5 ms·

Note that this is all based on this source material. https://foundation.mozilla.org/en/privacynotincluded/categories/cars/ https://foundation.mozilla.org/en/pri

Note that this is all based on this source material. https://foundation.mozilla.org/en/privacynotincluded/categories/cars/ https://foundation.mozilla.org/en/privacynotincluded/categor... I haven't dug too much into the methodology, but it seems like it's done based on privacy policies rather than actually looking into the car telemetry traffic. It's also written in a very caaual and sensationalist "omagad" tone that doesn't serve well the seriousness of the topic or findings

sfaxon 3y ago
I own a VW ID.4. For reasons I wanted to reverse engineer some of the API. After authenticating to the account tied to my car, the landing page (https://www.vw.com/en/owners.html https://www.vw.com/en/owners.html) makes calls to a lot of analytics trackers. I'll just list what pi-hole defaults block: analytics.tiktok.com sp.analytics.yahoo.com googletagmanger.com universal.iperceptions.com cdn4.userzoom.com snap.licdn.com secure-ds.serving-sys.com bat.bing.com ct.pinterest.com adherent.com And a few others. I would guess the phone app (which has access to the car location) has a similar list of trackers. I hope to get some time to MITM the app to be able to know for sure.
- creeble 3y ago
  Just to be clear, these are trackers from the web page, not trackers called by your car, correct? I'm never surprised by the web trackers (which my ad blocker generally filters too), but 3rd-party trackers called from devices/vehicles seems more insidious. Although the car / IoT companies can just as easily outsource the data once they have it anyway.
  - Nextgrid 3y ago
    They however still have access to the JS context and thus the authenticated session when you are on the website. They can most likely exfiltrate all the data visible on the page and maybe even the auth token for further server-side misuse after you've closed the page.
  - sfaxon 3y ago
    Yes, this is from the web page. Where I can manage my vehicle (see VIN, etc) and has my home address, dealer information, etc. I would be interested to hear of a way to intercept internet traffic between the vehicle and the internet.
    - waterheater 3y ago
      If you're being extra paranoid, you'd need to spoof a cell tower. Spoofing a Wifi AP and monitoring traffic with Wireshark gets you network traffic, but you can't know if the vehicle sends certain information exclusively over the cell network, short of on-vehicle firmware and software analysis. Also, if you wanted to go with the Wifi approach, you need to force Wifi connectivity, which would probably mean going outside of cell tower coverage or unplugging the vehicle's cellular antenna, both of which may affect what the car transmits.
  - hedora 3y ago
    Our GMC's telemetry showed up on the "list of crap you can delete" in my unused facebook account.
spookie 3y ago
The language also took me by surprise. Not a fan. Really, if you want to connect with people on this topic just mention "abortions", and "data sold".
JeremyNT 3y ago
Thanks. I read the original article and conspicuously absent is the actual mechanism of the data collection that is occurring here. Some of the claims seem barely believable. Is data exfiltrated from the phone, via some kind of data access loophole in Android Auto / Car Play? Are the microphones in vehicles actively listening to conversations and shipping them off for analysis? Or is this all purely hypothetical (i.e., they say they have the right to use it, so clearly they must be trying to acquire it...)? The only techniques I can imagine that might lead to collection of data such as sexual activity are truly egregious indeed, and although I have incredibly low trust in auto makers such techniques seem like a bridge too far, even for them.
- philsnow 3y ago
  > Are the microphones in vehicles actively listening to conversations and shipping them off for analysis? Or is this all purely hypothetical (i.e., they say they have the right to use it, so clearly they must be trying to acquire it...)? All data that they can acquire will be acquired because data can be sold, leading to higher quarterly profits. There are almost no other considerations.
  - kccqzy 3y ago
    This is reductionist and absurd. You bought an iPhone or an Android phone with a microphone. Will you automatically assume that Apple and Google will turn on your microphone remotely, acquire data, and sell them? If not, why do you assume so for cars?
    - Lio 3y ago
      Well I wouldn't be that surprised if Google started doing that. It's kind of their raison d'etre.

sfaxon 3y ago

I own a VW ID.4. For reasons I wanted to reverse engineer some of the API. After authenticating to the account tied to my car, the landing page (https://www.vw.com/en/owners.html https://www.vw.com/en/owners.html) makes calls to a lot of analytics trackers. I'll just list what pi-hole defaults block: analytics.tiktok.com sp.analytics.yahoo.com googletagmanger.com universal.iperceptions.com cdn4.userzoom.com snap.licdn.com secure-ds.serving-sys.com bat.bing.com ct.pinterest.com adherent.com And a few others. I would guess the phone app (which has access to the car location) has a similar list of trackers. I hope to get some time to MITM the app to be able to know for sure.

creeble 3y ago
Just to be clear, these are trackers from the web page, not trackers called by your car, correct? I'm never surprised by the web trackers (which my ad blocker generally filters too), but 3rd-party trackers called from devices/vehicles seems more insidious. Although the car / IoT companies can just as easily outsource the data once they have it anyway.
- Nextgrid 3y ago
  They however still have access to the JS context and thus the authenticated session when you are on the website. They can most likely exfiltrate all the data visible on the page and maybe even the auth token for further server-side misuse after you've closed the page.
- sfaxon 3y ago
  Yes, this is from the web page. Where I can manage my vehicle (see VIN, etc) and has my home address, dealer information, etc. I would be interested to hear of a way to intercept internet traffic between the vehicle and the internet.
  - waterheater 3y ago
    If you're being extra paranoid, you'd need to spoof a cell tower. Spoofing a Wifi AP and monitoring traffic with Wireshark gets you network traffic, but you can't know if the vehicle sends certain information exclusively over the cell network, short of on-vehicle firmware and software analysis. Also, if you wanted to go with the Wifi approach, you need to force Wifi connectivity, which would probably mean going outside of cell tower coverage or unplugging the vehicle's cellular antenna, both of which may affect what the car transmits.
- hedora 3y ago
  Our GMC's telemetry showed up on the "list of crap you can delete" in my unused facebook account.

spookie 3y ago

The language also took me by surprise. Not a fan. Really, if you want to connect with people on this topic just mention "abortions", and "data sold".

JeremyNT 3y ago

Thanks. I read the original article and conspicuously absent is the actual mechanism of the data collection that is occurring here. Some of the claims seem barely believable. Is data exfiltrated from the phone, via some kind of data access loophole in Android Auto / Car Play? Are the microphones in vehicles actively listening to conversations and shipping them off for analysis? Or is this all purely hypothetical (i.e., they say they have the right to use it, so clearly they must be trying to acquire it...)? The only techniques I can imagine that might lead to collection of data such as sexual activity are truly egregious indeed, and although I have incredibly low trust in auto makers such techniques seem like a bridge too far, even for them.

philsnow 3y ago
> Are the microphones in vehicles actively listening to conversations and shipping them off for analysis? Or is this all purely hypothetical (i.e., they say they have the right to use it, so clearly they must be trying to acquire it...)? All data that they can acquire will be acquired because data can be sold, leading to higher quarterly profits. There are almost no other considerations.
- kccqzy 3y ago
  This is reductionist and absurd. You bought an iPhone or an Android phone with a microphone. Will you automatically assume that Apple and Google will turn on your microphone remotely, acquire data, and sell them? If not, why do you assume so for cars?
  - Lio 3y ago
    Well I wouldn't be that surprised if Google started doing that. It's kind of their raison d'etre.