News for hackers. Stuff that matters.

A comment on When Your Used Car Is a Little Too ‘Mobile’.

Re:When Your Used Car Is a Little Too ‘Mobile’ by tyho on Thursday February 06, 2020 @12:48PM (#22258286)
BMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into the engine block and chassis so obviously cannot be changed, even after I sell the car. I also suspect these numbers are sequential. Till this car is scrapped I will be able to locate it, turn on the AC, unlock the doors etc.
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by nkrisc on Thursday February 06, 2020 @12:51PM (#22258319)
On many (all?) modern cars it's also visible at the bottom of driver's side of the windshield. A car's VIN is public information.
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by LinuxBender on Thursday February 06, 2020 @12:54PM (#22258346)
I have a small piece of black paper over mine. I am happy to let a law enforcement officer view it if they ask.
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by tbyehl on Thursday February 06, 2020 @01:49PM (#22258955)
Not illegal per se, but you're handing cops PC to enter your car to move the paper and any further evidence of "crime" they can see while doing that is fair game.
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by RandomBacon on Thursday February 06, 2020 @03:40PM (#22260051)
I thought about doing that, but if someone wants my VIN, they just have to squat down and look at the VIN that's punched in the frame of my truck.

I haven't checked other vehicles, but I imagine they also have their VINs punched in the frame where it's easily visible.

I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by JohnFen on Thursday February 06, 2020 @07:26PM (#22261961)
> I imagine they also have their VINs punched in the frame where it's easily visible.

It's not always easily visible, but the VIN must be stamped on the major components of the car by law. I believe this means visible from the driver's side windshield, stamped on the frame, and stamped on the major drivetrain components.

> I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.

In my state, it's illegal to do either of those things, but I don't believe it's illegal to obstruct the view of the VIN in a less permanent way.

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by grecy on Thursday February 06, 2020 @10:33PM (#22263005)
> I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.

My Jeep has added "frame rust protection" from the factory (Canadian-spec) and I've never been able to find a VIN stamped anywhere on the frame. Apparently the coating covered it. It was a pain in the ass crossing borders in Africa when they didn't want to use the VIN at the base on the windshield.

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by techopoly on Thursday February 06, 2020 @01:11PM (#22258506)
Not a bad idea. As far as I know it's not required to be visible
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by pandaman on Thursday February 06, 2020 @07:34PM (#22262005)
What about parking tickets? Do they just leave the VIN# empty or impound your car?
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by yellowapple on Thursday February 06, 2020 @10:34PM (#22263009)
Parking tickets usually go off the license plate, last I checked.

In fact, so do normal tickets, last I checked. My first job was punching in traffic ticket info for the CHP, and I don't recall ever seeing a VIN; just the LP and DL.

This is in the US, though. Other places might have different information tracked on citations.

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by pandaman on Thursday February 06, 2020 @10:42PM (#22263037)
LA parking tickets have VIN. You obviously cannot have DL on a parking ticket. Here is an example image: https://pci.etimspayments.com/pbw/include/la_sheriff/images/...
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by yellowapple on Friday February 07, 2020 @03:32PM (#22270585)
> LA parking tickets have VIN.

Noted.

> You obviously cannot have DL on a parking ticket.

Well yeah, obviously. I was talking about tickets in a broader sense, going by forms CHP 215 ("Notice to Appear", i.e. normal traffic tickets) and CHP 281 ("Notice to Correct Violation", i.e. "fix-it" tickets).

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by Piskvorrr on Friday February 07, 2020 @05:31AM (#22264723)
Also in the various databases? How does that work?
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by gassit on Thursday February 06, 2020 @07:19PM (#22261921)
I believe this is not quite correct, there is an additional step. Once you enter the VIN BMW ConnectedDrive will send a message to the car which you have to retrieve through the iDrive interface before it will 'pair' with online services or the app. You need to have physical access to the car.

And if you sell the car and it is added to another ConnectedDrive account (or BMW mark it as sold) it disappears from your dashboard and you need physical access again to add it.

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by csours on Thursday February 06, 2020 @01:28PM (#22258708)
It's not strictly sequential, but it is easily guessed if not sequential. The first portion is manufacturer's information, and then the last 6 are a serial number of final assembly (generally speaking)

VIN Card [big pdf]: https://www.genuinegmparts.com/src/pdf/resources/1960-2020_V...

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by RandomBacon on Thursday February 06, 2020 @03:44PM (#22260092)
I'm curious, would it be possible for a malicious person to create a bunch of VMs running the app and brute force VINs to get access to thousands of vehicles and do things all at the same time?

As it is, it already sounds like a theif's dream: no special, suspicious tools required: just a burner phone with an app, walk up to a car, enter the VIN, unlock doors, steal stuff.

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by fortytw2 on Thursday February 06, 2020 @10:32PM (#22263001)
VINs roughly follow patterns, so if you know one, you can figure out many other cars with very little brute force effort.

vinwiki probably has a guide explaining them somewhere if you search

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by rad_gruchalski on Thursday February 06, 2020 @04:23PM (#22260486)
No, it’s not possible: https://news.ycombinator.com/item?id=22259046
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by rad_gruchalski on Thursday February 06, 2020 @01:57PM (#22259046)
Yes, but:

- at least in Germany, you have to give physical signature at the dealer to sign up for CarData

- you need to give consent to every third party in order for them to access the data

- to have the car linked to CarData, you have to get in the car, turn the ignition on, receive activation code displayed which is displayed on the infotainment, type the code back into the CarData platform

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by river99 on Thursday February 06, 2020 @12:52PM (#22258321)
Also visible through the windshield from the outside.
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by leni536 on Thursday February 06, 2020 @01:35PM (#22258792)
>Can unlock the door.

>Visible through the windshield

Interesting.

[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by julianj on Thursday February 06, 2020 @08:50PM (#22262493)
In my area, the VIN is also easy to find with just a name from the public-facing tax property website.
[ Parent | on HN ]
Re:When Your Used Car Is a Little Too ‘Mobile’ by empath75 on Thursday February 06, 2020 @06:16PM (#22261491)
So wait if I see a new bmw, all I need to do to break in is download the app and put in the VIN?
[ Parent | on HN ]