Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

Post reply on HN
Print view View original

261–270 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#261

Post by yoaviram »

StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

Yes, all location tracking data is personaly identifiable.

Given any dataset like this it is trivial to pick any entry and trace where is home and where is work thus de-anonymizing it. Conversely given any home or work addreas it's trivial to find all other related entries for the individual.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#262

Post by peeters »

froh wrote: post #140
beefee wrote: post #62

Owners may want to disable this in hardware rather than relying on a sketchy opt-out mechanism. The relevant part is the "data communications module". It has an LTE modem and a backup battery, so it's able to transmit even if the car battery is disconnected. It requires a little bit of dashboard disassembly to access. You can either remove it or disconnect the LTE and GPS antennas. Toyota has technical documents avai…

in Europe, eCall is part of the homologation and must not be deactivated, by law. https://en.m.wikipedia.org/wiki/ECall

Do you have a source for it being illegal for an owner to disable it on their own vehicle? Your link talks about it being required in new cars but I didn't see anything that said you couldn't deactivate it.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#263

Post by poly_morphis »

FredPret wrote: post #258

Dear lord. The fact they even had this much data means I'll never even think about buying a Toyota in future no matter how many grovelling apologies they issue now. I used to have a Ford. Their app was generally good but I think all you need is the VIN to add a new car. Now you have the ability to track that car, lock the doors, remote start it, and so on. All second-hand car buyers should get their car's app and act…

I have an Audi from ~2017. Then, a few years ago, the 3G network was shut down in the US. Can't use the app to unlock the doors or check the car status. I think I prefer it like that. Interestingly, on the center console screen, it shows an LTE connection - must be for something else? Then why isn't the unlock/lock function over LTE? Who knows.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#264

Post by 93po »

plagiarist wrote: post #101
short_sells_poo wrote: post #36

Earlier quoted context omitted.

> Interior images, exterior images, facial geometry, voice recordings, This is an absolutely unbelievable level of privacy intrusion IMO. I 100% support very heavily fining this sort of behavior, otherwise it will continue to proliferate.

We need stronger laws about protecting user data. Like HIPAA but for everything. Storing millions of hours of video of people driving and their GPS should be a liability. I did not consent to any of this, but I'm certainly on recordings for drivers who did, that should also be an enormous fine.

we need politicians that do literally anything other than serve capitalism at all costs

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#265

Post by pnw »

int_19h wrote: post #222
maximinus_thrax wrote: post #210

Earlier quoted context omitted.

The VIN on my Toyota is displayed right beneath the windshield. Anyone can walk up to my car and read it.

VIN being visible through the windshield is a legal requirement in US.

More accurately, you can’t alter or remove the VIN. I don’t believe it has to be visible at all times. Some car owners obscure their VIN because of public sourced databases like Vinwiki.

https://www.justice.gov/archives/jm/criminal-resource-manual...

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#266

Post by shortcake27 »

_hypx wrote: post #260
shortcake27 wrote: post #256

Earlier quoted context omitted.

The average person is extremely concerned about their ability to take that 1,000 mile road trip they’ve never even considered before. This waste also makes cars heavier than they need to be which requires special tyres (more expensive, of course), does more road damage, results in worse braking performance, and more impactful in accidents. And for people who care about driving, the added weight makes the driving expe…

1,000 mile road trips actually happen, and until recently it was never a problem we had to deal with. I very much doubt we will ever get over it. We are specifically asked to abandon a feature we enjoyed for a century. We will likely only get over it when there are EVs that simply do not have this sacrifice.

I never said they don’t happen. I said it isn’t average to take one, and the average person is concerned about their ability to do something they’ll never do.

The average person doesn’t need hundreds of miles of range on a single charge assuming the charging infrastructure is there, and it’s getting there.

I’m not sure what your point is. You are in favour of wasting limited non-renewable resources because you personally take road trips?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#267

Post by cameldrv »

detrites wrote: post #183
jstarfish wrote: post #166

Earlier quoted context omitted.

> its still going to reduce down to just a handful of cars which can then be cross referenced against place of work, relatives, etc. You are correct, but I can't imagine why anybody would go to that much trouble for a speculative answer. Your idea requires quite a bit of intelligence collection as well (relatives' addresses, addresses of known hangouts, etc. that you have to vet for accuracy). If you have a confirmed…

The scammer in the third world country folks may be at threat of this breach being exploited by does not have that ability. But they do have the internet, and further no meatspace means scams can be automated/scaled. Honestly, this seems very bad.

Reidentifyig anonymized location traces has been common for many years in the gray data market world. If you have multi-year traces, it’s not too hard. You just need some sparse location data for the target and then if the sparse data matches the trace at 4-5 times you can be pretty sure it’s the same person.

For example, if you ever use public wifi, and you hit a web page with real-time bid ads on it, your ip address and tracking cookie will be reported. The IP can be geolocated, and presto, you have one time/location datapoint. Credit card transaction data can also be bought, and a cc transaction often gives you a location and a time.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#268

Post by UberFly »

Just once I'd like to see a company like this sued out of existence. It's not just that they are incompetent with customer data, it's that they essentially forced everyone to give them this info in the first place by default. What if you're an expatriate Chinese dissident? Maybe your ability to hide just got harder.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#269

Post by actionfromafar »

gambiting wrote: post #186
sandworm101 wrote: post #107

Earlier quoted context omitted.

Well, how do the shrink-wrapped EULA's work when you sell a computer? What is Microsoft's position on you selling your windows license to a third party? I expect that car manufacturers will eventually take a similar line. But it won't be a big deal for very long. As we will soon all be paying subscriptions to use our cars, license transfers will be balled up into the transfer fees paid when you move your ongoing subs…

>>What is Microsoft's position on you selling your windows license to a third party? It's 100% allowed within the EU, even for OEM licences. There have been multiple court cases about this and microsoft lost every single one. But I guess that's not what you were implying?

I wonder why I can’t buy a game license in a similar way from somebody.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#270

Post by TaylorAlexander »

abeppu wrote: post #17
TaylorAlexander wrote: post #11

Earlier quoted context omitted.

I worked for Toyota Infotechnology Center in Sunnyvale in 2016/2017 on a robotics research project involving their HSR robot running ROS. The robot had odometry from the wheels, though it was a bit noisy due to the construction of the omnidirectional mechanism. They decided to ignore wheel odometry and use only an odometry module based on the planar lidar, essentially visual odometry. This worked fine in most circums…

> silicon valley coding rigor This was refreshing to read. Within my bubble in tech, it's often easy to get jaded about how _unrigorous_ our "engineering" often is.

The place I worked next was google, which has probably some of the most rigorous software practices in the industry. Not everyone is going to be like them, but one of the absolute basics is using revision control for code!
Post reply on HN