Talk about ‘disgruntled’
Connecting state and local government leaders
GCN Lab's Greg Crowe notes that a few simple security tweaks could have prevented a disgruntled ex-employee from meddling with car dealership’s system.
While the GCN Lab was busy with FOSE, apparently a former employee at an Austin, Texas, car dealership was able to log into the dealership’s system and access a small black box in more than 100 cars. This box, through remote control, can set off the horn, keep the car from starting, and perform any number of other disturbing actions.
This system is ordinarily used by the dealership to disable its cars if a payment is past due, or simply honk the horn to remind past due customers. Apparently the ex-employee had his login account closed but managed to get in using another employee’s account. He found the database of more than 1,100 customers easily enough, and began to go through them alphabetically, disabling cars and setting off horns.
Other news sources have called the ex-employee a “hacker.” True, he went into the system with ill intent, but you really can’t say he “hacked” it, since he had a legitimate password. It was only when the auto dealership changed all its employees’ passwords (a few days after the complaints started) that the trouble stopped. Then the police used the logs to identify the IP address of the ex-employee’s Internet service. And his manager said he was good with computers.
Of course, this method of vehicle control has stemmed all sorts of debate about rights to privacy and so forth. But security really had not been one of the debate topics. Maybe that will change now.
All this could have been avoided if access to the Web-based system was limited to IP addresses of computers that are physically in the office. There really isn’t any need to do this sort of work — disabling cars with delinquent payments — remotely. It’s the sort of work that’s best done from the office. Heck, then you could even implement some biometrics, and disgruntled employees couldn’t get into the system even if they got another employee’s login information.
So, what do we learn from all of this? I guess the only thing I can glean is this: If you are buying a car, ask if they have installed one of these disabling black box systems. Then ask if they are planning on laying anyone off in the near future. See what that does to the sticker price.