Dangerous control of my Jeep over the internet

[jebiruph]

Here are the related Wired articles

https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
https://www.wired.com/2015/07/jeep-hack-chrysler-recalls-1-4m-vehicles-bug-fix/
https://www.wired.com/2016/08/jeep-hackers-return-high-speed-steering-acceleration-hacks/

Sponsored

 

[SwampNut]

Here are the related Wired articles

https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
https://www.wired.com/2015/07/jeep-hack-chrysler-recalls-1-4m-vehicles-bug-fix/
https://www.wired.com/2016/08/jeep-hackers-return-high-speed-steering-acceleration-hacks/

You misspelled "unrelated." Hope that helps.

 

[eaglerugby04]

They've done that for years. You'd not believe how cheap my son keeps getting his service - often free for months, then $5/month or LESS. He's never paid full price and he really "works" their system.
My wife, same thing. We've been buying Grand Cherokees since shortly after they were introduced and of course that's always means satellite radio along with it. They hound the XXXX out of us! Emails, countless phone calls (from 2 or 3 different numbers at least indicating they hire people to work from home, perhaps? to market?)
It's unreal how long we've seen the emails and phone calls coming in after the service has expired on my wife's GCs (she trades roughly every 3 years - this time not quite 3 years as she wanted the keep the current GC platform)
Sirius just had another satellite launched - they had to pay for the launch and the satellite, of course - not cheap. That sort of tells me they aren't doing all that bad. No worse than any other industry is doing in these weird times.
They are also having to modify their marketing and pricing to deal with the pandemic and some people having a bit less money to spend in the last year. You can't keep pushing things the same old way at the same old prices these days (unless you are selling TP and hand sanitizer)

Lowest including the App I was able to get them was $120 out the door after a long battle and a true desire to walk away from them that year. They offered lower, but never with the app so I could use it in both cars. Now I am getting an email where they are offering it for $60 for the radio, the app, and with a free Echo dot valued at $20? Seems like they can not be doing well at all to just put that out there.

And to the guardian service when they called me trying to get me to subscribe, they were like "if you ever change your mind call us back or press the button in your car". Like seriously they are still paying somebody to keep that service on.

 

[SwampNut]

Satellite radio is a dead technology, and they see the writing on the wall. I cancelled my XM radio sub years ago when I did something that I felt really dumb about. Even working with tech every day, I kinda let this one slip. A song I really liked came on, and I grabbed my iPhone to look up the same song and stream it at higher quality.

Wait what? I had mindlessly done that a few times. Satellite radio is over-compressed and sounds crappy, streaming makes it useless for most people in most places. The Guardian system isn't even related to that at all, and I have no idea why Sirius is even involved. It's an AT&T connected car service. Not satellite.

All I want is remote start and door control, but to get that, you have to buy the top package. The lower levels include useless junk like that help button. Who the hell is going to call someone to help get directions??? So I'm waiting for the upcoming conversation when they try to get me to renew.

 

[ShadowsPapa]

Look at the years of the articles. MOPAR introduced the firewall in what, about 2016?
Is there anything RECENT? Like from 2019?

As far as the owner manual, it should be read in this way:
A breach is a possible threat to life and health
To MITIGATE this possibility, do not insert stuff into your system.
That's how it should be read.
First point - there are safety issues related to breached systems - you can avoid these issues by not sticking stuff in the USB ports.
But people read the top paragraph and not the next one.

Warning - this coffee is HOT and it could burn your private parts!!
So you avoid getting their coffee instead of reading the next line with is -
You can avoid personal injury to your private parts by not sticking this cup between your legs and spilling the contents.

 

[ShadowsPapa]

Satellite radio is a dead technology, and they see the writing on the wall. I cancelled my XM radio sub years ago when I did something that I felt really dumb about. Even working with tech every day, I kinda let this one slip. A song I really liked came on, and I grabbed my iPhone to look up the same song and stream it at higher quality.

