Mach E Car Hacking?

ChasingCoral

Well-Known Member
First Name
Mark
Joined
Feb 3, 2020
Threads
379
Messages
12,434
Reaction score
24,588
Location
Maryland
Vehicles
GB E4X FE, Leaf, Tacoma, F-150 Lightning ordered
Occupation
Retired oceanographer
Country flag
No, I don’t mean car jacking. On our recent drive back from Ohio, two odd and mismatched requests appeared, one on Marlin’s Sync 4A screen, one in Ford Pass. They were about 3 hours apart on the same day.
Ford Mustang Mach-E Mach E Car Hacking? E12FB9D7-E22F-4FA6-A36F-161FF7B29E98

Ford Mustang Mach-E Mach E Car Hacking? 1C19A55A-8C47-4D9C-B345-B0C44F89B599


I seem to recall seeing the first one, the Brent Ferguson request come up on Marlin’s screen back in the spring (our March trip?).

Has anyone else seen an unexpected attempt at “entry“ into your Mach E?
 

Griddlez

Well-Known Member
First Name
Griddlez
Joined
Feb 18, 2021
Threads
5
Messages
170
Reaction score
287
Location
Illinois
Vehicles
2021 Mach-E AWD ER; 2022 Lightning On Order
Country flag
So let's think through how someone could send their profile. Do you really just need a VIN or do you have to "activate" the ford pass app within the physical car? I seriously can't remember how this worked on my FE.. I think I did it after I already bought it and activated the app. And on my GT I have ordered I don't think I have an option to send it to the car right now until I activate.

Hmm am I missing something? Can you really send a profile with just a VIN?
 

kdryden99

Well-Known Member
First Name
Richard
Joined
Sep 25, 2020
Threads
33
Messages
1,643
Reaction score
1,426
Location
Montreal Canada
Vehicles
Nissan Sentra Spec-V, Infinite Blue Mach E4X Prem
Country flag
If I remember once you got the car you had to pair the phone and activate the car on the screen after entering the vin in the app
 


OP
OP
ChasingCoral

ChasingCoral

Well-Known Member
First Name
Mark
Joined
Feb 3, 2020
Threads
379
Messages
12,434
Reaction score
24,588
Location
Maryland
Vehicles
GB E4X FE, Leaf, Tacoma, F-150 Lightning ordered
Occupation
Retired oceanographer
Country flag
So let's think through how someone could send their profile. Do you really just need a VIN or do you have to "activate" the ford pass app within the physical car? I seriously can't remember how this worked on my FE.. I think I did it after I already bought it and activated the app. And on my GT I have ordered I don't think I have an option to send it to the car right now until I activate.

Hmm am I missing something? Can you really send a profile with just a VIN?
All you have to have to make the request is the VIN. For the connection to be completed it has to be accepted by presenting “Let’s Go” on that request screen that comes up on the Sync 4A screen.
 

Mach1E

Well-Known Member
Joined
Sep 5, 2021
Threads
77
Messages
7,942
Reaction score
9,872
Location
Florida
Vehicles
Mach 1, Chevy SS-sold, GTPE delivered oct 2021
Country flag
All you have to have to make the request is the VIN. For the connection to be completed it has to be accepted by presenting “Let’s Go” on that request screen that comes up on the Sync 4A screen.
Does that mean if you leave your car unlocked, anyone with a phone could drive away?
 

Shayne

Well-Known Member
Joined
Aug 9, 2020
Threads
18
Messages
3,383
Reaction score
2,527
Location
Northern Ontario Canada
Vehicles
2021 MME4x Prem
Occupation
Retired
Country flag
No, I don’t mean car jacking. On our recent drive back from Ohio, two odd and mismatched requests appeared, one on Marlin’s Sync 4A screen, one in Ford Pass. They were about 3 hours apart on the same day.

I seem to recall seeing the first one, the Brent Ferguson request come up on Marlin’s screen back in the spring (our March trip?).

Has anyone else seen an unexpected attempt at “entry“ into your Mach E?
No Thomas both trips just Brent? Bit like a spam (trogon) email. Assuming you hit the delete icon (both times?) and no in the app.

