Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

231–240 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#231

Earlier quoted context omitted.

Well, how do the shrink-wrapped EULA's work when you sell a computer? What is Microsoft's position on you selling your windows license to a third party? I expect that car manufacturers will eventually take a similar line. But it won't be a big deal for very long. As we will soon all be paying subscriptions to use our cars, license transfers will be balled up into the transfer fees paid when you move your ongoing subs…

>>What is Microsoft's position on you selling your windows license to a third party? It's 100% allowed within the EU, even for OEM licences. There have been multiple court cases about this and microsoft lost every single one. But I guess that's not what you were implying?

The data collection would also be illegal in the EU I presume.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#232

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

Also, just looking into the window of the car at the dashboard is usually all you need to get the VIN for a car.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#233

And this is why I'm going to disconnect the DCM in my new car. :/

I believe Toyota began installing DCM radios since model year 2016 — so 2015 (and older) vehicles come tracker free.

I am one of those loons who doesn't carry a cell phone, so this is important to me =D

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#234
post #81

Can you buy a new car without a data plan anymore?

Yes, but you cannot finance it (i.e. you have to own it outright before you can disable the transmitter).

So: CASH purchases, only.

In the EU: cannot disable (legally)

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#235
post #76

It is clear that automakers are utterly failing at technology. In-vehicle control systems are typically garbage. Several hacks have been shown where vehicle data is exposed over cellular links, in some cases with remote attackers being able to actually control elements of the vehicle (eg: Jeep). Software updates are rare, with manufacturers often trying to charge exorbitant amounts for basic updates. Data breaches of…

So I don't work in automotive domain, but I work in Controls Engineering. Basically everything you just said relates to my work as well, and based on tidbits of anecdotal info I've picked up through various technical forums it sounds like automotive & controls are quite similar in that regard. The dirty truth is often times these domains were designed and chiefly operated by non-software people. Not to say a mechanic…

this is why Software Engineering as a regulated profession is going to be a necessity as much as civil engineering or electrical engineering has been

Unfortunately the challenge with this is still the same as always: do we even know how to engineer software, in the sense that established engineering disciplines use the term, yet?

If we started permitting only “qualified” software engineers to make the big technical decisions, who would decide on the required qualifications? Would it be the few experts who really have spent whole careers successfully developing genuinely high-reliability software in industry or researching innovative techniques for improving quality in academia? Or would it be people like career consultants who write popular books on “best practices” and give keynote speeches at conferences with big name sponsors?

The dominant trend in the software industry for years has been towards short-termism and ad-hoc everything. That often makes sense as a business strategy, at least given the current financial incentives, but it’s not necessarily the best way to promote robustness, predictability and longevity. Prematurely trying to codify accepted practices for engineering software might end up entrenching the status quo, when what is really needed as software eats the world is disruption by people who have demonstrably figured out better ways to do it.

So while I strongly agree that we need to raise standards in parts of the industry where Very Bad Things can happen when software fails, I don’t think regulating software engineering in the same way as more established engineering disciplines is a viable way to do that. Not yet, at least.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#236

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

Definitely agree. If I have a time series of geo location information, which visits point x,y once per day at 5:00pm I can probably conclude they probably live at this location.

Of course it would all be incredibly boring to analyze. We can conclude that people live at a certain location, (dumbly for no good reason) drive to another one 5 times per week and go a few other places.

Sure you might be able to find the odd person that is doing something weird or illegal but if you already know location x1, y1 contains bad guys might as well just go there and arrest them instead of creepily analyzing data that you know you shouldn’t have.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#237
post #147

Earlier quoted context omitted.

What does this mean? How do you "not accept this"? Are you jumping up and down now interior pictures are leaked from your Toyota? Do you not pay for recurring fees of licenses? Do you send an angry phone call in the general direction of Toyota HQ?

I drive a 30+ year old car. It can easily last another 10 years. 0 tracking by the manufacturer. No subscription services needed. No annoying beeping when you forget to put on your seatbelt for 10 seconds. No touchscreen, all physical buttons. No Android/Apple spyware. No cameras. No ads on any display. No car-key that can run out of battery. It's nice.

Maybe there will be a market for a dumb electric car in the future.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#238

Earlier quoted context omitted.

The scammer in the third world country folks may be at threat of this breach being exploited by does not have that ability. But they do have the internet, and further no meatspace means scams can be automated/scaled. Honestly, this seems very bad.

I read an article today about someone who was called by his daughter to transfer money. It turned out to be an AI deepfake. The criminal networks are pretty sophisticated.

I’d imagine the play here would be to search known people of prominence/public figures/clergy/politicians/etc and then review the logs for signs of I’ll doing. Most likely infidelity. Then blackmail ensues.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#239
post #205

Earlier quoted context omitted.

Every person that I've ever met who calls themselves a "prepper" has been what most would call an extremist. (I'm not calling you an extremist -- I've never met you.) That's a different crowd from someone who is just prepared for emergencies and disasters.

> Every person that I've ever met who calls themselves a "prepper" has been what most would call an extremist. It seems like you have a cognitive distortion to work out. Amplifying an anecdotal sample to classify all people with a shared interest as having other characteristics of your sample is understandable but also misguided.

“I strive never to mute a person’s lived experience.”

You, 3 weeks ago.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#240

Earlier quoted context omitted.

you can downshift some auto tranmissions too. Although you're trading brake pad wear for transmission clutch wear.

Clutch disc is much more expensive to replace, BTW. You won't notice if you buy new every other year, of course.

Going on year 15 with a good clutch on a low-end bmw here. Dunno if luck or not, but not a lot of clutch complaints on bmw forums.

Their automatics on the other hand…

Post reply on HN