The IT Nerd

This is the second time in a week that I am going to say this. My wife and I are keeping our current car until it dies. But instead of potential privacy issues, it’s due to the fact that cars these days are connected to the Internet. Which means that they could be pwned. Here’s an example of that:

Today, a group of independent security researchers revealed that they’d found a flaw in a web portal operated by the carmaker Kia that let the researchers reassign control of the internet-connected features of most modern Kia vehicles—dozens of models representing millions of cars on the road—from the smartphone of a car’s owner to the hackers’ own phone or computer. By exploiting that vulnerability and building their own custom app to send commands to target cars, they were able to scan virtually any internet-connected Kia vehicle’s license plate and within seconds gain the ability to track that car’s location, unlock the car, honk its horn, or start its ignition at will.

After the researchers alerted Kia to the problem in June, Kia appears to have fixed the vulnerability in its web portal, though it told WIRED at the time that it was still investigating the group’s findings and hasn’t responded to WIRED’s emails since then. But Kia’s patch is far from the end of the car industry’s web-based security problems, the researchers say. The web bug they used to hack Kias is, in fact, the second of its kind that they’ve reported to the Hyundai-owned company; they found a similar technique for hijacking Kias’ digital systems last year. And those bugs are just two among a slew of similar web-based vulnerabilities they’ve discovered within the last two years that have affected cars sold by Acura, Genesis, Honda, Hyundai, Infiniti, Toyota, and more.

“The more we’ve looked into this, the more it became very obvious that web security for vehicles is very poor,” says Neiko “specters” Rivera, one of the researchers who both found the latest Kia vulnerability and worked with a larger group responsible for the previous collection of web-based car security issues revealed in January of last year.

“Over and over again, these one-off issues keep popping up,” says Sam Curry, another member of the car hacking group, who works as a security engineer for Web3 firm Yuga Labs but says he did this research independently. “It’s been two years, there’s been a lot of good work to fix this problem, but it still feels really broken.”

This isn’t just a bad look for Kia. It’s a bad look for the entire car industry. George McGregor, VP, Approov Mobile Security had this to say:

  “This shows how mobile app security and backend API security must be considered together. The attacker was able to copy the apps behavior and the backend checks were not sufficient to distinguish these requests from those from a valid app. 

  “In fact the API needs contextual information about what is going on in the device and the app to be able to prevent this kind of vulnerability being exploited. And the assessment of device and app needs to be thorough and happen continuously so that every request is validated as being legitimate. 

  “An effective app attestation solution such as the one from Approov can easily stop unauthorized apps, bots, cloned mobile apps or scripts from accessing your APIs and provide a Zero Trust approach that prevents this kind of exploit. “

The car industry simply needs to do better when it comes to security. Because at present, it looks like they as a whole don’t take security very seriously. Though they are free to prove me wrong at any time by describing how they are going to do better on this front and how long that will take.

If you own a Kia vehicle that was made between 2015 and 2017, you might be eligible for an upgrade to Android Auto and Apple CarPlay. Assuming that the infotainment system inside your Kia is compatible of course. All you have to do is go to this website and have your VIN number handy. That will allow their system to confirm that you are eligible for the upgrade. Instructions on how to perform the upgrade can be found here if you have a car with a navigation system or here if you don’t.

There is a catch though. There’s this text on the Kia Canada website:

Please note that this software update is currently at beta-testing phase. If you experience any difficulties, please contact us.

While I am sure that some won’t be bothered by that, others might be put off. If the latter is you, then paying for the update via MnSoft would be your route to get all the Android Auto and Apple CarPlay goodness you’re looking for. Or you could just wait for the “beta” to end. Either way, Kia Canada owners now have options when it comes to getting cutting edge infotainment into their vehicles.

While owners of Hyundai Canada vehicles are frustrated by their inability to get upgrades to Android Auto and Apple CarPlay, owners of Kia vehicles in Canada don’t seem to have that issue. Kia owners in Canada can now get an update that gives a large number vehicle models an update to Android Auto and Apple CarPlay for $199 USD. I took this screen shot from this page that shows how many vehicles are getting hooked up with Android Auto and Apple CarPlay:

That’s a healthy list of vehicles, some of which date back to 2014, which have the ability to get a feature that consumers have shown that they want. But here’s the part that will frustrate Hyundai owners. First, the update comes from MnSOFT which is the infotainment division for Hyundai. Those are the same guys who have been unable to deliver similar updates to Hyundai vehicles in Canada. If that’s not enough, Hyundai owns just under 34% of Kia according to this Wikipedia article. I suspect that when word of this gets around to the owners of Hyundai vehicles in Canada, it will result in some very long days for Hyundai Canada’s customer relations department as the question that many of them will ask is “why is it that Kia owners get treated differently than we do if your corporate parent owns both?” I hope that for Hyundai Canada’s sake, they have a plan to deal with this as the optics at present really don’t look good for them.