Hacking Kia: Remotely Hijack A Car Using Only Its License Plate

September 27, 2024 by Maya Posch 55 Comments

These days everything needs to be connected to remote servers via the internet, whether it’s one’s TV, fridge or even that new car you just bought. A recently discovered (and already patched) vulnerability concerning Kia cars was a doozy in this regard, as a fairly straightforward series of steps allowed for any attacker to obtain the vehicle identification number (VIN) from the license plate, and from there become registered as the car’s owner on Kia’s network. The hack and the way it was discovered is described in great detail on [Sam Curry]’s website, along with the timeline of its discovery.

Notable is that this isn’t the first vulnerability discovered in Kia’s HTTP-based APIs, with [Sam] this time taking a poke at the dealer endpoints. To his surprise, he was able to register as a dealer and obtain a valid session ID using which he could then proceed to query Kia’s systems for a user’s registered email address and phone number.

With a specially crafted tool to automate the entire process, this information was then used to demote the car’s owner and register the attacker as the primary owner. After this the attacker was free to lock/unlock the doors, honk to his heart’s content, locate the car and start/stop the vehicle. The vulnerability affected all Kia cars made after 2013, with the victim having no indication of their vehicle having been hijacked in this manner. Aside from the doors randomly locking, the quaint honking and engine turning on/off at a whim, of course.

Perhaps the scariest part about this kind of vulnerability is that it could have allowed an attacker to identify a vulnerable parked car, gained access, before getting into the car, starting the engine and driving away. As long as these remote APIs allow for such levels of control, one might hope that one day car manufacturers will take security somewhat more serious, as this is only the latest in a seemingly endless series of amusingly terrifying security vulnerabilities that require nothing more than some bored hackers with HTTP query crafting tools to discover.

Continue reading “Hacking Kia: Remotely Hijack A Car Using Only Its License Plate” →

A render of an SAO that resembles a Speak 'n Spell.

2024 SAO Contest: Speak, SAO

September 27, 2024 by Kristina Panos 7 Comments

For some of us, the Speak ‘n Spell evokes pleasant memories of childhood as our first computer, along with one of those Merlin things. For others, it’s the ultimate circuit bending victim. For [Jeremy Geppert], they’re all-around good fun and he wanted to immortalize the device in a Simple Add-On (SAO).

This is [Jeremy]’s first board and SAO rolled into one, motivated by both Supercon and the SAO Contest. To start things off, [Jeremy] scaled down the design we all know and love to fit a 128×32 OLED display, and it looks great. The plan is to have the display, an amplified speaker, and a single button for input.

Before committing the board order, [Jeremy] had a brief freak-out about the pin distance as it relates to the window for the OLED display. Luckily, his brother suggested checking things first by printing a 1:1 scale image of the board outline, and laying that over the display.

This is the week it all comes together, as the tiny switches and (regular-size) connectors have arrived, and the boards are due quite soon. Go, [Jeremy], go!

Retro Gadgets: Things Your TV No Longer Needs

September 27, 2024 by Al Williams 62 Comments

It is hard to imagine that a handful of decades ago, TV wasn’t a thing. We’ve talked a few times about the birth of television. After an admittedly slow slow start, it took over like wildfire. Of course, anything that sells millions will spawn accessories. Some may be great. Then there are others.

We wanted to take a nostalgic look back at some of the strange add-ons people used to put on or in their TVs. Sure, VCRs, DVD players, and video game consoles were popular. But we were thinking a little more obscure than that.

Rabbit Ears

Every once in a while, we see an ad or a box in a store touting the ability to get great TV programming for free. Invariably, it is a USB device that lets you watch free streaming channels or it is an antenna. There was a time when nearly all TVs had “rabbit ears” — so called because they made an ~~inverted~~ V on the top of your set.

These dipoles were telescoping and you were supposed to adjust them to fit the TV station you were watching but everyone “knew” that you wanted them as long as possible at all times. Holding one end of them gave it a ground and would give you a major improvement in picture. People also liked to wrap tin foil around the tips. Was it like a capacitive hat? We aren’t sure.

The better rabbit ears had knobs and switches along with multiple elements. If you lived close to a TV station, you probably didn’t need much. If you didn’t, no number of fancy add-ons would likely help you. Continue reading “Retro Gadgets: Things Your TV No Longer Needs” →

Hackaday Podcast Episode 290: IPhone’s Electric Glue, Winamp’s Source Code, And Sonya’s Beautiful Instructions

September 27, 2024 by Tom Nardi 14 Comments

This week, Hackaday Editors Elliot Williams and Tom Nardi start things off by acknowledging an incredible milestone: 20 years of Hackaday! Well, probably. When a website gets to be this old, it’s a little hard to nail down when exactly things kicked off, but it seems like September of 2004 is about right. They’ll also go over the latest updates for the fast-approaching Hackaday Supercon, and announce the winner of another tough What’s That Sound challenge.

