Hacker News Reader

I could see an argument that the "viral challenge" is forcing them to change it. The manufacturers were aware of the problem, and doing the absolute minimum to address it. They were giving out steering wheel locks and offering to do a software fix for anywhere between $170 and $500. The issue spread through the "tiktok challenge" and that's forced them to make a move toward helping customers.

I guess it’s more like “companies forced to fix known flaw pointed out in viral TikTok trend” or something.

That's spot on. But the question for The Verge is, would you click on that headline?

I mean, yeah? That's actually still an interesting phenomenon that combines multiple hot button/trending things. I think in this case a more accurate headline is actually still plenty clickable. They simply didn't do a great job on the wording this time. It happens.

Or is it a paid story, with tiktok struggling to stay in the US, and this is a "tiktok good for all" story?

Trick question, I would not click on a link to The Verge.

Why not? From a tech journalism perspective, I find them as useful as any other news site.

I’m genuinely curious why you don’t like them

Is it really that different from the current headline?

The current headline suggests that TikTok is the reason for the update. At first I thought this was due to a software change in some tiktok app or something. But the reason for the change is the flaw, and tiktok users are merely calling attention to the existing flaw.

They went for years without fixing the flaw. Only TikTok exposing the flaw widely caused enough outcry to make them change.

It's like how it often takes public shaming on twitter to get a company to act like they should have done in the first place. It's not social media that causes the problem, it's just that the continuous bad "press" makes it inconvenient enough that a company might expend some meaningful effort into addressing their issue for a change.

I don't think a lot of companies really care about their reputation or about public perception. Some of the most hated companies on Earth continue to be enormously successful and shitty, but with enough attention over a long enough period of time and they'll often do something to make people shut up about their bad behavior on social media so that we'll move on to the next distraction and they can go back to being terrible.

My best friend is a KIA mechanic. Says they've known about this for a long time and simply refused to update it - which he said would be super easy to do a recall and have them simply put in the engine immobilizer.

I think you're right though. They tried ignoring the problem until it popped up on social media and cities have see huge increases in thefts for both Kia's and Hyundai's ever since.

AFAIK the real kick in their ass to finally get this going is insurance companies like State Farm refusing to insure their vehicles on a state by state basis.[1]

I own a 2020 Kia Sportage and I just got my offer in the mail today to go to Kia and get a free software upgrade right as I notice my insurance shooting up $40. Of note I'm in Louisiana where they are facing state farms new policy.

[1]https://www.wdsu.com/article/louisiana-state-farm-car-insura...

> "The thefts are reportedly easy to pull off because many 2015-2019 Hyundai and Kia vehicles lack electronic immobilizers that prevent thieves from simply breaking in and bypassing the ignition. The feature is standard equipment on nearly all vehicles from the same period made by other manufacturers."

It's more than that.

It's a combination of a lack of electronic immobilizer and putting the mechanical component behind a piece of plastic.

If they really want to save pennies on the immobilizer, they can move the mechanical piece further down the steering column

Additionally, this only happens for cars built for the U.S. The other countries have electronic immobilizer requirements, so they have them.

Ah that makes sense. I briefly combed the article and was confused because I had a factory immobiliser in my base model 97 Lantra.

was curious, all new cars in canada required them after 2007! https://www.cbc.ca/news/canada/anti-theft-device-now-mandato...

but now we're seeing a rash of thefts of keyless fob vehicles with a relay attack making me glad my tacoma needs a key

I thought keyless fobs all had some sort of counter to prevent replay attacks

Relay, not replay attack. For vehicles that unlock and push to start based on the proximity of the key, basically all you need to do is use a pair of software defined radios to trick the car into thinking that the key is there. Hence a relay attack, where one attacker is located near the key and the other is located near the vehicle, and the two attackers pass the components of the challenge/response to the vehicle via the channel between the two attackers.

Ah, that makes sense. Thanks for the detailed explanation

Don't they use time of flight?

Newer fobs, sure. But as this article demonstrates, it is very expensive and inconvenient to backport security improvements to millions of vehicles.

but that of course would cost more money to implement correctly with no further flaws, and many companies are opting for other solutions: https://www.carwow.co.uk/blog/keyless-car-theft-prevention

many many cars are vulnerable to it and will be for a long time.

> The feature is standard equipment on nearly all vehicles from the same period made by other manufacturers.

Even worse, that feature has been pretty common on mainstream vehicles since the 90s.

Which makes it an excellent opportunity to undercut competitors by a hundred bucks.

I wonder how systemic these kinds of shortcuts are in the wider market, not just automotive. How many problems that were solved in expensive ways decades ago are lurking beneath the surface, waiting to be discovered again because the problem - and solution! - are effectively invisible to most consumers?

Pretty much everything. The practice of engineering is as much an exercise in knowing what problems to solve as it is a practice in knowing which problems you can get away with not solving.

It's interesting to me that there's a similar problem in New Zealand with NZ-new and second-hand imports of the same model cars: the Toyota Prius C and Toyota Aqua are the same vehicle, but Aquas that were imported second-hand from Japan don't typically have immobilisers, and are heavily targeted for theft.

Given that ex-Japan models of cars are typically higher-spec than NZ-new equivalents, it's seems an odd difference; I have to wonder if there are differences in car theft rates in Japan or South Korea that play into the difference in what is a pretty basic piece of equipment in Western markets.

