10 ms·
When Your Used Car Is a Little Too ‘Mobile’
- vearwhershuh 7y agoThe issue here isn't that this guy can see and control the the vehicle without the next owner knowing. It's that the entire corporate world and government can see and control the vehicle without the next owner knowing. This is increasingly true across the board, regardless of trim level. I was excited about Rivian as a family friendly electric vehicle. Then they decided to add Alexa (due to an investment by Amazon) and reminded me why I will likely die driving my 1980s SUV.
- freepor 7y agoCertainly your 1980s SUV is certainly the thing most likely to be the location of your death, unless you’re older than ~70.
- correct_horse 7y agoThe same could be said of any 2020 SUV. Cars are dangerous.
- scarejunba 7y agoNew cars are way safer than the ones from the 1980s, though. In just a risk-minimization strategy I prefer a new car with Alexa over a forty year old car without. The privacy risk is low with the new one, but the death risk is high with the old one. Rolled my car and I just crawled out of the wreck and walked away with a mild concussion.
- ta999999171 7y agoYou must not be a journalist. Also, the best way to reduce risk for you would be to let someone else drive. It takes a LOT to roll a street car these days, holy hell.
- winrid 7y agoWell, if you somehow manage to de-beed a tire it's pretty easy. Maybe he was running from the cops. :)
- scarejunba 7y ago> Also, the best way to reduce risk for you would be to let someone else drive. Hahaha, solid bants. I enjoyed that. But given that the Lyft pass is no longer available, looks like I've got to risk my life. And of course I'm not a journalist, I do mostly productive work.
- ta999999171 7y agoJournalists (the few real ones who remain) who enable whistleblowers and get killed for doing so aren't doing productive work? Since you're a fan of the banter - fuck you!
- JohnFen 7y ago> The privacy risk is low with the new one Why do you say that? The new cars are constantly sending telemetry to the mothership.
- scarejunba 7y agoSorry, using the "risk = probability times damage" meaning here. It doesn't matter so much how much telemetry is sent until that leads to: a) compromising my privacy b) that breach leading to damage to me. I like to threat model things like this, rather than going on a binary scale of threatened/not-threatened and I think there is no threat model that leads to me needing to worry. Of course, if you have concrete information that I am in danger, I will pay you for it. I rate that as astronomically unlikely, especially since my SSN is out there and I haven't been identity thefted yet despite making half a million a year and having more credit cards than I can keep track of.
- JohnFen 7y agoI understand. I was just curious because telemetry is an automatic privacy intrusion. The only question is whether or not it exceeds your comfort level. In your case, it does not. That's fair.
- scarejunba 7y agoAh, right. I don't see an automated system seeing things about me as an intrusion until it has implications about me. For instance, I imagine if someone dev-nulled all telemetry but still had it running you'd consider it a privacy risk because your private data was exfiltrated but I wouldn't because no action was taken against me on private information.
- JohnFen 7y ago> I imagine if someone dev-nulled all telemetry but still had it running you'd consider it a privacy risk because your private data was exfiltrated Yes, this is my perspective. There are two aspects to privacy. The first is data collection. When data is collected about me or my use of my machines, that is a privacy intrusion regardless of what is done with that data post-collection. The second is what is done with the data post-collection. In my view, the impact of this is secondary -- how the data is handled post-collection will inform whether or not I'm willing to give consent for its collection in the first place.
- vearwhershuh 7y agoOnly if your 1980s SUV is capable of reaching speeds that might kill you. I will simply be maimed horribly and die later in the hospital, screaming "AT LEAST MY DEATH WASN'T TRACKED BY ALEXA". I am, on balance, comfortable with this fate. Alexa: His death was, in fact, tracked by Alexa
- nemosaltat 7y agoI’m hearing that last sentence in the voice of the narrator from arrested development.
- stilley2 7y agoI wish that voice was an option on echo.
- o_____________o 7y agoRon Howard! Director of A Beautiful Mind, Apollo 13, Willow, etc., star of Happy Days, father of Bryce Dallas Howard. https://www.youtube.com/watch?v=70nqLIj6l_M https://www.youtube.com/watch?v=70nqLIj6l_M
- julianj 7y agoAnd not to forget Opie from the Andy Griffith show
- scruple 7y agoMy Uncle drove an 80s Bronco until he died. "They see me coming, they get the fuck out of my way." He wasn't wrong.
