funsec mailing list archives

Re: Onstar - throwing the baby out with the bath water


From: Joel Esler <eslerj () gmail com>
Date: Fri, 20 Nov 2009 08:50:08 -0500

On Wed, Nov 18, 2009 at 4:28 PM, Chris Boyd <cboyd () gizmopartners com> wrote:


On Nov 18, 2009, at 12:25 PM, Alex Eckelberry wrote:

I'm not so sure.  While I empathize with the mother, Onstar does have a
point--they can't reactivate the Onstar system without someone pressing
the "Blue button".

A software design/architecture issue, which could undoubtedly be fixed
going forward.

Yes, they will probably looking at changing that.  Which opens another can
of worms.  How do you know the caller's not just trying to steal the car or
something from the car?  Stolen Visa card + access to DMV registration
records + OnStar = access to any car in the mall parking lot.


Totally true.  Didn't you guys see "Live Free or Die Hard"?



From the report:

Tampa Police, Hillsborough County Fire Rescue, and Triple AAA had
responded, but asked them to reach out to OnStar first.

Since when does having OnStar mean that the fire/police won't respond?  I
can understand if they were busy with higher priority life threatening
issues.  I can understand if they wanted to resolve the situation as quickly
as possible, and OnStar could do that at a lower cost to the jurisdiction.
 Would be nice if ABCActionNews had gone into more depth there....

But AAA?  Aren't they _paid_ to respond?

--Chris
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.




-- 
Joel Esler | 302-223-5974 | gtalk: jesler () sourcefire com
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.

Current thread: