Slashdot Mirror
Nissan Leaf HVAC-Hack Vulnerability Disclosed (bbc.com)
GWBasic writes: Some of Nissan's Leaf cars can be easily hacked, allowing their heating and air-conditioning systems to be hijacked, according to [Troy Hunt,] a prominent security researcher. .... Mr Hunt said the root of the problem was that the firm's NissanConnect app needed only a car's vehicle identification number (VIN) to take control. That means that pranksters could pretty easily run down a Leaf's battery via Nissan's app just by cycling through VIN numbers, which, the article points out, typically vary only in the last few digits for same-region Leafs, and for an electric car that's a big deal -- you can't just get a quick jump and be on your way. For now, Hunt says, the only thing owners can do is disable the remote-control feature completely.
Tiny non-problem discovered that nobody has experienced in the real world. That wouldn't cause any danger even if somebody did do it.
How much does being a "security researcher" pay again?? This guy just name-checked by the BBC for a trivial hack. Nice job.
I've been driving for nearly 30 years and I have yet to come up with a reason why my car needs to be on the internet. Or my DVD player. Or TV. Or refrigerator. Or light bulbs. They all seem to work just fine in standalone mode.
Modern app appers know that ONLY apps can app apps, so if they used apps instead of a LUDDITE HVAC system, this wouldn't be hackable!
Apps!
Let me Google that for you:
http://www.mattcastruccinissan.com/blog/how-to-jumpstart-a-nissan-leaf/
You can jump a Nissan Leaf if you want.
.
It appears that is the only way the car manufacturers will sit up and pay attention to the need for security in their vehicles.
You mean an app used utterly lame security and used something readily available?
Well, I'm totally shocked.
No, wait, the other one where I pretty much expect all of this crap to be broken by design.
Almost without fail, if you can control it from your smartphone, chances are good that someone else can.
No thanks.
Lost at C:>. Found at C.
In the summer!!!
Tell my wife and kids I loved them!!
SJW's don't eliminate discrimination. They just expropriate it for themselves.
You mean cycle through the one single VIN stencilled into the windscreen of your mortal enemy's Nissan Leaf, right? I think even the most inept developer of all time should be able to write an algorithm that's better than O(n)...
How is this any different than a regular ICE car having remote start? Those have been pitched as "get the car warmed up inside and out before stepping outside!" deals for ages now.
That's a perfectly accepted use case now. The problem is the app/IoT side. Currently, it uses your keyfob to "authenticate" the request.
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
this does not bug me, much - the Nissan EV apps's remote HVAC feature is nice for warming up the car in the morning while it is still attached to the home charger. You can heat the interior without impacting the traction battery. Little known fact: heating a LEAF that's been parked outside in freezing weather has a greater impact on the battery (driving range) than cooling the same vehicle in the summer.
So they've created a feature that allows you to remotely run the heater or a/c indefinitely while nobody is occupying the vehicle? Seems to me that one of the first things done when designing this would to implement a timer and/or an occupancy sensor. Preheating/cooling the interior on a cold/hot day is great, and sometimes you just want to run into a store with your dogs in the back without leaving the engine on, but both of these scenarios should be rather brief in duration. Allowing the system to discharge the battery to the point of leaving you stranded is just piss poor design. Security flaw aside, I see no good argument for allowing your car to be used as an unattended fridge or oven for extended periods of time.
the only thing owners can do is disable the remote-control feature completely.
In other news, thieves discovered a way to break into garages using drive-by attacks (this happened in the 1980s or 1990s). The only thing owners could do was to disable the remote-control feature completely (or replace it with a different one).
Yes, there are a few environments where you need to be able to turn the heat or AC on before you get into the car. Alaska and Phoenix, Arizona, I'm looking at you. But for everyone else, the risk (upper bound on the probability of a high-cost hack is still too high) outweighs the convenience.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
All this talk about hijacking a car's HVAC system puts me into a cold sweat.
We drive our Leaf daily in Michigan. Check the forecast. We are in a blizzard.
You have to put snow tires on it, as the Eco tires lack traction. Mileage drops significantly on the Guess-O-Meter due to the cold, though an attached garage would help. We warm ours up on a timer. Blue Tooth is disabled through the console.
ProjectQ returns long time FreeBSD
Nissan Leafs use AT&T 2G modems to connect to the server, so do Ford's Focus Electric and Energi PHEVs. AT&T 2G dies at the end of 2016 so I guess the problem will solve itself eventually.
It was actually Troy's brother, Mike who discovered the vulnerability.
Calling someone a "hater" only means you can not rationally rebut their argument.
When the car's on a 240 volt AC charger, sitting outside on a cold day, you trigger the heat fifteen minutes before you leave the building.
That way the car's interior and battery pack are heated up using the AC connection and not the battery. Since the heater is the single most power-hogging load in the vehicle, and batteries are more effective when warm, this extends your driving range significantly.
Remember the Leaf is not a Tesla - it's an otherwise great car with the Achilles Heel of very limited range. It only goes about 80 miles before you have to do a 5-hour charge at 240 VAC (or 15 hours if you are using a regular 15 Amp 120 VAC socket, which is absurd compared to Tesla's 20 minutes supercharge providing a couple hundred miles). So anything you can do to extend range is worth the effort!
My wife's Leaf has a seven day program that conditions it environmentally before she leaves every morning while it's still on wall power. If she had to make an unexpected trip, perhaps to take a child to the emergency room in the night, she'd use the remote to override the normal programming and heat the car while we got everyone dressed for the drive. It's a valuable feature.
But am I worried about someone running the battery pack down by seizing remote control? In a word, no. Unless you live in a city it's incredibly unlikely; somebody would have to make a special trip to my house or my wife's workplace during a hellish freeze in order to pull it off, and the car would be plugged in under those circumstances so the battery would never run down anyway.
And even if you live in a city, where people can get close enough to your car to do this while you're off doing something, is this really a threat? I mean, sure, I've been cursed at, threatened and coal-rolled for driving a Prius, and presumably electric car owners get taunted and abused worse than hybrid drivers, but the neanderthals who hate low-emissions cars are not really very dangerous opponents. Just look at the anti-environmentalists here on slashdot - not exactly the brightest bulbs in the pack, now are they? I'd laugh in their faces if they'd get close enough, but the haters are losers, not even brave enough to get out of their cars, so I have to laugh at them from a distance.