- draw_down 7y ago> The issue here isn't that this guy can see and control the the vehicle without the next owner knowing How is that not the issue? It is exactly the issue.
- tantalor 7y agoThey actually admit to it here: https://www.ford.com/help/privacy/ https://www.ford.com/help/privacy/ "We also share personal information with... Law Enforcement Agencies, Courts, Regulatory Agencies, and Others. We will [disclose] personal information when we believe that doing so is necessary to... comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies" That's pretty vague, and inadequate. Basically they will let the cops snoop on you if they say "please"; don't bother getting a warrant first.
- slumdev 7y agoFord (and other manufacturers) need to own the reset process. There's no way you can rely on car dealerships to do this. https://www.fi-magazine.com/311144/but-the-dude-can-sell https://www.fi-magazine.com/311144/but-the-dude-can-sell
- ng7j5d9 7y agoHow would manufacturers know when cars change hands? Sure, in the example in the article, it was a lease that was turned in to a Ford dealer. But I've sold cars by handing my keys and a title to an individual who handed me money. The manufacturer of the car was not involved in the transaction.
- reaperducer 7y agoHow would manufacturers know when cars change hands? The same way that every single marketing company, bank, finance and insurance company does. It's public information.
- ng7j5d9 7y agoThat might be a good 90% solution - car registrations are public records, which tons of companies harvest, which is why you get those annoying extended warranty junk mailers, etc. Not all cars get registered though - some are chopped for parts (in which case that infotainment system might live on in another car), some are shipped internationally to be re-sold elsewhere, etc. And there could be a lot of lag - some cars languish on dealer lots, get auctioned, languish on another lot, get auctioned again, etc. Or a dealer might like your car and slap dealer tags on it and keep it essentially as his personal vehicle for a while without registering it. Lots of little opportunities for data to leak or remote functionality to be abused. There ought to be a complete, no-joke, absolutely reset everything in the car (and expire any remote access tokens) option in the car itself, that either a buyer or seller can easily invoke.
- bcrosby95 7y agoI learned long ago never to trust dealerships to do what they say they will, unless I see them do it. When I traded in a car, among other things I signed was a release of liability for the DMV. They claimed they would submit it. They never did. 3 months later the DMV called asking about the lack of insurance for the car. I told them what happened, and they said its common for dealerships to never send in this paperwork. So, yeah, lesson learned. I can't imagine what a pain in the ass this would have been if the car were involved in an accident.
- reaperducer 7y agoI learned long ago never to trust dealerships I traded in a car in Houston and the employees of the dealership (an actual big-name dealership, not some guy selling cars on his lawn) took it on joyrides for a week blowing through tolls. I found out when I got a letter in the mail from the Harris County Toll Road Authority with a bill and photos of my old car zipping through the barriers. I called HCTRA, and they were super nice about it, cancelled the fees, and said it happens all the time.
- Johnny555 7y agoI always do an infotainment system reset when I rent a car -- both when I start using the car, and just before I return it. I don't know what apps or other data other people synced, and I don't want anything I synced to be available to the next person. I'd be doubly sure to reset the car at the end of a lease.
- alasdair_ 7y agoI find it more amusing to enter in the address of a local liquor store, then a bar, then a weed shop, a casino, a strip club, a bail bondsman, the local municipal courthouse and finally a divorce lawyer’s offices.
- lotsofpulp 7y agoI'll just never use anything other than my phone or CarPlay.
- tzs 7y agoThere are enough street labels visible on the map of the car location in the screenshot from the myford site to figure out where that is. I was kind of surprised the article did not obfuscate that. It looks like it is at one of these businesses in Milford, CT: Stevens Ford Lincoln, Stevens Ford of Milford, Steven's Collision Center, or Colony Ford. I wonder if one of those Ford dealers is the dealer that failed to do the reset when processing the lease return?
- Johnny555 7y agoIf it's at a car dealer, I'm not sure there's any need to obfuscate it -- revealing that an off-lease car is on a car dealer's lot is not much of a breach. If it was in a residential neighborhood it'd be a different story.
- randyrand 7y agoWhy? For fun, here is a location to a random house in the bay. 37.351019, -122.035565. Location alone doesn't mean much.
- gambler 7y agoPeople are now beginning to realize that cellphones send out too much data. Well, modern cars are far worse. Do you know that some of them have weight sensors in seats? Do you know that they send this info out? On your phone, you at least have some control. You have zero control over your car's cell connection. I'm not even sure you can disable over-the-wire updates.
