Shock Land Rover Discovery: Sellers could meddle with connected cars if not unbound

Both data and the online controls on "connected cars" from Jaguar Land Rover remain available to previous owners, according to security experts and owners of the upmarket vehicles. The car maker has defended its privacy safeguards and security of its InControl tech. El Reg began investigating the issue after talking to Matt …

[ckm5]

Re: Hire car data

Even in the US, where there are virtually no privacy laws, a phone number is considered PII and it subject to data control laws.

I would venture to guess that the GPDR considers a phone number PII.....

[Simon Ritchie]

I think that the fundamental problem here is that in a car manufacturer, product managers hold the purse strings. The second-hand car market has nothing to do with their bonus, so they are not interested in it. Spending money to make sure that the support system works for second-hand buyers is not on the agenda.

Until, as said earlier, GDPR comes along and bites them.

[The Original Steve]

Why so hard?

Two things:

1. Rather than a VIN, maybe a number that could be generated via the ECU and presented in the dash / iDrive. Appreciate the Evil Valet can still do it, but it's harder than walking up to the car and reading the VIN from the dashboard (some cars even have the VIN on the windows!)

2. If there's a dedicated button that needs pressing to connect the car to the online services, why not just have it so that if you press and hold the same button for - I don't know, 10 seconds? - the car will disconnect from the service?

Doesn't prevent the issue if the new buyer isn't aware, but both would help and could be implemented via a software update.

[KBeee]

Re: Why so hard?

The point is, there IS a button you need to hold for 10 seconds inside the car to register as the new keeper of the vehicle, along side having to set up an online account etc. which requires the VIN. The problem arises when the seller of the vehicle fails to un-register their old account/vehicle association when they sell it.

[KBeee]

Re: Why so hard?

There IS a button you need to hold for 10 seconds inside the car to register as the new keeper of the vehicle, along side having to set up an online account etc. which requires the VIN. The problem arises when the seller of the vehicle fails to un-register their old account/vehicle association when they sell it. Just having a button inside held for 10 seconds to dis-associate the old owner from the system would be great for a car thief that had stolen your key to nick your car.

[Graham Cobb]

Re: Why so hard?

Just having a button inside held for 10 seconds to dis-associate the old owner from the system would be great for a car thief that had stolen your key to nick your car.

No. It would make no difference at all.

If my car is stolen I don't go and find it and retrieve it myself. I call the police and the insurance company. They would still be able to use the mechanisms they use today to contact the manufacturer and get access to location and other information -- they aren't asking the owner for that today.

[Anonymous Coward]

Re: Why so hard?

If InControl is disconnected from JLRs systems how would they know where the car is? Customer has to consent to the data being collected.

It is the responsibility of the previous customer to disconnect and owners of cars with this tech will need to get used to checking their purchase has indeed been disconnected

[hammarbtyp]

Not quite the same, but every once in a while i get an e-mail every couple of months giving me a diagnostic report for my GMC Yukon. It gives my mileage. car state, etc.

Only one issue. i don't own a GMC Yukon, never been in one and don't even live in the states where I assume they are driven

I am assuming that whoever set it up mis-typed their email and here we are. It just goes to show however how hard it is to control information

[Throatwarbler Mangrove]

Well, if you want a GMC Yukon, it sounds like you have pretty ready access to one.

[John Brown (no body)]

"I am assuming that whoever set it up mis-typed their email and here we are. It just goes to show however how hard it is to control information"

I'm surprised stuff like that doesn't happen more often. I recently started getting emails to one of my live accounts about fund raisers for a school in the US asking "the committee members" to confirm attendance at fetes and things. No amount of replying to them would stop it. And I was very nice and polite about it too. Eventually I tracked down the school website only to find no email contact details other than to the "school district office", whatever that is. I sent them an email and slightly lied by saying the emails contained personal information regarding students. I never got a reply from them either, but the emails stopped almost immediately.

[hammarbtyp]

yeah, I used to get elections emails from a specific place in the US, which was fun. Eventually I replied

Hi Tom,

Thank you for your emails asking for my support in your coming election. I must admit after reading them I am strongly inclined to vote for you.