I think that it should not show up in the app and why different is bogging. It was weird at first you having to authenticate a second phone from the first phone and not the car. Could not understand why the second was not working and then my wife tells me your phone in here is noticing you like crazy (I had her phone sitting in the vehicle). Think they changed that but you would think the app should have nothing to do with it and it should be all sync and a ford server. Put a lock to adding users/keys in vehicle settings. Get a warm comfy feeling with Ford servers at this point.
 

Davedough

Well-Known Member
First Name
Dave
Joined
Oct 12, 2020
Threads
14
Messages
1,812
Reaction score
4,253
Location
West BYGOD Virginia
Vehicles
Mach E GTPE , Explorer ST
Occupation
Federal IT Sales Engineer
Country flag
I’ve got nothing to add but your phone’s battery level is stressing me out
 
OP
OP
ChasingCoral

ChasingCoral

Well-Known Member
First Name
Mark
Joined
Feb 3, 2020
Threads
379
Messages
12,434
Reaction score
24,588
Location
Maryland
Vehicles
GB E4X FE, Leaf, Tacoma, F-150 Lightning ordered
Occupation
Retired oceanographer
Country flag
No Thomas both trips just Brent? Bit like a spam (trogon) email. Assuming you hit the delete icon (both times?) and no in the app.

I think that it should not show up in the app and why different is bogging. It was weird at first you having to authenticate a second phone from the first phone and not the car. Could not understand why the second was not working and then my wife tells me your phone in here is noticing you like crazy (I had her phone sitting in the vehicle). Think they changed that but you would think the app should have nothing to do with it and it should be all sync and a ford server. Put a lock to adding users/keys in vehicle settings. Get a warm comfy feeling with Ford servers at this point.
Brent showed up before. The funny thing is the Brent request in the car and Thomas on Ford Pass were within Two hours of each other.
 
OP
OP
ChasingCoral

ChasingCoral

Well-Known Member
First Name
Mark
Joined
Feb 3, 2020
Threads
379
Messages
12,434
Reaction score
24,588
Location
Maryland
Vehicles
GB E4X FE, Leaf, Tacoma, F-150 Lightning ordered
Occupation
Retired oceanographer
Country flag
Does that mean if you leave your car unlocked, anyone with a phone could drive away?
No. The car has to be running to respond on the Sync 4A screen.
 

Shayne

Well-Known Member
Joined
Aug 9, 2020
Threads
18
Messages
3,383
Reaction score
2,527
Location
Northern Ontario Canada
Vehicles
2021 MME4x Prem
Occupation
Retired
Country flag
Brent showed up before. The funny thing is the Brent request in the car and Thomas on Ford Pass were within Two hours of each other.
Makes you think it is the same glitch (hacker jacker) but the same name would have been smoother. It may be easier to hack them all on the server than try to do it one by one ;).

You could just tap yes in your app? For Thomas not Brent anyway. Use to be after the prime (1st) phone was activated by sync then the others (next) were activated by the 1st phone with no sync screen but that was changed to both phone and sync4a I think. When I set up the third time after the paak service I had both? Believe the second time after I had them master reset it to check if they could get the charging schedule to work in a service bay I knew to look on the first phone as it was still not on the sync screen.

They should limit channels and just from the car with fob required. It is something that should not be done too often and the convivence of doing it on an app (like your charging schedule) may not be required and could be simplified and tightened. Lean and mean is always the best. Like an app that does paak and soc (charging) thru Bluetooth and that is it.

Can you provide your vin? We can try a ddos attack. We can get multiple forum members here bugging CC to see what happens ?. Guess you should consider yourself lucky some have been waiting for that screen with legit requests but you get them all the time ;).
 
OP
OP
ChasingCoral

ChasingCoral

Well-Known Member
First Name
Mark
Joined
Feb 3, 2020
Threads
379
Messages
12,434
Reaction score
24,588
Location
Maryland
Vehicles
GB E4X FE, Leaf, Tacoma, F-150 Lightning ordered
Occupation
Retired oceanographer
Country flag
Thomas is back. This is getting quite annoying!

Ford Mustang Mach-E Mach E Car Hacking? 4DAE161D-C3B0-412B-8008-A335E613D2CF

@Ford Motor Company : any idea how to block Thomas?
 
 




Top