What does your car know about you? We hacked a Chevy to find out | Hacker News Reader

What does your car know about you? We hacked a Chevy to find out

washingtonpost.com

143 pointsbookofjoe108 comments

When I bought my GM truck last year, it came with OnStar. The saleswoman came to the part of the sale where she had to set up my OnStar account. I told the saleswoman that I would not consent to the OnStar trial service. When she tried to cancel it for me through their online portal, she asked for my email address, which was required to cancel the service. I refused to give it to her. She didn't know what to do because that portal was the only tool that she had to work with, and it required the information (she was professional the entire time, btw, as was I), so I told her that I would take care of it.

I walked out to my new truck (still in the sales lot), pressed the OnStar button, and the operator came on, asking me to set up my service. I told them that I wanted to cancel the service completely. What did they do? They asked for my personal information.

I had a back-and-forth with them for 10 minutes or so, with the operator telling me that they could not turn off OnStar unless I gave them my personally identifying information, and I kept telling them that they did not need that information at all and that I would not give it to them (they already knew my vehicle's ID... it's automatically included with the OnStar call).

When asked why I would cancel a "free" service period, I told them in no uncertain terms that I disliked the OnStar company, that I did not consent to sharing any private information with them, and I wanted the "demo" service (that was active when purchasing a new vehicle) disabled completely because I had purchased the vehicle. They kept telling me that they could not cancel the service unless I provided my personally identifying information.

I offered them an alternative. I told them that I could hang up, and the OnStar would stay in the unlimited "demo" mode where I would continue to get the service for free.

They put me on hold, and when they came back, I was told that their supervisor OK'd the cancellation without me giving them any personal information.

I should have just removed the antenna!

I am glad people like you exist in our world.

How should they handle a fraudulent attempt to cancel someone else's service?

If the service was never set up, then there's nothing to cancel (other than a demo which I assume is easy to turn back on). If the service has already been set up, then they already have your personally identifying information and there is no problem reaffirming who you are.

For what it's worth, I've spent the last week disabling Car-Net on my car. The number of people who told me it's impossible and that it can't be done is a little upsetting. I really wanted to just manually disable it myself, but it seemed like I'd have to risk losing my warranty if I did so.

EDIT: To be clear, when I say disable, I mean it is impossible for Car-Net to contact my car or for my car to send out information wirelessly. I'd guess ~99% of dealers (I honestly don't think that is an exaggeration) have actually never performed this service before for anyone, and the vast majority are not even aware it is possible.

I think I saw this a little differently, the account the user was trying to cancel shouldn't have had any information attached to it anyway. So by OnStar asking for personal identification on an account that (probably) doesn't have any information to begin with seems a bit ridiculous. So to prevent fraud, I can imagine most users who actually use the account already have real information attached to it. So pushing for personal identification before removal makes much more sense in that case.

Similarly I tried to cancel my Car Net subscription and the lady on the phone tried to guilt trip me by saying if I crashed VW wouldn’t do anything to help me.

> I should have just removed the antenna!

You should absolutely find the SIM card and remove it. Just because you "disabled" the service doesn't mean they aren't still sending data back.

Any good tips on how to go about that? Is there an effective Google incantation to search for where it could be in a specific brand/make/model of car?

There’s no SIM card, the OnStar module is a closed box, easiest way is to just unplug the antenna, no permanent damage an easily reversible if you need your car serviced at the dealer.

Were you trying to prevent them from getting your personal info at all? Because, I'd be surprised if GM doesn't share that info with them. I guess you'll know if you get calls or mail trying to sell you the service.

I ask because the last couple cars I've bought (not GM mind you) had XM radio and I never did anything to activate it, yet when the free trial was up they had all my info to initiate a sales call and send mail.

I haven't seen it mentioned, but as a Tesla owner one concern I had was that if I sold my car Tesla might not get around to wiping the information it had on me. Worse there were stories of people selling cars where the new owner was given CC numbers and more of the old owner.

