How car telematics helped catch a murderer

[SilverSolder]

Ford, GM, Chrysler, and other OEM's are working and have been actively working on selling this information for more than a decade.  Ford has been selling this data from all of their SYNC enabled cars all over the place, State Farm is a big buyer.  They are currently engaged in a large scale project to further parse and monetize this information.

IMHO, this site needs a section dedicated specifically to this type of hack.  I've been through my SYNC system out of some boredom.  It's collecting... Everything... Including pictures from the front mounted camera.

FYI to connect to it you need to connect a rather generic USB-to-ethernet adapter to the USB port.  From there... You can figure it out ;-)

How does the data get uploaded to the mother ship?

[sokoloff]

Regarding diminishing returns, sure, why not indefinitely? That kind of data volume is dirt cheap to store. One instance where it proves useful to have the data justifies years worth of storage for thousands of individuals.

The "cost" to store the data is most properly measured in terms of the owner's and driver's privacy, not in the AWS S3/Glacier bill.

[angrybird]

Ford, GM, Chrysler, and other OEM's are working and have been actively working on selling this information for more than a decade.  Ford has been selling this data from all of their SYNC enabled cars all over the place, State Farm is a big buyer.  They are currently engaged in a large scale project to further parse and monetize this information.

IMHO, this site needs a section dedicated specifically to this type of hack.  I've been through my SYNC system out of some boredom.  It's collecting... Everything... Including pictures from the front mounted camera.

FYI to connect to it you need to connect a rather generic USB-to-ethernet adapter to the USB port.  From there... You can figure it out ;-)

Via the integrated LTE/GSM module

How does the data get uploaded to the mother ship?

[SilverSolder]

Ford, GM, Chrysler, and other OEM's are working and have been actively working on selling this information for more than a decade.  Ford has been selling this data from all of their SYNC enabled cars all over the place, State Farm is a big buyer.  They are currently engaged in a large scale project to further parse and monetize this information.

IMHO, this site needs a section dedicated specifically to this type of hack.  I've been through my SYNC system out of some boredom.  It's collecting... Everything... Including pictures from the front mounted camera.

FYI to connect to it you need to connect a rather generic USB-to-ethernet adapter to the USB port.  From there... You can figure it out ;-)

How does the data get uploaded to the mother ship?

Via the integrated LTE/GSM module

OK so there is a way to silence it...

[Mr. Scram]

Sure.

No. Proper data analysis (both in scope and fairness) is the protection the system should provide.

Your example of why you shouldn't talk to police is valid in a world where there is no such data collection and police are motivated to "solve" crimes and close cases, even at the cost of prosecuting the innocent, however, in a scenario where there is global, all encompassing data collection, assuming you are innocent, data collection will more likely help to prove your innocence, or even stop that line of investigation before the law enforcement approaches you, and if they do come for you, just tell them you were asleep in your bed, and your IoT, iBed 3000 will happily print out your sleep schedule, hearth beat and blood pressure charts for the night in question, corroborated by the TurboChill smart fridge that logged you opening the door for 67 seconds and picking up the slightly expired orange juice, prompting you to buy new juice, which you agreed to by scanning your fingerprint, just as the murder was happening 20 city blocks away. Also, you were filmed drinking the juice straight from the carton, by your toaster.
It would also help finding the real perpetrator before innocent people are accused of the crime.

Thinking collected data will set you free is a rather optimistic approach even when assuming a developed nation with properly functioning authorities. Reality shows us that it's much more likely to implicate you than that it sets you free for the same reason statements to the police are unlikely to set you free. The more data there is, the bigger the chance there's something to tie you to whatever is being looked at. You have to remember that like in the video posted the police isn't working to exonerate you. You also presume you have access to the data that will show you're innocent. There's large incentive to dig deep and get warrants for data that implicates people but there's much less of an incentive to dig as deep to prove you're innocent when they think they already have something on you. If you were dependent on tracking data from your car you may have gotten it had you know about it, but a lot of the time companies are under no obligation to provide data to you and you won't even have a clue it exists in the first place. That's before we even take into account that the justice system isn't perfect and sometimes just flat out broken.

