16 ms·
VW breach exposes location of 800k electric vehicles
- ycombinatrix 2y agoIsn't this a GDPR violation by VW?
- TheChaplain 2y agoThat could be a nail in the coffin to end VW, the EU GDPR is quite a sharp weapon.
- tencentshill 2y agoI think even in the EU, VW group is "too big to fail".
- creshal 2y agoToo big to fail and too much of it is state owned, either directly, or through government-owned retirement funds. The government will investigate itself and find no wrongdoings, let's go after the journalists who committed the ultimate crime: Embarassing Officials.
- johnea 2y agoOh yea, that big gubmint is the one to blame! Never mind that it's a for-profit company that does the surveiling, and wrote the faulty IT structure. Neoliberal religion runs deep...
- davidrm 2y agosupervisory board of VW has 20 members, state of Lower Saxony appoints 2 (as a minority shareholder), workforce elects 7 among themselves, and 3 are trade union representatives also elected by the workforce. no one is denying it's a for profit company, but its governance model doesn't really scream "neoliberalism". assuming you're from the US, (German) enterprises like VW are vastly different from what exists in the US, not just in the terms of their structure but also their influence on Germany and EU.
- creshal 2y agoWay to miss the point. Governments giving semi-private companies blank cheques is the worst possible combination, because nobody's incentivised to care about laws in such constructs.
- gadflyinyoureye 2y agoThe EU will play favorites. There will be a slap on the wrist. Some probation. Maybe a CEO or high level C* person will step down in disgrace with only a few hundred million in severance. Then everything will go back to normal.
- jwr 2y agoThe EU won't do much, because this is a car company. Car companies run the EU, basically, especially German ones.
- newsclues 2y agoNot surprisingly as the EU grew out of post war coal and steel association
- rad_gruchalski 2y agoThe problem was caused by Cariad, not VW directly. Cariad will be held responsible for, not VW.
- Reason077 2y agoCARIAD is a 100%-owned subsidiary of the Volkswagen group.
- BoredPositron 2y agoIt’s their bad software bank.
- rad_gruchalski 2y agoSure. Good accounting and disaster prevention from VW. The matter of the discussion proves that the decision was correct.
- 7bit 2y agoYep, and this will be the end of CARIAD. Volkswagen has already b decided to bleed them to death with the Rivien joint-venture. I guess they'll shut down the rest of the operation much, much faster now. This is the perfect reason for them to do so and what they have been waiting for.
- tremon 2y agoThat's not how the GDPR works. Cariad may be a subcontractor (data processor in GDPR speak) for VW, but the driver does not have a contract with Cariad -- their contract is with VW (the data controller in GDPR speak). The data controller is always jointly liable with the processor for 3rd-party data breaches.
- mzs 2y agoif you can read German: https://www.spiegel.de/netzwelt/web/volkswagen-konzern-datenleck-wir-wissen-wo-dein-auto-steht-a-e12d33d0-97bc-493c-96d1-aa5892861027 https://www.spiegel.de/netzwelt/web/volkswagen-konzern-daten... https://www.ccc.de/de/updates/2024/wir-wissen-wo-dein-auto-steht https://www.ccc.de/de/updates/2024/wir-wissen-wo-dein-auto-s...
- dmitrygr 2y agoWhy is nobody talking about the fact that this should not be possible? There is precisely zero reason for them to have this location data. Give the CEO one year of jail per person whose location was illegally tracked.
- zer8k 2y agoOn the contrary it's relatively simple to understand how it got there trivially. Most modern cars, especially ones that fit into more "luxury" brands have an app. That app gives you telemetry and location data for a price. It's rather convenient to be able to pre-condition your car, or figure out where you parked in a massive unlabeled parking lot, etc. This is all consented to, but regardless the data is tracked anyway via some GPS/cell system modern cars have. When you pay for it you get more stuff - anti-theft, better tracking, service tracking, etc. It's a convenience. I'm not entirely comfortable with it but if you want a better-than-decent car made after 2016 you probably have it on-board and unless you rip the ECM out you're stuck with it. Personally, I'd rather pay BMW, for example, for anti-theft and tracking than pay OnStar or another service that is gonna stick me with a ridiculous contract and stuff my car with even more buttons.