Nice coincidence with the article is I had a 2017 Volt. Great car, hated OnStar. First just trying to make them go away is nearly impossible and GM was doing their best to link even remote start on the app to having an account; it may actually be so but I sold it before the grace period expired.

OnStar is an example of how car makers are expecting to profit off cars once they leave the lot. Go look at the rates OnStar wants and for what. We had more than one update go around where features were going to be stripped from the app without subscription to basic information promised originally was to be moved to a premium category. I can honestly say OnStar was in my top three for reasons for leaving my Volt.

Yes, they can send you driving habit data if you opt in. I have a similar feature with a small blue tooth device for State Farm in my Tesla; connects to my phone and such and scores driving. Going to see what it does over six months. Currently my impression of it is that it thinks I take ever turn too fast; always one star out of five unless I come to full stop. It also will deduct points for going eight miles over speed limits. It rates acceleration, deceleration, turning, speeding, and phone use. On phone use it logs it but does not score for it as it could be a passenger.

You could install your own OS on it: https://www.reddit.com/r/teslamotors/comments/a1fln4/rooted_...

A sale would be an event where you can wipe data or at least have control over the situation. Worst case is a car accident that sends the driver to the hospital where the insurance company claims the car. Now they have a car with your daily routine, your favourite songs, GPS destinations, sensor logfiles, Sentry dashcam footage, crash data, calendar entries, phonebook entries. Probably not something you want your insurance company to have insight in.

I've bought my last two vehicles used-- a 350z and g37 coupe. The 350z came with the previous owner's Home and Work addresses programmed into the GPS.

The g37 came with five different phones paired to it, and it had downloaded the contact info of all of those phones, as per the relevant Bluetooth standard.

Also, I found a registration card belonging to someone from Cupertino behind the glove box while servicing the air filter.

I guess my point is, this stuff happens even with old, dumb cars (the 350z).

Removing OnStar antenna and power was one of the first things I did on my new GM truck. It doesn't require any special tools or knowledge and only takes several minutes. The fact I had to do any of this at all instead of being asked to opt-in to data collection is depressing, but not unexpected in today's data-hungry market.

I’m shocked they didn’t rig it so doing what you did turns the check engine light on or something ridiculous.

Don't give them ideas, please.

I was thinking just halt after 30 minutes, like Intel does if you were to fully remove the Management Engine.

That would fail them in any type approval test anywhere in the world.

Only if they know about it.

It might set a "stored" trouble code already, which won't trigger the engine light (only "active' trouble codes do in most vehicles). Some stored trouble codes are there for the technicians to see which passive systems/sensors are failing or have failed in the past.

>not unexpected in today's data-hungry market.

It's worth noting that this sort of data collection shouldn't be simply driven by the market and what it can get away with.

There's a big gap in US law where collecting data like this for certain uses shouldn't be legal, and there should be laws governing whether or not e.g. an insurance company can access and store data from your car in the event of an accident.

US laws have never been updated for privacy in the computer age simply because the people who have kept themselves in power for that long do not choose to do so.

US Citizens assume that there's a legal safety blanket associated with corporations and what they're allowed to do because for non computer related privacy issues, the laws generally agree with common sense. Corporations can't open other people's mail just because it's laying in the car when they tow it from an accident, that's illegal.

People assume the same is the case with the data they enter into their car computers, and it's completely untrue.

This is the primary reason why I sold my car and went carless the instant that was a feasible thing to do. If I should need to own a car in the future, it will be an older, pre-spying, one.

You're the first person I've met to claim that their aversion to motorized transportation had a basis in privacy.

I'm a londoner and we have here a system of public transport which is controlled by cards ('oyster' cards, RFID credit card sized things - https://en.wikipedia.org/wiki/Oyster_card).

Not exactly to address your point but they're a good way of tracking individuals so I always try to pay anonymously (cash) and never register it. I should probably buy a new one every few months but usually forget.

FYI anyway. Privacy aside it's a pretty decent system.

They can recognize your face as you tap at the turnstile. Maybe they don’t do it now, but if they currently don’t they will in the name of anti-terrorism.

Remember, pedophiles get the train too.

Won't you think of the children?

