News for hackers. Stuff that matters.

A comment on Unlocking any car from X brand in most of the world. Parent comment

Re:Unlocking any car from X brand in most of the world by lakeviewterrace on Sunday November 08, 2026 @10:32PM (#50420721)
GM was doing this 25 years ago.

It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.

They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.

Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.

[ Parent | on HN ]
Re:Unlocking any car from X brand in most of the world by miki123211 on Monday November 09, 2026 @04:00AM (#50422961)
They had other issues. SQLI, XSS and XSRF were rampant in those days.
[ Parent | on HN ]
Re:Unlocking any car from X brand in most of the world by kotaKat on Monday November 09, 2026 @08:22AM (#50425254)
I've pondered how "secure" the old OnStar system was. It was apparently just some level of in-band signalling/modem communication on top of AMPS (or CDMA).

I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.

[ Parent | on HN ]