Hyundai and Kia issue software upgrades to thwart killer TikTok car theft hack
- Reference: 1676446150
- News link: https://www.theregister.co.uk/2023/02/15/hyundai_kia_software_upgrades/
- Source link:
The "Kia Challenge" started circulating in mid-2022 and explained that it's possible to remove the steering column covering on some Hyundai and Kia models by force, exposing a slot that fits a USB-A plug. Turning the plug activates its ignition, allowing thieves to drive away.
Videos depicting the hack went viral, leading to huge spikes in thefts of the vulnerable models around the world.
[1]
The United States National Highway Traffic Safety Administration (NHTSA) on Tuesday [2]stated it is aware of "at least 14 reported crashes and eight fatalities" resulting from the hack.
[3]
[4]
Now both automakers have announced they'll issue software to thwart the exploit.
Hyundai's [5]advisory states the upgrade will be performed by dealers and will require less than an hour to complete.
[6]
"The software upgrade modifies certain vehicle control modules on Hyundai vehicles equipped with standard 'turn-key-to-start' ignition systems," The car-maker explained. "As a result, locking the doors with the key fob will set the factory alarm and activate an 'ignition kill' feature so the vehicles cannot be started when subjected to the popularized theft mode."
The update will be progressively offered to owners of "almost four million vehicles" – namely the 2017–2020 Elantra, 2015–2019 Sonata and 2020–2021 Venue.
[7]Software developer cracks Hyundai car security with Google search
[8]Automotive industry is driving revenue for at least one chip company: STMicroelectronics
[9]Japanese giants to offer security-as-a-service for connected cars
[10]Oh, no: The electric cars at CES are getting all emotional
The NHTSA's announcement states that "Kia is also rolling out its FREE software updates in a phased approach. The company will begin to update vehicles later this month, with ensuing phases throughout the next several months."
Kia appears not to have announced its updates but did yesterday [11]pledge over the air updates in-car infotainment and navigation systems for some models.
Only cars that use keys are susceptible to the hack. Press-to-start vehicles – which rely on radio signal from a fob to allow engine start – are immune to the attack because they lack the mechanical elements that make this exploit possible.
[12]
Literal brute force attacks on car ignitions have been possible for decades, as have other electrical means of starting vehicles without a key.
The Kia Challenge’s presence on TikTok and other social media platforms, however, meant the method was widely shared. And thanks to the viral nature of social media, and its central place in popular culture, also widely emulated. ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@y7UsZpcPKClMGHKgMY3AAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.nhtsa.gov/press-releases/hyundai-kia-campaign-prevent-vehicle-theft
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@y7UsZpcPKClMGHKgMY3AAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@y7UsZpcPKClMGHKgMY3AAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.hyundainews.com/en-us/releases/3768?uuid=lSsVufn8jKhEaxLg2980
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@y7UsZpcPKClMGHKgMY3AAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/08/17/software_developer_cracks_hyundai_encryption/
[8] https://www.theregister.com/2023/01/26/stmicroelectronics_q4_2022/
[9] https://www.theregister.com/2022/10/18/ntt_denso_security_for_cars/
[10] https://www.theregister.com/2023/01/06/ces_ev_concept_cars/
[11] https://press.kia.com/eu/en/home/media-resouces/press-releases/2023/Kia-enables-over-the-air-software-updates.html
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@y7UsZpcPKClMGHKgMY3AAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Re: Wait.... they did not have that?
Maybe its territory, the Elantra, Sonata Venue are not currently part of the range on sale in UK, unless it uses a different name. I’ve never heard of or seen a Venue.
Factory fitted immobilisers have been compulsory for all new cars sold in UK since 1998.
Re: Wait.... they did not have that?
Can't find the source, but pretty sure the issue was that in the US where the immobilizer isn't mandated, it was sold as an optional extra.
I think all these cars were available in Canada - but there they have a mandated immobilizer, like here.
"Theft Mode"
I'm pretty sure this is not what the NSA meant when they insisted they put a backdoor in to enable hijacking of these vehicles.
I've had two theft cases with my Corolla so far.
In both cases ne'er-do-wells forced the driver door to unlock with a tool (screwdriver) and did the same with the ignition.
In the first case, the car was recovered.
Second case the ne'er-do-well abandoned the attempt as the steering gear lock was preventing the use of the gears.
In both cases I had to buy new door locks and a new ignition lock module - luckily replacing these was a doddle, no reprogramming or anything needed.
I cannot afford the loss of this car, and dread the day it will get stolen.
Bah, ne'er-do-wells.
My Corolla could be opened and started with any Corolla key. It probably could have been forced with a screwdriver, but why bother?
Yes, that was many years ago.
Hack to death ratio
14 hacks and 8 deaths - who is taking these cars? Children who can't drive? Or does the hack leave the vehicle inherently unsafe?
Re: Hack to death ratio
What do you mean they can't drive...they all got massive scores on GTA and Saints Row and they could own you on Minecraft
Re: Hack to death ratio
They removed the steering wheel by force and I don't see a mention of the steering wheel being put back on (Unless I am blind)?
Re: Hack to death ratio
@Captain Scarlet
Cover on steering column removed by force, not the wheel
Re: Hack to death ratio
The average tiktok users are so dumb that they can't even drive a car.
Wait.... they did not have that?
"The software upgrade modifies certain vehicle control modules on Hyundai vehicles equipped with standard 'turn-key-to-start' ignition systems," The car-maker explained. "As a result, locking the doors with the key fob will set the factory alarm and activate an 'ignition kill' feature so the vehicles cannot be started when subjected to the popularized theft mode."
I know that this is really not a new thing to have - even the (ancient even 15 years ago) Renault of friends had that (insert joke about French cars here...). And I also know that insureances sort of expect this to be present. How is this absent in recent-ish models? My mind is boggled...