For a typical workday there are so many datapoints: Checking into the secured bicycle parking, walking through the turnstiles at the exit. Walking into the train station. Walking out of the train station. Walking into the metro station. Walking out of the metro station. Entering the bus. Exiting the bus.

And the opposite way when I go home.

I asked them to delete the entering/exiting data on the secure bicycle parking as it's a free service but they declined as their system couldn't handle manual data removal.

TfL has openly said they track mobile device movements in their network.

I suspect this is literally the only reason there is WiFi available now.

The same system exists for the Dutch public transport (exactly the same cards). Privacy wise you are able to buy an anonymous card with cash. But ... the operators are phasing out machines which are able to accept cash faster than you can find them and they are idiotically expensive if you want to replace them every few weeks as they are tracking you anyways even on the anonymous cards.

Interestingly, in Japan for my short stay there, I found that the Suica card I needed for public transport could only be purchased and recharged with cash.

It’s tough to use TFL anonymously.

You only need to pay once by card for them to link it to you.

You cannot get refunds (e.g. train delay) without registering the card.

I'm the second.

We're certainly a tiny minority, but there's a few of us kicking around. As time goes by, I seem to meet more and more.

So your payment record with Uber or public transport is somehow better? Or you only pay in cash now and only take public transport no planes or trains?

I don't use ride-sharing or public transport. That I occasionally use a cab and fly in no way means that there isn't value in reducing my data leakage in other areas whenever possible.

So what do you do instead? You’re aware that nearly every rideshare app is collecting massive amounts of data right? I’d imagine even many of the larger public transit systems are as well.

I guess I’m just not seeing what you gain? Your movements are very likely still being tracked.

For 90% of my transportation needs, I use a bicycle. For the rest, I take a cab. I'm fully aware that my cab rides are tracked.

> I guess I’m just not seeing what you gain? Your movements are very likely still being tracked.

Sure, but there is still great value in reducing the amount of data leakage when possible. And in this case, the data is going to the car manufacturers and the companies they share with (marketers, etc) -- entities that have no legitimate need for any data at all about me.

Cutting them out plugs a large data leak without causing any inconvenience or hassle to me, so why wouldn't I?

My car knows that I'm going to ride it like it like a horse and never put it out to pasture. My old grey mare, she ain't what she used to be, but she don't ever spy on me.

My 1993 Toyota is looking better by the day :-)

Unless you get into a crash that is.... https://youtu.be/xidhx_f-ouU

Tank of a Land Cruiser should do a bit better

Heavier vehicles make collisions more dangerous for everyone.

That faceplant at 1:58 looks awful.

My carburetor requires 0 data to operate!

Most car makers are global - and sell heavily in European markets, which are covered by the GDPR. So I suspect that for these manufacturers, many brands will be GDPR compliant by default. That said: - Under what principle is data collected (Article 6) - What measures have they put in place to enable access to PI (Article 15) - How consent may be withdrawn (Article 7) - How consent may be obtained when a vehicle is sold (Article 7) - How do they ensure data is protected (Article 25) so that PI access by the subject (under Article 15) is matched to ownership (or registered keeper as the vehicle may be owned by a finance company) of the vehicle

Answers on a postcard please :-)

They have enough volume that there doesn't have to be much money involved per vehicle to make US specific versions.

Of course if a US-spec vehicle is exported to the EU, GDPR then applies to any data collected by that manufacturer from that vehicle.

That liability will be on the importer though, in the same way that making the indicators and emissions systems compliant to EU standards would be

If it sends the data to the manufacturer, they're liable. If they importer are, and the manufacturer doesn't care, they not going to sell any cars.

Having worked at one, they are very careful about being GDPR complaint in every service, even internal. It’s refreshing!

I mean, except Ford and Tesla, none of the American brands are very popular in Europe. I guess this would move affect European and Asian car makers that can collect more data outside of Europe.

Tesla is not popular in Europe. Two orders of magnitude fewer units sold vs the popular brands.

http://carsalesbase.com/european-car-sales-analysis-july-aug...