Wait what? I had mindlessly done that a few times. Satellite radio is over-compressed and sounds crappy, streaming makes it useless for most people in most places. The Guardian system isn't even related to that at all, and I have no idea why Sirius is even involved. It's an AT&T connected car service. Not satellite.

All I want is remote start and door control, but to get that, you have to buy the top package. The lower levels include useless junk like that help button. Who the hell is going to call someone to help get directions??? So I'm waiting for the upcoming conversation when they try to get me to renew.

It will still be needed by people who don't have their entire music collection ripped onto a $1,000 phone.
What about the more than half of all people who don't have unlimited bandwidth or even broadband. We are limited to 6 gig on our phones, and 55 gig to our home internet (also via cell) because there is no other service available.
So some of us must use satellite even now. (my phone is a phone, not an iPod)
Actually, early Beatles still sounds pretty good on satellite compared to the vinyl I have LOL. And CDs, just not the same.
I don't feel like ripping my entire collection - and I don't have everything I like to listen to so radio it is. (and our neighbors have said the same - they don't have much at all for bought tunes, and aren't into the using a phone as an MP3 player, so on their long trips, it's satellite. And Larry likes the sports channels. So do my wife's cousins - the subscribe for the non-music and sports.

It may be "dying" but many still depend on it because in the USA, there's no clear clean alternative.
My IT boss liked it because it was portable - he could get it through a receiver in his office or his PC at home.

 

[johnparjr]

Everyone needs to quit feeding into this. Over the years I’ve learned people that are this paranoid are not going to listen to anything best bet is to let this thread die or close it. Nothing you say or do or post will change their mind

 

[LostWoods]

You misspelled "unrelated." Hope that helps.

Look at the years of the articles. MOPAR introduced the firewall in what, about 2016?
Is there anything RECENT? Like from 2019?

As far as the owner manual, it should be read in this way:
A breach is a possible threat to life and health
To MITIGATE this possibility, do not insert stuff into your system.
That's how it should be read.
First point - there are safety issues related to breached systems - you can avoid these issues by not sticking stuff in the USB ports.
But people read the top paragraph and not the next one.

Warning - this coffee is HOT and it could burn your private parts!!
So you avoid getting their coffee instead of reading the next line with is -
You can avoid personal injury to your private parts by not sticking this cup between your legs and spilling the contents.

The hack applied to just about every FCA vehicle and is why they now have the security gateway module. No solution is 100% secure in this case so it's only a matter of time before someone finds a new vulnerability. Even if it requires physical access, that's not exactly hard on a vehicle frequently found without doors.

You say don't stick things in ports but how many are rolling around right now with their gateway disconnected and a Tazer JL installed? How many have looked at their OBD-II port or the USB port in the center console recently?

Call it paranoia, I call it experience. Companies always prioritize delivering functionality over security and FCA was no different. So much of the IT world is held together by bubblegum and tape it's frightening and people who trust it without question are either stupid or naive. I'd rather the vehicle I drive do as little communication as possible.

 

[SwampNut]

It will still be needed by people who don't have their entire music collection ripped onto a $1,000 phone.
What about the more than half of all people who don't have unlimited bandwidth or even broadband. We are limited to 6 gig on our phones, and 55 gig to our home internet (also via cell) because there is no other service available.

I don't have my music collection ripped, nor a $1,000 phone (but close), nor unlimited bandwidth. I use less than 3GB/mo. Satellite is dead. A small number of people actually have a use for it, most just haven't figured out they don't need it. Like me, until a couple years ago. I was paying for something I only thought I needed. Satellite is the walking dead, which is why they are doing all these desperate offers. You could probably also take what you spend on XM and get much more cellular bandwidth, AND better sound quality.

Also, The Beatles are untalented hacks, and their "music" sounds like badgers having sex with hyenas on meth.

