BMW web portal vulns pose car hack risk – researchers

Two unpatched vulnerabilities in BMW's ConnectedDrive web portal create a mechanism to manipulate car settings, a security researcher warns. The first (and more serious) vulnerability creates a means for a hacker to access another driver’s Vehicle Identification Number (VIN) before changing in-car settings such as lock/ …

[Anonymous Coward]

Technology, eh?

This is exactly why my next 'new' car will be an Austin Allegro or Escort Mk III from fleaBay.

[Anonymous Coward]

Re: Technology, eh?

Well, at least you won't contribute significantly to global warming.

[Anonymous Coward]

Re: Technology, eh?

Well, at least you won't contribute significantly to global warming.

Are you kidding me? The last Allegro I owned left a cloud of smog behind it that would put a VW to shame. That said, that was just before two conrods and associated parts exited through the side of the crankcase.

There was a reason they earned the nickname "All Aggro" ...

[Anonymous Coward]

Re: Technology, eh?

That was my point - few of them ever managed a high mileage.

My mother, while I was away, was persuaded to swap her beautiful Morris Minor with leather seats that I had kept in perfect mechanical condition for years, for an Agro. She's dead now and I've kind of forgiven her. I could not make her understand what she'd done. It got the driver's door kicked in by a horse, which proves that even horses have some taste.

[A Long Fellow]

Obligatory Luddite Quote from Star Trek III

Scotty: "The more they overthink the plumbing, the easier it is to stop up the drain."

Make mine a horse or a bicycle.

[Fred Dibnah]

Might be useful

A hacker could at least make the indicators work.

[Graham Lockley]

Re: Might be useful

Case of mistaken brand I think, it's Audis that have the indicators turned off by default.

[Anonymous Coward]

Re: Might be useful

No, our neighbour switched from an Audi to a BMW and the indicators don't work any better.

[robidy]

Re: Might be useful

Oh s*** we need genetic engineering after all :)

[gollux]

We are creating a world...

That we richly deserve... While the planet dies off from under us, the dispossessed rise up against us, we create navel gazing cars that quickly gain the ability for others to transport us to misery.

[mark 177]

VIN Confused

I don't understand how entering a VIN can be part of the authentication process.

After all, it is sitting there at the base of your car's windscreen, in the plain view of everybody.....

[Zimmer]

Re: VIN Confused

Have an Upvote, I was thinking the same......

[The Original Steve]

Re: VIN Confused

Not on my BMW. Was actually bloody annoyed that I had to pop the bonnet to be able to set up the connected drive services. Why the on board computer (iDrive) can't display it I have no idea.

[mark 177]

Re: VIN Confused

Can't display it 'cos it's not a Tesla.

Will display it soon, as BMW+Mercedes are now shit-scared of Tesla.

[Anonymous Coward]

Re: VIN Confused

A VIN should not be used for the same reason that a social security number in the US or NI number in the UK should never be used as a primary key. And anybody who hasn't thought about it enough to work out why should never be allowed near the system architect job.

[gerdesj]

Re: VIN Confused

"A VIN should not be used for the same reason that a social security number in the US or NI number in the UK should never be used as a primary key."

Seems a perfectly good candidate for a primary key to me - that's what they are by definition. They should not be used for authentication on their own.

[ckdizz]

So basically it's like a BMW. Flashy, expensive, looks great but won't last a year and might kill you.

[Al fazed]

Who wants a BMW ?

If anyone of such persuasion was to change the delivery address and tie a new owner to the VIN, I can think of a couple of people that could do with a FREE car as payment for all that they have contributed to this Cuntery. The list would include people like the executives in HR at BMW plant Oxford and several politicians (whose names I have to look up 'cos I haven't been paying that much attention). Anyways safe to say that these twats deserve nothing less - oh yeah and they could also come with a chatty android (unpaid) driver named Tay for good measure, as an expression of their faith and confidence in UK govermins IT schemes.