Yet another security issue highlighted recently in the press on Jaguar Land Rover, but affects all cars with online connectivity.

 

https://www.fleetnews.co.uk/news/manufacturer-news/2016/07/21/warning-on-defleeted-car-app-security

 

Skoda connect? Did you deregister the car before you got rid? Or are you spying on the new owner?

I read that article with interest too.  I made sure that I cleared everything down.  And with the S3 not having a built in Sim, was easily able to remove all traces.  It’s another area where a still behind the times and technology Dealer network and national customer centre do not understand the implications of what should be done.  The about to be ex-Owner should be the one remembering to do it, but many of them don’t understand the tech either....... nor I suspect is it mentioned in the handbook?  With BMW now also offering Office 365 on board, it could lead to some embarrassing email or document leaks - and no I haven't enabled it .

 

It is one of the annoyances that I have with the new BMW Connected Drive.  Yes the connection allows lots of fancy data to be transferred - though interestingly only to an iPad with cellular (even if it isn’t set up!).  Built in Sim only, and expensive data contracts through Deutshe Telecom and whoever ‘carries’ them in the UK.  Updating the maps is done 4 times a year over the air rather than via a USB stick.  There is no function that I have yet found to ‘de-register’ me as the owner and therefore release the system for reassignment to a new Owner.  The 220xD is on lease so will need clearing down in 4 years.  Let’s hope the processes have been made easier.  Anyone working with the GDPR will understand why some concern about this needs to be shown.

 

For the WiFi, I’ve bought a 4G MiFi Router and use a PAYG Sim which means lower cost, better speeds (DT limit to 10Mbps in/2Mbps out regardless) and it’s mine rather than going via the car.

Edited 31 July, 20187 yr by FelisBengalensis

You would think there would be an easy delete user that the car can do...

Infotainment Factory Reset?

Problem part is the user not deregistering at the Skoda Portal side and general ignorance of the new user or simply not even giving it a thought. If you were so inclined, you could even sell your car on and for a while until the new owner resets everything, if he does at all, still keep tabs, see where it is parked, if the car is unlocked, honk and flash if that amuses you.....

 

Problem is worse for other marques that allow remote unlocking.

Edited 31 July, 20187 yr by xman

Another nxp design?

The selling second hand process needs tightening up. There should be a ‘handover’ page on the portal that either wipes everything when part exchanging via a dealer or hands over the car to a new buyer.

On 31/07/2018 at 20:00, freelunch said:

Infotainment Factory Reset?

 

I do it with every car when we return it, have done ever since they gained bluetooth connection or Sat Nav.

 

The issue here is of more concern to a second owner.

To really scare you look at

 

https://www.pentestpartners.com/security-blog/

 

Anyone bought their child a "connected" toy?  Anyone have a connected car?  And why would anyone would ever want a sex toy with internet connectivity!

BMW can definitely clear the data and deregister the car. Mine was factory reset when I got it.

However my Mini came complete with the previous users phone book, which is actually still in there I think. I onlt realised when I tried to use the (utterly woeful) voice commands and it tried to dial Janet. I don't know a Janet.

 

I suspect a lot of the manufacturers will be starting to run scared over GDPR with their out of date car data systems.

 

Pen Test Partners do a lot of testing on weird devices, they do it for marketing. Their MD Ken Munro is a very good speaker worth seeing if you get the chance.

@AspmanYour BINI tried to call the Joint Academic NETwork!?  Was it a voice call or data?

1 hour ago, KenONeill said:

@AspmanYour BINI tried to call the Joint Academic NETwork!?  Was it a voice call or data?

 

Luckily I know the incident handlers at JCIRT so they weren't too concerned at some raving and swearing from a small car