Data privacy of connected cars: Which data are stored and how to protect your self?
By: Ahmed Amine Gargoura
Tags: Data Storage, Security, Automotive, Privacy, Connected Cars

The future of the automotive industry is digital; Vehicles are becoming computers with advanced and smart capabilities that will pave the way to the creation of a fully autonomous vehicles (AVs). To reach this higher level we need to connect, gather and process data of every actor in our ecosystem. And here comes the topic of data privacy.

Our ecosystem includes physical and no-physical parties, starting from car owners, Automakers, Intelligent Transport Systems (ITS), Telematics (e.g. telecommunication operators, satellites), Assurance companies until Service Providers, IoT and Cloud-Based Software Solutions.

The vehicle needs to be connected and communicates different type of data and information. This network connection is intended to facilitate the operation of vehicles by their owners and to ameliorate the driving experience through the provision of In-Vehicle Infotainment system (IVI), while intelligent driver assistance systems like Night Vision , Lane Departure Warning, Blind-Spot Detection etc.. are intended to improve safety levels.

At this point, it is important to distinguish between essential data to the functioning of the car and data being gathered for other purposes like Data analysis, commercial reasons or even for malicious use and spying. This rise the need to implement much higher standards in data privacy.

Many security researchers have been calling to pay attention to these problems for several years, but there are also some considerable privacy problems that come with driving a modern smart vehicle. The privacy implications of modern/connected vehicles collecting and storing different kind of data have not been exposed much publicly. Much of the concern around these amazing vehicles has been centered on safety as it is vulnerable to potential remote attacks, especially long-range attacks and neglected somehow about physical access attacks. However, all data downloaded to your car would be available to any attacker who decided to dig for it.

Through a personal experience using cars from a famous Car-Sharing service. Where I was about to synch my phone via Bluetooth to play my songs list. I have found names of previous users in the old synched devices on the infotainment displayer and this prove that even after disconnecting the phone, where many confidential information are being stored persistently on the infotainment unit. Any attacker could later retrieve this data using the USB ports.

Actually, this has already been done by two researchers, where they developed a script that can be loaded into an USB stick and then connected it to the car’s USB port. They were able to retrieve data of the synced devices and even able to send the car’s current location to a remote machine.

The data that stays even after you disconnect your phone are call history, contacts, text messages, email messages, and even directory listings. We could also mention that the smart connected vehicles could store and collect much more data about you, such as driving mode, Personally Identifiable Information (PII), driving profile, number of passenger, the music you listen to… This is too much confidential information.

The situation on which we need to take caution about this kind of attack is; either while renting a car or using a car from a shared-ride service. And because data stays there even after you disconnect the phone, and an attacker could easily gather important data from each device that was synced to the car, you need to delete carfelly and immediately all your data after using those services. Sooner or later, there will be a need to control physical unsupervised access and untrusted parties to the vehicle.

I tried to cover one vulnerability within the car which is USB access but still a dozen of risks could violate your privacy and security like for exemple having your data stored in a centralized database.