- CatWChainsaw 2y agoEh, "consented to" is rather weak when you are forced to hit the "I agree" button to be able to drive the car you bought. That and forced arbitration need to die posthaste.
- rad_gruchalski 2y agoI refuse to believe that it’s not possible to drive the car without the app.
- CatWChainsaw 2y agoAnd I'm skeptical that it is. Happy Friday.
- olddog2 2y agoFind the guys who usually park at expensive family homes, but occasionally visit a known brothel, then blackmail them. We all just let surveillance haplen to us, in fact we paid for most of it
- omolobo 2y ago[dead]
- ctippett 2y agoI once worked for a firm that had access to credit card transaction data and came across almost this exact scenario. Kindergarten transactions one day, escort payments on another. It was — and still is — creepy. An average Joe like me shouldn't be able to pry into someone's private life like that.
- harimau777 2y agoMy theory is that most people think about data misuse, perhaps unconsciously, from the viewpoint of your average good person. E.g. "if I got a hold of a stranger's bank information, then I'd be tempted to steal from them." Instead they should think from the perspective of an evil person. E.g. "how can I proactively use whatever data that I can get to hurt someone." For example, at a previous job I went to my managers and pointed out that every developer working on our system had access to our user's names and their involvement with racial justice programs our client was running. By guessing someone's ethnicity from their name, a bad actor could target minorities involved in racial justice. The response I got was not to fix the security issue; instead it was horror that I would ever conceive of such a scheme.
- aziaziazi 2y agoI hate those management arrogance. Reminds me a teacher that amply mocked me in front of the class to have mentioned Light Pollution [0] (I heard about in a youngster science magazine) during a chapter about... "various pollution type"! Do you have a written record of the conversation? 0 https://en.wikipedia.org/wiki/Light_pollution https://en.wikipedia.org/wiki/Light_pollution
- CatWChainsaw 2y agoAh, here's my daily reminder to treat my 2005 Honda like a princess and hope it never, ever dies.
- 2OEH8eoCRo0 2y agoI plan to buy old used cars forever when I can no longer keep my 2013 Subie going.
- throwaway173738 2y agowhy not have whatever dies replaced? I will probably do that with my crappy small truck from 2006.
- dghlsakjg 2y agoAfter a certain point, parts just aren't made. I drive a 1997 ES300 that needs a new left rear taillight lens. The new part doesn't exist anymore, and I can't find a used part in Canada.
- Scoundreller 2y agoSo uhhhh, buy one from USA?
- mulmen 2y agoThey may very well be a different part. The USA and Canada have different regulations.
- garaetjjte 2y agoRust. I mean, it's still possible to repair but it gets annoying.
- ryukoposting 2y agoSubframe rot. I live in Wisconsin. My 2000 Lexus won't live forever, no matter what I do.
- RajT88 2y agoHey EU, maybe mandate an opt out for all vehicle telemetry? Then maybe the rest of the world will follow suit. I know, I know, I am kidding myself.
- hyhconito 2y agoOpt in you mean, like the cookie banners? Oh no that'll never happen because VW are a European company and the money is in fining US tech companies!
- rad_gruchalski 2y agoEuropean companies get fined the same as any other companies.
- hyhconito 2y agoWell within the constraints they set out which exclude a hell of a lot of European companies. (I am in Europe for reference, this is not an external perspective)
- 7bit 2y agoWhat constraints? And which companies are excluded by them?
- mtmail 2y agohttps://www.enforcementtracker.com/?insights https://www.enforcementtracker.com/?insights shows breakdown by country, type, industry sector. "Highest fines: individual" top 10 list is all international companies (Meta, Amazon, TikTok, LinkedIn, Uber) and those make the news. Smaller European companies hardly make the news.
- adolph 2y agoVW paid "$14.7 billion to settle civil charges in the United States" and was ordered "to pay a $2.8 billion criminal fine for 'rigging diesel-powered vehicles to cheat on government emissions tests'." https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal
- jsiepkes 2y agoIf it so bad there is actually a whistleblower then how do they pass their ISO27001 audits? Bit too friendly with TUV Nord? https://cariad.technology/content/dam/digitalmindofmobility/documents/CARIAD-SE-ISO_9001-certificate.pdf https://cariad.technology/content/dam/digitalmindofmobility/... EDIT: Just noticed this is an ISO9001 certificate. Though on their job offer site they do ask for "Foundational understanding of security related regulations and standards preferred (e.g. ISO21434, ISO27001, NIST-800)". Unclear if they are actually ISO 27001. Found the 9001 one by fluke, they don't seem to list that one on their site either.
