A CBP contract shows the risks in connecting your vehicle and your smartphone • Hacker News Board

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#101

Post by annoyingnoob » Tue, May 04, 2021, 7:53 PM UTC

StavrosK wrote: post #96

annoyingnoob wrote: post #66

Earlier quoted context omitted.

My Volvo has a cellular radio in it that I cannot disable with pulling a fuse for a bunch of things. I've always assumed that the car uploads everything to Volvo without my knowledge or permission. I'll bet law enforcement can just ask Volvo for my data without needing a tool.

I mean, though, you can always disable a cellular radio, it's just a matter of finding it.

There is a SIM card in the glove box that supports the Infotainment system and in-car hotspot if you want. I pulled that one out. The car still has another one, somewhere, as I occasionally get calls into the car but I don't pay for that service. I found the fuse for the factory phone but not the SIM, you're right its somewhere but for all I know its not removeable.

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#102

Post by x86_64Ubuntu » Tue, May 04, 2021, 7:53 PM UTC

josephcsible wrote: post #88

Animats wrote: post #14

“Your phone died, you’re gonna get in the car, plug it in, and there’s going to be this nice convenient USB port for you. When you plug it into this USB port, it’s going to charge your phone, absolutely. And as soon as it powers up, it’s going to start sucking all your data down into the car.” That used to be just something seen in hostile devices. Now it's standard equipment.

How effective is this today? Don't modern phones refuse to do anything except charge over a USB connection until the user unlocks the phone and trusts the connected host?

Yes, but we are back at square one, where if I want to use "Chevy Play" or whatever their music player is, I have to battle a legion of dark patterns reaching for my data i.e "Allow this Stop Watch app to not don't allow prohibit from reading contacts"

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#103

Post by InitialLastName » Tue, May 04, 2021, 7:53 PM UTC

userbinator wrote: post #92

tashoecraft wrote: post #75

Earlier quoted context omitted.

The problem with older cars, is that safety standards have improved dramatically in that time. So while you might have a "dumb" car that isn't spying on you, in the event of an crash, you are going to be much more likely to be injured. If I had to weigh being spied on with being injured, I'd guess the odds of being injured actually impacting my life negatively as greatly higher. I do miss my old Saab though...

"Those who give up freedom for security deserve neither," as the saying goes, and these recent years that saying has gotten quite a bit more meaningful, I think.

From now on, you only get to pull that quote out if you make literally no compromises to your freedom for the sake of security. Lock your car doors, thus making yourself less free to open them in favor of a bit of security? Run a firewall on your server, reducing your freedom to connect frictionlessly however you like in favor of that also being true of others?

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#104

Post by sokoloff » Tue, May 04, 2021, 7:56 PM UTC

jmnicolas wrote: post #54

So do I have to ride horses to get my privacy back now? I would totally buy a brand new car without all the "visible" electronics (by visible I mean all the screens and doodads. I don't mind ABS and other "invisible" electronics as long as they are reliable which is not a given nowadays). I don't get the point of turning the interior of a car into a smartphone experience. I watched a YT video of a Mercedess class S r…

> I don't mind ABS and other "invisible" electronics as long as they are reliable which is not a given nowadays

These are pretty damned reliable, IMO, in absolute terms (before even giving credit for the fact than an automobile is pretty harsh environment for electronics with temperature and humidity swings, large voltage transients, poor grounds, mechanical shock/vibration, road salt, corrosion, etc). I've probably changed more power window regulators than ABS or EFI modules.

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#105

Post by triceratops » Tue, May 04, 2021, 7:57 PM UTC

mssundaram wrote: post #59

toss1 wrote: post #9

Earlier quoted context omitted.

Probably true, but good luck with that. As my grandfather said: "You might be right, but you don't want to be dead right." CBP already have extra authorities due to border control because crossing the border is not a constitutional right. The most egregious expansion was the declaration that all territory within 100 miles of the border is 'authorized' for all CBP's nonsense. That happens to cover about 90% of the US…

I'm having trouble understanding how 100 miles from the border covers 90% of the US population? Edit: I see - I was thinking only in terms of e.g. the Arizona southern border, however looking up the Constitution Free Zone shows that it means the entire US - California, all states connected to Cananda etc. Eidt 2: Would this mean ALL of Hawaii is in this Constitution Free Zone?

