* by smart car, I am not talking about self driving cars, I am talking about the gimmick of running some Android and iOS apps on one's car
A disconnected car is a requirement by any parameter of sanity given considerations of security including privacy, within a basic right of rejection of absurdity: but for how long will the "privilege" of avoiding lunacy will be granted?
In Europe already one has to have law-mandated (in terms of shipment) hardware modules removed (the "e-call"). For how long non-connected cars will be available on the market? It is even possible that some rogue legislating body will decide that some connected feature should be mandated...
You can send messages through ble or their cloud api / gsm. The app needed to first acquire a token to successfully establish a ble connection.
I'm not saying you can't buffer overflow through ble messages but at least the authentication was solid.
> The attack can’t be done at scale, because the local network that the vehicle owner is using would have to be infiltrated by the attacker.
Wikipedia says BlueLink uses Bluetooth [2]. So I'm not sure what connection is actually used, but if it's Bluetooth/local wifi and there are no further security bugs, then it would be unlikely that someone else could connect to the car in the first place.
[1] https://www.tomshardware.com/news/hyundai-blue-link-vulnerab... [2] https://en.wikipedia.org/wiki/Hyundai_Blue_Link
I use it mostly to track and keep a record of my Niro status.
I remember being excited when I could remotely control the lights on my table from school (fun little arduino/rpie + led project).
Now we remotely control cars with REST... Indeed cool and terrifying!
Been thinking - lately - to perhaps also use this package with Google Home, but haven't gotten around to it. Might come in handy fellow Hyundai owners.
It would be considerably less terrifying if this was just canbus messages.
BIG YIKES