- tuwtuwtuwtuw 2y agoThe fact that you have passed audits isn't a guarantee (or even an indication) that you don't have major security vulnerabilities.
- starbugs 2y ago> The fact that you have passed audits isn't a guarantee (or even an indication) that you don't have major security vulnerabilities. Please explain that to my IT department.
- rf15 2y agoTÜV certification has always been more about certification theater and being able to verify that you don't have egregious amounts of negligence than certifying that you are doing your work well. edit: I've never prepared for our audits and we always get our certification, no matter what they find as long as you say "yes, we are aware"
- gsich 2y ago27001 does not specify implementation details.
- tremon 2y agoNot sure about 27000, but ISO9001 is a paper audit only: you pass or fail them based on your defined business processes. The technical configuration of your systems is outside the scope of the audit.
- jwr 2y agoI so hope this will start an avalanche and car companies will not be able to get away with collecting so much data about users (cars, but that's pretty close). Especially in the EU, the hypocrisy is jarring: on one hand, GDPR, protecting users from surveillance by businesses, etc, and on the other hand, car companies get a free pass, because they are car companies, and the EU likes car companies.
- __fst__ 2y agoEVs are topping the list of (imho) useless extras in cars. I'm still cherishing my Honda Fit pre-touchscreen edition. I'm going to drive it until it will fall apart. My next car will be an EV but I have yet to find one that still comes with mechanical features (door handles, knobs/buttons), without a whole battery of surveillance/telemetry tech and (crossing fingers) exchangable batteries. Simple electric propulsion ...
- Rebelgecko 2y agoIn a lot of cars you can pull the fuse that powers the cellular modem without any side effects
- 1oooqooq 2y agoyou're taking to a bunch of old men shouting (literally) at clouds
- mulmen 2y agoPulling a fuse in a car is peak old maning.
- doodlebugging 2y agoPeak old manning would involve locating all the information needed to be able to identify and remove all the components used to facilitate the tracking (or other bullshit that complicates vehicle ownership) and then following the documented procedures and updating other like-minded owners on vehicle forums so that everyone else can do the same. In the process some forum threads would pick up hundreds of posts over a decade or more so that removal of every nut, bolt, screw, plastic plug, etc is documented with photos, allowing anyone with the vehicle to see exactly how to take ownership of the vehicle from the manufacturer. True old-school old manning involves not only removal of all the bullshit, but also covers all cosmetic changes to the vehicle that would be needed to eliminate all signs that any of the offending components were ever installed and would include things like how to accomplish all the trim and body work necessary to permanently fill all the holes in the vehicle like antenna penetrations through the vehicle body and plastic trim mods to fill holes that formerly held buttons or switches that no longer exist. In the process, old-school old manning would attack the software used in the vehicle, removing all the offending functionality with a custom flash tool so that the only software running on the vehicle after all the mods are completed would be that which controls and monitors engine and transmission functionality since that is actually the only software on a vehicle that adds value by allowing the vehicle owner to track operating efficiency in real time.
- forgetfreeman 2y agoWhy the sideways fuck did they even have location data to begin with? It's like the checklist for buying a new car starts with figuring out what circuit drives the cell modem and pop that fuse out before taking a test drive to confirm it doesn't brick anything critical. Fucking ridiculous.
- ImJamal 2y agoMost new cars have features that require it such as onboard GPS, speed limits on the dash, OnStar and similar features.
- forgetfreeman 2y agoAll bullshit my car shouldn't do in the first place.
- tzs 2y agoThose are mostly things that require the car to know its location. They don't require that the car share the location with the car's maker except possibly sharing what region the car is in. The region sharing might be needed to efficiently update things like the map and the speed limits.
- NewJazz 2y agoNiche feature that shouldn't affect any other part of the car's operation if it were turned off or nonfunctional due to modem hardware shutoff.
- mulmen 2y agoNone of that requires cellular connectivity. It can and was accomplished using only wifi sync at home. Live traffic information is (was?) broadcast on AM radio.