Don't international airports count as "the border" too?

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#106

Post by RyJones » Tue, May 04, 2021, 7:57 PM UTC

I included a sample of what Honda[0] records when you pay for Honda Navigation System. It spams your VIN every minute it’s on WiFi, though, regardless of trim level.

[0]: https://gist.github.com/ryjones/73739f6a7e662b9ed9ba64d9141f...

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#107

Post by StavrosK » Tue, May 04, 2021, 8:00 PM UTC

annoyingnoob wrote: post #101

StavrosK wrote: post #96

Earlier quoted context omitted.

I mean, though, you can always disable a cellular radio, it's just a matter of finding it.

There is a SIM card in the glove box that supports the Infotainment system and in-car hotspot if you want. I pulled that one out. The car still has another one, somewhere, as I occasionally get calls into the car but I don't pay for that service. I found the fuse for the factory phone but not the SIM, you're right its somewhere but for all I know its not removeable.

You'll probably need to do at least some disassembly to get to it (maybe next time you take the car for servicing). Then you can either wrap the antenna in some aluminum foil or just cut it (which would probably fry the transmitter).

I agree, though, all our devices are becoming hostile to us.

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#108

Post by mixmastamyk » Tue, May 04, 2021, 8:05 PM UTC

josephcsible wrote: post #88

Animats wrote: post #14

“Your phone died, you’re gonna get in the car, plug it in, and there’s going to be this nice convenient USB port for you. When you plug it into this USB port, it’s going to charge your phone, absolutely. And as soon as it powers up, it’s going to start sucking all your data down into the car.” That used to be just something seen in hostile devices. Now it's standard equipment.

How effective is this today? Don't modern phones refuse to do anything except charge over a USB connection until the user unlocks the phone and trusts the connected host?

I was going to ask this. My iPhone will charge but won't talk to my computer unless I type my PIN and confirm a trust dialog. Don't these cars work the same way?

Or is this an Android/BlindlyHittingYes situation?

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#109

Post by ethagnawl » Tue, May 04, 2021, 8:06 PM UTC

saruken wrote: post #61

kgwxd wrote: post #34

Earlier quoted context omitted.

You can't really buy a "dumb" gas car anymore either. I'm holding onto my 2011 Nissan Versa to the bitter end.

Same here with my '93 Saab. I replaced the smart (for its time) HVAC control system with an Arduino running software I wrote, but otherwise it's bone stock. I'd love an electric too, but the way I figure it, continuing to use a fairly efficient vehicle that already exists is probably better for the environment than buying something new anyway. It takes a lot of resources and material to build a car.

That sounds very interesting. I don't own a Saab but I'd still like to see a write-up on your project.

Re: A CBP contract shows the risks in connecting your vehicle and your smartphone

#110

Post by bellyfullofbac » Tue, May 04, 2021, 8:06 PM UTC

annoyingnoob wrote: post #66

1024core wrote: post #20

From the marketing material: iVe currently supports AUDI, BMW, Buick, Cadillac, Chevrolet, Chrysler, Dodge, FIAT, Ford, GMC, HUMMER, Hyundai/Kia, INFINITI, Jeep, Lincoln, Mercedes-Benz, Maserati, Mercury, Nissan, Pontiac, Ram, Saturn, SEAT, Skoda, SRT, Toyota and Volkswagen Now you know which brands to avoid!

My Volvo has a cellular radio in it that I cannot disable with pulling a fuse for a bunch of things. I've always assumed that the car uploads everything to Volvo without my knowledge or permission. I'll bet law enforcement can just ask Volvo for my data without needing a tool.

Apparently new cars sold since 2018 have to have a way to automatically contact emergency services after a crash, so they all probably come with a SIM card: https://en.wikipedia.org/wiki/ECall

My guess is the manufacturer wants to upload "diagnostic" data, they would just use that same SIM card. And you probably can't disable it because it's a legal requirement (or, maybe you can on your Volvo?).

Maybe one could just put a prepaid SIM card with zero bandwidth quota/zero call credits, because those are still able to call the emergency number.

Interestingly the automatic "call the cops" function means hit and runs would be a lot harder, since the cops would get a timestamp of an accident, and a phone number as a car identifier...