South Korea has 5.3 car thefts per 100k people per year. Japan has 28.1.

The US has 268.2.

https://en.wikipedia.org/wiki/Motor_vehicle_theft#Motor_vehi...

The proliferation of knowledge about how easy it was to do this, and the resulting subcultural trend, is the reason they are being forced to change it. Otherwise, people would be stealing them at the same rates they were before the recent trend.

From what I've gathered, "Viral TikTok Challenge" and its variations are sleeper-agent activation phrases for news editors which make them automatically accept the next story pitch you give them.

Headlines are chosen by the editor, not the journalist, to my knowledge.

Back in the '80s and '90s, many computer vendors like Sun and IBM shipped their systems with radically broken security configs, not to mention holes in their software. Often, the only way to get them to fix their problems was to make their problems very public. Hence, BUGTRAQ.

https://bugtraq.securityfocus.com/archive

if this is what it took to get two large multinational automakers to capitulate to basic theft immobilization in their vehicles to protect customers, perhaps we should reconsider the 'tiktok is objective evil' narrative.

Totally agree. Sounds like they're just using an established, more generic narrative to deflect accountability - basically, "It's not our fault, it's the hackers and bad kids on the internet." We see this all the time for security incidents: "Hackers steal data from BigCorp", when the headline should read more like, "BigCorp released a faulty product, and now you're suffering."

> perhaps we should reconsider the 'tiktok is objective evil' narrative.

I don't think the fact that tiktok was educating car thieves on ideal targets leading to an increase in stolen vehicles is a great example of tiktok's benevolence or enough to excuse it for the other harms it enables.

That said, nothing is pure evil all the time. Tiktok is just a popular means of communication and sometimes the message being communicated will be good and sometimes it will be bad. There's no criticism of tiktok's content that doesn't apply just as much to youtube or any other social media platform. However, tiktok still has their own privacy/security issues, the concerns over what and who gets promoted or suppressed by tiktok's algorithms/moderators, and of course that whole supporting china/genocide/the oppression of hong kong thing all of which makes me doubt the "tiktok is evil" narrative is going to go away just because a couple car companies caved to some bad press.

I just bought a 23 Kia Telluride (was also looking at palisades) to upgrade my 05 outback; I did extensive research, and ended up zoning in on Hyundai-Kia specifically because their electronics are so 'hackable,' while still containing all the cutting edge sensors.

I think it is going to be a tiny sliver of cars that are allowed to get away with having a vehicle be able to be controlled like a remote control from a completely unencrypted, trivially intercepted-and-changed protocol. In the future I suspect if manufacturers want to put these features on cars, they will have to protect the communication between the different systems.

How do you like it? And why did you pick the Telluride over the Palisade?

It's of course a huge improvement. It was close and I'd probably have been happy with either but ultimately the telluride had features i cared about (better towing) and palisade had some i didn't (electified third row seats); and I like the look of the telluride better.

I live in a rural area and got the trim with the 'offroadish' appeal; which didn't really exist in palisade.

Someone is clearly taking advantage of this:

More than 3,000 cars have been reported stolen in Minneapolis this year, including 432 Kias and 368 Hyundais. Officers are warning people to do what they can to protect their vehicles because this year, an average of 13 cars are stolen each day.

Prior to this spring, Hondas, Toyotas, Chevys, and Fords were the most common cars stolen in Minneapolis. But as word spread on social media this year about how easy Kias and Hyundais are to steal, they now account for more car thefts.

https://www.fox9.com/news/data-kias-and-hyundais-now-most-st...

I'm pretty sure that steering wheel locks were required by law starting in the 1970s. Does this process bypass the steering wheel lock somehow? Or do these cars not have steering wheel locks?

The plastic under the steering wheel is removed exposing the ignition barrel, at the end of the barrel you can pop it off. Exposing a little fob like turner, stick your usb cable over it and twist. The steering lock gets released. This is an old car stealing trick however, in the olden days you could do the same thing but the steering column would remain locked. Skinny 12 year olds in the UK had enough strength to snap the lock by grabbing the wheel and quickly pulling it in either direction, once you broke the lock you were good to go! We called them twocs (taken without owners consent) the whole adventure was known as joy riding..

The Kia boys were a couple of American youths doing something similar and uploading videos of it on tik tok. A reporter asked them, don’t you feel bad for people who’s cars you are stealing? The kid replied nah, they got insurance. The reporter- what if they don’t have insurance? The kid straight faced and serious- that’s illegal so they shouldn’t be doing that. Sure the video of that interview is out there somewhere. Hilarious. Also unlucky if your car got stolen. Don’t blame the kids they just bored and need guidance.

>This is like saying that movies in the 1980s sparked a rash of car thefts because they showed people hotwiring cars all the time.

Probably did, but the scale of the problem is much larger considering TikTok's reach.

This is funny because we have a Hyundai Elantra 2010 and that one has an immobilizer. You can't turn it on without the encoded key.

I guess that at some point Hyundai and Kia decided to save some money?

>I guess that at some point Hyundai and Kia decided to save some money?

If this can be fixed with a software update, that's not saving money. That's making money by making you pay extra for the immobilizer.