AUSTIN, Texas — When a disgruntled employee decided to get even with the auto dealership that fired him, he returned the favor by logging in to the dealership’s online vehicle immobilization system and sabotaging 100 vehicles by interrupting the starter function or, in some cases, by activating their horns.
News stories released on Wired and other media outlets called the former worker a “hacker”—but with the right information in his hands (login/password), the man was no Internet whiz cracking code. This was a case of insider invasion. He knew how to activate the WebTeck system connected to vehicles, which is generally only activated when the owners fail to pay.
The good news is that Pay Technologies LLC (PayTeck), creator of WebTeck and other car starter interrupt systems, responded immediately to the dealer’s service call, first changing all passwords and then providing a list of actions for the dealership to reverse all of the former employee’s vehicle shut-off and/or horn commands.
Because of the PayTeck software system, the necessary information was captured and provided to the Austin police department. The police examined those records and traced the unauthorized access back to Omar Ramos-Lopez, 20, who was charged with computer intrusion on March 16.
“Over the last 10 years, PayTeck has developed very secure, high-quality equipment and provides dealer support that goes above and beyond troubleshooting,” said James Krueger, president and CEO of the Cleveland, Ohio-based firm. “The situation was handled seamlessly, and because of the information we maintain, we can react in the rare case that an upset occurs.”
To date, Payteck has hundreds of thousands of these units in service and working 24/7. This Texas incident is the only time the system has been breached. And the reported “hacking” was actually abuse of login and password. This is called “inside invasion,” the most damaging type of system abuse and business abuse. That’s because the offender knows the company and systems, and he or she could operate years without notice and do lots of damage.
“Logins and passwords are the keys to door at the dealership, and when employees leave, you need to take the keys back or change them,” Krueger emphasized. ”When personnel changes occur, dealers are encouraged to immediately change logins and passwords.”
PayTeck changes usernames and passwords at any time. While it’s the dealer’s responsibility to manage the system, Krueger says PayTeck provides consultation and technological backup to help dealers make smart decisions before connecting cars to the system—and after cars are connected to make sure everything is running smoothly.
Ultimately, PayTeck and similar systems are an alternative to the repo man, but they serve an important function of allowing dealers to take a chance on car buyers with less-than-perfect credit. Rather than declining them the opportunity to drive a car, the dealer can install a system like PayTeck’s WebTeck Plus in the car, and gain some peace of mind knowing that the system can be implemented to shut off a car’s starter if payment is not received in a timely manner.
“It’s insurance for dealers’ accounts receivables and a tool that allows salespeople at dealerships to extend car ownership to these risky customers,” Krueger explained.
The secure technology works like this: Commands are issued through a website that are relayed through wireless pager or cellular networks to allow dealerships to disable a car’s ignition system or start its horn. The dealer decides which cars get controllers, at what point to activate the system, and who at the dealership gets a login and password to immobilize vehicles. Some dealers choose one point person to manage the system; others distribute login/passwords to hundreds of individual employees.
“What we hope dealers take away from this story is that it’s important to manage logins and passwords carefully, and to invest in a system that is secure and backed up by the type of technological support that will ensure that any breaches, should they occur, are managed efficiently and effectively,” Krueger said.