They are quite popular in Norway (https://elbilstatistikk.no/). But of course, we're only a rather small corner of Europe.

> Electric car sales grew by 90% in July and by 69% in August, while PHEV sales were down 19% in July and down 29% in August.

Tesla is massively supply constrained in Europe. Hence GF4 which could break ground next month.

The new ford hud's/entertainment systems ('19) have quite a lot of "EU only" settings correlated to sending data and EuroNCAP test requirements which are not enabled now but can be if required (I decompiled the programs looking for specific settings). I'm pretty sure most data gathering is off at the moment and you can always remove the connectivity module which also disables remote start and stuff of course. In that case, also do not connect to your phone via WiFi as it will try to connect to the internet though it.

At the moment it only sends your VIN, installed updates and the configuration data and as far as the internet has figured out nothing is done with it, but it is worrying.

You still have to opt in to the FordPass systems though.

Is this info being collected for police cars? That could be useful in litigation.

Could you go in a bit more detail on your thoughts about this—would love more insight

Not OP, and not sure what they had in mind, but police departments “lose” data directly in proportion to how damaging it is to them. It would not be very useful in litigation.

How would car data make any difference

Criminal's lawyer: "Your honor, clearly my client was being chased viciously by that officer, here's the car data saying it was going 65mph"

Judge: "Yes, and as we just saw in the video footage from three news helicopters, your client was travelling even faster than the police chasing him, weaving in and out of traffic, before losing control when his tire blew".

Engine run time, speed, location, engine temps, impact, hard breaking, hard acceleration, this is the type of data that is being collected.

Also I would imagine fleet vehicles, like police cars and taxis, would not include most of this as it increases the costs and complexity of repairs. Fleet vehicles are generally designed to use the same major components as multiple other vehicles/generations and be fairly no-frills features to be the easiest to work on. Major police departments (large cities, state police) generally have their own garages that do all of the work.

If police cars have the same data-collection systems as consumer cars, all phoning home to the GM/Ford mothership, then those police departments won't be able to "lose" data. A company the size of Ford isn't going to cooperate with some puny little police department in Arkansas or wherever in illegally destroying evidence.

it is probably possible to collect that on police cars but I suspect police has access to it, so not very useful

If it exists, the police has access to it, if they have an excuse to

http://archive.md/JOe8F

That site collects detailed information about you via dns.

*.pixel.archive.md

The washington post doesnt ?

So use an internet condom.

Other than your ip, what else does the DNS request provide?

archive.* is an internet gem. It's def on the shortlist for the censors. I suspect we will be hearing more about it soon. ahum re Skippy's friends.

My wife drives a 2017 Volt. I considered disconnecting the OnStar antenna, but I like the monthly report that's emailed to me which provides oil life, energy usage (electric vs gas miles), and tire pressure. I also like that I'll get an email alert if tire pressure is low. There's also this:

https://www.voltstats.net/

https://ibb.co/WHxpm5P

> With paid OnStar service, I could, on demand, locate the car’s exact location.

I haven't paid for OnStar but I can use the "locate vehicle" feature. I vaguely recall that "basic OnStar" is included for 5 years? The myChevrolet app can also be used as a keyfob in a pinch.

We are not signed up for Smart Driver.

Privacy vs functionality is a trade-off. The bigger issue here is that you can't download your data directly from the car, that OnStar is opt-out instead of opt-in, and that you can't fully opt-out w/o physically disconnecting the antenna.

The article states GM has 11M, 4G enabled vehicles, does this imply it's actively tracking these vehicles? Doesn't this also imply you don't have to be paying for any type of service/connectivity on your end and GM can be paying for the connectivity on theirs and be extracting data unbeknownst to the driver?

> Doesn't this also imply you don't have to be paying for any type of service/connectivity on your end and GM can be paying for the connectivity on theirs and be extracting data unbeknownst to the driver?

You can always press the OnStar bouton and it will works, whether you are subscribed or not. That means that it's always connected. What data is does send though, that's a big mystery for sure, but at the bare minimum they know which 4G antenna you are connected to.

