VW breach exposes location of 800k electric vehicles

https://cyberinsider.com/vw-suffers-major-breach-exposing-location-of-800000-electric-vehicles/

by benwerner01 • 2 years ago

275 297 2 years ago

cyberinsider.com

mzs• 2 years ago

if you can read German:

https://www.spiegel.de/netzwelt/web/volkswagen-konzern-daten...

https://www.ccc.de/de/updates/2024/wir-wissen-wo-dein-auto-s...

TheChaplain• 2 years ago

That could be a nail in the coffin to end VW, the EU GDPR is quite a sharp weapon.

tencentshill• 2 years ago

I think even in the EU, VW group is "too big to fail".

creshal3• 2 years ago

Too big to fail and too much of it is state owned, either directly, or through government-owned retirement funds.

The government will investigate itself and find no wrongdoings, let's go after the journalists who committed the ultimate crime: Embarassing Officials.

gadflyinyoureye• 2 years ago

The EU will play favorites. There will be a slap on the wrist. Some probation. Maybe a CEO or high level C* person will step down in disgrace with only a few hundred million in severance. Then everything will go back to normal.

rad_gruchalski13• 2 years ago

The problem was caused by Cariad, not VW directly. Cariad will be held responsible for, not VW.

Reason077• 2 years ago

CARIAD is a 100%-owned subsidiary of the Volkswagen group.

7bit2• 2 years ago

Yep, and this will be the end of CARIAD. Volkswagen has already b decided to bleed them to death with the Rivien joint-venture. I guess they'll shut down the rest of the operation much, much faster now. This is the perfect reason for them to do so and what they have been waiting for.

tremon3• 2 years ago

That's not how the GDPR works. Cariad may be a subcontractor (data processor in GDPR speak) for VW, but the driver does not have a contract with Cariad -- their contract is with VW (the data controller in GDPR speak). The data controller is always jointly liable with the processor for 3rd-party data breaches.

jwr2• 2 years ago

The EU won't do much, because this is a car company. Car companies run the EU, basically, especially German ones.

newsclues• 2 years ago

Not surprisingly as the EU grew out of post war coal and steel association

dmitrygr• 2 years ago

Why is nobody talking about the fact that this should not be possible? There is precisely zero reason for them to have this location data. Give the CEO one year of jail per person whose location was illegally tracked.

zer8k• 2 years ago

On the contrary it's relatively simple to understand how it got there trivially.

Most modern cars, especially ones that fit into more "luxury" brands have an app. That app gives you telemetry and location data for a price. It's rather convenient to be able to pre-condition your car, or figure out where you parked in a massive unlabeled parking lot, etc. This is all consented to, but regardless the data is tracked anyway via some GPS/cell system modern cars have. When you pay for it you get more stuff - anti-theft, better tracking, service tracking, etc.

It's a convenience. I'm not entirely comfortable with it but if you want a better-than-decent car made after 2016 you probably have it on-board and unless you rip the ECM out you're stuck with it. Personally, I'd rather pay BMW, for example, for anti-theft and tracking than pay OnStar or another service that is gonna stick me with a ridiculous contract and stuff my car with even more buttons.

CatWChainsaw5• 2 years ago

Eh, "consented to" is rather weak when you are forced to hit the "I agree" button to be able to drive the car you bought. That and forced arbitration need to die posthaste.

gsich2• 2 years ago

There is no reason why this can't be E2E.

behnamoh3• 2 years ago

Can we some how hack the car and disable this "feature"?

betaby2• 2 years ago

Most likely that's illegal in DE, FR and PL. See a related thread about trains at CCC.

olddog2• 2 years ago

Find the guys who usually park at expensive family homes, but occasionally visit a known brothel, then blackmail them.

We all just let surveillance haplen to us, in fact we paid for most of it

ctippett3• 2 years ago

I once worked for a firm that had access to credit card transaction data and came across almost this exact scenario.

Kindergarten transactions one day, escort payments on another.

It was — and still is — creepy. An average Joe like me shouldn't be able to pry into someone's private life like that.

harimau777• 2 years ago

My theory is that most people think about data misuse, perhaps unconsciously, from the viewpoint of your average good person. E.g. "if I got a hold of a stranger's bank information, then I'd be tempted to steal from them."

Instead they should think from the perspective of an evil person. E.g. "how can I proactively use whatever data that I can get to hurt someone."