- myself248 7y agoPull the SIM card, or if it's an eUICC cut the trace. Yank the antenna wire, cap it with a terminator. Cut the module off the bus if you feel like pulling the fuse isn't enough.
- OkGoDoIt 7y agoWould the car detect the tampering and refuse to operate? Seems like there is a fair argument to be made for that by car manufacturers in the name of safety.
- somehnguy 7y agoWhile totally possible I've never heard of such a thing actually happening. Tearing out the OnStar module on Chevrolets has been done by people with a specific mindset for a long time. Whats kinda neat is that if it does still work after tearing out the module it should continue to work forever because you just ripped out the update mechanism. Assuming you don't go to the dealer for service of course...but who does that?
- z2 7y agoAgree, and if I may add, I think cars are worse because their primary function (transport) hasn't changed nearly enough compared with that of phones (voice calls into computation/information-at-fingertips). Therefore, it's harder to justify the same exponential increase in complexity and 'smart'. Maybe OTA hardware tuning ala Tesla will prove me wrong in the future...
- josephwegner 7y agoFun fact: Nissan Connect, which allows you to track, start, stop, lock, unlock, trigger horn, and toggle headlights is also massively insecure. In order to gain control of a Nissan Connect-enabled car, you need to know the VIN of the car and the name of the person to whom it is registered. Most of the time those details can be found on the internet, but if you're reasonably motivated you can find the VIN visible on a car's dashboard and probably find the owner's name in their mailbox. If you own a Nissan, register your car in Connect, or someone else will!
- julianj 7y agoHelpfully, my state will allow you to search tax records by VIN or name.
- tyho 7y agoBMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into the engine block and chassis so obviously cannot be changed, even after I sell the car. I also suspect these numbers are sequential. Till this car is scrapped I will be able to locate it, turn on the AC, unlock the doors etc.
- nkrisc 7y agoOn many (all?) modern cars it's also visible at the bottom of driver's side of the windshield. A car's VIN is public information.
- LinuxBender 7y agoI have a small piece of black paper over mine. I am happy to let a law enforcement officer view it if they ask.
- techopoly 7y agoNot a bad idea. As far as I know it's not required to be visible
- deleted 7y ago[deleted]
- tbyehl 7y agoNot illegal per se, but you're handing cops PC to enter your car to move the paper and any further evidence of "crime" they can see while doing that is fair game.
- RandomBacon 7y agoI thought about doing that, but if someone wants my VIN, they just have to squat down and look at the VIN that's punched in the frame of my truck. I haven't checked other vehicles, but I imagine they also have their VINs punched in the frame where it's easily visible. I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.
- h2odragon 7y agoI'm thankful our 2004 & 2002 cars are as free of "smart" as they are. They're aging out on us and we've been looking at replacements; the used market is contaminated with screens and systems that we DO NOT WANT. I wonder how difficult it will be to strip all that shit out when the time comes. What's going to have to be stubbed out or emulated to make the car run and how difficult will that be? Are we looking at things like people rolling their own EverQuest shards yet?
- dillonmckay 7y agoYeah, I really don’t like anything newer than 2009 in terms of the electronics integrations. My next purchase, I am considering either a 2008 Lexus GX470 or a Tesla Model Y.
- H1Supreme 7y agoPart of the reason I've been learning about embedded systems is so I can take these sorts of things into my own hands. I do not want a car with WI-FI, and I especially don't wait it attached to anything that makes my car move (or stop).
- judge2020 7y agoCars manufactured starting May 2018 must have backup cameras, so chances are whatever car you get will also have infotainment and other features. Maybe there are a few cars that have a pop-up screen or something similar that is only used for backup. https://en.wikipedia.org/wiki/Backup_camera#Mandates https://en.wikipedia.org/wiki/Backup_camera#Mandates
- semi-extrinsic 7y agoFWIW we just bought a 2012 model European car, and it's nicely free of all this infotainment systems crap. I believe Dacia will still sell you a car like this in 2020. Maybe there is a US equivalent, but I don't know.
- kube-system 7y agoYikes. This is a serious safety issue. Imagine if this wasn’t an EV, and someone started a car while in the new owner’s garage.
- speedgoose 7y agoCan you start a ICE vehicle remotely? I thought it was mostly a EV thing, some people have aftermarket kits.
- josephwegner 7y agoI can start my Nissan (not EV) from an app.
