Slashdot Mirror
Nissan Leaf HVAC-Hack Vulnerability Disclosed (bbc.com)
GWBasic writes: Some of Nissan's Leaf cars can be easily hacked, allowing their heating and air-conditioning systems to be hijacked, according to [Troy Hunt,] a prominent security researcher. .... Mr Hunt said the root of the problem was that the firm's NissanConnect app needed only a car's vehicle identification number (VIN) to take control. That means that pranksters could pretty easily run down a Leaf's battery via Nissan's app just by cycling through VIN numbers, which, the article points out, typically vary only in the last few digits for same-region Leafs, and for an electric car that's a big deal -- you can't just get a quick jump and be on your way. For now, Hunt says, the only thing owners can do is disable the remote-control feature completely.
I've been driving for nearly 30 years and I have yet to come up with a reason why my car needs to be on the internet. Or my DVD player. Or TV. Or refrigerator. Or light bulbs. They all seem to work just fine in standalone mode.
Let me Google that for you:
http://www.mattcastruccinissan.com/blog/how-to-jumpstart-a-nissan-leaf/
You can jump a Nissan Leaf if you want.
.
It appears that is the only way the car manufacturers will sit up and pay attention to the need for security in their vehicles.
You mean an app used utterly lame security and used something readily available?
Well, I'm totally shocked.
No, wait, the other one where I pretty much expect all of this crap to be broken by design.
Almost without fail, if you can control it from your smartphone, chances are good that someone else can.
No thanks.
Lost at C:>. Found at C.
App's can't keep me cool.
You mean cycle through the one single VIN stencilled into the windscreen of your mortal enemy's Nissan Leaf, right? I think even the most inept developer of all time should be able to write an algorithm that's better than O(n)...
How is this any different than a regular ICE car having remote start? Those have been pitched as "get the car warmed up inside and out before stepping outside!" deals for ages now.
That's a perfectly accepted use case now. The problem is the app/IoT side. Currently, it uses your keyfob to "authenticate" the request.
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
Why would you have a remote control feature on a car enabled at ALL?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
this does not bug me, much - the Nissan EV apps's remote HVAC feature is nice for warming up the car in the morning while it is still attached to the home charger. You can heat the interior without impacting the traction battery. Little known fact: heating a LEAF that's been parked outside in freezing weather has a greater impact on the battery (driving range) than cooling the same vehicle in the summer.
Yep. It's completely a non-problem when I go out to my car after work and it won't run. Oh, wait, your were trolling, right? Right? Maybe you didn't have time to put forth a more compelling argument because you are too busy adding security to an app that has access to certain controls on my car, though I can't possible see why any rational person in the world would have expected that SOME form of authentication/authorization would be included in a product that I paid money for. After all, I usually invite the neighborhood kids to come turn on the air conditioning and heated seats in my car whenever they get the urge. 'Cause, why wouldn't I, right? Such a non-problem.
So they've created a feature that allows you to remotely run the heater or a/c indefinitely while nobody is occupying the vehicle? Seems to me that one of the first things done when designing this would to implement a timer and/or an occupancy sensor. Preheating/cooling the interior on a cold/hot day is great, and sometimes you just want to run into a store with your dogs in the back without leaving the engine on, but both of these scenarios should be rather brief in duration. Allowing the system to discharge the battery to the point of leaving you stranded is just piss poor design. Security flaw aside, I see no good argument for allowing your car to be used as an unattended fridge or oven for extended periods of time.
Because it's really convenient to be able to start the air conditioning remotely, so that the car is already cool when you get in it. This is especially important with electric cars, where the power to cool the car down initially will then be drawn from the grid, not the battery.
I have seen those and can understand its appeal. Especially if it's limited against moving the car out of park.
Picture yourself on a 20 degree day starting your car by remote and having the heat start while you sit in your warm living room enjoying your first cup of coffee.
Why would you have a remote control feature on a car enabled at ALL?
If Google is successful, it will soon also support the command "go pick up the pizza I ordered."
How? Sit in the parking lot flashing lights and honking horn until somebody notices and drops the pie in the driver's seat?
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
the only thing owners can do is disable the remote-control feature completely.
In other news, thieves discovered a way to break into garages using drive-by attacks (this happened in the 1980s or 1990s). The only thing owners could do was to disable the remote-control feature completely (or replace it with a different one).