For example, at a previous job I went to my managers and pointed out that every developer working on our system had access to our user's names and their involvement with racial justice programs our client was running. By guessing someone's ethnicity from their name, a bad actor could target minorities involved in racial justice. The response I got was not to fix the security issue; instead it was horror that I would ever conceive of such a scheme.

3eb7988a1663• 2 years ago

That's just bad opsec. I would have thought rule number one of soliciting was to be cash only.

Ignoring of course that the amount of aggregated surveillance makes it impossible to escape monitoring. Credit cards, license plate scanners, phone GPS, airtags, doorbell cameras, "Eye in the Sky" spy planes, etc

Am4TIfIsER0ppos• 2 years ago

An average Joe like me shouldn't be able to

The average joe is merely a side effect of the government collecting all that data. The government is also why your car reports its location.

CatWChainsaw5• 2 years ago

Ah, here's my daily reminder to treat my 2005 Honda like a princess and hope it never, ever dies.

2OEH8eoCRo0• 2 years ago

I plan to buy old used cars forever when I can no longer keep my 2013 Subie going.

throwaway173738• 2 years ago

why not have whatever dies replaced? I will probably do that with my crappy small truck from 2006.

RajT882• 2 years ago

Hey EU, maybe mandate an opt out for all vehicle telemetry?

Then maybe the rest of the world will follow suit.

I know, I know, I am kidding myself.

hyhconito2• 2 years ago

Opt in you mean, like the cookie banners?

Oh no that'll never happen because VW are a European company and the money is in fining US tech companies!

rad_gruchalski13• 2 years ago

European companies get fined the same as any other companies.

adolph• 2 years ago

VW paid "$14.7 billion to settle civil charges in the United States" and was ordered "to pay a $2.8 billion criminal fine for 'rigging diesel-powered vehicles to cheat on government emissions tests'."

https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal

rad_gruchalski13• 2 years ago

The reason for all that telemetry is the legislation. How do you think they are going to implement the full “intelligent” speed assistant in 2027?

wintermutestwin• 2 years ago

More like automated ticketing for speeding.

mulmen23• 2 years ago

An onboard database and a GPS receiver?

magicalhippo5• 2 years ago

It's opt-out on my Renault Megane e-Tech.

It was a very clear prompt during initial setup, and it shows me a very unambiguous notification that it's enabled every time I start the car. If I click on that it takes me to the setting.

edit: might even have been opt-in during initial setup, now that I think about it. I do recall it being a very deliberate thing during setup.

Of course I'll have to trust that turning it off actually turns it off, no way for me to verify that.

The reason I keep it on is because my SO is a bit absent minded to where she parks the car, and I value not having to run around in the streets trying to find it when I'm in a hurry over the potential privacy loss.

edit: Renault was found[1][2] to be the "least problematic" with respect to privacy by Mozilla last year.

[1] https://foundation.mozilla.org/en/blog/privacy-nightmare-on-...

[2] https://news.ycombinator.com/item?id=37443644

amluto10• 2 years ago

Apple knows how to allow one to find one’s devices without Apple knowing where they are. It’s not that hard.

likeabatterycar2• 2 years ago

The opt-out should be pulling the telematics fuse. Unless you can audit the source code, you can't, and shouldn't, trust the software.

moffkalast• 2 years ago

Nah, make it illegal to collect any kind of identifiable data in the first place.

sschueller2• 2 years ago

It already is and this will go to EU courts.

merb2• 2 years ago

VW do use opt-in. In fact it is so annoying that you get asked every time when you start your car. So basically every time your car start it says „do you want to use the profile connected with the vw service“ if you do not accept it than the car will be in a dumb mode. One of my coworkers was annoyed by it and „reset“ the car to use a non connected profile which does not do that.

I’m a owner of a id.4 (or rather a user of it, since my company owns it)

switch007• 2 years ago

Reminds me of cookie banners. Annoy you into submission

(I know the EU doesn't mandate annoying cookie banners but unintended consequences etc)

jsiepkes• 2 years ago

If it so bad there is actually a whistleblower then how do they pass their ISO27001 audits? Bit too friendly with TUV Nord?

https://cariad.technology/content/dam/digitalmindofmobility/...