Another mistake is to presume you're innocent. None of us is. Research shows the average citizen commits multiple felonies a day. Many jurisdictions can't even tell you how many laws exist within their borders so there's no hope of knowing and adhering to them all even if you tried. This didn't use to be a problem as most of these aren't causing real issues and there wasn't any evidence of it anyway. Rampant data collection means you can be prosecuted at will. This unfortunately has been proven to not just be a theoretical issue either, see the following link.

https://mises.org/library/decriminalize-average-man

[Mr. Scram]

OK so there is a way to silence it...

As far as I know it's so intertwined with the other electronics that's very hard to do.

[SiliconWizard]

Another mistake is to presume you're innocent. None of us is. Research shows the average citizen commits multiple felonies a day. Many jurisdictions can't even tell you how many laws exist within their borders so there's no hope of knowing and adhering to them all even if you tried. This didn't use to be a problem as most of these aren't causing real issues and there wasn't any evidence of it anyway. Rampant data collection means you can be prosecuted at will. This unfortunately has been proven to not just be a theoretical issue either, see the following link.

https://mises.org/library/decriminalize-average-man

Yup.

Anyway. Any sane and free society shouldn't even think of that. Again, that's a patent violation of privacy which should be a guaranteed basic right. It doesn't matter whether this is all made for the greater good: this kind of approach is exactly that of all totalitarian regimes.

It's funny how almost everyone screams when they hear about mass surveillance in China, yet most of us just ignore it when we do the exact same, just because, you know, we are different right?
At least China's government is not hiding it.

One good thing at least in the EU (there must be one ) is that privacy is still relatively protected. And I doubt this kind of systematic data collection from cars' vendors is allowed in the EU. Does anyone know more about this?

Edit: sorry I seem to have forgotten that the UK once was in the EU.
So I wonder how all this can be compliant with the EU directives. I'm curious.

[rdl]

Not taking the time to dig into it, but I think some sort of agreement must be signed before it's legal. Now, maybe if the vehicle is being leased they can hide this in the fine print, but seems that if you were buying the vehicle outright it would have to be separate, and therefore much more obvious.

[langwadt]

Another mistake is to presume you're innocent. None of us is. Research shows the average citizen commits multiple felonies a day. Many jurisdictions can't even tell you how many laws exist within their borders so there's no hope of knowing and adhering to them all even if you tried. This didn't use to be a problem as most of these aren't causing real issues and there wasn't any evidence of it anyway. Rampant data collection means you can be prosecuted at will. This unfortunately has been proven to not just be a theoretical issue either, see the following link.

https://mises.org/library/decriminalize-average-man

Yup.

Anyway. Any sane and free society shouldn't even think of that. Again, that's a patent violation of privacy which should be a guaranteed basic right. It doesn't matter whether this is all made for the greater good: this kind of approach is exactly that of all totalitarian regimes.

It's funny how almost everyone screams when they hear about mass surveillance in China, yet most of us just ignore it when we do the exact same, just because, you know, we are different right?
At least China's government is not hiding it.

One good thing at least in the EU (there must be one ) is that privacy is still relatively protected. And I doubt this kind of systematic data collection from cars' vendors is allowed in the EU. Does anyone know more about this?

Edit: sorry I seem to have forgotten that the UK once was in the EU.
So I wonder how all this can be compliant with the EU directives. I'm curious.

cell phone companies store the same info all the time and give it to law enforcement when (properly) requested.
cell phone data has been used as evidence in many cases, and so has a suspects phone conveniently being off the
time of a crime

[SiliconWizard]

Which doesn't answer my question really.

I invite people to read this: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
(and of course the directive itself)
and see how compliant those companies possibly are point by point. My guess is: probably not very. Not that people seem to care apparently anyway.

[angrybird]

Ford, GM, Chrysler, and other OEM's are working and have been actively working on selling this information for more than a decade.  Ford has been selling this data from all of their SYNC enabled cars all over the place, State Farm is a big buyer.  They are currently engaged in a large scale project to further parse and monetize this information.

IMHO, this site needs a section dedicated specifically to this type of hack.  I've been through my SYNC system out of some boredom.  It's collecting... Everything... Including pictures from the front mounted camera.

FYI to connect to it you need to connect a rather generic USB-to-ethernet adapter to the USB port.  From there... You can figure it out ;-)

How does the data get uploaded to the mother ship?

