> it fed a crime wave, something a number of US cities are suing Kia over

A large part of the crime wave stems from the policies these cities implemented. Many times from the same leaders who are suing Kia now.

For instance, a friend got their car stolen in D.C. After they caught the guy, they let him go with no consequences, because they said he was under 25 and it was the first time they caught him. D.C. recently put a convicted murderer on the sentencing commission who believes that this kind of "it's not really their fault if they're under 25" thinking should be extended to murders as well.

Local politicians even told us there wasn't a crime wave, and that it was just a fake narrative. Then when that stopped working, they started pointing fingers at everyone else they could.

Regarding the Kia Boyz - immobilizers have been mandatory in most of Europe since late 90s, in Canada since 2007. Basically there is something to put on (lack of) regulations as well as on HKMC.

> If you've read about carjacking waves in places like Milwaukee and Chicago: that was largely driven by a decision Kia made, which resulted in the nationwide deployment of a giant fleet of "burner" cars that could be stolen with nothing but a bent USB cable.

"A nationwide epidemic of Kia thefts" seems to be a natural consequence of decreased security. However, that carjacking in Milwaukee and Chicago specifically would follow from a nationwide omission of interlocks is not obvious as the vehicles are easily stolen without the need for personal confrontation. What is the connection of Kia interlocks to carjacking in Milwaukee and Chicago?

We Canucks needs all the features we can get to stop cars from being stolen, without exaggeration a car is stolen in Canada every 5 minutes on average.

Because car manufacturers have such a clear decision making role in the legal and judicial process of a place like Milwaukee. It can't be that the government simply realized that they aren't legally obliged to deal with any problems the populace have and simply let them eat cake in a 21st century way.

This couldn't be the same state where they tried to just bribe a foreign company known for exploitative labor practices to set up a facility there could it: https://en.wikipedia.org/wiki/Wisconn_Valley_Science_and_Tec....

How did the insurance companies respond to this? They should have made the cars extremely expensive to insure, no?

Largely driven? You're forgetting at least one variable

I wasn't sure what an "interlock" was, and it's a breathalyzer that prevents the vehicle from starting. Was that a mistake?

Edit: ah! I think you meant engine immobilizer

> something a number of US cities are suing Kia over

I can think of nothing more American than suing car manufactures because they're too easy to steal. The US is truly screwed.

Don't anthropomorphize the lawnmower and blame Kia for this, blame the NHTSA for making it legal to skimp out on immobilizers in the first place. Regulations matter!

Kia is a joke car manufacturer. It’s surprising that they are still able to sell cars and stay in business

If you get 10x MoM growth you can lobby for it to be legal next year

Something kinda like that was done, TikTok apparently algorithmically identified likely 'drivers' and flooded them with videos instructing and glorifying taking the cars for a joyride... while other platforms did not promote and even took those videos down.

[flagged]

A Kia authorised dealer being able to look up any Kia has some very useful benefits (for the dealer, and thus Kia).

If a customer has moved into the area and you’re now their local dealer they’re more likely to come to you for any problems, including ones involving remote connectivity problems. Being able to see the state of the car on Kia’s systems is important for that.

Is this a tradeoff? Absolutely. Can you make the argument the trade off isn’t worth it? Absolutely. But I don’t think it’s an unfathomably unreasonable decision to have their dealers able to help customers, even if that customer didn’t purchase the car from that dealer.

> What if a dealership employee uses this to stalk an ex or something?

Yes, and everyone should remember this the next time these companies and their lobbyist run TV ads telling you that your wives and daughters will be stalked and raped in a parking lot if Right to repair is allowed to pass.

Yeah for some reason I find it so creepy that Kia ties your license plate number to your car's functionality. I don't know why but I feel like those two things should operate exclusively.

What if the internet is used for that?

Security is an afterthought... nobody cares, until shit hits the fan.

[dead]

(this was originally posted in https://news.ycombinator.com/item?id=41657833 but we merged that thread hither)

Almost all modern cars have a way of providing or grabbing location data, however most manufactures do not "Spy" on your car by default, this would violate CCPA, colorados privacy act, GDPR... ETC. The users need to opt-in to telematics data. For example in Hyundai case when you create a "Blue link" account and accept their terms of service you are connecting whatever vehicle you have verified on your account to their telematics system, and subsequently opting in to tracking.

Manufactures like VW/Audi place an opt out within the vehicle itself so if you opt out of telematics in the vehicle you are in a full privacy mode and the manufacture cannot get the data or override this request. This covers the scenario if other "Users" of the vehicle are driving and would choose to opt out outside of the main users/owner.

So some bake it into your app registration and signup, and some leave it in the vehicle. The gist is you can opt out, and if the manufacturer does not respect that you have grounds to sue, Currently there is a lawsuit against GM/Caddy because a user did not opt-in to Usage Based Insurance, but their information was captured and brokered blocking them from acquiring new insurance.

If you own a car since about 2010 onwards it's probably ratting you out already.

https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...

Not just KIA. Most if not all major automobile manufacturers track a huge amount of data on the vehicles [and their owners/operators]. For example, many vehicles come with that OnStar thing, and so they have a baseband processor and even LTE as well as a GPS receiver, and it's always on even if you don't pay for the service, which means that the manufacturer gets to know your vehicle's location and all the places you go and the routes you take.

I question some of this though. I have an older Kia that I’m pretty sure has no cell modem yet the support table shows it can be geolocated.

After your phone which is the ultimate oppressor device, now your car is also snitching on you. Nice future ahead of us.

