Slashdot Mirror
FTC Warns Consumers: Don't Sync To Your Rental Car! (securityledger.com)
Slashdot reader chicksdaddy quotes an article from Security Ledger:
The Federal Trade Commission is warning consumers to beware of new 'connected car' features that allow rental car customers to connect their mobile phone or other devices to in-vehicle infotainment systems. "If you connect a mobile device, the car may also keep your mobile phone number, call and message logs, or even contacts and text messages," the FTC said in an advisory released on Tuesday. "Unless you delete that data before you return the car, other people may view it, including future renters and rental car employees or even hackers."
The Commission is advising renters to avoid syncing their mobile phones to their rental car, or to power devices via a USB port, where settings on your device may allow automatic syncing of data. Consumers who do connect their device should scrutinize any requests for permissions.
Security researchers have also discovered another car-related vulnerability. The software connecting smartphones to in-vehicle "infotainment" systems could also make cars vulnerable to remote attacks.
The Commission is advising renters to avoid syncing their mobile phones to their rental car, or to power devices via a USB port, where settings on your device may allow automatic syncing of data. Consumers who do connect their device should scrutinize any requests for permissions.
Security researchers have also discovered another car-related vulnerability. The software connecting smartphones to in-vehicle "infotainment" systems could also make cars vulnerable to remote attacks.
Don't sync your devices to untrusted devices. Same as don't stick an unknown usb drive into your computer.
Though this warning is useful since most normal users may not be aware of the security risk. The ignorance of security is the same ignorance that will cause people to ignore this warning, naturally.
I'm a good cook. I'm a fantastic eater. - Steven Brust
You nerds are getting what you deserve, with your desire to put electronics and computers in everything. Poetic justice, I must say.
Most vehicles have the option to not sync your contacts, but still connect via Bluetooth for hands free driving.
If you do sync your contacts, there is normally a fairly easy way to remove the data. I would hope that the rental company would reset the system in part of their cleanup/inspection after return, however.
The cigarette lighter to usb adapters are cheap. They work for charging. If you need more than the built in speakerphone, you could bring something like a visor clip bluetooth speaker and microphone. That too could be charged from a second port on the cigarette lighter adapter.
In general though you have to regard a rental cars systems as potentially compromised. It would be like buying a used computer and trusted the OS load on it not to be full of malware.. Well it is perhaps not that bad yet, but give it time...
This has been the case for years. Did someone just wake up and realize this is happening? Oh wait, the government. iDarwin...this is not survival of the dumbest. Let their data be mined, just like all the Pokemon Go sheep.
This isn't your data to begin with. Information stored about you (such as texts, phone numbers, call logs) are bits on a storage device owned by the service provider.
All this NSA / Snowden leak info should tell people they don't own the data that is about them. If you connect to a rental car, all your doing is syncing one company's data with another, none of which is yours.
Even if I did share my contact list or SMS messages with the car, what are rental car clerks going to do with my contacts or a text message from my sister that reads "When are you going to be here?"?
Thousands of car rental employees mining car entertainment systems for data seems like an awfully inefficient way for hackers to harvest data when it's far easier to do the same thing by releasing a trojan horse app to collect the data.
Captain's log – stardate 3352.4
Due to a transporter malfunction, we have been stranded on the surface of Earth in the year 2016. We have been unable to find means to return and have learned to survive by following the cultural phenomena known as ComicCon.
Everybody tracks everyone, everybody keeps all the information they can get, the most trivial of interactions leave consumers vulnerable, and the FTC warns consumers, who are not even theoretically in full control of their devices, not to charge their phones in a rental car? I say charge all you want and SUE THE FUCKERS who sniff your data and the greedy arseholes who built your phone. If they wanna be root on your devices, they better be held responsible.
If I were to purchase a new car (something I would never do because it is a waste of money) I would ask them to tear out all the "connected" garbage. Aftermarket sounds systems are always better anyway.
a car was just a car...
a phone was just a phone...
a television was just a television...
So I suppose that you should wipe all data from your own car when you take it in for servicing. This might keep the mechanics and other service personal from accessing your phone records, trip logs and so forth, although the car company itself probably has all of that info already from over the air.
If millenials cared about their privacy, they wouldn't post each and every minute detail of their private lives on Facebook or Instagram.
A wise man once said that democracy is thyrany of the cluless masses over the thinking minority.
"Unless you delete that data before you return the car, other people may view it, including hackers, rental car employees or even future renters."
There, fixed that. It would be fun to see this in Mr. Robot, the least (but not without) face-palming I have ever had to do when it comes to the fictional portrayal of "hackers".
Brought to you by Carl's Junior.
With Apple removing the 3.5mm plug from the iPhone 7, this is yet another inconvenience for any potential buyer, as bluetooth streaming OR remembering to bring YET ANOTHER adapter are the only options.
Apple HATES people who travel, or they really don't care for them very much as customers.
Either way, it's a middle finger to consumer options.
I bought a used car and it still had previous owners numbers in it. Don't expect the dealer to do it, they basically wash em and detail em and push out on the lot these days. But if your using a rental car the ability to know how the erase all that data can be confusing. Not likely something people think about very much, but obviously should. Reminds me of a rather significant figure on how many notebooks go lost in airports. I mean, how do you forget your notebook? Or smartphone for that matter? Of course parents leave kids in hot cars to die, so what do I know. Maybe humans are getting dumber by the day.
The FTC warned drooling morons that by leaving lists of their private information in a public place, other people could read i the information.
The FTC failed to also warn the drooling morons about GPS location histories in rental cars, giving subsequent renters a detailed list of your travel destinations.
Truth be told though, the omission is probably a moot point anyway, as no one sees or pays any attention to the FTC's announcements. This is most especially true for drooling morons.
Have gnu, will travel.
Lots of techies forget that 99% of the population does not care about the how it works when it comes to technology -- they care about whether it works and is easy to figure out. Phone operating systems don't even have the concept of user-accessible storage and filesystems. Of course it's all there under the hood, but it's abstracted away. All data is stored in an app-specific data store in the cloud as far as users are concerned.
Warnings like this and the "check what's in the address bar before you hand over your password" type of message need to be given. Few will listen, but putting it out there doesn't hurt. We now have what was asked for in the past -- end user systems that have almost no complexity and learning curve. It makes sense that newer generations growing up with this aren't used to files, filesystems, the concept of stored data and so on.
This is silly. Every rental/loaner I've ever had has already five phones paired. I delete everything, and pair mine. When the car goes back I make sure I"ve deleted my profile as well. If you can read slashdot, you can figure this out, be it iDrive, Sync, CUE or AcuraLink. I'd be more concerned with leaving addresses in the satnav...but I blank those too.
WTF?
So "hackers" is the new "criminals who use some kind of technology"? Or just "who use stuff I don't have no clue whatsoever but insist in using regardless?"
Seriously, I really, really, really wish you could kill people with a computer remotely. Only then we have at least a minimal chance to get people to actually know what they're doing with their boxes, and some idiots wouldn't be allowed near one because they'd endanger themselves and others.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.