Sam Curry is a security researcher who writes up vulnerabilities he found in large companies, including car makers, Apple, Starbucks and airline platforms.
HN links it for detailed vehicle hacking writeups such as Kia and Subaru; commenters cite them when discussing connected-car security and remote controls.
I have a new EV (a modest MG ZS long range 2022) and I'm not much concerned about privacy BUT much, much, much more about remote controls ability from the factory AND potentially someone else due to some crapware vulnerabilities who happen to be vast https://samcurry.net/web-hackers-vs-the-auto-industry/
My take is simple:
- all cars can be connected BUT the connection must be user controllable, meaning the car must run on FLOSS easily installable by the formal owner;
- all cars can offer remote controls BUT in a classic ssh-alike fashion, meaning it's ok to have a web(cr)app for end users, but not proxyed by the OEM only. OEM might act as a proxy to circumvent NAT, but the user is free to choose a DynDNS and other P2P/distributed solution hosted alone.
In mere privacy IMVHO my car can snoop videos of me/anything surrounding / capture audio no more and no less than an Android or iOS macrospy also know as smartphones. So I'm equally concerned BUT so far such smart devices can't potentially lock me outside in the middle of anything, making me crash on some people and than state I'm a terrorist crushing on purpose and so on. Witch limit much the risk surface.
Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list):
- https://blog.orange.tw/
- https://ngailong.wordpress.com/
- https://whitton.io/
- https://sakurity.com/blog
- https://homakov.blogspot.com/
- https://buer.haus/
- https://philippeharewood.com/
- https://portswigger.net/research
- https://gerbenjavado.com/
- https://medium.com/@intideceukelaire
- https://samcurry.net/
- https://stephensclafani.com/
- https://www.josipfranjkovic.com/
- https://www.arneswinnen.net/
- https://blog.assetnote.io/
- https://medium.com/@alex.birsan
- https://cablej.io/
- https://jonbottarini.com/
- https://www.corben.io/
There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference.
Shameless plug: I write about web application security at https://edoverflow.com/.
Still don't see anything better than Mazda to buy, if you look at the "general modern car bullshit" bingo card including but not limited to: not enough real buttons, cybersecurity blunders (https://samcurry.net/web-hackers-vs-the-auto-industry) or ridiculous corner cutting.
The MX-5 ND especially has no serious competition at its price, as a true sports car (manual gearbox, truly light weight, independent suspension, not FF layout, "fun" engine) with high build quality. The Yaris GR could have been it, but Euro eco taxes killed it for my wallet (and the US doesn't want small cars).
I count 16 separate post on twitter for something that could have been more readily digested as a single blog post. The author has a blog at https://samcurry.net/blog, why not create a blog post and link to it in a single tweet? Parsing it in its current form flairs up my ADD to the point I can barely follow along.
You're right iCloud itself wasn't "cracked", per se, but the XSS exploit is (was) incredibly malicious and did not require any social engineering that I can see.
https://samcurry.net/hacking-apple/#vuln3
The article Jalopnik based its piece on (and didn't even link to): https://samcurry.net/hacking-subaru
Previous HN discussion on that: https://news.ycombinator.com/item?id=42803279