However I am little hazy about election law. Do you need to be a resident of Mamaroneck to vote for you? Or in fact a a US citizen? or even reside in the USA?. It is possible I might of flown over Mamaroneck on the the way back to England, but I'm pretty sure that would not be enough to give me a say in your election.

So on the balance of probabilities it is unlikely I will be able to help you in your quest for office. However I wish you well in your coming election.

However if things do not work out and you ever feel the desire to stand for parish councilor in England be assured of my full support

Yours sincerely

Never go a reply again (Tom lost)

[Daedalus]

And the bozocalypse continues

When will the people who come up with these technological miracles realize that they will be handled, used, abused and confused by people whose main motivation in life is getting to beer o'clock?

[MJI]

A least mine is fine

Too old and no fragile Ford engine either

[Danny 14]

Re: A least mine is fine

i quite like JLR using ford engines, it means i can get updates on my ford mondeo for free and JLR technicians get the full ETIS computer. I have a mate who works in a dealership....

[MJI]

Re: A least mine is fine

We just take the pee out of the Ford engines.

My 5 cylinders (basic remap) puts out roughly same power as the Ford V6 and is very unlikely to snap its crank.

Rusty ones are now being used as engine donors to replace late Defender Transit engines.

Just realised I have identfied myself as a Discovery 2 owner!

[Michael Jarve]

As long as they're still using Lucas...

...electronics, there should be little to worry about. Based on my personal experience with my own Range Rover, attempting to unlock the doors remotely will only result in the gas-cap cover opening, and attempting to remotely start it will just just cause a puddle of oil to appear under the engine. Pretty much, there is nothing a previous owner, or evil valet can do to those vehicles that's worse than what they already do.

I still remember the reassuring "click" of the safety belt the first time I drove mine off the lot, and the weird sensation of the fastener portion of the belt sliding across my lap and chest as it came out of its anchor about 2-blocks away from the dealership. Land Rover: Inventors of the self-releasing seatbelt.

[Yet Another Anonymous coward]

Re: As long as they're still using Lucas...

With a Land Rover the only GDPR related issue should be checking that the previous owner hadn't left a couple of sheep dogs in the back

[MJI]

Re: As long as they're still using Lucas...

Mine has a Lucas engine ECU. Other ECUs from other companies.

[Mark 85]

Re: As long as they're still using Lucas...

Land Rover: Inventors of the self-releasing seatbelt.

That's not a bug but a feature. If your seat belt suddenly unbuckles maybe the driver will drive more carefully?

[Borg.King]

Re: As long as they're still using Lucas...

Land Rover: Inventors of the self-releasing seatbelt.

That's in preparation for your hasty exit as flames start to lick around the edges of the bonnet.

[Anonymous Coward]

This capability is fraught with danger

Getting into someone's car to push a button for 10 seconds isn't a high bar at all if you know the person. Ever ride in someone's car and they leave their car for a moment to go inside their house for something they forgot, run to a restroom at a gas station, etc.? You can press that button then. Ever visit someone's house and they leave you alone for a few minutes while they are in the bathroom, taking an important call, dealing with a crying child? If they keep their car in a garage, it is almost certainly unlocked and you can press the button and return before they're done and none the wiser. Most stalkers are known to their victims, not strangers...

There needs to be some security around this process greater than physical access that allows you to press a button. At the very least they need to provide a method where the owner can disable this capability permanently, and not have it be trivially re-enabled without their knowledge because someone pressed a button. If I owned one of these cars, I'd be googling right now trying to figure out who to talk to about a class action lawsuit.

[JohnFen]

Re: This capability is fraught with danger

"Getting into someone's car to push a button for 10 seconds isn't a high bar at all if you know the person"

Or even if you don't. Gaining access to a locked car is unbelievably easy, as numerous car thieves and roadside service companies demonstrate on a daily basis.

[Anonymous Coward]

Apparently the button is behind a flap in the overhead console

So it would be trivial to trigger if you were in the passenger seat while the owner was driving it - they probably wouldn't notice you doing that, and if they did you could say you were trying to open the sunroof or seeing if it had a built in garage door opener transmitter.