Via the integrated LTE/GSM module

OK so there is a way to silence it...

For now, with architectures up to 2020-ish, I believe there still is, however you will likely "void" your warranty (or at least disqualify yourself from warranty-covered dealer service calls until you allow the updates) as the vehicles now depend on this network connection for software updates to various systems.  No one writes good software anymore and the OEM's aren't immune from this phenomena.  The "we can fix it later as long as it's not a big safety issue" mentality is strengthened by this ability to push updates to the vehicle later.

[JPortici]

Ford, GM, Chrysler, and other OEM's are working and have been actively working on selling this information for more than a decade.  Ford has been selling this data from all of their SYNC enabled cars all over the place, State Farm is a big buyer.  They are currently engaged in a large scale project to further parse and monetize this information.

IMHO, this site needs a section dedicated specifically to this type of hack.  I've been through my SYNC system out of some boredom.  It's collecting... Everything... Including pictures from the front mounted camera.

FYI to connect to it you need to connect a rather generic USB-to-ethernet adapter to the USB port.  From there... You can figure it out ;-)

How does the data get uploaded to the mother ship?

Via the integrated LTE/GSM module

OK so there is a way to silence it...

Also every time you go to the dealer or any other "authorized" mechanic

[angrybird]

Not taking the time to dig into it, but I think some sort of agreement must be signed before it's legal. Now, maybe if the vehicle is being leased they can hide this in the fine print, but seems that if you were buying the vehicle outright it would have to be separate, and therefore much more obvious.

Trust me when I tell you that car manufacturers have been selling this data without your direct consent since the inception of these systems, they get around rules because the data is "anonymized".... Companies ARE using this data, as an example State Farm IS setting some drivers' insurance rates based on some of this information and no one is supposed to know this.  I have independently proven this on multiple SYNC capable vehicles manufactured in 2012-2014 model year.  I believe American manufacturers are the most guilty of this.  At this very moment, Ford is making a large effort right to further process and package this data in an attempt to generate more revenue from it (as they are in a sort of panic mode due to their financial situation).

We live in a world where the companies known as "data brokers" are allowed to vacuum up all of our information from utility companies, cellullar phone companies, internet providers, car manufacturers, credit card companies, and this list goes on forever.  The data is more or less "anonymized" but with a bit of creative software, you can link all of a person's data together, package it as "person X" and sell it, with the understanding of "psssst... everything is here to figure out exactly who this person is and target them with ads, set their insurance rates, sell it to someone else, etc".

It's a crime against humanity, and everyone ignores it because they would rather be entertained than care, and they won't care until it is too late (IMHO it already is).

[JPortici]

I don't see how the car companies or insurance companies or anyone else has a right to this kind of information by default. Surely the owner of the vehicle has to authorize it first, otherwise how could it even be legal?

Yep, you do. If you don't read contracts before you sign, you can only blame yourself.

It's funny, though. I never ever remember signing anything other than the papers for ownership when i bought my (second hand) car.
Then i did read and sign the contract for my insurance and didn't find anything about data collection from the vehichle.
I did, howeve,r for when i installed the black box (different contract form), but that's the whole point

[rdl]

To do list:

Buy a new car.
Buy an old car.

[tom66]

Trust me when I tell you that car manufacturers have been selling this data without your direct consent since the inception of these systems, they get around rules because the data is "anonymized".... Companies ARE using this data, as an example State Farm IS setting some drivers' insurance rates based on some of this information and no one is supposed to know this.  I have independently proven this on multiple SYNC capable vehicles manufactured in 2012-2014 model year.

I would be interested to see your research on this.

[G7PSK]

[/quote]

OK so there is a way to silence it...
[/quote]

Wrap the cars antennae in tin foil bonded to the rest of the car might stop it, would not be surprised if it also stopped the car when it failed to report back to the manufacturers.

[Mr. Scram]

OK so there is a way to silence it...

Wrap the cars antennae in tin foil bonded to the rest of the car might stop it, would not be surprised if it also stopped the car when it failed to report back to the manufacturers.

I don't think these are conveniently placed antennas which are accessible to wrap.

[SilverSolder]

OK so there is a way to silence it...

Wrap the cars antennae in tin foil bonded to the rest of the car might stop it, would not be surprised if it also stopped the car when it failed to report back to the manufacturers.

