Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

Post reply on HN
Print view View original

181–190 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#181

Post by tric »

I was looking into getting a new toyota, but was hesitant because of this tracking "feature."

I searched online for how to disable it, and found this question:

https://carkiller.com/scottykilmer/qa/how-to-permanently-dis...

These responses are typical:

"But you're still going to be traceable by your phone."

"...everyone, EVERYONE, on the planet has their information out there. There is no such thing as "off the grid." "

"your phone has sent more than enough info about you to every advertiser on Earth mord than the DCM will ever do."

Many people just don't care....

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#182

Post by DoingIsLearning »

spacebanana7 wrote: post #164
TheCapn wrote: post #134

Earlier quoted context omitted.

So I don't work in automotive domain, but I work in Controls Engineering. Basically everything you just said relates to my work as well, and based on tidbits of anecdotal info I've picked up through various technical forums it sounds like automotive & controls are quite similar in that regard. The dirty truth is often times these domains were designed and chiefly operated by non-software people. Not to say a mechanic…

> Software Engineering as a regulated profession is going to be a necessity as much as civil engineering or electrical engineering has been Wouldn’t it be easier to regulate the quality of software used in critical products? AFAIK similar regulatory standards and certifications exist for aerospace software.

It technically exists:

ISO26262 - "Road vehicles – Functional safety"

But it's not nearly as prescriptive as what you have in DO-178C for example.

Nevertheless most of these telematics systems are not "considered" safety-critical in a hazard analysis unless you have OTA updates or something similar so large chunks of of 26262 would also not be applicable.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#183

Post by detrites »

jstarfish wrote: post #166
StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

> its still going to reduce down to just a handful of cars which can then be cross referenced against place of work, relatives, etc. You are correct, but I can't imagine why anybody would go to that much trouble for a speculative answer. Your idea requires quite a bit of intelligence collection as well (relatives' addresses, addresses of known hangouts, etc. that you have to vet for accuracy). If you have a confirmed…

The scammer in the third world country folks may be at threat of this breach being exploited by does not have that ability.

But they do have the internet, and further no meatspace means scams can be automated/scaled.

Honestly, this seems very bad.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#184

Post by tric »

tinco wrote: post #138
dylan604 wrote: post #67

Earlier quoted context omitted.

I've purchased a few Toyota models, with the first having the connect service being a 2014 model. The sales rep asked for my phone so they could download the app that works with their system. The manner in which it was asked was interesting to me in that they clearly had not had someone so much as flinch as to giving them their unlocked phone and access to an app store. Maybe I was the first person not a grandparent…

That sounds perfect. How could a car system be better than just be a screen and interface for the functionality your phone provides? It's literally the dream. If it's a particularly cheap car I wouldn't even mind if it doesn't have a screen or interface, and just supplies an API to the phone and a holder for it. Either way would be a million times better than any car made between 2005 and 2015 has to offer.

> How could a car system be better than just be a screen and interface for the functionality your phone provides? It's literally the dream.

This is how Apple Carplay works. It just streams the phone to the display, and accepts input from the car's buttons. I think Android Auto does the same.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#185

Post by tric »

eulers_secret wrote: post #93

There's some really active community discussions around disabling the Data Collection Module, discussing everything from simply pulling the DCM fuse to disabling only the antenna. If you pull the DCM fuse, you'll loose the microphone and potentially one of the right-hand speakers - these can be fixed by jumping the wires in/out of the DCM. What's concerning to me are reports of the car still uploading all the collect…

> What's concerning to me are reports of the car still uploading all the collected data if you attach a cell phone to the radio's bluetooth

This must be if you have the car manufacturer's app installed. I can't think of any other way for it to phone home from DCM via buetooth if the cellular module is disabled.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#186

Post by gambiting »

sandworm101 wrote: post #107
dybber wrote: post #102

Earlier quoted context omitted.

How does these EULA’s work if you buy a used car? I suppose manufacturer doesn’t really know if the car has been sold and the new owners haven’t accepted the terms?

Well, how do the shrink-wrapped EULA's work when you sell a computer? What is Microsoft's position on you selling your windows license to a third party? I expect that car manufacturers will eventually take a similar line. But it won't be a big deal for very long. As we will soon all be paying subscriptions to use our cars, license transfers will be balled up into the transfer fees paid when you move your ongoing subs…

>>What is Microsoft's position on you selling your windows license to a third party?

It's 100% allowed within the EU, even for OEM licences. There have been multiple court cases about this and microsoft lost every single one. But I guess that's not what you were implying?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#187

Post by michaelmior »

short_sells_poo wrote: post #36
thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

> Interior images, exterior images, facial geometry, voice recordings, This is an absolutely unbelievable level of privacy intrusion IMO. I 100% support very heavily fining this sort of behavior, otherwise it will continue to proliferate.

When you look at the specific uses, I think it's a bit less unbelievable. I think the important piece is that they should more clearly stipulate how the data is used and what controls are in place to protect it. Even more importantly, opt out by default if there's any chance of the data leaving your vehicle and a clear mechanism for wiping all collected data.

> Your Facial Geometric Features will only be stored on your vehicle.

> Vehicles equipped with Teammate use sensor and/or image data from the vehicle’s interior and exterior to evaluate the vehicle’s surroundings

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#188

Post by _hypx »

feanaro wrote: post #160
_hypx wrote: post #115

Earlier quoted context omitted.

No one needs to bother with that race. It is just a ploy by China to gain marketshare in the car industry. It won't work because it ultimately creates a massive new resource dependency. One that just happens to shift everyone's supply chain to China or Chinese controlled companies. I believe Western companies will eventually walk away from pursuing battery cars, at least in the sense of them being the only solution.…

What are these obvious problems?

Expensive, limited range, slow recharge times, huge dependency on a battery supply chain, etc. Right now, people are obsessed about them but I think this is just temporary phenomenon. Once people realize that there are cheaper forms of green transportation that avoid those above issues, the obsession with battery EVs will end.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#190

Post by _hypx »

CamperBob2 wrote: post #162
_hypx wrote: post #112

Earlier quoted context omitted.

The other companies are wasting their time. Battery EVs are a dead end and they will all have to move to hydrogen tech eventually. It is the other companies that are way behind.

In EE terms, betting against batteries is like betting against CMOS. Progress will go where the industry's money goes, not where any one company's money goes. If I could say just one thing to Toyota's management, it would be, "Stop trying to make hydrogen happen. It's not going to happen. There are just too many technical and economic drawbacks." But any of their engineers could tell them the same thing, so what'd be…

The most prominent alternative (fuel cell EV) are also EVs. There are no fundamental downsides in comparison either. To continue your EE analogy, you're betting against another kind of CMOS which also happens to be made of far cheaper materials. Like your CMOS is made of germanium but the competition is made of silicon.
Post reply on HN