Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

Post reply on HN
Print view View original

171–180 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#171

Post by JohnFen »

lmkg wrote: post #91
SR2Z wrote: post #72

Earlier quoted context omitted.

Yeah, companies seem to think that "personally identifiable information" is basically just your name. That's clearly wrong because GPS data and VIN make it extremely straightforward to figure out who a car owner is. As far as I'm concerned, this is PII. That statement is a bald-faced lie and a state AG should bring charges over this - it's extraordinarily irresponsible for Toyota to collect this data and then leak it…

"Personally identifiable information" is a legal term with a legal definition[1], and location data is not PII. Companies think that PII is basically just your name because that's literally true: PII means name and government-issued ID number. That's it. Everything else is not PII. Relatedly, PII sucks as a basis for privacy law. The laws enshrining PII were made in response to identity theft[2], and that's the "thre…

That's why I think PII is a completely worthless term.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#172

Post by DoingIsLearning »

brk wrote: post #76

It is clear that automakers are utterly failing at technology. In-vehicle control systems are typically garbage. Several hacks have been shown where vehicle data is exposed over cellular links, in some cases with remote attackers being able to actually control elements of the vehicle (eg: Jeep). Software updates are rare, with manufacturers often trying to charge exorbitant amounts for basic updates. Data breaches of…

> Auto manufacturers need to become bona-fide software developers and take development, QA, cyber security, etc. far more serious than they have so far.

Follow the money.

Their core business depends on the sale of a manufactured good, software is not the product. Software in Automotive is a cost centre.

They will absolutely contract out to the lowest bidder (coincidently probably the least capable). Cost downs in BOMs/features are trimmed to the cent because they are manufacturing in volume so manufacturing cost per unit is King.

What we define as sane Software best practices™ is a result of an industry were Software or services via software are in fact the product.

Also people won't vote with their wallet because we absolutely post-rationalize features and UX in a car. Most people don't realize or won't admit how reptilian their decision process goes in buying a car it's 80% "do I like the looks of it" and 20% the price tag.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#173

Post by JohnFen »

chubot wrote: post #58
dapearce wrote: post #53

> It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals The data included timestamped GPS data, which has been demonstrated to be easy to de-anonymize.

But the VIN number was available, as it says right below that I mean does anyone think there HASN'T been a leak of VIN numbers and owners that would be trivial to join with this? It's also kind of staggering how long this was a problem Toyota Motor Corporation disclosed a data breach on its cloud environment that exposed the car-location information of 2,150,000 customers for ten years, between November 6, 2013, and…

In my state, anyway, vehicle registrations are public information. If you have a VIN or license plate #, you can get the identity and address of the person the car is registered to, and if you know the name and address of a person, you can get the VINs/plate #s of the vehicles registered to them.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#174

Post by whaleofatw2022 »

jeffbee wrote: post #63
thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

All car shrink-wrap licenses that I have looked at are similar. That's why I think it is funny when people freak out about Android Automotive. The Android Automotive terms are much, much better for customer privacy. The EULA for my Honda says that Honda can and will share all available data with itself and third parties, named and unnamed, for any or no reason.

... I do wonder whether this was related to GMs plans to do their own thing?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#175

Post by quickthrower2 »

bboygravity wrote: post #157
mpol wrote: post #147

Earlier quoted context omitted.

What does this mean? How do you "not accept this"? Are you jumping up and down now interior pictures are leaked from your Toyota? Do you not pay for recurring fees of licenses? Do you send an angry phone call in the general direction of Toyota HQ?

I drive a 30+ year old car. It can easily last another 10 years. 0 tracking by the manufacturer. No subscription services needed. No annoying beeping when you forget to put on your seatbelt for 10 seconds. No touchscreen, all physical buttons. No Android/Apple spyware. No cameras. No ads on any display. No car-key that can run out of battery. It's nice.

Has to be a Saab 900

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#176

Post by feanaro »

mpol wrote: post #147
feanaro wrote: post #137

Earlier quoted context omitted.

How will this happen if we don't accept it?

What does this mean? How do you "not accept this"? Are you jumping up and down now interior pictures are leaked from your Toyota? Do you not pay for recurring fees of licenses? Do you send an angry phone call in the general direction of Toyota HQ?

Don't buy a new Toyota. Make it widely known why you're not buying it. Remove the modem and publish instructions on how to do so. Start or join an initiative to legally punish this.

Literally anything is better than sitting and solemnly spelling out what "will" and "must" be.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#177

Post by JohnFen »

Mobius01 wrote: post #153
chasd00 wrote: post #75

Earlier quoted context omitted.

"tracker detection and removal" would be a great service for a local service garage to offer.

In many cases this isn’t viable. On my car for for instance - a 2016 Subaru - removing the telematics module also disables all front speakers because the audio signal is routed through it.

Sounds like a relatively easy problem to solve. Install your own sound system.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#178

Post by kevviiinn »

quickthrower2 wrote: post #175
bboygravity wrote: post #157

Earlier quoted context omitted.

I drive a 30+ year old car. It can easily last another 10 years. 0 tracking by the manufacturer. No subscription services needed. No annoying beeping when you forget to put on your seatbelt for 10 seconds. No touchscreen, all physical buttons. No Android/Apple spyware. No cameras. No ads on any display. No car-key that can run out of battery. It's nice.

Has to be a Saab 900

Or an early 90s honda

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#179

Post by hammyhavoc »

asdfman123 wrote: post #155
StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

> Am I dumb or are they I don't think you're wrong. I wonder what incentive bleepingcomputer has to make it seem not so bad.

Avoiding getting rekt for defamation or a potentially libellous article.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#180

Post by galangalalgol »

Mountain_Skies wrote: post #129
LinuxBender wrote: post #118

Earlier quoted context omitted.

Where would the support for fines come from? Probably when a legislators private graphic videos with an escort or drug dealer or something more interesting gets leaked. Perhaps some government officials data is present in the leak as we speak. It might be harder to spot if not a personally owned vehicle or still cloud registered to a previous owner.

That's how video rental records became private when Supreme Court justice nominee Robert Bork's records were leaked and suddenly everyone in Congress panicked that it could someday happen to them. Bork turned out to have mundane tastes in movies but obviously members of Congress were renting movies a bit more wild.

Is the movie list still around? That might make for a fun watch list.
Post reply on HN