Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

71–80 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#71

good lord. i'm so glad my toyota doesn't have any of those features. shout out to the lean method.

If it is anything after about 2012 it probably does. Also if this hack is out of the software I think it is, I am not surprised. Some of the main devs were more worried about what a function was named than how to make it work correctly and securely.

how do i know if it's enabled? i've never done any sort connectivity thing in my vehicle.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#72

> It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals The data included timestamped GPS data, which has been demonstrated to be easy to de-anonymize.

Yeah, companies seem to think that "personally identifiable information" is basically just your name. That's clearly wrong because GPS data and VIN make it extremely straightforward to figure out who a car owner is.

As far as I'm concerned, this is PII. That statement is a bald-faced lie and a state AG should bring charges over this - it's extraordinarily irresponsible for Toyota to collect this data and then leak it for TEN YEARS.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#73
post #45

Earlier quoted context omitted.

> All machines of meaningful complexity need maintenance if you expect them to last, including EVs This is honestly not true - there is an order of magnitude less parts in an EV drivetrain vs a modern ICE car. You can go a decade between seeing a service center in an EV, largely thanks to regen braking/one pedal driving allowing you to avoid new pads or discs. There is no transmission in virtually all EVs, with drive…

> largely thanks to regen braking allowing you to avoid new pads or discs I’m almost there with the old-school way: a manual transmission and downshifting to decelerate. While not as effective, drum brakes really lasted a while.

you can downshift some auto tranmissions too. Although you're trading brake pad wear for transmission clutch wear.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#74
post #14

I hope jailbreaking and disabling this data collection becomes the norm in the future. It is obvious companies do not prioritize the security protecting our data.

It's a matter of time before that is legislated away as an option. Drunk driver detection and remote disable for law enforcement and other rights-trampling "safety" features will be always-on, probably by law. If it's not those, always-on comms will be mandated to help go to a self-driving fleet. One way or another, they'll force us to have spyware cars.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#75
post #62

Owners may want to disable this in hardware rather than relying on a sketchy opt-out mechanism. The relevant part is the "data communications module". It has an LTE modem and a backup battery, so it's able to transmit even if the car battery is disconnected. It requires a little bit of dashboard disassembly to access. You can either remove it or disconnect the LTE and GPS antennas. Toyota has technical documents avai…

"tracker detection and removal" would be a great service for a local service garage to offer.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#76
It is clear that automakers are utterly failing at technology.

In-vehicle control systems are typically garbage.

Several hacks have been shown where vehicle data is exposed over cellular links, in some cases with remote attackers being able to actually control elements of the vehicle (eg: Jeep).

Software updates are rare, with manufacturers often trying to charge exorbitant amounts for basic updates.

Data breaches of various customer data, credentials, PII, etc. are repeated.

IMO we are at the point where in-vehice technology is a thing that is never going away. Auto manufacturers need to become bona-fide software developers and take development, QA, cyber security, etc. far more serious than they have so far.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#77
post #8
post #2

Japanese auto completely missed the memo on software. Many of them won't make the ev transition. It's hard to imagine what Japanese economy is going to be like once their auto industry is gutted.

Toyota's hybrid tech is and has been the best and most reliable for a very long time. I think it's a shame that the EV regulations and incentives (at least in America) are not as friendly for traditional hybrids and plug-in hybrids. They have basically zero downsides compared to full ICE or full EV, and would still make a massive dent in emissions. PHEVs in particular - most people are going under 100 miles a day, so…

Hybrid vehicles are the most likely to catch fire.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#78
post #2

Japanese auto completely missed the memo on software. Many of them won't make the ev transition. It's hard to imagine what Japanese economy is going to be like once their auto industry is gutted.

> Many of them won't make the ev transition. What exactly makes u come to this conclusion?

Toyota in particular has wasted a ridiculous amount of time and money on consumer-level hydrogen tech. As a result competitors that focused on battery EVs over the last few years have a decent head start.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#79
post #74
post #14

I hope jailbreaking and disabling this data collection becomes the norm in the future. It is obvious companies do not prioritize the security protecting our data.

It's a matter of time before that is legislated away as an option. Drunk driver detection and remote disable for law enforcement and other rights-trampling "safety" features will be always-on, probably by law. If it's not those, always-on comms will be mandated to help go to a self-driving fleet. One way or another, they'll force us to have spyware cars.

yeah i've always thought self driving and autonomous car fleets would be a godsend to governments. One order and you can immobilize a street, neighborhood, city or whatever. I bet it's hard to escape oppression on foot.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#80
post #8
post #2

Japanese auto completely missed the memo on software. Many of them won't make the ev transition. It's hard to imagine what Japanese economy is going to be like once their auto industry is gutted.

Toyota's hybrid tech is and has been the best and most reliable for a very long time. I think it's a shame that the EV regulations and incentives (at least in America) are not as friendly for traditional hybrids and plug-in hybrids. They have basically zero downsides compared to full ICE or full EV, and would still make a massive dent in emissions. PHEVs in particular - most people are going under 100 miles a day, so…

PHEV sounds like best of both world on paper but actually worst of both worlds in reality. You are hauling a massive dead weight. Very little useful space inside. Most of them don't make past 10yrs due to the cost of complex system and battery replacement.
Post reply on HN