Having worked in the connected car/telematics industry for a while as a contractor, I can very well relate to this and can confirm that the security systems in

Having worked in the connected car/telematics industry for a while as a contractor, I can very well relate to this and can confirm that the security systems in place inside the car's telematics unit is not good enough. For example, in one of the oauth process of authenticating a car with the cloud, the VIN was passed around as a client secret and MDN of the modem as the username ! We recommended to immediately stop this practice, but the "IT" dept of the automotive maker said, " You know we sell cars, not security software." There is no budget to rewrite the mechanism, and the telematics unit cannot be updated OTA. The upgrade requires customers bringing the car to a dealer and USB stick updates etc. I believe the frequent bursts of data from the car was given to insurance companies. Or they were trying to package insurance deal along with the car sale or something.