> car that requires you to create an account online to "activate" the vehicle

I have a 2023 Kia and that's not necessary. You only need the account if you want to use the optional online services.

That is unusual. They give 7 years warranty compared to European or US cars manufacturers and it often shows why. They are indeed dependable.

Well... There is no reason to have a middleman like the OEM, so the car could be connected just with the formal owner (i.e. with a personal subdomain o dyndns), FLOSS stack under users control and some hard limits (like you can't act on the car if it moving and so on).

Ok, I wont.

If it's done well, there are some useful features there.

App unlock, remote start + remote temperature control. All very useful.

I couldn't imagine buying a car without carplay now.

In the U.S., by 2026, all new cars must have a "kill switch", and that includes a remote operation. The requirement is about preventing drunk driving, but it's being interpreted by many to require a kill switch.

Here's the NHTSA report to Congress about this:

https://www.nhtsa.gov/sites/nhtsa.gov/files/2023-07/Report-t...

> Section 24220, “ADVANCED IMPAIRED DRIVING TECHNOLOGY,” of the Bipartisan Infrastructure Law (BIL), enacted as the Infrastructure Investment and Jobs Act (IIJA), directed that “not later than 3 years after the date of enactment of this Act, the Secretary shall issue a final rule prescribing a Federal motor vehicle safety standard (FMVSS) under section 30111 of title 49, United States Code, that requires passenger motor vehicles manufactured after the effective date of that standard to be equipped with advanced drunk and impaired driving prevention technology.” Further, the issuance of the final rule is subject to subsection (e) “Timing,” which provides for an extension of the deadline if the FMVSS cannot meet the requirements of 49 USC 30111.

Now, I don't see anything in there about a "rmeote switch", and I don't understand how the "remote" bit would work to prevent DUI.

Don't know about 2024, but my 2023 Honda Civic EX-B (Canadian market) is actually pretty old school. Yes, it has the keyless unlock and even a remote engine start button on the keyfob (can be disabled, thankfully - car is parked inside and we have kids!) But no cellular connectivity, no wifi, and all the touchscreen stuff is "extra icing" - all the controls you need are there in physical form except for some radio and cell phone call functions. Yes, the car may be vulnerable to signal boost kind of attacks (to pretend the keyfob is nearby when it's not) and possibly the "pop off a headlight and get into the CANbus" attack. But no cloud dependency and no way for the cloud to reach in and mess things up. Also, the software it does have seems "debugged" based on a year of using it.

Anything in the last 10 years is probably ratting you out already.

https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...

You can pull the fuse on a ford maverick and it physically disables the telemetry. You could also opt out and disable it through the settings. Remote start from your keyfob still works. As expected remote start, seeing where you parked, remotely locking the car through the ford app will not work.

It would be interesting to have a list of modern cars without these kind of connected features, but I haven't found any.

depends how wide is your definition of "connected features". all modern vehicles in the EU are required to have the eCall feature which uses cell to send your location in case of a crash. Since the hardware is in there I have absolutely no faith in car makers/govs to not use it for other purposes (now or in the future) https://en.m.wikipedia.org/wiki/ECall

Cut the cords to the cellular module

its brought about a lot of shops that can rip the electronic tracking devices out of your car pretty easily too, which is nice in case you don't feel like being someone's datapoint

> but at least my vehicle isn't ripe for theft/abuse.

From this particular vulnerability. If anything, I'd still be concerned.

The warrant is still necessary, evidence obtained through illicit means is generally not acceptable.

By law, we need to be able to disconnect any product whose core functionality does not depend on the network.

>These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.

It's hardly unique to Kia!

https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...

Don't feel stupid, feel a little angry. The only thing you could have done to prevent this was not buy a Kia.

I don't think the police are using this software. I'm pretty sure they have their own official access to governmental (DMV) records.

From https://www.hyundaiusa.com/us/en/vulnerability-disclosure:

  In submitting reports, please note that although Hyundai Motor America sincerely
  values vulnerability reports, we do not provide monetary compensation (“bounties”)
  or non-monetary remuneration in exchange for submitted reports. This program is
  only meant to facilitate the responsible reporting and resolution of cybersecurity
  vulnerabilities.

Almost all vehicle manufacturers have bug bounty programs of some kind (open or closed) but I seriously doubt Kia is one of them.

BTW, the Tesla bug from April is really scary. $100K is peanuts for the ability to remotely control the engine from an adjacent vehicle.

Hardware companies usually suck at doing software.

[flagged]

I'm trying to imagine time when I would want my car to be connected to the internet. Hard to come up with, other than remote locking, that's it for me. Not sure that's worth the attack surface.

What I do find useful is the car having "cellular connectivity" to make emergency calls. But that doesn't require internet connectivity.

At least have a hard toggle switch mandated just like the button for emergency flashers.

Why would any of the decision makers want to do that? It's not like 99.9% of consumers appear willing to pay 10 cents more for an unconnected car.

Yes, we can still modify our cars as we please. Maybe it won't be legal. But we are able to. And we should.

They have the best EV architecture on the planet currently; despite all the hacking issues, I'm still considering an EV6 for my next vehicle. Probably with a yanked cell radio fuse...

Cars are essential to living in America except for a few cities. Car manufacturers can basically do whatever they want.

There was a recent YouTube video with a car thief that basically showcased a "special" tablet that could get any car started in a minute by plugging into the OBD port. Pretty shitty security model if it relies on no tablets getting out.