Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's perfectly legal for cars to harvest your texts, call logs

theregister.com

Post reply on HN
Print view View original

11–20 of 177 posts

Re: It's perfectly legal for cars to harvest your texts, call logs

#11

Post by arjvik »

galleywest200 wrote: post #9
arjvik wrote: post #7

Earlier quoted context omitted.

Both of which require Bluetooth pairing (or at least auto-pair without asking you if I recall correctly) which allows the head unit to siphon data!

Apple CarPlay works over my USB-C cable, at least in my 2018 Subaru Crosstrek on an iPhone 15. No Bluetooth required I am fairly certain. I also have to unlock the device every so often with my Face ID -- unsure what triggers this as it is not 100% of the time.

My car also uses wired Android Auto, but somehow after I set it up the day I drove it home, my phone automatically connected to it via Bluetooth. I recall something similar when a friend plugged in their iPhone but I’m not sure.

Re: It's perfectly legal for cars to harvest your texts, call logs

#12

Post by nonameiguess »

SenAnder wrote: post #2

> In other words, it's A-OK for your car to "automatically and without authorization , instantaneously intercept, record, download, store, and [be] capable of transmitting" text messages and call logs since the privacy violation is potential, but the injury not necessarily actual. So it's effectively legal to sell backdoored hardware and software to spy on people. I wonder what would happen if I sold backdoored phone…

I'm not an attorney, but I think a lot of the Internet misunderstands the law. It is legal to do this, apparently, but that doesn't mean the court is saying it's okay or they should do this, and it certainly doesn't mean anyone would be okay with you doing it. But if you managed to, then yes, it would apparently be legal. The court can only rule on what the law actually says and it says you only have grounds to sue once you've suffered an actual injury, not because the party you're trying to sue has done someone that might harm you in the future.

This is frankly a shortcoming of trying to use civil law for something like this. As far as I'm aware, this is nearly always the case that you have no grounds to sue unless you've suffered quantifiable monetary damage from someone's actions. If we just want this kind of thing to be generally illegal, then it needs to be made illegal according to criminal law or it needs to violate some law overseen by a government regulatory body with the power to levy its own fines.

Re: It's perfectly legal for cars to harvest your texts, call logs

#13

Post by lotsofpulp »

arjvik wrote: post #7
lotsofpulp wrote: post #5

This is why I would not consider connecting my phone to anything other than CarPlay/Android Auto.

Both of which require Bluetooth pairing (or at least auto-pair without asking you if I recall correctly) which allows the head unit to siphon data!

I always connect to CarPlay with a wire, and have never connected with bluetoooth. It has not auto paired Bluetooth either with iPhones.

I have not used Android Auto, but if it does auto pair Bluetooth, that would be a shame. I thought the whole point was that the car just provides a screen your phone can extend a display to, and no data ever leaves.

Re: It's perfectly legal for cars to harvest your texts, call logs

#14

Post by Night_Thastus »

bobim wrote: post #10
supportengineer wrote: post #4

Earlier quoted context omitted.

Let's keep our older cars on the road as long as possible.

Let’s face it, in an energy starved world the car of the future is an e-bike. Side effect it’s free of connected BS. So far…

We will not be "energy starved" anytime soon, short of an actual apocalypse happening. What we use for energy may change, but energy won't.

Re: It's perfectly legal for cars to harvest your texts, call logs

#15

Post by bri3d »

I dug into the technical details here over the last few days and as usual it's not quite as sinister as the hand wringing:

* Automotive head units are just embedded computers. Most run Linux, QNX, or Windows CE, with some proprietary UI system on top.

* These machines usually store data in an onboard database in flash (sometimes just SQLite).

* Sometimes, phone data is captured using standard Bluetooth mechanisms (Message Access Protocol MAP and Phone Book Access Protocol PBAP) which require authorization on the phone side. Some vendors implement an additional "are you sure you want to share your information" check on the head unit side, and others don't.

* This data is cached on the head unit so that finding a contact to call or reading a text message doesn't require 10 minutes worth of Bluetooth nonsense.

* Some vendors inadequately purge this cached data when a Bluetooth pairing is removed from the head unit.

* Berla sell data extraction exploits to law enforcement, just like other forensics vendors do for mobile phones. Sometimes this can extract latent data and sometimes active data.

My advice:

* Never authorize a head unit to download your contacts or SMS.

* If you use a rental car, Factory Reset the head unit when you leave.

That's decent protection for most people. I didn't find any evidence pointing to a central server upload, a conspiracy to build an LE database, etc. It's just typical crappy hardware manufacturer-made software leaving data around that shouldn't be left around, creating an opening for forensic vendor exploits to slurp the data.

Re: It's perfectly legal for cars to harvest your texts, call logs

#16

Post by bri3d »

arjvik wrote: post #7
lotsofpulp wrote: post #5

This is why I would not consider connecting my phone to anything other than CarPlay/Android Auto.

Both of which require Bluetooth pairing (or at least auto-pair without asking you if I recall correctly) which allows the head unit to siphon data!

You can disable Sync Contacts (PBAP) and Notify Messages (MAP), and then the Bluetooth head unit won't download your contacts or messages.

Re: It's perfectly legal for cars to harvest your texts, call logs

#18

Post by Caboose8685 »

bri3d wrote: post #15

I dug into the technical details here over the last few days and as usual it's not quite as sinister as the hand wringing: * Automotive head units are just embedded computers. Most run Linux, QNX, or Windows CE, with some proprietary UI system on top. * These machines usually store data in an onboard database in flash (sometimes just SQLite). * Sometimes, phone data is captured using standard Bluetooth mechanisms (Me…

I think an argument should be made against normalizing this, which could then lead to OEMs building in internet assisted data export functionality in new cars and people won't know until a lawsuit (likely) starts years after the fact and the harm is done.

Re: It's perfectly legal for cars to harvest your texts, call logs

#19

Post by drewcoo »

bri3d wrote: post #15

I dug into the technical details here over the last few days and as usual it's not quite as sinister as the hand wringing: * Automotive head units are just embedded computers. Most run Linux, QNX, or Windows CE, with some proprietary UI system on top. * These machines usually store data in an onboard database in flash (sometimes just SQLite). * Sometimes, phone data is captured using standard Bluetooth mechanisms (Me…

> * If you use a rental car, Factory Reset the head unit when you leave.

That is ridiculously onerous! Just because geeks can share arcane knowledge about how to be safe does not mean that this isn't horribly anti-consumer.

Re: It's perfectly legal for cars to harvest your texts, call logs

#20

Post by almatabata »

> store each intercepted, recorded, and downloaded copy of text messages in non-temporary computer memory in such a manner that the vehicle owner cannot access it or delete it,

You might think why care if its your own car. But if you rent cars this can become an issue where if poorly implemented the next driver could access the information.

It is such an easy feature to implement and suppliers in Europe already do this due to GDPR. I remember working for an automotive supplier where we implemented this feature. The whole phonebook was actually downloaded onto the unit in an encrypted Database. The system would decrypt it on the fly as needed. When GDPR came around we had to implement a wipe feature that would allow the user to delete their profile which included that database.

I feel like GDPR for all its flaws had a positive impact in that it forced the supplier to actually care about this use case.

Post reply on HN