BMW Wants to Charge for Heated Seats. These Grey Market Hackers Will Fix That.

Last week, the internet dragged BMW for a proposal in which heated seats would become an $18/month subscription service. Now, a community of hackers who have been unlocking features in BMWs for years tell Motherboard they're prepared to help owners unlock subscription-only features.

These companies say they perform vehicle "coding" to add additional features like Android screen mirroring or remove undesired programs like turning off annoying chimes and can also enable a feature on the European model of BMW’s older electric car that was disabled for regulatory reasons. They advertise their services through various enthusiast forums and popular shopping websites like eBay and Etsy. Long viewed as part of the enthusiast/modding culture, some of these modders say they could unlock subscription-based features too.

“We're always listening to our customers and finding ways to offer the features they're looking for. As long as BMW makes it possible to activate heated seats, we can look at offering it. If BMW doesn't allow it, then the same feature could be added with a hardware retrofit, so in the end the driver is always going to be able to get what they want,” Paul Smith, content marketing specialist at Bimmer Tech, a BMW coding firm, told Motherboard in an email. 

Historically, cars come with various features offered as part of packages, or “trims,” which the buyer decides when they purchase the car. Originally, these were nearly all physical or hardware upgrades like leather seats, more horsepower, or a sunroof. But, increasingly, they are software-enabled features like automatic headlights and wiper activation and driver assist features like adaptive cruise control. The creation of software-locked features means all versions of a car can have the feature, but only if the customer pays to unlock them. Some coders are helping customers do this off-the-books. 

Automakers seem to have figured out they can make more money by making people pay twice for these software-enabled features, once when they buy the car and again via a subscription software to unlock it over the course of ownership. With the proliferation of internet-connected cars and the digitization of nearly every feature a car offers, automakers increasingly view selling software upgrades as part of their business model. Stellantis, the parent company of Jeep, Dodge, and Chrysler, recently told shareholders during its “Software Day” presentation it expects to generate $22.5 billion from selling software and subscriptions alone, matching projections from other major automakers like Volkswagen, General Motors, and Ford.

Tesla sells some features via software upgrade, most notably the company’s controversial Autopilot and Full Self-Driving packages which cost upwards of $12,000 to unlock. But it also sells the same car in different software configurations that allow extra power and range owners can pay to unlock. Tesla also revokes paid software features on used cars when ownership is transferred, which has created a market for hackers to reverse those changes.

Arguably, no automaker has pushed the envelope on consumer expectations for paid software upgrades more than BMW. In 2019, the company royally pissed off its customers by announcing it would charge $80 per year to use Apple CarPlay, a feature many owners consider essential and even the cheapest cars provide for free. BMW backtracked, but obviously hasn’t given up on the “Software as a Service” model. It recently announced that in South Korea, owners will have to pay $18 a month to activate the heated front seats. In recent years, BMW owners in Europe have had to pay extra fees to enable features that are arguably just as  important for other people on the road, such as automatically disabling high beams when they detect a car in the opposite lane and driving assistant features that help avoid crashes.

Enter the BMW coders, who are well placed to offer aftermarket solutions.

BMW coding firms generally offer customers two different ways to receive new features for their vehicle. The company can either offer the coding in person, where a representative will visit the customer at their home and perform the coding there, or they will remotely access the customer’s BMW. While some firms only offer remote coding in the United States and Canada, others perform the task worldwide, according to their websites.

For remote coding, customers will first need to buy an ENET cable. This is a cable with an Ethernet port at one end that plugs into their laptop, and the other end plugs into the on-board diagnostics (OBD) port on their BMW. These go for around $25.

The features that coders then offer to activate is dizzying. They include turning on an alarm sound when unlocking or locking the vehicle which is off by default in some regions; enabling video functions while driving; removing the legal notice on the iDrive BMW entertainment and communications system on startup; automatically unlocking the doors after pressing the Stop Button; closing the car’s windows via the key fob; setting the windows to open with the key fob but keeping the sunroof open; automatic headlamp cleaning, and many, many more.

