Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

Post reply on HN
Print view View original

131–140 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#131

Post by brewdad »

wlesieutre wrote: post #86
dapearce wrote: post #53

> It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals The data included timestamped GPS data, which has been demonstrated to be easy to de-anonymize.

All of five seconds. Where does the car park at night? Put the address into https://www.fastpeoplesearch.com/address

This is why I park in front of my neighbor's house. :)

While I don't do that, I do always use a nearby neighbor's address for my Google Maps directions. I'm sure Google isn't fooled but it amuses me.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#133

Post by gpcz »

ycombinete wrote: post #29
greenie_beans wrote: post #10

good lord. i'm so glad my toyota doesn't have any of those features. shout out to the lean method.

What is the lean method in this case?

I'd assume the Toyota Production System and their method of lean manufacturing.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#134

Post by TheCapn »

brk wrote: post #76

It is clear that automakers are utterly failing at technology. In-vehicle control systems are typically garbage. Several hacks have been shown where vehicle data is exposed over cellular links, in some cases with remote attackers being able to actually control elements of the vehicle (eg: Jeep). Software updates are rare, with manufacturers often trying to charge exorbitant amounts for basic updates. Data breaches of…

So I don't work in automotive domain, but I work in Controls Engineering. Basically everything you just said relates to my work as well, and based on tidbits of anecdotal info I've picked up through various technical forums it sounds like automotive & controls are quite similar in that regard.

The dirty truth is often times these domains were designed and chiefly operated by non-software people. Not to say a mechanical engineer or electrical engineer can't program, it's just that their focus is on their work, and the software is but a tool to accomplish those means. So the world of software has leapfrogged over PLC and automotive design and gone to run laps around it several times since the 90s. It's only in say the last 5 years or so that I've seen a cultural shift in controls towards embracing the modern realities of software, networking, security, version control, databases, etc.etc.etc.

I'm not going to go too much further into this, but this is why Software Engineering as a regulated profession is going to be a necessity as much as civil engineering or electrical engineering has been. The digital world is just too vast and complex now with so many pitfalls for those who only ride the edges can handle. And people's lives are starting to matter. It is no longer safe to treat security as secondary with an "oopsy" anymore. We don't tolerate bridge collapse or electrical design that can destroy livelihoods, why do we still tolerate hacks governing data and safety of public?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#135

Post by panax »

jerry1979 wrote: post #52

Does anyone have a guide to modding vehicles to prevent them from collecting data? I would be willing to snip the microphone in the cab and remove the gps receiver if I knew where it was.

It is highly dependent on make/model but most of the time the data is transmitted through the telematic control unit (TCU) which often has a cellular modem that can connect to cellular networks and you might be able to remove or disable/cut power to the TCU.

There can also be other devices similar to a black box in the vehicle which record data and store it in case of a crash for forensic purposes. I would leave these alone as long as they don't have network connectivity.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#137

Post by feanaro »

sandworm101 wrote: post #107
dybber wrote: post #102

Earlier quoted context omitted.

How does these EULA’s work if you buy a used car? I suppose manufacturer doesn’t really know if the car has been sold and the new owners haven’t accepted the terms?

Well, how do the shrink-wrapped EULA's work when you sell a computer? What is Microsoft's position on you selling your windows license to a third party? I expect that car manufacturers will eventually take a similar line. But it won't be a big deal for very long. As we will soon all be paying subscriptions to use our cars, license transfers will be balled up into the transfer fees paid when you move your ongoing subs…

How will this happen if we don't accept it?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#138

Post by tinco »

dylan604 wrote: post #67
thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

I've purchased a few Toyota models, with the first having the connect service being a 2014 model. The sales rep asked for my phone so they could download the app that works with their system. The manner in which it was asked was interesting to me in that they clearly had not had someone so much as flinch as to giving them their unlocked phone and access to an app store. Maybe I was the first person not a grandparent…

That sounds perfect. How could a car system be better than just be a screen and interface for the functionality your phone provides? It's literally the dream.

If it's a particularly cheap car I wouldn't even mind if it doesn't have a screen or interface, and just supplies an API to the phone and a holder for it.

Either way would be a million times better than any car made between 2005 and 2015 has to offer.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#139

Post by StillBored »

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car."

Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at 3AM over some time period. Which then gives you the VIN and the entire location history, right? Sure you might get more than one car if the someone lives in a city and uses street parking but its still going to reduce down to just a handful of cars which can then be cross referenced against place of work, relatives, etc.

And of course home address lookup can be made with any number of public databases with little more than a name and maybe some additional filtering (age, city, phone number, etc).

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#140

Post by froh »

beefee wrote: post #62

Owners may want to disable this in hardware rather than relying on a sketchy opt-out mechanism. The relevant part is the "data communications module". It has an LTE modem and a backup battery, so it's able to transmit even if the car battery is disconnected. It requires a little bit of dashboard disassembly to access. You can either remove it or disconnect the LTE and GPS antennas. Toyota has technical documents avai…

in Europe, eCall is part of the homologation and must not be deactivated, by law.

https://en.m.wikipedia.org/wiki/ECall

Post reply on HN