EDIT: Just noticed this is an ISO9001 certificate. Though on their job offer site they do ask for "Foundational understanding of security related regulations and standards preferred (e.g. ISO21434, ISO27001, NIST-800)". Unclear if they are actually ISO 27001. Found the 9001 one by fluke, they don't seem to list that one on their site either.

tuwtuwtuwtuw• 2 years ago

The fact that you have passed audits isn't a guarantee (or even an indication) that you don't have major security vulnerabilities.

starbugs• 2 years ago

The fact that you have passed audits isn't a guarantee (or even an indication) that you don't have major security vulnerabilities.

Please explain that to my IT department.

rf15• 2 years ago

TÜV certification has always been more about certification theater and being able to verify that you don't have egregious amounts of negligence than certifying that you are doing your work well.

edit: I've never prepared for our audits and we always get our certification, no matter what they find as long as you say "yes, we are aware"

gsich2• 2 years ago

27001 does not specify implementation details.

tremon3• 2 years ago

Not sure about 27000, but ISO9001 is a paper audit only: you pass or fail them based on your defined business processes. The technical configuration of your systems is outside the scope of the audit.

jwr2• 2 years ago

I so hope this will start an avalanche and car companies will not be able to get away with collecting so much data about users (cars, but that's pretty close).

Especially in the EU, the hypocrisy is jarring: on one hand, GDPR, protecting users from surveillance by businesses, etc, and on the other hand, car companies get a free pass, because they are car companies, and the EU likes car companies.

__fst__• 2 years ago

EVs are topping the list of (imho) useless extras in cars. I'm still cherishing my Honda Fit pre-touchscreen edition. I'm going to drive it until it will fall apart. My next car will be an EV but I have yet to find one that still comes with mechanical features (door handles, knobs/buttons), without a whole battery of surveillance/telemetry tech and (crossing fingers) exchangable batteries. Simple electric propulsion ...

behnamoh3• 2 years ago

I hate touchscreen buttons too and unfortunately all EVs I've seen have adopted that. I wonder if there are EVs with good old fashioned mechanical buttons.

natch5• 2 years ago

Many EVs have a sensible amount of buttons, and you generally don’t need the touchscreen for driving or much else for that matter.

I can even keep driving while the whole system is rebooting. Around here (where we have many immigrants and some odd practices) I’ve seen people with a towel hanging over their screen while driving, to protect it like a dust cover I guess.

The one thing you might argue I do need from my screen is the speed, which is very easy to see and usually not needed in the flow of traffic.

The outcry against screens is just misinformed imho. My car has plenty of mechanical buttons.

nunodonato• 2 years ago

Kia/hyundai, best EVs imho

mhandley• 2 years ago

The Polestar 2 is pretty good in this regard. All the most important things are on the steering wheel stalks, steering wheel buttons, and a few buttons for things like demist, play/pause and volume control on the centre console. There's still a lot on the touchscreen, including climate control, but it seems to hit a pretty good balance for me (and I'm not a fan on car touchscreens).

Loudergood• 2 years ago

Both my Bolt(RIP) and my Ioniq 5 have mechanical buttons for the most common things(media controls/HVAC)

wkat42427• 2 years ago

Safety agencies in Europe are already pushing to bring these back: https://arstechnica.com/cars/2024/03/carmakers-must-bring-ba...

johnea2• 2 years ago

I just bought a used 2023 Nissan Leaf.

Fully EV, real buttons and knobs, and of course the model is cancelled.

The original tracking was 2G cellular, later updated to 3G cellular. 2G is long depricated, and 3G is already shutdown in many places.

This is a great car! Which explains why it's no longer available. It doesn't meet modern american needs, like being at least as large as a small building, or having 0 visibility over the hood, or costing at least $75K. (p.s. I paid $15K for mine, with 18K miles on the odometer and 150 miles of battery range)

But if you're into retro, like buttons and knobs, I highly recommend it...

p.s. I have to wonder if the data breach doesn't affect ICE cars as well? Would they use a separate surveilance system?

grakker• 2 years ago

I bought a used '14 Leaf in '16. It has been a great car with very little battery degradation. Sure, I'm not going to be taking it on any long trips, but for 90% of my driving it is great. I paid $11k for it. Best car purchase I've made in 30+ years of car ownership.

dboreham• 2 years ago

That's amazing considering 2023 was only last year.

steelframe3• 2 years ago

I've owned two LEAFs. Fantastic vehicle. I only got rid of it when I realized all the cars around me were only getting bigger and heavier, and I felt I needed to get an SUV to defend myself against that.

geor9e2• 2 years ago

Just to be clear, this breach mostly affects non-EV cars. Even my stick shift, manual window crank car came with a hidden cellular data modem, collecting my GPS location by default.

natch5• 2 years ago

One person’s useless extra is another person’s collision avoidance system, AC, music system… I like extras when they make sense.

prmoustache2• 2 years ago

You can convert an old car to EV. There are comoanies speciliazing in this, mostly to convert classics that needed a ton of maintenance.