- reaperducer 7y agoCan you start a ICE vehicle remotely? With a keyfob for decades, and with an app for years. It's virtually standard equipment in certain states, along with plug-in engine block heaters. I thought it was mostly a EV thing A guy at work likes to start his massive Ford Raptor with his phone at the end of the day and set off the alarms of the cars he's parked between.
- cydonian_monk 7y agoDo we work together? (I'm assuming not.) Some guy where I work does the same thing, same truck. Usually he's still thousands of feet away when he starts it too, maybe even still in the office. Or maybe it's just a Houston thing.
- reaperducer 7y agoI'm not in Texas. I think it's an "I bought a giant truck to carry around six dead leaves in the back when I go shopping at Target" kind of thing.
- justincredible 7y ago
- river99 7y agoFirst thing I do in any rental car is turn off any remote tracking, mobile apps, clear out bluetooth and turn off wifi if equipped.
- _sbrk 7y agoWhile always good to turn non-essential features off, this doesn't mean that you can't be tracked. Many vehicles, even if non-rental, now come standard with cellular voice/data connections. GM pioneered this with OnStar in the mid-90s[1], and other manufacturers soon followed. Combined with the "black box" recording of _every_ sensor in your car, there can be some pretty damning evidence against the driver in the event of a wreck, etc. There are no switches for the driver to disable regarding the data inside your ECU[2], or Event Data Recorder[3]. It's not that you can't get away with anything anymore, it comes down to minor infractions are now enforceable (with the lucrative fines that follow) and that your car can present evidence against you. [1] https://smart.gi-de.com/automotive/a-brief-history-of-car-connections/ https://smart.gi-de.com/automotive/a-brief-history-of-car-co... [2] https://www.plaintiffmagazine.com/recent-issues/item/beware-the-black-box https://www.plaintiffmagazine.com/recent-issues/item/beware-... [3] https://www.jstor.org/stable/26167752?seq=1 https://www.jstor.org/stable/26167752?seq=1
- river99 7y agoSome cars have a tracking toggle switch. I believe BMW is one such example.
- ReptileMan 7y agoCan't you just cut the antenna? Or just improvise a Faraday cage around it.
- reaperducer 7y agoGood luck finding it. And then, good luck getting to it.
- 7y ago
- josefresco 7y agoA low tech example, but I bought a used car a couple years ago with navigation and still saved in the system were addresses the previous owner had entered. From this simple list, I was able to determine where they lived, and if was curious enough the businesses and homes they visited, or at least used navigation to find.
- nimbius 7y agosomewhat off-topic, but if you'd like a hardware hack to disable the perpetual vehicle tracking in most modern cars, its actually a component of OnStar in GM vehicles. BMW Assist and others are patterned off the same technology as it all comes off the boat as a single embedded package from China. Its a cellular modem with a header for your OBD and ECM and data line for your info-tainment. its NOT built into the info-tainment. on GM Vehicles You're looking for a metal box under the passenger side footwell, about the size of a cable modem. newer models have it in the trunk on the right or left side. You can remove the box, open it up, and inside will be a riser card with 2 or 3 connectors for a cell antenna. theres no SIM card. Pull the riser and you wont get any error codes. Confirm the hack by pressing the OnStar button (or whatever your car calls it.) it will ring, but no one will pick up. this will NOT affect your bluetooth ability OR your backup camera. thats actually part of the infotainment. this WILL however disable the SOS button and the automated SOS on airbag deployment signal as the riser doesnt exist to make the call.
- gbrown 7y agoIn your opinion, is this worth doing even if you never signed up, activated, or signed any agreements with respect to on-star?
- justAnotherNET 7y agoNot OP, but yes
- tantalor 7y agoThe master reset and much, much more is actually detailed in their privacy policy: https://www.ford.com/help/privacy/ https://www.ford.com/help/privacy/ "Performing a Master Reset returns the vehicle’s modem to the factory settings and removes any imported personal data like cellular phone contact lists, names of paired devices and/or connected networks. Master Reset also disconnects modem-equipped vehicles from any FordPass / Lincoln Way accounts. See 4 above. Deleting the FordPass/Lincoln Way app from your device will not disable data sharing. PEFORM A MASTER RESET: BEFORE SELLING OR TRANSFERRING OWNERSHIP AFTER PURCHASING OR LEASING A PRE-OWNED VEHICLE BEFORE AND AFTER RENTING A VEHICLE FROM A RENTAL COMPANY "