We know where your car is parked

Summary

Michael Kreil and Flüpke show how movement data from 800,000 electric cars, including owner information, was accessible without protection and revealed sensitive routines. The two of them gave the talk together. The exposed data concerned around 800,000 electric cars.

Ideas

• Vehicle telemetry maps homes, workplaces, journeys and personal routines.
• Contact information links pseudonymous vehicle data back to real people.
• An open cloud storage bucket can undermine strong vehicle security outside the car.
• Central data collection multiplies the damage of a single misconfiguration.
• Government and company vehicles reveal structures far beyond individual owners.
• An unclear purpose of collection prevents informed decisions by those affected.

Insights

• Connected vehicles are permanently moving sensors with a revealing trail of people’s lives.
• Data minimisation reduces damage that access controls can never prevent completely.
• Cloud boundaries are part of the security model of every physical product.

Quotes

• Bewegungsdaten von 800.000 E-Autos sowie Kontaktinformationen zu den Besitzern standen ungeschützt im Netz. (“Movement data of 800,000 electric cars and contact information of their owners were openly accessible on the internet.”) – talk description

Habits

• The speakers examine large data sets for structural consequences while protecting identifiable people.

References

• CCC: Wir wissen wo dein Auto steht (We know where your car is parked)
• Volkswagen and Cariad: manufacturer and software context of the data.
• 38C3: Illegal Instructions (the event of the talk).

Critique

• The stage version condenses numerous affected people and data relationships into selected examples.
• The talk does not explain every internal cause and responsibility of the cloud operation.

Remarks

• The talk is one of the most watched recent recordings on media.ccc.de.
• The publication preserves more privacy than the data set it examined.

Recommendations

• Collect precise location data only with a documented purpose and short retention.
• Regularly test cloud storage from the perspective of unauthenticated third parties.
• Separate identity, telemetry and location data technically and organisationally.

Watch the talk →

Search the Web Archive

Links to the original source and the Web Archive open in a new tab.