mokotoy

The cyber security part of me thinks that this app is a perfect pivot point for people to remotely hack your car through your phone. How secure is the app?

Carista

The app is secure, for some reasonable definition of "secure". It doesn't get its commands from the network or allow other apps to control it or anything - it just responds to direct user input.

But what I worry about is when people leave the bluetooth dongle plugged into their OBD port when they're not using it. THAT is just inviting someone to walk by and start hacking. Of course, most or all computers in the car are turned off when the ignition is off, but there might still be an attack vector there. So I always recommend that users never leave the dongle plugged in when they're not using it, especially when they're not in the car. And of course, this has nothing to do with the app - it's just that the hardware leaves its connectivity open when no app is using it.

P.S. You're in Seattle? And you have a "cyber security part"? I did a Master's at UW, which included cyber security coursework... are you by any chance affiliated with UW?

underextended

I am changing my brakes out soon and will require VAGCOM to disengage the electronic brake, will Carista allow this option? If so, sign me up!

Carista

Not yet, but we're planning to add this in a future version of the app.

Carista

Guys we've just released a new beta version (beta-7) which adds a lot of B8-specific customization settings. Please check it out here: Beta-Testing | Carista OBD2 - Vehicle Diagnostics and Customization and let me know if everything is working well. If a certain setting doesn't change the behavior of the car, return it to its original value before proceeding with other settings.

Dustin Fennell

Just got my ELM327 device, paid for the Pro license of Carista, and joined the Beta program. I'll be happy to test and report back. I have a 2014 SQ5.

mokotoy

I'm '09 Informatics Grad from UW. I'm not in Seattle anymore though. I'm currently getting my Masters in Cyber Systems and Operations at the Naval Postgraduate School.

That's good to know that you guys designed the app with security in mind. There's way too many app developers out there that don't even think about it. Yea I definitely agree with the bluetooth dongle being a vulnerability if left attached when not using. I can already think of scenario where a car drives beside you on a freeway (with the bluetooth dongle attached) and starts sending commands to your car == not good.. haha!!

But yea, I'm intrigued. I'm thinking about trying it out. I don't have an Android though. I'll wait for the Apple app.

mokotoy

When a stable beta-version comes out for the iOS (that's not gonna crash car or brick the ECU) I'd be happy to evaluate it and provide feedback. Let me know!

Carista

Awesome, thanks! One thing I wanna ask you is to send us a "debug data" report, since we don't have data from a 2014 Q5 yet, let alone an SQ5. There are instructions on how to send debug data at the bottom of our beta page. Please include your email in the report so I can reply to you and let you know what new stuff we have for you to test.

Cool, go Huskies! I'll post here when we have an iOS version available. Also, you can sign up for updates here: Carista for iOS (iPhone / iPad / iPod touch) | Carista OBD2 - Vehicle Diagnostics and Customization

Sweep

Is there a way to see all available customization options for a 2013 A5 before buying the ELM327 device?