Rental Cars Can Steal Phone Data Like Contacts and Text Messages (privacy infosec threat)

Fortune ^ | 09/01/2016 | Jeff John Roberts

[MarchonDC09122009]

Rental Cars Can Steal Phone Data Like Contacts and Text Messages

http://fortune.com/2016/09/01/rental-cars-data-theft/

Tech Internet of Things Watch Out That Your Rental Car Doesn't Steal Your Phone Data

By: Jeff John Roberts

September 1, 2016, 10:51 AM 

Watch out how you connect to cars.

Here’s something to think about the next time you plug your phone into a rental car: The vehicle may be slurping up and recording all sorts of data, including your location, personal contacts, and even your text messages and web browsing.

That warning comes via a Federal Trade Commission blog post this week, which highlights a downside of so-called “connected cars.” The gist of it is that, today, a strange car is just like a strange computer, and consumers should be careful how them connect to them.

A blog post written by an FTC staff attorney describes how rental cars can not only access and record your cell phone data, but hold on to it for an indefinite period. The risk is obvious.

“Unless you delete that data before you return the car, other people may view it, including future renters and rental car employees or even hackers,” explains the post.

To reduce the risk, the FTC recommends consumers avoid using rentals cars’ USB ports to charge their phones, and rely on the cigarette lighter as a charging device instead. But while this is a nice suggestion, it may not be very practical because some cars don’t have a lighter port. Furthermore, many people don’t own the necessary adapter—meaning it’s much more likely they will just use their phone charger to plug into the USB port.

The FTC also recommends checking out the permissions setting on a car’s infotainment system, and granting access only to your phone’s music but not its contact list. The agency also recommends deleting any data from the system before returning the rental car.

The latter ideas are good ones but still beg the question: Why can rental cars collect such information in the first place? If there was ever a case for lawmakers to mandate privacy-by-design, this seems like an obvious case: Congress or state attorneys general should simply forbid car rental agencies (or the phone carriers they partner with) from collecting phone data in the first place.

I reached out to the FTC to get more information about who exactly is collecting this day and why. I’ll update with more details if I hear back.

This new concern over data theft comes as the auto industry frets over other connected car vulnerabilities, including hackers taking control of vehicles.

[discostu]

There’s no failure to warn. It’s a failure of people to bother to think through what they’re doing. It’s the problem of a largely non-technical populace surrounding themselves with high tech objects they have no idea how they work. They told the car to talk to the phone, and vice versa, and somewhere in that manual they didn’t bother to read it says that during that conversation the car will download a bunch of data for smoother operation. It also says how to delete that data, but they didn’t bother to read that either. Now they leave a bunch of data behind, and they insist it’s somebody elses’ fault.

There’s 4 simple letters that have been able to solve this problem for decades. But nobody bothers:
R
T
F
M

[zeebee]

It links to your contacts but only when the phone is there. It will display “Zeebee’s Phone” for the next customer if I don’t delete it, but that next person cannot get to my data.

So as I understand it, it links to your phones data when connected, but doesn’t download and store it.

I think this is a bogus scare.

[RikaStrom]

ping

[eyeamok]

somewhere in that manual they didn’t bother to read it says that during that conversation the car will download a bunch of data for smoother operation. It also says how to delete that data, but they didn’t bother to read that either.

Only if it can be demonstrated to actually say that, but there are Thousands of CIVIL Tort Cases that have been won for an OBSCURE FAILURE TO WARN, that Nobody would ever find or read.

I agree with to a certain extent, but a Good Lawyer would take apart their case in a few short minutes.

[discostu]

It does. Also keep in mind the cars are designed with owners not renters in mind. The vast majority of the time nobody is going to be bothered by the fact that THEIR car is storing their data. It’s only when it’s NOT their car that it becomes a problem. And truth be told it wouldn’t even need to be in the manual if people bothered to actually understand a little bit about their technology and think it through. Everybody who actually works with technology reads this article and says “well yeah, of course the car still has the data on it, how did you think this worked”. The problem really is that most people didn’t bother to think.

[Faith65]

Bkmk

[MarchonDC09122009]

Wrong.

1. The rental car Co software does not expressedly present informed consent as to what and why personal device data is uploaded.

2. Most people don’t think of personal device data exfiltration by connecting to a car stereo to play tunes, or safely make hands free phone calls.

3. Also, it isn’t just bluetooth connection where data upload occurs.
The car’s USB port is also a problem, since individuals may use that to conveniently charge their phone and now couples their device to the rental car’s entertainment system software.

RE: “The headline is amisleading. The rental car doesn’t “steal” phone data. If you like your phone to the rental car’s system, it copies it. Solution — don’t link your phone to the rental car’s system.”

[buckalfa]

But, but real men don’t read manuals or ask for directions.

[TexasGator]

It’s not hacking