“When I first started doing this about seven years ago, there were a lot of requests for common comfort features” like using the key fob to open and close windows, a coder in San Francisco, who asked not to use his name because of the gray-market status of his work, told Motherboard. These could be done by using a BMW software suite. “But now it’s kind of changed a little bit because a lot of the scene has matured a bit” with coders hacking the car’s firmware, generating fake certificates to enable paid features, or even coming up with hardware solutions to enable latent features like BMW’s driver assist system. 

Back in 2019 when BMW said it would charge customers $80 a year to use CarPlay, some of the BMW coding firms offered access to the baked-in feature for a fraction of the price. “Bimmer Remote Coding,” for instance, advertises “lifetime activation” for CarPlay as well as additional quirks like being able to play videos while the car is in motion for $54.99.

“CarPlay activation has always been one of the most common coding inquiries, back when it was a subscription service and today when it still isn't offered in all markets,” Smith from Bimmer Tech added. 

A coder named Rob, who didn’t provide his last name and who is from another firm called Easy Bimmer Coding, initially told Motherboard in an email he would be happy to share “how BMW over the years has ‘nickeled and dimed’ its customers, and how we have filled the market void.” After Motherboard sent a list of specific questions, Rob replied that “I’m actually going to respectfully decline from this due to conflicts that may arise.”

Smith said that third parties being able to access and change diagnostic information isn’t under threat, but that his company does need to keep up with BMW’s own constant changes to its software.

“​​BMW's software is a moving target, so we need to change things to keep our services working. For example, coding through the vehicle's USB port is only possible in vehicles running certain software versions, so updating the vehicle's software takes away that option,” he said. BMW itself might also reverse any of the applied tweaks. “BMW technicians can also reset the system during a vehicle service, which wipes any changes. For that, we also offer a reactivation service to reinstate any custom features,” he added. The coder from San Francisco said the problem of fixes getting reset after software updates has become more acute since cars became capable of over-the-air updates via internet connections, which has enabled more frequent updates.

While most of the coding services on offer give drivers control over fun or more convenient quirks of their vehicle, others may be skirting U.S. regulations. On its website, Bimmer Tech advertises the ability to turn on the range extender for BMW’s i3 electric car much earlier than ordinarily allowed in the U.S. market. 

The i3 REx is an electric car with a small two-cylinder gasoline engine that acts as a range extender by charging the battery which powers the car. In i3 REx vehicles sold in the U.S., this range extender only turns on when the battery charge is below six percent. This is to meet an arcane California Air Resources Board regulation around the definition of battery-electric vehicles as opposed to hybrids. Meanwhile in the European market, drivers can manually turn on the range extender once their battery charge drops below 75 percent. 

“A lot of US i3 REx owners look at that European configuration with more than a hint of jealousy in their eyes…,” Bimmer Tech’s website adds. “The solution: BMW i3 hacks.”

In most scenarios, this does not make a difference. But in certain energy-intensive conditions, like driving uphill at highway speeds in cold temperatures, the range extender may not be able to recharge the battery as quickly as it is depleted. So if the battery only has a tiny amount of charge left, it can result in the car only going as fast as the little gas engine—originally designed for BMW motorcycles—can power it, which is typically 45 mph or slower. Being able to plan ahead and activate the range extender earlier solves the problem, but that option was not available to U.S. customers. (A class action lawsuit about the U.S.’s range extender configuration was filed in California in 2016, but was dismissed because the judge ruled it was not actually a product defect but worked as designed. The plaintiffs have appealed.)

However, Bimmer Tech says one of its technicians can remotely turn this latent feature on in U.S. models of the vehicle. 

The coder in San Francisco says it’s inevitable people will try to circumvent paid features like heated seats. “I typically don’t like to provide any service that requires firmware hacking. Hardware hacking is whatever, but people typically do that after the warranty anyways,” he told Motherboard. “But what tends to happen is, because a lot of info for coders is shared on forums, if for example there’s a forum post and someone says they figured out how to gain full access to the heated seats, it’s really democratized how people do things. As long as people can read a forum post and follow directions, they can do it themselves. And I guess that’s the neat thing about the internet.” But he said it may be more trouble than it’s worth. “I don’t think there’s going to be, like, a second hand market for it. It really depends how automakers roll out the pricing structure. I think it’s going to be $450 if you want to buy the heated seats outright? That’s nothing. In the grand scheme of things I’d probably just buy the heated seats.”

BMW did not respond to a request for comment.