Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VW breach exposes location of 800k electric vehicles

cyberinsider.com

Post reply on HN
Print view View original

31–40 of 317 posts

Re: VW breach exposes location of 800k electric vehicles

#31

Post by starbugs »

tuwtuwtuwtuw wrote: post #26
jsiepkes wrote: post #16

If it so bad there is actually a whistleblower then how do they pass their ISO27001 audits? Bit too friendly with TUV Nord? https://cariad.technology/content/dam/digitalmindofmobility/... EDIT: Just noticed this is an ISO9001 certificate. Though on their job offer site they do ask for "Foundational understanding of security related regulations and standards preferred (e.g. ISO21434, ISO27001, NIST-800)". Unclear if t…

The fact that you have passed audits isn't a guarantee (or even an indication) that you don't have major security vulnerabilities.

> The fact that you have passed audits isn't a guarantee (or even an indication) that you don't have major security vulnerabilities.

Please explain that to my IT department.

Re: VW breach exposes location of 800k electric vehicles

#32

Post by mikedelfino »

wintermutestwin wrote: post #23
rad_gruchalski wrote: post #18

Earlier quoted context omitted.

The reason for all that telemetry is the legislation. How do you think they are going to implement the full “intelligent” speed assistant in 2027?

More like automated ticketing for speeding.

I’d love to see that implemented, yes, but it would be even better if all cars' speed were automatically limited to the speed limit of each road.

Re: VW breach exposes location of 800k electric vehicles

#33

Post by AlotOfReading »

rad_gruchalski wrote: post #15
CatWChainsaw wrote: post #10

Earlier quoted context omitted.

Eh, "consented to" is rather weak when you are forced to hit the "I agree" button to be able to drive the car you bought. That and forced arbitration need to die posthaste.

I refuse to believe that it’s not possible to drive the car without the app.

The data is collected even if you don't use the app or hit agree. The manufacturer has your personal info attached to the car from the warranty info. They're required to collect it so they can send you recall notices.

It's trivial to put a car in limp mode if the vehicle computers don't detect all the modules the manufacturer put there. It's slightly less trivial to detect missing antennas, but that tends to disable other features people enjoy like directions and data. Manufacturers simply don't care to cat-and-mouse this right now.

Re: VW breach exposes location of 800k electric vehicles

#34

Post by 7bit »

hyhconito wrote: post #24
rad_gruchalski wrote: post #19

Earlier quoted context omitted.

European companies get fined the same as any other companies.

Well within the constraints they set out which exclude a hell of a lot of European companies. (I am in Europe for reference, this is not an external perspective)

What constraints? And which companies are excluded by them?

Re: VW breach exposes location of 800k electric vehicles

#35

Post by rf15 »

jsiepkes wrote: post #16

If it so bad there is actually a whistleblower then how do they pass their ISO27001 audits? Bit too friendly with TUV Nord? https://cariad.technology/content/dam/digitalmindofmobility/... EDIT: Just noticed this is an ISO9001 certificate. Though on their job offer site they do ask for "Foundational understanding of security related regulations and standards preferred (e.g. ISO21434, ISO27001, NIST-800)". Unclear if t…

TÜV certification has always been more about certification theater and being able to verify that you don't have egregious amounts of negligence than certifying that you are doing your work well.

edit: I've never prepared for our audits and we always get our certification, no matter what they find as long as you say "yes, we are aware"

Re: VW breach exposes location of 800k electric vehicles

#36

Post by gsich »

jsiepkes wrote: post #16

If it so bad there is actually a whistleblower then how do they pass their ISO27001 audits? Bit too friendly with TUV Nord? https://cariad.technology/content/dam/digitalmindofmobility/... EDIT: Just noticed this is an ISO9001 certificate. Though on their job offer site they do ask for "Foundational understanding of security related regulations and standards preferred (e.g. ISO21434, ISO27001, NIST-800)". Unclear if t…

27001 does not specify implementation details.

Re: VW breach exposes location of 800k electric vehicles

#37

Post by behnamoh »

dmitrygr wrote: post #5

Why is nobody talking about the fact that this should not be possible? There is precisely zero reason for them to have this location data. Give the CEO one year of jail per person whose location was illegally tracked.

Can we some how hack the car and disable this "feature"?

Re: VW breach exposes location of 800k electric vehicles

#38

Post by gsich »

zer8k wrote: post #8
dmitrygr wrote: post #5

Why is nobody talking about the fact that this should not be possible? There is precisely zero reason for them to have this location data. Give the CEO one year of jail per person whose location was illegally tracked.

On the contrary it's relatively simple to understand how it got there trivially. Most modern cars, especially ones that fit into more "luxury" brands have an app. That app gives you telemetry and location data for a price. It's rather convenient to be able to pre-condition your car, or figure out where you parked in a massive unlabeled parking lot, etc. This is all consented to, but regardless the data is tracked any…

There is no reason why this can't be E2E.

Re: VW breach exposes location of 800k electric vehicles

#39

Post by behnamoh »

__fst__ wrote: post #28

EVs are topping the list of (imho) useless extras in cars. I'm still cherishing my Honda Fit pre-touchscreen edition. I'm going to drive it until it will fall apart. My next car will be an EV but I have yet to find one that still comes with mechanical features (door handles, knobs/buttons), without a whole battery of surveillance/telemetry tech and (crossing fingers) exchangable batteries. Simple electric propulsion…

I hate touchscreen buttons too and unfortunately all EVs I've seen have adopted that. I wonder if there are EVs with good old fashioned mechanical buttons.

Re: VW breach exposes location of 800k electric vehicles

#40

Post by 7bit »

rad_gruchalski wrote: post #14
TheChaplain wrote: post #3

That could be a nail in the coffin to end VW, the EU GDPR is quite a sharp weapon.

The problem was caused by Cariad, not VW directly. Cariad will be held responsible for, not VW.

Yep, and this will be the end of CARIAD. Volkswagen has already b decided to bleed them to death with the Rivien joint-venture. I guess they'll shut down the rest of the operation much, much faster now. This is the perfect reason for them to do so and what they have been waiting for.
Post reply on HN