I don't think these are conveniently placed antennas which are accessible to wrap.

Where there's a will, there's a way...

I don't foresee ever wanting to own a car that would "squeal" on my sometimes very enthusiastic driving on empty roads!   

[angrybird]

Your phone is already doing it.  With GPSDO in every cell tower, continuous multilateration is performed and your phone's geographical location logged in perpetuity every time it pings the tower.  This has been going on for nearly 20 years and based on police radio traffic I hear, and while it was not very accurate in the 2000's, they are now able to locate to under 50m radius without GPS due to the density of cell towers and increased accuracy from the new trimble GPSDO they use.  911 dispatchers in the USA hand this information out to officers constantly upon request, over the radio, no warrant required.

[G7PSK]

OK so there is a way to silence it...

Wrap the cars antennae in tin foil bonded to the rest of the car might stop it, would not be surprised if it also stopped the car when it failed to report back to the manufacturers.

I don't think these are conveniently placed antennas which are accessible to wrap.

Certainly on some cars they use the one antenna point very often they look a bit like a sharks fin on the roof. Would not be much point burying it under the hood.

[angrybird]

The antennas generally are multi-purpose, also serving your navigation and sattelite radio, so covering the antenna may not be idea.  However, there are usually multiple coax coming away from there, and they route to the appropriate modules, and can likely be disconnected there.  It varies widely between manufacturers and generation.  The antennas are powered and there is usually an antenna protector device in the module which supplies power to the antenna (bias T).  These use a part which is current limited and also can have open and short circuit detection so disconnecting the antenna can give you more than just a "no signal" error.

In current architectures we are reaching the point where it is so thoroughly integrated with the vehicle that it's not possible to disable it without significant inconvenience, or worse.  For the last 10-15 years, the telematics/infotainment module has been the home for the most powerful microprocessor in the vehicle, and this caused more and more functionality to be pulled into this module.

I'm surprised that there is not more hacking done of these modules.  On many of the newer vehicles there are options you can unlock - Such as bluetooth - That the OEM wants you to pay for much like the scope options people are hacking on here.

It would be great to see some people put their passion into thoroughly analyzing and publicly documenting these architectures.  Most people "in the know" are under perpetual NDA (or worse) and really can't talk about specifics at all and can only make general statements. 

Every infotainment system has various test modes/systemaccess method present, either used for diagnosis when a module is sent back to the factory, or remaining from the development phase.  A majority are running some flavor of linux.  Access is generally via a USB port on the module (that is not connected to a harness like the other USB port(s) in the vehicle), or through one of the USB ports in the vehicle (if there are multiple, generally only one can be used to access the system), or through a USB to Ethernet adaptor.  Or any/all of the above.  Some have secret keypress combinations to open up a port or boot the infotainment system in a way that enables access but I'm sure people can figure it out.  Would love to see it.

[amyk]

To do list:

Buy a new car.
Buy an old car.

If you were ever surprised how much people will pay for restored or even "good condition" vintage cars... I predict there will be even more interest in them in the future.

[angrybird]

To do list:

Buy a new car.
Buy an old car.

If you were ever surprised how much people will pay for restored or even "good condition" vintage cars... I predict there will be even more interest in them in the future.

This is certainly true, and for more reasons than just this tracking stuff.  Anything made after the late 2000's is subject to the incrementally higher EPA restrictions and due to engineering, labor, etc cost combined with this restriction, the only way to make vehicles profitable was to make them disposable.  So, we get slightly better fuel economy, but now the car is filled with more plastic, very thin steel that rapidly rusts, significant reduction in durability of every component including critical suspension and drivetrain components and it all ends up in the landfill much sooner than those terrible old cars that got slightly lower overall fuel economy for comparable size and load capacity.  People are becoming wise to this and buying older cars.  The time to buy is now, I plan to fill a barn I have in the states with a good number of similar cars which can be driven and/or cannibalized for parts for the car being driven.  A personal junkyard, if you will.

[G7PSK]

To do list:

Buy a new car.
Buy an old car.

If you were ever surprised how much people will pay for restored or even "good condition" vintage cars... I predict there will be even more interest in them in the future.

A ten year old Land Rover now costs more than a brand new Suzuki jimny here in the UK.