Yes, there are a few environments where you need to be able to turn the heat or AC on before you get into the car. Alaska and Phoenix, Arizona, I'm looking at you. But for everyone else, the risk (upper bound on the probability of a high-cost hack is still too high) outweighs the convenience.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Your Goose is cooked man... The heat is on!
At least until the battery dies...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
All this talk about hijacking a car's HVAC system puts me into a cold sweat.
Assuming you have the thing plugged in.
Which, given that these types of cars are pretty much exclusively commuter vehicles, and many workplaces provide plugs these days is pretty likely.
Generally, they're either sat at work, or at home, usually plugged in.
That's the big advantage of an electric car, no range anxiety, unlike with a petrol car. You never have to think about filling it up with petrol, because it just gets plugged in every time you stop.
Your silly is my nice convenience. Open the windows from my office on a hot sunny day. Car isn't a million degrees by the time I get out there. Forget to close my windows and it starts raining? Close them remotely, and I stay dry.
Leaf HVAC is the same thing, and is actually more important for an electric, assuming you're plugged in. You can start the heat or A/C when you're parked, still plugged in. The car gets up or down to your desired temperature while still running on the grid instead of draining your battery. Not having to ride around in a cold/hot car is just a nice perk.
Of course there should be a secret to go with the known value of the VIN. VIN is readable in the windshield, so if you want to get back at someone who's parked like an ass, just start his A/C & kill his battery...
Ah, Nissan didn't take long to put their damage-controlls online.
Thanks for sharing the company's PR perspective with us, AC. But how 'bout we actually discuss the real facts and the real effects, hmm?
Slashdot moderators... I am disappoint.
Welcome to the Panopticon. Used to be a prison, now it's your home.
I own a Leaf in the desert southwest. Being able to turn on the AC from your phone is fantastic. The difference between getting into an 80 degree car and a 120 degree car is pretty huge.
Nissan Leafs use AT&T 2G modems to connect to the server, so do Ford's Focus Electric and Energi PHEVs. AT&T 2G dies at the end of 2016 so I guess the problem will solve itself eventually.
Why would you have a remote control feature on a car enabled at ALL?
For people who live in properly hot or cold areas, being able to heat or cool your car down to a sensible temprature before getting in is a godsend. Especially if you live in a humid area and need to demist your windows when it gets as low as 16 degrees C.
Also see this informative picture.
I used to drive a manual with a metal gear stick knob, I have the H-pattern permanently burned into my palm as a result.
Calling someone a "hater" only means you can not rationally rebut their argument.
Wow..I have yet to see ANY charging stations anywhere in the city, much less at a parking lot where people work.
I would guess they're pretty much only prevalent out west in CA and the like and maybe in some of the North East states?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
It was actually Troy's brother, Mike who discovered the vulnerability.
Calling someone a "hater" only means you can not rationally rebut their argument.
I am never moving to the southwest.
Snowden and Manning are heroes.
Well because ......... Internet of Shit
https://twitter.com/internetof...
Self Defense - A Human Right www.a-human-right.com
I preferred the pizza analogist.
You're assuming the pizza restaurant is staffed. Instead, the pizza is assembled and cooked by a robotic system. Your self-driving car communicates directly with the pizza restaurant main AI, informing it when it arrives, at which point a robotic arm puts the pizza in the car. Meanwhile, sentry guns fire rubber bullets at the hoards of permanently unemployed and desperate humans attempting to loot the pizza restaurant and turn your car to scrap. During all of this, you lounge casually around your living room in the fortified neighborhood you call home, secure in the certainty that what differentiates you from the ravenous hordes is that they are stupid and lazy.
120F cars are not uncommon, even in not the south west. A car sat out on a 75F will be 120F inside in about an hour. On a 100F day it'll be 150F inside in the same time.
That's the big advantage of an electric car, no range anxiety, unlike with a petrol car.
No one gets range anxiety when they can fill up anywhere on their route in less than five minutes.
(Is this one of those things where you think that if enough people repeat it enough it will become true? Those approaches hardly ever work).
I'm a minority race. Save your vitriol for white people.
I've never seen a plug anywhere for electric cars to charge up. I've heard some employers out in California provide them and maybe a few other places but even there I hear complaints about not enough charging ports. Does your employer have a port for every single electric car?
The best part is really you're not turning the car on, just the heater. I can't wait until the range gets up to around 300 miles and charging stations become normal. Until then I'll just keep dreaming.