Expensive yes but might be worth it if you value your privacy.

bdangubic4• 2 years ago

me thinks anyone with a cell phone in this year of our Lord 2024 should not say they worry about privacy in any context. instead of converting old car to EV I’d start by converting a rotary phone to a portable one :)

whimsicalism4• 2 years ago

only worth it if you really value the environment, your privacy, but not your life

geor9e2• 2 years ago

How is a complete rebuild of a car your go-to solution to an easily accessible cellular modem powered through the fuse box

Rebelgecko• 2 years ago

In a lot of cars you can pull the fuse that powers the cellular modem without any side effects

1oooqooq• 2 years ago

you're taking to a bunch of old men shouting (literally) at clouds

forgetfreeman4• 2 years ago

Why the sideways fuck did they even have location data to begin with? It's like the checklist for buying a new car starts with figuring out what circuit drives the cell modem and pop that fuse out before taking a test drive to confirm it doesn't brick anything critical. Fucking ridiculous.

ImJamal• 2 years ago

Most new cars have features that require it such as onboard GPS, speed limits on the dash, OnStar and similar features.

forgetfreeman4• 2 years ago

All bullshit my car shouldn't do in the first place.

tzs• 2 years ago

Those are mostly things that require the car to know its location. They don't require that the car share the location with the car's maker except possibly sharing what region the car is in.

The region sharing might be needed to efficiently update things like the map and the speed limits.

NewJazz5• 2 years ago

Niche feature that shouldn't affect any other part of the car's operation if it were turned off or nonfunctional due to modem hardware shutoff.

mulmen23• 2 years ago

None of that requires cellular connectivity. It can and was accomplished using only wifi sync at home. Live traffic information is (was?) broadcast on AM radio.

jazzyjackson6• 2 years ago

speed limits come from a database written alongside map data

bdcravens• 2 years ago

Mobile apps (one of our cars in a VW ID.4, and I can see where it is right now), as well as repo/theft recovery.

forgetfreeman4• 2 years ago

Repo isn't a customer's concern and is thus irrelevant. Incidentally I walked to the window and I can see where my truck is without my phone. Is there really no limit to the bullshit folks will allow themselves to be convinced to install on their phones?

thebruce87m• 2 years ago

I wonder if they were all petrol vehicles, or all diesel if that would be so prominent in the headline. The drive train has nothing to do with an unsecured s3 bucket, and if you think that electric vehicles are the only “connected” cars in 2024, you’re in for a shock.

potato3732842• 2 years ago

Because EVs are new-ish and so mentioning them specifically is aproximate shorthand for "consumers of a certain tax bracket" so it's useful for getting those people to click on the article, hand wring, re-tweet and do all those other things that make money.

a3w• 2 years ago

Best of from 38th CCC: every three letter secret service of the country seems to be spyied out by this. And a secret VW testing facility in sweden was uncovered.

Also, effects mostly EVs, but not only. (If the EV motor was the group usually logged to the opened AWS bucket, I don't understand how there were ICE or possibly hybrid cars involved in the leak.)

https://streaming.media.ccc.de/38c3/ had a german language video on it, live, but will surely add english translation and permanent video link soon.

mulmen23• 2 years ago

Also, effects mostly EVs, but not only. (If the EV motor was the group usually logged to the opened AWS bucket, I don't understand how there were ICE or possibly hybrid cars involved in the leak.)

I can't parse this. Is there a missing word? Mostly implies other possible inputs but the last part of that sentence specifically says this is confusing. Why is it hard to understand how ICE or Hybrid groups also had access to a bucket EVs mostly had access to?

schobi• 2 years ago

What I understand from the presentation

Many Volkswagen cars somehow report telemetry. Looks like there is data not only from the EVs based on the MEB plattform? But for a Name/email to be associated with the VIN of the car, the owner has to register and use the app (once). Many EV owners did, but fewer of the non EVs did.

rurban3• 2 years ago

https://streaming.media.ccc.de/38c3/relive/598 is the recording

haspok• 2 years ago

English "dub": https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo...

slightwinder• 2 years ago

I don't understand how there were ICE or possibly hybrid cars involved in the leak.

