I'm routinely ridiculed for driving a car with a traditional ignition key, and insisting upon it, as if it's exclusive to Luddities.

Everyone else can enjoy their reflection/replay attacks or whatever.

Honorable mention to Toyota who has still not completely abandoned this simple, functional technology for a clunky fob that can be easily hacked.

FWIW, fobs are not for your convenience. It's for theirs.

Backup cameras are amazing. Especially now that I have kids shorter than my trunk line, I appreciate them even more.

A lot of the other stuff, though, I agree with you.

Ah, I agree for the most part, however, safety has definitely moved forward. There is a lot more to safety than airbags and seatbelts.

I miss them too.

Re. the radio: Now its a big useless screen that shows me useless data while still hiding all the useful data that I can get over OBD-II. And whats worse, that screen is tied to your fucking cars computer and configures your car so you cant remove it, no matter how much the software sucks. I hate my 2022 CR-V's garbage infotainment screen. Its a shit UI, shit audio quality, and the Bluetooth is bugged to all hell. I already have a computer with me in my car called a phone that does everything but better. And that's not saying much.

I came to the same conclusion. The exact year varies a bit by manufacturer.

Chevy's pre-2008 were in a good spot, maybe 2007 for the avalanche body change? Quite a few Hondas and Toyotas were good through the early teens, especially the 4 cylinders.

I have a late 80s GMC pickup, 2005 Buick, and a Chevy Volt. The only one I have any real issues with is the Volt, though that's only been the last couple years as the battery is getting old; the most frustrating thing is needing to run questionable software on an airgapped laptop just to turn the Volt back on when a high voltage safety flag is flipped tripped in the computer.

There still are cars being sold without much of new "technology", I daily a MY2024 Abarth 595 that still doesn't have start-stop, ECall, auto braking, telemetry, lane-assist, the infotainment is replaceable by a standard third-party box without messing with the rest of the car and still has a traditional ignition key. It's a basic turbocharged FIAT FIRE engine, so maintenance is stupidly cheap and anyone can do it.

I own a bunch of impractical cars, but my daily driver is a 2005 Honda. I always explain to people exactly this. It's the last good year before everything became too digitized and wireless. It's got physical controls, a real horn, a cable driven throttle and at 350,000 miles with so little maintenance and no sign of stopping.

I also own a 05 55 AMG, also all mechanical, but oh so impracticable :D

Think you're onto something. I'm still rolling a 2005 Toyota. Incredibly functional, reliable, and I can add whatever I want and choose instead of having it forced down my throat by the current wave of nonsense ... Oh, and zero worries about it being hacked !

I recently read "The car hacker's handbook". It seemed to explain the basics very well and pointed me to all the necessary software and hardware to get started.

It is an interesting topic for sure.

Look up OBD-II.

Could still contain it though. Bluetooth would only be needed for the non critical sound/calls/navigation stuff which should be it's own separate subsystem, on a read only OS with boot chain security so even if you did find an exploit in the bluetooth stack, it would only give you access to very unimportant things, and only until the car reboots.

Of course I don't expect it's implemented anywhere near securely, but in theory it's very possible. Game console companies have this stuff pretty solved.

Why leave out the first 2/3rds of the sentence, which are the more severe ramifications of the exploit?

>From there the attacker can track the vehicle’s location, record audio from inside the car, and obtain the victim’s phonebook data.

Combined with:

>"In some cases pairing is possible without any user interaction"

You end up with a stalker's dream.

  "In order to conduct an attack, the hacker needs to be in range and able to pair their laptop with the targeted infotainment system over Bluetooth. In some cases pairing is possible without any user interaction, while in others pairing requires user confirmation, or it may not be possible at all."

This is the wrong attitude to have.

There are cases where vulnerable code is found, but it may take weeks of tinkering to actually build an exploit that gets arbitrary RCE.

An example could be a buffer overflow that only allows a few bytes to be written. At first, you're likely just causing segmentation faults. DEP and ASLR will make writing an exploit that gives RCE difficult. This is when an attacker "may" be able to do something, if there's an attacker determined enough to figure out a full exploit.

The original researcher might not be interested in spending that time and just wants the vendor to fix it.