Not only could you use that to activate the system, you could deactivate it - i.e. if a parking lot attendant wanted to take it for a joyride it wouldn't be trackable. Seems like it would also be the first thing a thief would do before driving off with it - if you push it in for 10 seconds you deactivate the tracking. If the tracking isn't enabled, pushing the button won't do anything because you have to do the online setup first for that work.

Kind of defeats the purpose of being able to track a stolen car if the thief can override the tracking with such a simple method!

[phuzz]

Re: This capability is fraught with danger

At a certain point you just have to hope that people are trustworthy. If you let someone into your house, how long would it take them to find the spare keys? Or to perform an 'evil-maid' type attack on your computer, or to surreptitiously leave a window open so they can get back in later?

[Charles 9]

Arguing aside, I can at least see some of JLR's point. I mean, other than being psychic, how is a car manufacturer supposed to know when one of their cars changes hands in a private sale that doesn't involve them? I mean, technically, when the car is sold and driven off the lot, it's no longer their car. This is creeping towards some very grey territory.

[Michael Jarve]

I agree entirely. If it's some sort of authorized dealer sale, then yes, LRJ, Volvo, and others do bear responsibiliy to make sure ownership "truly" changes hands, but if I'm selling my Rover to Charles, here, who's job is it to make sure I hand over *all* the keys? Is it his, having researched the vehicle and deciding to buy it? Is it mine, having owned the POS and having become familiar with all its quirks bugs? Is it in fact LRJ's having no idea I've become disillusioned with their vision of luxury and instead selling my RR and buying a fleet of old-lady gold colored 1990 Toyota Camary's and not looking back?

Should it be easy enough for someone, presumably almost anyone, to defeat the "connectedness" of a modern car just to prevent someone else from taking over our 2.5-ton lethal projectile and causing embarrassment, inconvenience, or worse? Is there really some way to prevent some occurrence without constantly phoning home to Nanny? Or should we decide that out car really does not need to talk to our toaster or alarm clock, and that carrying a keyfob with the traditional "lock, unlock, panic" buttons is really not all that hard or traumatic. I know El Reg's readership tends to turn a more critical eye towards such things than readers of say Ars Technica's "Oh! Shiny Phone App until Privacy Breach!", but I suspect that even even Gitlin would prefer security and safety to adding yet another mostly useless app to their iTimepiece.

Then again, there is a reason the Rover (14,000 hard-fought miles) is saved for Friday nights and trips to the Cities and the 18 year old 940 Turbo (536000 miles) is driven daily. Not to mention that I live in northern Minnesota- the Swedes, at least at one time, knew how to make a car for our climate.

[JohnFen]

Good reason not to buy

This is a good reason not to buy any "connected" vehicle, period.

[Charles 9]

Re: Good reason not to buy

So what happens when (not if) ALL card are connected...by law?

[Wade Burchette]

Re: Good reason not to buy

"So what happens when (not if) ALL card are connected...by law?"

I would like to see how a connected car can work without an antenna and its fuse removed.

[Charles 9]

Re: Good reason not to buy

Simple. If the antenna doesn't work, the CAR doesn't work, either. AND they'll consider that user tampering, meaning bye-bye warranty.

[JohnFen]

Re: Good reason not to buy

"meaning bye-bye warranty"

Lots of people, including myself, don't care about the warranty to begin with, so that certainly wouldn't stop me.

[Fonant]

Re: Good reason not to buy

I can't think of any (good) reason why a society would require all cars (and vans, lorries, motorcycles, mopeds?) to be "connected" by law. And what would all these cars be connected to, some national database? How would you protect against a malicious actor generating masses of radio interference to bring the M25 to a halt because the cars were no longer connected?

If we did end up in such a dystopia, there's always walking or riding a bicycle. Or voting for someone other than the Tories.

[Anonymous Coward]

Re: Good reason not to buy

That makes it important that we try to elect people who won't let that happen.

I know...but it's my fantasy world and I can live in it if I want.

