the car's on a 240 volt AC charger, sitting outside on a cold day, you trigger the heat fifteen minutes before you leave the building.
That way the car's interior and battery pack are heated up using the AC connection and not the battery. Since the heater is the single most power-hogging load in the vehicle, and batteries are more effective when warm, this extends your driving range significantly.
Remember the Leaf is not a Tesla - it's an otherwise great car with the Achilles Heel of very limited range. It only goes about 80 miles before you have to do a 5-hour charge at 240 VAC (or 15 hours if you are using a regular 15 Amp 120 VAC socket, which is absurd compared to Tesla's 20 minutes supercharge providing a couple hundred miles). So anything you can do to extend range is worth the effort!
My wife's Leaf has a seven day program that conditions it environmentally before she leaves every morning while it's still on wall power. If she had to make an unexpected trip, perhaps to take a child to the emergency room in the night, she'd use the remote to override the normal programming and heat the car while we got everyone dressed for the drive. It's a valuable feature.
But am I worried about someone running the battery pack down by seizing remote control? In a word, no. Unless you live in a city it's incredibly unlikely; somebody would have to make a special trip to my house or my wife's workplace during a hellish freeze in order to pull it off, and the car would be plugged in under those circumstances so the battery would never run down anyway.
And even if you live in a city, where people can get close enough to your car to do this while you're off doing something, is this really a threat? I mean, sure, I've been cursed at, threatened and coal-rolled for driving a Prius, and presumably electric car owners get taunted and abused worse than hybrid drivers, but the neanderthals who hate low-emissions cars are not really very dangerous opponents. Just look at the anti-environmentalists here on slashdot - not exactly the brightest bulbs in the pack, now are they? I'd laugh in their faces if they'd get close enough, but the haters are losers, not even brave enough to get out of their cars, so I have to laugh at them from a distance.
It's not a Nissan problem.
I worked on a related system sold by a different company and AFAICT it's basically the same. Car people care more about feature checklists than reliability when it comes to software.
Remember the Toyota killer firmware?
And that was damn user safety, the makers' concepts of security and DRM are from the 1980s, no wonder you can hack their systems.
And given that they are mining your personal info from all the shitty features you could imagine...