The data-collection has nothing to do with the used engine, but the software-platform. Basically, the "OS" on which the car is running. EVs and premium Cars where the first to modernize this platform, and for obvious reasons they all use the same platform. After that, other cars are moving on to this platform too, so they now have a mix of different car-models who are mainly defined by their price-category.

cherryteastain2• 2 years ago

We need a way to disable vehicle telemetry.

No, a software switch is not enough. We need to be able to physically unplug the cellular modem entirely and have the vehicle work with 100% functionality (barring features which inherently require cellular connectivity like turning the heating on remotely)

Car manufacturers' features are mostly useless anyway thanks to Android Auto/Apple CarPlay

callc• 2 years ago

Thank you for summarizing my feeling so succinctly.

The simplicity makes me think that law-makers can understand it.

NewJazz5• 2 years ago

Instead, US senators will rail about the security risk of Chinese vehicles while refusing to provide competitive alternatives.

remarkEon2• 2 years ago

What do Chinese vehicles have to do with this, or the ability of US Senators to "provide" alternatives? Sorry wasn't aware that the Ford family has someone in the US Senate.

blackeyeblitzar• 2 years ago

No device should be allowed to be sold without the ability to function without telemetry or sale of data to third parties. And telemetry and any data sharing should be opt in, as part of configuring the thing the first time. With a one click opt out of all.

mjevans2• 2 years ago

Default Opted Out

Opt In should NOT be required to enable features.

Features should not be rented, and should be delivered as purchased with the car. Shipped but disabled features that take up additional vehicle weight (relative to lacking the feature) should not be allowed. (This phrasing is precise, to allow for silicon and software enhancements which are not a material change to vehicle manufacturing / design.)

Setup processes should always empower the user. If there are multiple choices or paths a default may be indicated, but alternatives MUST NOT be in other locations, and MUST be displayed with equal prominence in a logically adjacent section of the dialog.

Example from a website: 'Paperless' should not be force enabled by default; the ability to have paper or paperless billing should be radio boxes next to each other. Additional benefits (E.G. higher account interest rates) should not be tied to either selection.

ryandrake• 2 years ago

Expand this to any product. I should be able to use ANY product fully, without maintaining some kind of communication channel to and/or from the product's manufacturer. When I buy a hammer from Home Depot, I take it home and hammer with it. The manufacturer doesn't know I have it, doesn't know how many nails per month I hammer with it, how many swings it takes on average for me to drive in a nail, how often I use the claw side. They don't know if I use it for other purposes besides hammering nails. They don't know if I lend it to my neighbor. I can sell it to someone else without the manufacturer's permission.

Somehow hammer manufacturers can live with this. Why can't automakers, tech device manufacturers, and software developers live with this?

rrr_oh_man4• 2 years ago

My solution: Buy an old car...

whimsicalism4• 2 years ago

modern cars are unfortunately much safer

chgs3• 2 years ago

And in 10 years time what’s your solution?

spike0215• 2 years ago

I believe my new car has a fuse you can pull to disable the remote telemetry. However, it disables some useful features, like being able to set valet mode from the Toyota app (useful because some dealer service departments will take cars joy riding) and track the car usage. it also tracks tire pressures. sure the tire pressure can easily be checked manually with my Slime gauge but having it on the phone is handy.

mulmen23• 2 years ago

Both of those features were available on cars before cellular connectivity.

NewJazz5• 2 years ago

You can't see the tire pressure on the dash?

jazzyjackson6• 2 years ago

I've read disabled cellular modem on toyota prius also disables the microphone for bluetooth phone calls / handsfree commands. funny that.

mulmen23• 2 years ago

Why would turning on the heating require cell service? If you’re out of key fob range do you really need to pre-heat the car?

The only possible use of cell service is for infotainment and even that’s questionable in a world of ubiquitous cell phones.

jazzyjackson6• 2 years ago

I like the 'call emergency services on airbag deployment' too, on the fence about removing it, I guess if I had an apple watch that could do the same thing but then I'm just moving the surveillance from one ecosystem to another

queuep• 2 years ago

Schedule heating etc through their app

fastasucan3• 2 years ago

If you’re out of key fob range do you really need to pre-heat the car?

Yeah, that can save 15 minutes of scraping the windows for snow and ice in the morning and afternoon.