- jazzyjackson 2y agowas it ever AM? info I can find points to traffic info being encoded in FM broadcast, as "audio" but above audible frequencies, 57khz, same as any metadata you get with modern digital radio - station name, song name, artist name etc. https://www.mediarealm.com.au/articles/fm-rds-radio-data-system-guide/ https://www.mediarealm.com.au/articles/fm-rds-radio-data-sys...
- deleted 2y ago[deleted]
- thebruce87m 2y agoI wonder if they were all petrol vehicles, or all diesel if that would be so prominent in the headline. The drive train has nothing to do with an unsecured s3 bucket, and if you think that electric vehicles are the only “connected” cars in 2024, you’re in for a shock.
- potato3732842 2y agoBecause EVs are new-ish and so mentioning them specifically is aproximate shorthand for "consumers of a certain tax bracket" so it's useful for getting those people to click on the article, hand wring, re-tweet and do all those other things that make money.
- a3w 2y agoBest of from 38th CCC: every three letter secret service of the country seems to be spyied out by this. And a secret VW testing facility in sweden was uncovered. Also, effects mostly EVs, but not only. (If the EV motor was the group usually logged to the opened AWS bucket, I don't understand how there were ICE or possibly hybrid cars involved in the leak.) https://streaming.media.ccc.de/38c3/ https://streaming.media.ccc.de/38c3/ had a german language video on it, live, but will surely add english translation and permanent video link soon.
- haspok 2y agoEnglish "dub": https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen#l=eng https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo...
- slightwinder 2y ago> I don't understand how there were ICE or possibly hybrid cars involved in the leak. The data-collection has nothing to do with the used engine, but the software-platform. Basically, the "OS" on which the car is running. EVs and premium Cars where the first to modernize this platform, and for obvious reasons they all use the same platform. After that, other cars are moving on to this platform too, so they now have a mix of different car-models who are mainly defined by their price-category.
- mulmen 2y ago> Also, effects mostly EVs, but not only. (If the EV motor was the group usually logged to the opened AWS bucket, I don't understand how there were ICE or possibly hybrid cars involved in the leak.) I can't parse this. Is there a missing word? Mostly implies other possible inputs but the last part of that sentence specifically says this is confusing. Why is it hard to understand how ICE or Hybrid groups also had access to a bucket EVs mostly had access to?
- schobi 2y agoWhat I understand from the presentation Many Volkswagen cars somehow report telemetry. Looks like there is data not only from the EVs based on the MEB plattform? But for a Name/email to be associated with the VIN of the car, the owner has to register and use the app (once). Many EV owners did, but fewer of the non EVs did.
- cherryteastain 2y agoWe need a way to disable vehicle telemetry. No, a software switch is not enough. We need to be able to physically unplug the cellular modem entirely and have the vehicle work with 100% functionality (barring features which inherently require cellular connectivity like turning the heating on remotely) Car manufacturers' features are mostly useless anyway thanks to Android Auto/Apple CarPlay
- callc 2y agoThank you for summarizing my feeling so succinctly. The simplicity makes me think that law-makers can understand it.
- NewJazz 2y agoInstead, US senators will rail about the security risk of Chinese vehicles while refusing to provide competitive alternatives.
- deleted 2y ago[deleted]
- remarkEon 2y agoWhat do Chinese vehicles have to do with this, or the ability of US Senators to "provide" alternatives? Sorry wasn't aware that the Ford family has someone in the US Senate.
- NewJazz 2y agoIf the US Senate can't effectively set industrial policy, then they don't deserve to call themselves oligarchs. They can and do though, and they are. https://www.peters.senate.gov/newsroom/press-releases/senator-peters-urges-commerce-department-to-finalize-new-rule-to-protect-national-security-and-secure-us-automotive-supply-chains https://www.peters.senate.gov/newsroom/press-releases/senato...
- remarkEon 2y ago
- sschueller 2y agoVW got caught because of their shit security but what is the situation with all other car makers? The US does not have a GDPR so the collection of this information is legal. How much data is lying around at GM and others for someone to abuse?
- apelapan 2y agoI'm curious if the breach is from the German core Cariad or the Swedish subsidiary/joint-venture, WirelessCar? Based on what sort of data was exposed, it seems plausible that it is one of the services from WirelessCar.
