>We reported the issue to SiriusXM who fixed it immediately and validated their patch.
Nice to see that it was addressed quickly, but it's frightening that such a shoddy system design was accepted by auto manufacturers with seemingly no oversight.
(I'm not endorsing this perspective, to be clear, just recognizing that it exists.)
When there's damnable, devastating security news for some publicly-traded company that makes it to the big news sources, the stock takes a 0-10% dive and then completely recovers within a couple weeks. Even if the company's response is completely bungled, mismanaged, or miscommunicated, the market doesn't understand security issues and it seems like the company just benefits from the news exposure.
I wish I kept notes on the last few times I've seen this happen so that I could cite examples.
If the customers cared, there would be significant drop in the price of the stock because a vulnerability like this would result in lower sales
What are you even talking about?
WHAT ARE YOU TALKING ABOUT?
On the other hand revealed preferences tell a completely different story about physical security.
That's thanks to the old tale of "outsourcing what is not a core business". I get it, it's fine when you have the capacity and capability to do oversight - but in most cases, the beancounters eventually decide that this capacity is not needed, and then shit like this happens.
Except that this telematics product is a core business unit for SiriusXM.
I have seen companies prepare for a SOC2 compliance audit, and I get the feeling that these companies like vendors because the audit doesn't apply to vendors, so all they really have to do is ask the vendor to pinky swear that the software is safe.