News for hackers. Stuff that matters.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by userbinator on Saturday August 16, 2025 @11:54PM (#44928712)
It wouldn't be "baffling" if we stopped thinking that companies should continue doing work for free after they've already sold their products. I know the locks on my car are easily picked, but I don't expect GM to give me a free lock cylinder replacement either. Caveat emptor.

Edit: didn't know Hyundai owners were so entitled.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by terribleperson on Sunday August 17, 2025 @12:16AM (#44928820)
As far as I'm concerned, security issues (outside of very niche situations) in a product mean that the product was defective. If you sell a defective product, you should be on the hook to correct the defect.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by hamburglar on Sunday August 17, 2025 @03:22AM (#44929611)
There’s no bright line that defines “defect” and makes this determination. What Hyundai should be considering here is whether consumers will decide that buying a car from a company that doesn’t fully own their security mistakes isn’t worth it.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by terribleperson on Sunday August 17, 2025 @04:18AM (#44929875)
I agree it's hard to draw a bright line, but I'm personally comfortable erring heavily on the side of defect for security issues.

I'd be willing to agree that certain security issues might not constitute a manufacturing or design defect. If a thought-to-be-secure encryption was cracked tomorrow, that doesn't make products using it defective at the time of manufacture.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by hamburglar on Sunday August 17, 2025 @11:33PM (#44937139)
The point is, it doesn’t matter. The only thing that matters is how consumers feel about whether the company’s reaction makes them feel like they want to trust that company with their next purchase.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by mrangle on Sunday August 17, 2025 @12:13AM (#44928799)
If security flaw is so egregious as to warrant a patch, then the patch should be considered to be a fix of a defective product and free.

If the situation doesn't rise to that level of severity, then it follows that a patch isn't necessary.

If GM were to offer lock cylinder replacements because their original cylinders were so flawed as to warrant them, then yes the cylinder replacements should be free. The sold product was not as described.

If the original cylinders aren't so flawed as to warrant a replacement, then no cylinder replacement would be offered.

Are GM cylinder replacements being offered? If not, then your analogy isn't analogous.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by lostdog on Sunday August 17, 2025 @12:08AM (#44928767)
It's a defect. We should fix it by making them do a recall.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by verdverm on Sunday August 17, 2025 @12:09AM (#44928783)
You missed some points

1. This is only in the UK, they are not doing the same in the US

2. Recalls are the responsibility of the manufacturer. Security lapses, even if "up to standards" at the time are not a legitimate exemption (imo)

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by zmb_ on Sunday August 17, 2025 @02:04AM (#44929269)
In the automotive industry, pretty much the whole point of standards like cybersecurity (ISO21434) and functional safety (ISO26262) is to let the manufacturer claim in court that they followed “modern best practices” and therefore are not liable when something goes wrong.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by mrangle on Sunday August 17, 2025 @12:02AM (#44928746)
I didn't know Hyundai corporate defenders were so unrealistic and childish.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by userbinator on Sunday August 17, 2025 @12:09AM (#44928784)
I don't even like Hyundai.

What's "unrealistic and childish" is expecting free labour.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by indemnity on Sunday August 17, 2025 @12:17AM (#44928822)
Other manufacturers treat defects in their products by doing a recall and wearing the costs of their mistake.

Asking customers to pay for the actually-secure retrofit is certainly a choice.

I hope the small amount of money recovered was worth it, Hyundai/Kia just disappeared from my consideration for any future vehicle.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by serf on Sunday August 17, 2025 @12:33AM (#44928880)
>Other manufacturers treat defects in their products by doing a recall and wearing the costs of their mistake.

No.

Other manufacturers treat defects with recalls after analyzing the fiscal prospect of doing so, and determining whether or not state/regional laws require them to do it.

Here's one of the "not that wrong" scenes from Fight Club to better explain[0].

[0]: https://www.youtube.com/watch?v=SiB8GVMNJkE

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by lukan on Sunday August 17, 2025 @03:05AM (#44929531)
Do you have any other sources than a hollywood movie made for entertainment?
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by nulld3v on Sunday August 17, 2025 @12:17AM (#44928821)
Many would argue that this "free labour" you speak of is labour that Hyundai should have put into their product before releasing it.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by superb_dev on Sunday August 17, 2025 @12:13AM (#44928803)
It's not free labor, they already got paid for it. They just fucked it up the first time.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by jcdentonn on Sunday August 17, 2025 @01:57AM (#44929229)
Nope. It requires new hardware installed.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by whatevaa on Sunday August 17, 2025 @02:12AM (#44929305)
Hardware which should have been there in the first place.