- i80and 2y agoAccording to the article, Cariad
- JKCalhoun 2y agoSofa King stupid. Why add this shit that is a liability? Maybe legal needs to have a talk with marketing.
- jmward01 2y agoThe answer is simple: No matter the reason, if you have a data breach you must pay each person 100$ min with higher amounts depending on the information lost. Additionally, if that information is used in a crime then you are liable for further damages. Car companies, and other data vacuums, will just stop collecting it if they are liable for what happens to it. I will not buy a car that does this. I am starting to turn my phone off when I am not using it as well. Being tracked every second of my life is not acceptable.
- tgsovlerkhgsel 2y agoThe $100 thing is kind of a standard that a European court just established in a Facebook data leak case! In the case of full location data, it would need to be a lot more though. Yes, that might bankrupt the company. They should have thought about that before they illegally stalked nearly a million people then put their highly sensitive data on the Internet. If I did this to one person, I'd probably (and rightfully) go to jail. I'd like the same standard applied here.
- deleted 2y ago[deleted]
- jazzyjackson 2y agoUgh, I would love to see more companies bankrupted. How much more dynamic the economy might be if all of Volkswagens assets were put up for bid at government auction. Adbusters magazine (credited with spurring occupy wallstreet with a solid meme campaign) tried to get inertia going around revoking corporate charters, stop acting like we don't have power, corporations are borne into existence by acts of government, we are not powerless to punish them for crimes against humanity (to be dramatic about it, I don't know what language would be appropriate for collecting location information for a million individuals without disclosure), but didn't see much traction about it. https://www.adbusters.org/full-articles/rise-of-the-corporate-charter-revocation-movement https://www.adbusters.org/full-articles/rise-of-the-corporat...
- 2y ago
- mensetmanusman 2y agoEvery satellite imaging company knows where they are.
- mogadsheu 2y agoRevisit frequency and spatial resolution aren’t high enough to meaningfully and uniquely identify vehicles without additional data.
- mensetmanusman 2y agoI doubt VW cares about real time locations of all their vehicles. Only government officials at the DMV care.
- rurban 2y agoOf course they care. Only then they can sell it. With real name and full precision location. Even with 10m precision it would be a good sell.
- doodlebugging 2y agoAs a former owner of 3 VW vehicles, it does not surprise me that they have skipped obvious steps needed to secure owner data. They cut costs across the board on everything involved in producing vehicles for sale in the US to the point where their interior plastics were half the thickness of competitor's interior furnishings and their wire harnesses used the smallest gauge wire possible to carry the loads expected.
- greesil 2y agoI had to opt in to this shit to get firmware updates. I'm very angry. This explains the laggy infotainment on my id.3 if these idiots were involved in its creation. I can't seem to find a link to the leaked data. I want to see if I'm in it. As per this guy, maybe I should sell my vehicle before VW is sued out of existence. https://www.reddit.com/r/electricvehicles/comments/1hnh3sg/comment/m42juqc/ https://www.reddit.com/r/electricvehicles/comments/1hnh3sg/c...
- thesumofall 2y agoThis is made worse by the fact that they created a really bad UX for their cars in the name of data protection (at least in Germany). Example: you have to accept the T&C of the online services with every(!) start of the vehicle. If you don’t press either the accept or reject button, you can’t enter any of the nav / entertainment/ … screens. In the name of data protection, you are not even allowed to have two main users of the car. As a result, it’s either me or my SO being able to see the car‘s state of charge in the mobile app. It’s impossible for both to see it except you do account sharing
- whatevaa 2y agoAccepting T&C is for covering their asses, not data protection. Smells like bullshit excuse.
- deleted 2y ago[deleted]
- CommanderData 2y agoSoon we'll be in an era where our vehicles are geofenced. Stop people driving to protests? areas of strategic interest? congestion? Yep that's all coming quick.
- _yb2s 2y agoNot surprised- VWs CarNet app for interacting with the car is the single worst software I have ever used… I would literally believe that their entire software engineering team consists of a single 11 year old with 2 weeks of coding experience.
- AzzyHN 2y agoI'll be holding on to my dumb 2012 civic for as long as I can
- devops99 2y ago[flagged]