Since everyone's phone is tracked 24/7/365, what does it matter if you're in a car or not?

If you are confident in the privacy commitment of your phone manufacturer, then that is not as much a concern. I don’t have any trust in any car company, and none of them seem to care.

>Well, apparently AT&T, Sprint, and T-Mobile all sell data—including geographic locations associated with customer phone numbers—to a variety of sketchy third-party companies.

Source: https://www.howtogeek.com/402043/can-anyone-really-track-my-...

You might trust Apple, but do you trust your carrier?

My cell is not registered in my name and I can take the battery out. I often do any time I am not on call.

Out of curiosity what model do you use? The last phone I had with the capability to do so was an s4.

Samsung $12 pay-as-you-go phone from Walmart. They don't have that model in the store any more, but there is a similar one for $29.

The ultra-high-end LG V10 and V20 phones have this too. However, the V30 and V40 went to non-replaceable batteries. Also, the Galaxy S5 had it too, but the S6 and latter did not.

Is there similar research or concern about SiriusXM?

Isn't satellite radio a receive-only system?

The satellite radio you have now is a receive-only system, but SXM is heavily investing in the telematics market as well. Soon it won't be.

The more I hear about how computers are taking over the car market, the more I appreciate my "App" free Honda Fit from 2013.

My 2015 Mazda 3 doesn't have any of this stuff either. It does have the terrible XM radio, but that's optional and is receive-only.

There needs to be a way to counteract this.

You can disable OnStar. For the other stuff I'm not sure. Maybe a custom ECU or infotainment flash. New startup? :)

Here's the story without a forced sign up/paywall: https://driving.ca/chevrolet/volt/auto-news/news/what-does-y...

> Doug also (twice) sent GM a formal request under a 2003 California data law to ask who the company shared his information with. He got no reply.

I wonder if they are planning to follow up on this? If there's a law in place, GM shouldn't be able to get away with simply ignoring requests.

Luckily for us consumers, at least in the EU we now have GDPR, which you definitely can not ignore.

I wonder if he could just ship an american car with onstar to the EU and start requesting the information using GDPR.

The more important thing is what we consent to, during regular maintenance. Can they just suck up all the data and sell it to the highest bidder, or to law enforcement? I sign a multi page agreement every visit, and have never read it's fine print

It is important to read even though they harry you to sign: I caught my dealer sneaking in a clause on the checkout papers that one had to initial to deny during a maintenance trip - it gave them rights to contact me for sales calls; I had been wondering why they had been bugging me on the phone so much recently and realized it was because I had not caught on to this clause in previous trips. The service advisor had bounced over it when trying to get me to sign the checkout papers but nodded glumly when he saw I had initialed it. I used to think the "stealership" label was harsh for dealerships but I can see why it is tempting to apply it.

It doesn't strike me as ridiculous that a car's nav would keep track of where you've been.

It collects 25gb of information an hour and beams it back to the car marker. So a bit more that just your location.

If there were really 25GB of data going back to GM, I can't imagine what their wireless contract costs are like.

not all data needs to flow back and compression still exists

Sure, but data that doesn't flow back isn't much use to anyone, nor much of a danger to the consumer, and no amount of compression is going to make 25GB of raw data per hour per car for 100M cars anything other than very, very expensive. They probably send very little data.

This is seriously scary, how easy it is to make disinformation. The article never mentions beaming all this data to the car maker. In which world could you believe that GM could make enough from the data to pay to transfer that much data?

The fact is, they simply don't know what the data GM receive is, they only mentions what the computer store (and what it could potentially store).

This is the world we live in, an article about what data a computer store make everyone believe all this data is send to someone else.

> The article never mentions beaming all this data to the car maker

you are correct, we do not know how much of the data is beamed back

> The fact is, they simply don't know what the data GM receive is

We know they send things like "braking and turning styles" which they will helpfully send to your insurance company if you want :)

> In which world could you believe that GM could make enough from the data to pay to transfer that much data?

The one we live in. You don't pay developers to log, transmit, and store data for funsies.

Reply on news.ycombinator.com