Hacker News Reader

Comment by usrusr | Hacker News Reader

So the immobilizer does not immobilize as much as expected/hoped. While that sure isn't something the manufacturer should be proud of, it is hardly a really critical problem, nowhere close to "stop driving until resolved". Immobilizers may have lowered car theft before, but never fully stopped it. The incentive situation for thieves has shifted a bit, that's all, a gradual change, not a 180 degree bit flip.

The bigger mistake than sourcing imperfect components is the attempted cover-up and I am positively surprised that this is even reflected in the headline. (at least theoretically: the first glance takeaway message for this story will always be "security hole in car!", no matter how much the author tries to put the cover-up in focus)

View on HN

The title seems to just be the standard clickbait approach to titles.

They got an injuction so that's a pretty public way to go about trying to do a "cover-up".

They've had the injunction for two years, but haven't initiated a recall in the meantime!

"Cover up" sounds accurate to me.

A recall for what? There's no safety issue here. There's no functional loss.

Unless they advertised the car as being unstealable or anything close there's not even a marketing point that's not working as one could reasonably expect. Carmakers call this a theft-deterrant feature, they don't even call it anti-theft or similar.

The immobilizer is not as secure as one would hope, but nobody ever promised you anything here in the first place.

What keeps your car from being stolen is not the immobilizer. The government and laws are what keep your car from being stolen.

It's obviously not a safety recall, but that doesn't mean it isn't serious.

Other companies have been known to do voluntary recalls defective locks, why is VAG exempted in your mind?

"It barely can even be considered an immobiliser" is almost certainly contrary to reasonable consumer expectations, and it wouldn't surprise me if the EU, at least, had laws regarding this kind of issue.

It's not serious. It still requires someone to specifically target you & your car with special gear and know-how far outside the realm of the typical car thief.

IDK about "far outside the realm of the typical car thief". Not that the typical car thief is going to be trailblazing the research, but once the research is done, it just takes someone putting a black box VW keyless unlocker together, and then it's in the realm of the typical car thief. In fact, at that point you're talking about the break in being the simplest part of the theft, with fencing being much more difficult.

You really think your typical car thief is going to go find and purchase specialized tools?

As always, relevant XKCD: https://xkcd.com/538/

Uhm... these sort of tools are being developed and purchased all the time in black markets.

See http://krebsonsecurity.com/ for plenty of examples.

> It's not serious. It still requires someone to specifically target you & your car with special gear and know-how far outside the realm of the typical car thief.

It wouldn't fill me with warm and fuzzies if I were sold a high-end door lock / alarm system / safe that was only exploitable with 'special gear and know-how far outside the realm of the typical thief.'

>It wouldn't fill me with warm and fuzzies if I were sold a high-end door lock / alarm system / safe that was only exploitable with 'special gear and know-how far outside the realm of the typical thief.'

Then you'd better never buy a high-end door lock / alarm system / safe, they all have that in common.

I'm not familiar with the current state of physical security exploitation, but I get the sense that it would take more than 30 minutes and pushing the button on a black box someone built for me to compromise. Unlike this.

The issue with electronic exploitation is that the know-how component is relatively trivially automated. Script kiddies, etc.

If I bought an $80k Porche, I'd be bit miffed that it could be stolen from a parking lot in the time it took me to have a sit-down lunch.

I personally have never gotten that sense, but as both of us are too lazy to check, to each their own.

If you bought an $80k Porshe you knowingly bought something you know will be a target for theft, and probably have enough money to have anti-theft insurance and be able to afford the inconvenience which would be your car vanishing. Yes apparently the ease of it being stolen is slightly greater than you thought when you bought it. But if not having your car stolen was a top priority for you then you would not of bought a car which people would want to steal as much.

As they mention in the article this would of been a difficult thing to fix on existing models, they did however change the system so it doesn't apply to new models.

It takes 10 seconds to bypass a window. Alarm systems are a deterrant, not prevention.

True, but isn't the whole point of an alarm system to draw attention to the thieves? If a thief can bypass the alarm system or other security measures, it may not look they are stealing the car. This gives them a significant amount of time before law enforcement can be informed and greatly lessens the chance of them being caught.

That's the whole point of an immobilizer. To prevent the typical physical methods (break window, hotwire ignition) from being accepted unless the security token is also present.

I don't think Porche et al are under any illusions their windows are rock-proof. ;)

You really think someone couldn't automate this, and sell the black box (or executable) to car thieves?

Reply on news.ycombinator.com