Researchers at penetration testing and threat intelligence firm PCA Cyber Security (formerly PCAutomotive) have discovered that critical vulnerabilities affecting a widely used Bluetooth stack could be exploited to remotely hack millions of cars.

The researchers conducted an analysis of the BlueSDK Bluetooth framework developed by OpenSynergy and found several vulnerabilities, including ones that enable remote code execution, bypassing security mechanisms, and information leaks.

They demonstrated how some of these flaws could be chained in what they named a PerfektBlue attack to remotely hack into a car’s infotainment system. From there the attacker can track the vehicle’s location, record audio from inside the car, and obtain the victim’s phonebook data.

The attacker may also be able to move laterally to other systems and potentially take control of functions such as the steering, horn and wipers. While this has not been demonstrated, previous research showed that it is possible for a hacker to move from a car’s infotainment to more critical systems.

The PerfektBlue hack has been demonstrated against recent infotainment models shipped with Mercedes-Benz, Skoda, and Volkswagen cars, as well as products made by another, unnamed OEM that was only recently made aware of the findings.

BlueSDK is present in millions of devices. The list includes not only vehicles, but also mobile phones and other portable gadgets made by dozens of major tech companies.

In order to conduct an attack, the hacker needs to be in range and able to pair their laptop with the targeted infotainment system over Bluetooth. In some cases pairing is possible without any user interaction, while in others pairing requires user confirmation, or it may not be possible at all.

“Essentially, PerfektBlue requires at most 1-click from a user to be exploited over-the-air by an attacker,” PCA Cyber Security explained.

The PerfektBlue vulnerabilities were reported to OpenSynergy back in May 2024 and were assigned the CVE identifiers CVE-2024-45434, CVE-2024-45431, CVE-2024-45432 and CVE-2024-45433.

Patches were created and distributed to customers starting in September 2024, but PCA Cyber Security waited until now to disclose them to ensure that the fixes would be widely deployed.

Earlier this year, PCA Cyber Security disclosed a series of vulnerabilities that could be exploited to remotely hack a Nissan Leaf electric vehicle, including for spying and the physical takeover of several functions.

Opencollective no more, Hello Liberapay!

• Reference Open Collective Post: https://opencollective.com/reddthat/conversations/we-have-migrated-to-liberapay-4pzb7zgp#comment-1749981430361
• Our Liberapay: https://liberapay.com/reddthat
  • Which goes directly to me
• You can also do ko-fi: https://ko-fi.com/reddthat
  • Which goes via Paypal (I think)
• Or send it directly via Crypto if that is your thing.
  • See the main donation page for the addresses

Summary:

It has now been 8 weeks since our last contact with our fiscal host on Opencollective and I have made the hard decision to migrate away to Liberapay.

"New" Donation Platform

When I started Reddthat I wanted to show everything that we were doing in a transparent way. We have the modlog which shows eveything that happens on Reddthat and the Lemmy-verse and I wanted to bring that to the financial side of things as well.

So I looked around at the payment processors. Patreon/etc had higher fees than what I expected and as they were donations I really didn't want to lose up-to 8% of your good will! Liberapay was the obvious choice originally but it turns out they are a platform where people can donate directly to people. Everyone needs to link their Paypal, Stripe, or EU Bank account to accept transactions on Liberapay.
This also looked a bit hard and I don't really trust Paypal, especially if out of the blue I started getting $50 "donations". Working in marketing I've head of paypal closing down accounts and holding money for ransom while you have to consistently prove you are who you are and jump through their hoops.
As I was already an "active" member of the wider Fediverse, I looked up how these services managed to accept donations and eventually stumbled upon Opencollective. This was exactly what I wanted. A open and inviting platform to handle all the money side of things while providing a truly transparent account of what is happening.

Opencollective solved all of the things I could hope for while also solving a secondary issue. Taxes. Something I have no idea about when it comes to donations, but will surely need to be up to speed on it within the next month!
After reading a few documents, you need to pick a Fiscal Host on opencollective, or prove you are a "business?" (or something like that, I don't remember) so you can become a fiscal host and accept money. This looked to be extra work on top of getting Reddthat up and running so I went looking for a local Australian fiscal host, and found one who also had 0% fees! They would accept all the donations and then transfer it back to me as a reimbursement, or I could even get them to pay invoices! This ticked all my boxes. Even if the host evidently ended charging a small 1-2% I would have been happy with that as our relationship after these last two years have been great. We even donated back to them for a few months in the early days.

~~Fast forward to today. We now have 2 months I have paid for without being reimbursed by our host. For a total of A$285.49. That would have left A$518.40 in our account for our future months~~

Update: We have managed to get all of our donations back!

Unfortunately since the payment in April I haven't heard anything from them and so we are saying Goodbye to OpenCollective and Hello to Liberapay! I'll hold out hope that they will come back online, or they've gone away for a huge holiday without internet, but this is a lesson we can all learn from.
I would like to continue using OpenCollective but the thought of losing more money the same way through another fiscal host would be too much. And the alternative of having to setup more paperwork to become our own fiscal host, and getting hit with a transaction fee for taking your donations and then "paying" myself just doesn't seem worth it. So Liberapay it is.

I've setup Liberapay and I've setup Stripe. Given them a fair amount of my details ( 😥 ). So you should be able to donate directly to me and we'll never have any of these unfortunate issues relating to other entities holding our money.

I feel like I've let you all down with ~$500+ disappearing into the ether. We can only learn from our mistakes and moving to Liberapay, Ko-Fi, or Crypto, where I hold the funds is the best way forward to ensure stability.

I'd like to remind everyone that donations are completely optional but they certainly help with it comes to a "big" instance like ours. Lemmy is growing every year and it's great to see everyone and all the things they do and the communities we have created!

And now back to the regular update.

June 2025

We've rolled out v0.9.12 for Lemmy which contained a few bugfixes as well as Peertube federation support, so now you should be able to see more peertube videos i that is your thing.

We turned 2 this month. The 6th of June was our birthday and it was an absolute banger! It was so big we all blacked out at the party and forgot it was happened! As June is a busy month for me, I made sure to renew our domain to make sure nothing happened. ;)

Since last update Lemmy World has successfully turned on the Parallel Sending which we (Reddthat) instigated way back when we started lagging behind and we all found out that sending internet traffic from one side of the world to the other sequentially might be bad. This means we no longer have need for our proxy system and it has saved us 4Euro/month (and the extra management overhead).
This also has had the same affect on our sister instances in AU/NZ allowing them to not lag behind too.

I hope you all had a great year and here's to another amazing one!

Cheers,

Tiff (& The Reddthat Admin Team)

PS. I believe I have managed to cancel all recurring donations. So if you wish to keep donating please do come over to Liberapay. <3

PPS. Did I mention that I've enabled Secret Donations for Liberapay, so I won't be able to know who you are!

I'm classing this as an exploit because it sounds like backblaze exploited their shareholders!

We (Reddthat) were going to use them as our object storage provider when we started. Luckily we didn't! It would make me want to migrate asap!

I nice write up on the #TikTok VM

We regularly see this on Reddthat's and my own personal services too.

I don't usually link to Reddit but damn... Entra leak is a big deal