5 ms·
We know where your car is
- uxhacker 2y agoTDLR: The data was held by VW subsidiary Cariad. The location data was available for Volkswagen 460,000 vehicles in Amazon cloud. It was 300.000 cars in Germany, 80,000 in Norway, 70,000 in Sweden, 60,000 in the UK, 61,000 in the Netherlands, 50000 in France, etc
- pintxo 2y agoAnd contrary to the privacy notice, gps data was not truncated.
- deleted 2y ago[deleted]
- n4r9 2y agoI guess the product owner is still bumping that story card to the next sprint every fortnight.
- johannes1234321 2y agoWell, for some brands they truncated the GPS info. There is some likeliness that they misconfigured a branch of their software by mistake and a fix is to set the flag they already got (and then ensuring to keep the flag right on a permanent base ...)
- ninalanyon 2y agoIf it is something required ny law it doesn't need a flag. Just remove the condition altogether.
- netsharc 2y agoTechnically they were truncated to 6 decimal digits, giving a 10cm location precision... ;)
- LightBug1 2y ago[flagged]
- mdp2021 2y agoTry using old cars in territories where it is forbidden. In some areas, if you want to use old cars you have to renounce to entering even small cities and the villages surrounding big cities.
- potato3732842 2y agoThat's the thing about a '69 VW beetle, or a '32 Ford, or any other "classic" car. The cops will mostly leave you alone regardless of the law because you don't fit the profile of people they want to apply threat of state violence to. Now, if you were driving something from the 90s the cops would be all over you because you'd get profiled as exactly the sort of white trash that the police's stakeholders want to see lots of jackboot applied to. That said, even in the "classic" car you're accepting the risk that any given cop can choose to screw you on a whim and the more you expose yourself to such risks the odds of getting unlucky just keep going up.
- tietjens 2y agoWas it in an S3 bucket?
- mrweasel 2y agoSome articles says: "the data was accessible due to it being left on an unprotected and misconfigured Amazon cloud storage service." [1] I'm not sure what Caraid does, but I continue to be surprised by the complete lack of security awareness from car makers. Why do they even need this data? If it's a safety feature, then sure, ping a remote endpoint every 60 second with your current location, but don't store it anything but the last ten minutes and delete everything after a week. The automotive industry has such a shitty track record with software that it baffles the mind that they haven't improved or simply decided that it's not worth the risk. One quote stands out to me as particularly egregious: "Cariad responded to Spiegel saying that no sensitive data was exposed, adding that customers don’t need to take any action, as no sensitive information like passwords or payment data is affected."[2] That tells me that Cariad doesn't understand security or privacy AT ALL. Having someone know you location can be much more damaging/dangerous that losing your payment information. The difference is that passwords and credit cards is financial damage, which companies apparently understand, but location is people getting stalked or killed, once the first companies have been held financially reliable for providing location info to a killer, then perhaps something will improve. As long as losing your ability to accept a VISA card is more important than your customers physical safety nothing will change. 1) https://www.techspot.com/news/106155-volkswagen-data-leak-exposes-private-information-800000-ev.html https://www.techspot.com/news/106155-volkswagen-data-leak-ex... 2) https://electrek.co/2024/12/30/massive-data-leak-at-volkswagen-exposes-800000-ev-drivers/ https://electrek.co/2024/12/30/massive-data-leak-at-volkswag...
- agilob 2y ago>Why do they even need this data? They sell it of course.
- johannes1234321 2y ago> Why do they even need this data? The stated reasoning is that the want to track battery performance to optimize it, thus they need to see in what environment (weather and terrain) the vehicle is used to make sense of the data. The second reason is that they offer "fleet management" for company cars, so that a dispatcher for some company can see which car is where and which to send to a customer. Of course location data is valuable in many other ways as well ...
- BlueTemplar 2y ago(de)
- agilob 2y agoclick on the settings icon to change to English https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen#l=eng https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo...
- kiezpro 2y agoAnd here’s a translated version of the article itself: https://www-ccc-de.translate.goog/en/updates/2024/wir-wissen-wo-dein-auto-steht?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp https://www-ccc-de.translate.goog/en/updates/2024/wir-wissen...
- riiii 2y agoGPS car data was used to find a crossbow killer in the UK few years ago. The killer torched the car but the car had already uploaded GPS and black box data. https://www.bbc.co.uk/news/uk-wales-65985341 https://www.bbc.co.uk/news/uk-wales-65985341 I recommend the referenced podcast there, the whole story is crazy.
- mattigames 2y agoTo avoid such tracking would have been enough use a gps scrambler? Or maybe wrap the in-car GPS with tinfoil?
- stavros 2y agoI don't know much about car tracking specifically, but I really doubt they have anything more than a simple GPS module. If you disable that, you lose fine-grained tracking. You'd still have the phone company triangulating your radio's location, which is lower-resolution, but you may want to disable that as well. Really, disabling the radio entirely would be your best bet.
- Gigachad 2y agoSeems like the best option is to escape by bicycle.
- netsharc 2y ago
- cjrp 2y agoThat level of telemetry-upload used to be easy enough to disable as there was a physical SIM card (usually in the glovebox); without that there was no remote connection. But I suspect it's a lot harder now, thanks to eSIMs etc.
- lifestyleguru 2y agoIn fleet management, the automotive is well ahead of physical sim cards.
- stavros 2y agoI'd really like a wiki on how you can disable the remote crap on each model of car. Maybe I should start one, though I don't really know how to disable anything.
- amatecha 2y agoYou can watch the recording of the presentation at https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo... , including with translated audio tracks (!)
- lifestyleguru 2y agoI'm so sick of everyone frivolously requiring mobile phone number and email address and there doesn't seem to exist much resistance from general user base.
