3 ms·

Was it in an S3 bucket?

mrweasel 2y ago
Some articles says: "the data was accessible due to it being left on an unprotected and misconfigured Amazon cloud storage service." [1] I'm not sure what Caraid does, but I continue to be surprised by the complete lack of security awareness from car makers. Why do they even need this data? If it's a safety feature, then sure, ping a remote endpoint every 60 second with your current location, but don't store it anything but the last ten minutes and delete everything after a week. The automotive industry has such a shitty track record with software that it baffles the mind that they haven't improved or simply decided that it's not worth the risk. One quote stands out to me as particularly egregious: "Cariad responded to Spiegel saying that no sensitive data was exposed, adding that customers don’t need to take any action, as no sensitive information like passwords or payment data is affected."[2] That tells me that Cariad doesn't understand security or privacy AT ALL. Having someone know you location can be much more damaging/dangerous that losing your payment information. The difference is that passwords and credit cards is financial damage, which companies apparently understand, but location is people getting stalked or killed, once the first companies have been held financially reliable for providing location info to a killer, then perhaps something will improve. As long as losing your ability to accept a VISA card is more important than your customers physical safety nothing will change. 1) https://www.techspot.com/news/106155-volkswagen-data-leak-exposes-private-information-800000-ev.html https://www.techspot.com/news/106155-volkswagen-data-leak-ex... 2) https://electrek.co/2024/12/30/massive-data-leak-at-volkswagen-exposes-800000-ev-drivers/ https://electrek.co/2024/12/30/massive-data-leak-at-volkswag...
- agilob 2y ago
  >Why do they even need this data? They sell it of course.
- johannes1234321 2y ago
  > Why do they even need this data? The stated reasoning is that the want to track battery performance to optimize it, thus they need to see in what environment (weather and terrain) the vehicle is used to make sense of the data. The second reason is that they offer "fleet management" for company cars, so that a dispatcher for some company can see which car is where and which to send to a customer. Of course location data is valuable in many other ways as well ...
bleakenthusiasm 2y ago
May I interest you in another talk covering data in S3 buckets and how far companies will go to fix their misconfigurations? (Hint: not far) https://media.ccc.de/v/38c3-projekt-bucketchallenge https://media.ccc.de/v/38c3-projekt-bucketchallenge

Some articles says: "the data was accessible due to it being left on an unprotected and misconfigured Amazon cloud storage service." [1] I'm not sure what Caraid does, but I continue to be surprised by the complete lack of security awareness from car makers. Why do they even need this data? If it's a safety feature, then sure, ping a remote endpoint every 60 second with your current location, but don't store it anything but the last ten minutes and delete everything after a week. The automotive industry has such a shitty track record with software that it baffles the mind that they haven't improved or simply decided that it's not worth the risk. One quote stands out to me as particularly egregious: "Cariad responded to Spiegel saying that no sensitive data was exposed, adding that customers don’t need to take any action, as no sensitive information like passwords or payment data is affected."[2] That tells me that Cariad doesn't understand security or privacy AT ALL. Having someone know you location can be much more damaging/dangerous that losing your payment information. The difference is that passwords and credit cards is financial damage, which companies apparently understand, but location is people getting stalked or killed, once the first companies have been held financially reliable for providing location info to a killer, then perhaps something will improve. As long as losing your ability to accept a VISA card is more important than your customers physical safety nothing will change. 1) https://www.techspot.com/news/106155-volkswagen-data-leak-exposes-private-information-800000-ev.html https://www.techspot.com/news/106155-volkswagen-data-leak-ex... 2) https://electrek.co/2024/12/30/massive-data-leak-at-volkswagen-exposes-800000-ev-drivers/ https://electrek.co/2024/12/30/massive-data-leak-at-volkswag...

agilob 2y ago
>Why do they even need this data? They sell it of course.
johannes1234321 2y ago
> Why do they even need this data? The stated reasoning is that the want to track battery performance to optimize it, thus they need to see in what environment (weather and terrain) the vehicle is used to make sense of the data. The second reason is that they offer "fleet management" for company cars, so that a dispatcher for some company can see which car is where and which to send to a customer. Of course location data is valuable in many other ways as well ...

bleakenthusiasm 2y ago

May I interest you in another talk covering data in S3 buckets and how far companies will go to fix their misconfigurations? (Hint: not far) https://media.ccc.de/v/38c3-projekt-bucketchallenge https://media.ccc.de/v/38c3-projekt-bucketchallenge