Rohansi2• 2 years ago

I do this all the time. Don't even have a fob to begin with but it's very convenient when you're in a shopping mall and are going to make your way back to the car, for example.

Also handy to find your car if you manage forget where you parked for some reason. Or to set a destination for GPS navigation.

modeless• 2 years ago

In many (all?) cars with cellular modems you can remove the SIM card to have this effect.

jazzyjackson6• 2 years ago

I would love a wiki of vehicles for simply 'how to rip out the SIM card'

I thought I saw instructions somewhere for my 2020 prius but can't find it now. a few reddit threads asking about it, I like the suggestion that even if its eSim or somehow embedded in the cellular modem, "Disconnect the antenna! / shunt the telecommunication modems antenna with a resistor shunt. It will trick the radio into thinking the antennas still connected but won't allow any data to be going out they just won't get signal"

https://www.reddit.com/r/Toyota/comments/1be9zuc/wheres_the_...

donquichotte• 2 years ago

In Europe, this is mandated by law.

https://en.m.wikipedia.org/wiki/ECall

wkat42427• 2 years ago

Yes and no. Ecall is but telemetry is not. And ecall only makes a call in case of a crash.

cherryteastain2• 2 years ago

Just enable it by default and put a warning in big red letters that disabling the cellular modem will also disable the ECall system, which may mean you might not get the emergency assistance you need and therefore die.

naranjito• 2 years ago

In Spain they soon will require V16 [0] too. Originally it was just a flashing light but then it was improved to use mobile networks to send an emergency call to authorities. And proving, that technically, it is possible to have something like ECall without deep integration into the car.

No need of having always on connection to the network, enable on emergencies only. Thus no remote hacking of SIM/base band possible at random times, or broadcasting presence until used. Mechanic or user can check battery periodically, replace if low, just like refilling wiper fluid. Car could even cut all other electric systems after deploying the integrated autonomous V16-like system.

Car manufacturers deciding to make their ECall implementations complex and privacy invading was their choice.

[0] https://en.wikipedia.org/wiki/V16_warning_beacon_lights

ale42• 2 years ago

AFAIK ECall uses a voice call with data encoded on the audio channel. This is not what telemetry does, it should be doable to leave the voice channel and disable any data connections. (But it's probably very hard to check for someone who has no background in emebedded systems). Plus, in theory an emergency call can be done without even using a SIM card, right (if network allows)?

surajrmal5• 2 years ago

It's pretty much industry standard for all consumer products to deliver metrics back to home base. Honestly there are many good reasons to do so and it does result in finding real problems and solving them. While I understand the argument that we did fine in these products for decades without them, the complexity of the products was also a lot less back then. Finding issues via metrics from the production fleet is an incredible tool and anyone who's deployed software to a server probably understands this.

I'd rather focus on standardizing a transparent and privacy safe way to gather these metrics. Consumers would know what metrics are collected and there would be guarantees that privacy is kept. There are ways to accomplish this today.

Providing a way to disable metrics is never going to be sufficient for anyone other than a power user.

0points• 2 years ago

Honestly there are many good reasons to do so and it does result in finding real problems and solving them.

Honest question, what is a good reason to do this?

My Logitech software sends telemetry to Logitech.

My VW apparantly sends my GPS coordinates.

How is this useful for improving their hardware?

effdee• 2 years ago

I'd rather focus on standardizing a transparent and privacy safe way to gather these metrics. Consumers would know what metrics are collected and there would be guarantees that privacy is kept.

I'd rather see laws to have it disabled by default. People who don't mind can then opt-in again.

carra• 2 years ago

Defending this because "it's industry standard" is no better than justifying any wrong practice because "it's always been done this way".

hulitu2• 2 years ago

Honestly there are many good reasons to do so and it does result in finding real problems and solving them.

Tell that to Microsoft. Although their products have telemetry, they become shittier every day.

UniverseHacker2• 2 years ago

We need a way to disable vehicle telemetry

It should have a standard UI for doing so, but if you are technically inclined it is usually trivial to do- pulling a fuse, or changing a setting over the OBD port.

However, you will lose useful features like advanced charging controls, and starting the HVAC remotely on EVs.

sschueller2• 2 years ago

VW got caught because of their shit security but what is the situation with all other car makers?

The US does not have a GDPR so the collection of this information is legal. How much data is lying around at GM and others for someone to abuse?

apelapan• 2 years ago

I'm curious if the breach is from the German core Cariad or the Swedish subsidiary/joint-venture, WirelessCar?

