Hacker News Reader

Comment by avianlyric | Hacker News Reader

LLM seems to think it’s Toyota/Lexus based on an open source alternative client[1] documenting the same APIs that appear in the blog post.

A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.

[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...

View on HN

I received an email from Toyota asking me to connect to a newly-purchased vehicle in their app. I hadn't actually purchased a Toyota, but I went ahead and installed the app to see what it would do, and I ended up having full access to someone's car. I could see the car's location, lock/unlock it, and even start the engine remotely. I did try to contact Toyota about the issue through various channels and never got a response.

If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.

Yes the car in the video looks like an RX350

RAV4 is always in the top 10 of most stolen cars [1]. Maybe this is why.

[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...

Almost certainly not. For one, this hack only unlocks the car, it doesn't start it or allow it to actually drive. The reason they're stolen frequently is the same reason the Camry and Accord used to be the top stolen vehicles ~20 years ago: they're best-selling vehicles and thus the parts from them are relatively valuable and have a worldwide market.

Looks like the XA50 AFAICT

Definitely XA50. My sister bought one last week, time to find the sim card....

Reply on news.ycombinator.com