They will also be charging elevated dealership prices for thag labor.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by mrangle on Sunday August 17, 2025 @12:17AM (#44928823)
It seems like you don't like Hyundai. What's childish is your resort to ad hominem because you disagree.

It's not free labor anymore than the car was free. It's a fix of product that was defective off of the line. The necessity of the fix being evidence of the defect.

Car buyers are not automotive cybersecurity engineers, and they can never be expected to be. Caveat Emptor is a hilarious remark for this situation.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by lmz on Sunday August 17, 2025 @02:30AM (#44929386)
Is it a defect if it required the development of an adversarial tool / exploit which previously did not exist? If the roof leaked when it's raining it's a defect because rain existed before. But this exploit didn't exist before.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by 14 on Sunday August 17, 2025 @12:51AM (#44928965)
Well if your car had a seat belt defect and people were dying you know they absolutely would recall the car and pay for the defect.

The defect that allows the car to be stolen in seconds is absolutely a serious problem. I hope Hyundai changes course and decides to provide it for free. We have already seen reports of the trend where people were stealing Hyundai/Kia vehicles and going on joy rides driving extremely dangerously. This has lead to deaths in several instances. So they have a flaw that has lead to people dying. IANAL but I would say leaving this flaw unpatched may even leave them liable if anyone else were to be hurt. As a recent example of something similar is the Sig Sauer P320. They are in the middle of fighting some lawsuits over their faulty product. So it would not be a far stretch if Hyundai/Kia were held responsible for a know flaw in their product.

Anyways it is just my opinion that they should just eat the cost to provide this for free as a show of standing behind their product. Just seems like such bad PR to now make people pay.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by throwaway173738 on Sunday August 17, 2025 @01:16AM (#44929059)
I think the deaths might qualify the cars as an attractive nuisance at this point. Although The Club is only about $50.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by brewdad on Sunday August 17, 2025 @01:35AM (#44929134)
I don't expect free labor. I expect the service workers to get paid by Hyundai
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by mindslight on Saturday August 16, 2025 @11:59PM (#44928729)
Sure, that could be a decent legal regime. Of course the first step to enabling that would be releasing the source code and system documentation for the product they've sold, so that it's possible for anyone else besides themselves to fix it. Until then it's a black box the company has chosen to retain responsibility for. And frankly regulators should be making sure they support the 20-40 years of useful life we generally expect from automobiles.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by thfuran on Sunday August 17, 2025 @12:06AM (#44928756)
I think you significantly overestimate people’s expectations for automobiles.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by mindslight on Sunday August 17, 2025 @01:10AM (#44929036)
I'm not talking about individuals' expectations for how long they personally will use a given vehicle, but rather societal expectations for how long a given vehicle will live across all tiers of the market. The cell phone made-to-be-ewaste model shouldn't be allowed to infect capital assets costing 100x as much.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by thfuran on Sunday August 17, 2025 @02:16AM (#44929322)
Yes, and the scrappage rate is about 4.5%. A 40 year old car is not the norm.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by Dylan16807 on Sunday August 17, 2025 @02:32AM (#44929392)
At 4.5% loss per year, you'd still have 16% of cars running at 40 years. That's pretty normal.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by thfuran on Sunday August 17, 2025 @02:55AM (#44929492)
By that logic, shouldn’t about 25% of US persons be 150, given the annual death rate of 9.28 per thousand?
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by Dylan16807 on Sunday August 17, 2025 @04:00AM (#44929782)
No. Humans age in a way that cars don't, so "that logic" would not attempt to apply the same curve to humans.