Everyone needs to quit feeding into this. Over the years I’ve learned people that are this paranoid are not going to listen to anything best bet is to let this thread die or close it. Nothing you say or do or post will change their mind

Nope, the willfully ignorant only double down on it. I was reminded of this thread while trying to deal with a customer call 15 minutes ago. New executive assistant for a long-time customer says that the conference system is broken. None of the conferences work. I walk through a few things, and go check logs. I see every conference she creates is being attended by one person, for a minute, then gone. WTF. I ask her about this and she says she "has to" call in to every conference ahead of time to be sure it works. For pretty obvious reasons, our system drops the room and prevents future calls after the last employee leaves. It's security against someone calling in and abusing it, and against having outside people stay on the call without an employee present. But, she insists, she must call in to test it. "It's on my list of things to do." WTFx2. So change the list, I tell her, and take that off, because the conferences always work. Her answer? "Ummm...but...I didn't make the list."

Sheesh.

 

[eaglerugby04]

Wait what? I had mindlessly done that a few times. Satellite radio is over-compressed and sounds crappy, streaming makes it useless for most people in most places. The Guardian system isn't even related to that at all, and I have no idea why Sirius is even involved. It's an AT&T connected car service. Not satellite.

All I want is remote start and door control, but to get that, you have to buy the top package. The lower levels include useless junk like that help button. Who the hell is going to call someone to help get directions??? So I'm waiting for the upcoming conversation when they try to get me to renew.

To fully not miss satellite I just need to build myself out a wireless android auto stick. Once I do that radio will really seem like a painful thing from the past.

This is where the security concerns come in for me. Who the hell's servers are we connecting to? It has Mopar/Uconnect branding. Sirius employees on the other end of the call function, but at the minimum rides the ATT network.

I agree so much useless stuff in the service and its all or nothing, even if your Jeep doesn't have features like remote start on it.

 

[LostWoods]

Also, The Beatles are untalented hacks, and their "music" sounds like badgers having sex with hyenas on meth.

How many likes can I give this line?

Also, the only reason satellite radio still exists is because the OEMs whore themselves out and stick it in every fucking vehicle. It's a thing that pulls you in by default and is about as hard to cancel as a gym membership.

 

[SwampNut]

The remote start is the "premium" service, so you can actually get the other services without that. I forgot how they break out exactly. But remote start in summer is my ONE big thing. I'd give up the rest, all I really need is remote start outside of fob range.

Whose servers? Yeah, these days, that's like asking who made the wheat in your mac & cheese. It's likely some AWS or Azure virtual servers, run by a group dedicated to the in-car services with AT&T, and branded/sold through the existing XM relationships with dealers. I suppose I could go try to track down some IP addresses when I have some spare time.

How many likes can I give this line?

I only regret that you have but one like to give.

 

[Mr._Bill]

The Uconnect features managed by SiriusXM are not new, and are available on other vehicles. My 2013 Nissan Leaf uses the same SiriusXM/AT&T setup for its remote features. They provide a platform for the Auto Industry to interface with that includes access security. If each car maker had to come up with their own remote access system, security would likely be a much bigger issue.

 

[SwampNut]

If each car maker had to come up with their own remote access system, security would likely be a much bigger issue.

Agreed. I wonder how much, if any, tech or services they share with Viper. I had their SmartStart system on several vehicles.

 

[ShadowsPapa]

At least it isn't Google/Alphabet.

Whose servers? Yeah, these days, that's like asking who made the wheat in your mac & cheese. It's likely some AWS or Azure virtual servers, run by a group dedicated to the in-car services with AT&T, and branded/sold through the existing XM relationships with dealers. I suppose I could go try to track down some IP addresses when I have some spare time.

Yup - Amazon or Mickysoft - cloud services not physical servers sitting in a closet.
Also likely hitting whatever is available or closest, good luck tracing. Could vary depending on where you are. East coast could be hitting different "servers" than west coast.

Hey, I just figured something out...... AT&T..........hmmmmm

Sponsored