Based on what sort of data was exposed, it seems plausible that it is one of the services from WirelessCar.

i80and• 2 years ago

According to the article, Cariad

JKCalhoun• 2 years ago

Sofa King stupid. Why add this shit that is a liability?

Maybe legal needs to have a talk with marketing.

jmward01• 2 years ago

The answer is simple: No matter the reason, if you have a data breach you must pay each person 100$ min with higher amounts depending on the information lost. Additionally, if that information is used in a crime then you are liable for further damages. Car companies, and other data vacuums, will just stop collecting it if they are liable for what happens to it.

I will not buy a car that does this. I am starting to turn my phone off when I am not using it as well. Being tracked every second of my life is not acceptable.

tgsovlerkhgsel• 2 years ago

The $100 thing is kind of a standard that a European court just established in a Facebook data leak case!

In the case of full location data, it would need to be a lot more though. Yes, that might bankrupt the company. They should have thought about that before they illegally stalked nearly a million people then put their highly sensitive data on the Internet.

If I did this to one person, I'd probably (and rightfully) go to jail. I'd like the same standard applied here.

jazzyjackson6• 2 years ago

Ugh, I would love to see more companies bankrupted. How much more dynamic the economy might be if all of Volkswagens assets were put up for bid at government auction.

Adbusters magazine (credited with spurring occupy wallstreet with a solid meme campaign) tried to get inertia going around revoking corporate charters, stop acting like we don't have power, corporations are borne into existence by acts of government, we are not powerless to punish them for crimes against humanity (to be dramatic about it, I don't know what language would be appropriate for collecting location information for a million individuals without disclosure), but didn't see much traction about it.

https://www.adbusters.org/full-articles/rise-of-the-corporat...

Vinnl• 2 years ago

I will not buy a car that does this.

Unfortunately it looks like that might be pretty hard:

https://foundation.mozilla.org/en/privacynotincluded/article...

Lio3• 2 years ago

One way of looking at it is that the manufacturers are acting as a cartel to prevent anyone having access to privacy.

mensetmanusman2• 2 years ago

Every satellite imaging company knows where they are.

mogadsheu• 2 years ago

Revisit frequency and spatial resolution aren’t high enough to meaningfully and uniquely identify vehicles without additional data.

mensetmanusman2• 2 years ago

I doubt VW cares about real time locations of all their vehicles. Only government officials at the DMV care.

doodlebugging2• 2 years ago

As a former owner of 3 VW vehicles, it does not surprise me that they have skipped obvious steps needed to secure owner data. They cut costs across the board on everything involved in producing vehicles for sale in the US to the point where their interior plastics were half the thickness of competitor's interior furnishings and their wire harnesses used the smallest gauge wire possible to carry the loads expected.

greesil• 2 years ago

I had to opt in to this shit to get firmware updates. I'm very angry. This explains the laggy infotainment on my id.3 if these idiots were involved in its creation.

I can't seem to find a link to the leaked data. I want to see if I'm in it.

As per this guy, maybe I should sell my vehicle before VW is sued out of existence. https://www.reddit.com/r/electricvehicles/comments/1hnh3sg/c...

thesumofall• 2 years ago

This is made worse by the fact that they created a really bad UX for their cars in the name of data protection (at least in Germany). Example: you have to accept the T&C of the online services with every(!) start of the vehicle. If you don’t press either the accept or reject button, you can’t enter any of the nav / entertainment/ … screens.

In the name of data protection, you are not even allowed to have two main users of the car. As a result, it’s either me or my SO being able to see the car‘s state of charge in the mobile app. It’s impossible for both to see it except you do account sharing

whatevaa• 2 years ago

Accepting T&C is for covering their asses, not data protection. Smells like bullshit excuse.

CommanderData• 2 years ago

Soon we'll be in an era where our vehicles are geofenced.

Stop people driving to protests? areas of strategic interest? congestion? Yep that's all coming quick.

UniverseHacker2• 2 years ago

Not surprised- VWs CarNet app for interacting with the car is the single worst software I have ever used… I would literally believe that their entire software engineering team consists of a single 11 year old with 2 weeks of coding experience.

AzzyHN• 2 years ago

I'll be holding on to my dumb 2012 civic for as long as I can

ycombinatrix• 2 years ago

Isn't this a GDPR violation by VW?

VW breach exposes location of 800k electric vehicles

Related Stories