- yupyupyups 2y agoEmails are fine, as they can be anonymous as long as you don't use one of the larger providers. Phone numbers, not so much. They are in many countries tied to people's real IDs because something about stopping organized crime.
- Gigachad 2y agoThat’s basically the point though. Websites ask for your phone number because it’s the easiest way to limit abuse. Eventually everyone has a phone number, and very few have ways to create multiple.
- gspr 2y ago> Eventually everyone has a phone number, and very few have ways to create multiple. I agree that having a phone number often comes with a paper trail in many jurisdiction, but surely it's not common to make it hard to have multiple such numbers?
- michaelt 2y agoIt's not unusual for someone to have a home landline phone, a personal cell phone, a work landline, and a work cell phone. In fact it's so common that people in the snooping business already know ways to correlate them.
- echoangle 2y agoIt's not hard to have multiple, but it's hard to have on-demand throwaway ones.
- mdp2021 2y ago
- chimo777 2y agoPrivacy doesn't exist in this 21st century.
- stavros 2y agoNot with that attitude.
- jillesvangurp 2y agoOr put better, people need to adapt to the notion that most movement in public spaces is observed by a multitude of networked devices; most of which are not under your control. Most cars have some sort of mobile connectivity, contain at least one passenger with an active mobile phone (also GPS equipped). Cars are probably one of the more easy to track and monitor things in public spaces. And of course, many cars on the road are also equipped with cameras that are perfectly capable of capturing things like license plates of cars around them, which are of course designed to keep track of cars. Not to mention countless cameras monitoring traffic, speed limits, etc. Most privacy protection is going to have to come from laws and legislation on how to access and use tracking data. That does still exist. But it's under a lot of pressure. There's so much tech out there that avoiding being tracked is only getting harder. Tin foil hats are not quite good enough at this point.
- HPsquared 2y agoAlso every device has a microphone now. Many even constantly listen, ostensibly for a "Hey Google" or whatever.
- einpoklum 2y ago> Or put better, people need to adapt to the notion that most movement > in public spaces is observed by a multitude of networked devices s/adapt to the notion/actively resist the fact/ there, fixed that for you. Personal resistence and local and wider-level political organization to resist mass surveillance.
- mdp2021 2y ago> people need to adapt Are you eliciting or was that just a bad choice of words? In many languages, "if you (A) adapt to something (B)", A changes (and possibly largely tolerates) and B does not. "If you (A) adapt something (B)", B changes after your action, A does not.
- m2f2 2y agoIs this another instance of "my external contractors need access my data but I cannot ask them to install an authenticator app on their BYOD mobiles"... Nor manage proper authentication for my randomly built BI suite?
- kiezpro 2y agoShort answer: no. Slightly longer answer: watch the recording, it’s very worthwhile.
- chvid 2y agoRmeinds me of these two tweets by Elon Musk on the Cybertruck explosion at a Trump hotel: https://x.com/elonmusk/status/1874579547452269054 https://x.com/elonmusk/status/1874579547452269054 We have now confirmed that the explosion was caused by very large fireworks and/or a bomb carried in the bed of the rented Cybertruck and is unrelated to the vehicle itself. All vehicle telemetry was positive at the time of the explosion. https://x.com/elonmusk/status/1874558969802547611 https://x.com/elonmusk/status/1874558969802547611 The whole Tesla senior team is investigating this matter right now. Will post more information as soon as we learn anything. We’ve never seen anything like this. --- It is obvious that car companies have a lot of access to the modern "highly connected" cars they are making. And perhaps also more than what they say officially and are sharing with authorities under normal circumstances.
- agilob 2y agoI like the wording here: >rented Cybertruck and is unrelated to the vehicle itself. Because as we know Teslas and Cybertrucks don't randomly self-ignite https://www.autoevolution.com/news/the-third-documented-tesla-cybertruck-fire-in-less-than-a-month-raises-questions-239065.html https://www.autoevolution.com/news/the-third-documented-tesl...
- chvid 2y agoI thought the line: "All vehicle telemetry was positive at the time of the explosion." was more telling.
- mikewarot 2y agoThis isn't the only way they know where you are. WAMI systems[1] are rumored to be deployed worldwide by many 3 letter agencies. (Much in the same way general surveillance of the public was rumored before Snowden's revelations) [1] https://en.wikipedia.org/wiki/Wide-area_motion_imagery https://en.wikipedia.org/wiki/Wide-area_motion_imagery
- isaiahwp 2y agoIt's scary how surveillant car companies now. Next thing you know, the companies will track what you do in your car.
- mdp2021 2y agoWas this rhetoric?! Are you aware of the Mozilla Foundation report on Privacy and Cars, https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/ https://foundation.mozilla.org/en/privacynotincluded/article... - "we reserve the right to profile your sexual activities", "you are responsible for informing your passengers that by entering your car they renounce to privacy"? Are you aware of the news about Tesla employees exchanging recordings of car owners - https://www.reuters.com/technology/tesla-workers-shared-sensitive-images-recorded-by-customer-cars-2023-04-06/ https://www.reuters.com/technology/tesla-workers-shared-sens... , https://www.theverge.com/2023/4/6/23672760/tesla-employees-share-vehicle-recordings-privacy https://www.theverge.com/2023/4/6/23672760/tesla-employees-s... , https://arstechnica.com/tech-policy/2023/04/tesla-workers-shared-images-from-car-cameras-including-scenes-of-intimacy/ https://arstechnica.com/tech-policy/2023/04/tesla-workers-sh... ? (Title on ArsTechica: "Tesla workers shared images from car cameras, including “scenes of intimacy”")
- deleted 2y ago[deleted]