From there, the conversation makes its way from the fascinating electrically-activated adhesive holding the latest iPhone together to pulsed-power lasers and a high flying autonomous glider designed and built by a teenager. You’ll also hear about 3D printing on acrylic, home biohacking, and the Tiny Tool Kit Manifesto. Stick around to the end to hear the duo discuss the fine art of good documentation, and an incredible bodge job from Arya Voronova.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Download in DRM-free MP3 and savor at your leisure.

Continue reading “Hackaday Podcast Episode 290: IPhone’s Electric Glue, Winamp’s Source Code, And Sonya’s Beautiful Instructions” →

Makerpipe Turns Conduit Into Structures

September 27, 2024 by Dan Maloney 25 Comments

At the risk of stating the obvious, building big things can be difficult. Sure, parts that fit on the bed of a 3D printer are easy to make, if not particularly fast, and scaling up from there is possible. But if you need a long beam or structural element, printing makes little sense; better to buy than build in that case. The trouble then becomes, how do you attach such parts together?

Enter Makerpipe. This South Carolina company, recently out of a crowdfunding campaign, makes a range of structural connectors and fittings for electrical mechanical tubing, or EMT, the galvanized steel conduit used in the electrical trades. EMT is widely available in multiple sizes and is relatively cheap, although we have noticed that the price here has ticked up quite a bit over the last couple of years. It also has the advantage of being available off-the-shelf at any big-box home improvement store, meaning you have instant access to a fantastic building material.

Makerpipe’s bolt-together couplings let you turn pieces of EMT, easily cut with a hacksaw or pipe cutter, into structures without the need for welding. Yes, you can do the same with extruded aluminum, but even if you’re lucky enough to live near a supply house that carries extrusions and the necessary fittings and is open on Saturday afternoon, you’ll probably pay through the nose for it.

Makerpipe isn’t giving their stuff away, and while we normally don’t like to feature strictly commercial products, something that makes building large structures easier and faster seems worth sharing with our community. We’ve done our share of fabricobbling together EMT structures after all, and would have killed for fittings like these.

Continue reading “Makerpipe Turns Conduit Into Structures” →

This Week In Security: Password Sanity, Tank Hacking, And The Mystery 9.9

September 27, 2024 by Jonathan Bennett 15 Comments

It looks like there’s finally hope for sane password policies. The US National Institue of Standards and Technology, NIST, has released a draft of SP 800-63-4, the Digital Identity Guideline.

There’s password guidance in there, like “SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords” and “SHALL NOT require users to change passwords periodically.” NIST approved passwords must be at least 8 characters long, with a weaker recommendation of at least 15 characters. Security questions like name of first pet get the axe. And it’s strongly recommended that all ASCII and Unicode characters should be acceptable for passwords.

This is definitely moving in the right direction. NIST guidelines are only binding for government services and contractors, though they do eventually get picked up by banks and other industries. So there’s hope for sane password policies eventually.

Tank Hacking

Researchers at Bitsight are interested in infrastructure security, and they opted to take a closer look at Automatic Tank Gauging (ATG) systems. Those are found at gas stations, as well as any other facility that needs automated monitoring of liquids or gasses in a tank. There is an actual ATG message format, originally designed for RS-232 serial, and woefully unprepared for the interconnected present. The protocol allows for an optional security code, but it maxes out at only six alpha-numeric characters.

Among the vulnerabilities getting announced today, we have a pair of CVSS 10 command injection flaws, a quartet of 9.8 authentication bypass flaws, with one of those being a hardcoded credential — AKA a backdoor. The other CVSS9+ flaw is a SQL injection, with a trio of slightly less serious flaws. Continue reading “This Week In Security: Password Sanity, Tank Hacking, And The Mystery 9.9” →

British Commuters Get Their WiFi Hacked

September 27, 2024 by Jenny List 24 Comments

As if there weren’t enough worrying global news stories already, today the British press and media have been full of a story involving the public WiFi networks at some major railway stations. Instead of being faced with the usual don’t-be-naughty terms and conditions page, commuters were instead faced with a page that definitely shouldn’t have been there.

Hackaday readers will immediately have guessed what is likely to have happened. This is probably more of a compromise of the page than of the network itself, and, indeed, the BBC are reporting that it may have come via an administrator account at Network Rail’s er… network provider. Fortunately, it seems the intent was to spread a political message rather than malware, so perhaps those travelers got off lightly. The various companies involved have all got the proverbial egg on their faces, and we’re glad we don’t work in the IT department concerned.

Continue reading “British Commuters Get Their WiFi Hacked” →