If you're done nitpicking, you're welcome to explain your number better. You forgot to say how to apply "4.5%". I'm sure an exponential fit has issues, but a linear fit would be much worse, and anything fancy needs more data points.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by mindslight on Sunday August 17, 2025 @02:35AM (#44929415)
That's why I gave a range. That average stat actually seems to line up with the low end of that range, and since every car isn't scrapped at the same age it's going to be a distribution. There are not many cars from 1985 on the road today, but there sure are some. And since we're talking software which doesn't actually degrade, it shouldn't be the thing limiting the overall lifetime.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by ethan_smith on Sunday August 17, 2025 @12:23AM (#44928845)
This isn't about normal wear-and-tear but a fundamental security design flaw that allows thieves to steal these cars with a $25 device exploiting the CAN bus - more akin to GM shipping cars with a master key hidden under the floor mat than a pickable lock.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by userbinator on Sunday August 17, 2025 @04:10AM (#44929840)
The article claims it's a $20k device.

Claiming it is a "security design flaw" is absurd paranoia, the same paranoia that causes manufacturers to destroy the aftermarket and fight right-to-repair in their quest for "security".

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by throwawayoldie on Sunday August 17, 2025 @01:14AM (#44929057)
Except even more egregious, because if your GM car had a master key under the floor mat, you could just remove it yourself and throw it down a handy storm sewer.
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by anywhichway on Sunday August 17, 2025 @12:27AM (#44928858)
I think your take makes more sense in a world where you actually own the car fully and have the freedom to do what you want with it. Even if someone was able to write this patch themselves without the source code, distributing it would require owners to root their devices, which isn't legal in all jurisdictions.

You don't expect Microsoft or Adobe to issue fixes any time someone finds a remote exploit that let's attackers gain control of you system though security issue in their software? I 100% expect this of my software vendors even for this purchase in the past. The expectations for software and hardware are certainly very different, but even for hardware we have laws that force companies to fix their hardware in some situations.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by themafia on Sunday August 17, 2025 @12:27AM (#44928860)
> I know the locks on my car are easily picked

They aren't actually. Which is why theives just smash your windows. In either case the alarm is going to go off so there's no advantage to them learning a complex attack on your lock cylinder when a piece of concrete will do.

Further there often were additional ignition interlock mechanisms that required the correct key code or a key with the correct additional hardware to be present for the starter cylinder to actually engage your starter.

> didn't know Hyundai owners were so entitled.

It's called a defect. It should be a recall. We have laws that cover this. They're pretty explicit. I didn't know Hyundai CORPORATION was so entitled as to think they were not subject to them.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by anywhichway on Sunday August 17, 2025 @12:45AM (#44928931)
I agree Hyundai should fix this for free (would make up a small portion of the bad PR for having this issue in the first place), but don't forced recalls usually only apply to defects that cause safety issues?

I'm not sure this would fit the definition of a product safety defect.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by selkin on Sunday August 17, 2025 @12:30AM (#44928868)
It's not ease, it's efficiency: opening a locked car door is 1-2 minutes for an experienced person. Smashing the window is 2 seconds (though you also need some experience, as modern car side windows are also laminated).
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by userbinator on Sunday August 17, 2025 @05:52PM (#44935257)
opening a locked car door is 1-2 minutes for an experienced person

Look up LockPickingLawyer on YouTube. Less than a minute with the right tool.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by selkin on Wednesday August 20, 2025 @05:31PM (#44966710)
You don't need his level of skill to open a car door (you attack the latching mechanism, not the barrel itself).
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by DrewADesign on Friday August 22, 2025 @12:47AM (#44981077)
This video has some great footage of typical modern break-ins:

https://m.youtube.com/watch?v=iWWWyG5ZwG8

The lockpicking lawyer’s skillset is not what’s required for that task. 30 seconds would be an eternity for a typical thief to just be able to open a car door. Most of these thieves take maybe 15 seconds from approach to escape. Stealing a whole car is a little bit different but nobody is going to sit there with their adrenaline pumping, wearing gloves, in the middle of the night trying to pick a car door lock that won’t even disable the alarm.

Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by exe34 on Sunday August 17, 2025 @02:42AM (#44929447)
so if I sell you a bridge that's not fit for purpose, I wouldn't have to fix it for you at my cost? nice! I've got a bridge to sell to you...
Re:Hyundai wants loniq 5 customers to pay for cybersecurity ... by userbinator on Sunday August 17, 2025 @04:02AM (#44929805)
Caveat Emptor