[JohnFen]

Re: Good reason not to buy

Easy. I'll disable the antenna. If that's not possible, then I'll just stick with old used cars (they'll have to be grandfathered in as a matter of practicality). If that's not possible, I just won't own a car.

[Anonymous Coward]

I would just like to say something futile...

Whether its Android-Slurp, SmartTV-slurp, Win10-Slurp, IoT-slurp or this latest Smart-Car-Hell... I am buying far less tech. The feature set versus the risks is just too high. Not that I expect this view will change anything.

But eventually like the 20% fall in Facebook this week, a few clusterfucks are going to come home and burn the carmakers just like the emissions scandal. Better hope no one is playing musical chairs when that happens. But of course key decision makers like CEO's will all be in the Caribbean by then! So we need a GDPR clawback that costs directors, not the firm!

[Anonymous Coward]

Car makers like everything else in tech it seems

They lust after the analytics, just none of the responsibility.

Em, sounds like something else with similar consequences!

[Charles 9]

Re: I would just like to say something futile...

Odds are Facebook will rebound quickly. They're still top of the heap in social media; nothing else comes close. Unless someone suddenly comes along who can out-Facebook Facebook, we still can't fix Stupid.

[quxinot]

Don't care who the maker is...

I do not need my car going online. Period. This crap needs to be optional at the time of purchase, and easily disabled or modified after purchase.

I love driving tremendously, but absolutely am not looking forward to buying my next car. I'd cheerfully trade all the electro-tinsel for a decent chassis that delivers what I ask of it.

[DryBones]

Re: Don't care who the maker is...

So, a Miata then?

[RobinCM]

It's no different from any other tech

Yes it's a car, but how is this different to selling a phone, laptop, tablet, fridge or anything else with tech in it?

If I sell an Android phone, I need to make sure I remove my data and Google account from it before I sell it.

Ditto for any of the other items I mentioned. As a seller, I would want to do this, so I know my data has gone before the device leaves my ownership.

If I'm buying a second hand car I'm definitely going to be asking the retailer if any connected functionality has been correctly the reset and is ready for my use - before I buy the car.

Seems like the guy in the article failed to do that, and then got in a strop and blamed the vehicle manufacturer for his own lack of foresight.

If I bought a used iPhone and the previous owner hadn't wiped it properly, and I didn't check that before I bought it, how would that be Apple's problem?

[Charles 9]

Re: It's no different from any other tech

The guy bought the car in a private sale that didn't involve the dealer, and the guy was a curious techie so he poked around.

So, how do you solve this situation without the government making it worse such as requiring resales to the dealer complete with markup? Since dealers can't psychically see every private sale, where can they possibly fit in? And don't expect the tech to go away; in fact, expect it to be mandatory in future for safety and environmental considerations.

[Jason Bloomberg]

Ho hum

One would have expected it to be a simple "Bring it into your local dealer with your paperwork. They'll reset everything for free while you enjoy a complementary cup of tea. And here's a nice glossy brochure and a voucher for 20% off your next service. Welcome to the JLR family".

I guess that's too much like good customer service.

[Anonymous Coward]

Re: Ho hum

"One would have expected it to be a simple "Bring it into your local dealer with your paperwork. They'll reset everything for free while you enjoy a complementary cup of tea. And here's a nice glossy brochure and a voucher for 20% off your next service. Welcome to the JLR family"."

No.

Firstly, the vast majority of private buyers never want to visit a 'stealer' - even for free stuff like safety recalls, and would never be in the market for a new or 'approved used' vehicle so as far as the dealer network and manufacturer are concerned, they are not and never will be a potential revenue stream.

Secondly, who is going to pay for this reset? the manufacturer? nope, they don't care about out-of-network sales, see above. The dealer? nope, they haver to assign tech's time to something, can't be sales, as they didn't sell it and cant be workshop as no-one to bill, can't be internal work as the tech's will kick up a stink over lost productivity & bonus (and rightly so) - just to 'log in' to a vehicle with DoIP, SPA or Flexray takes ~20 mins...

20% discount on a service? 10% is the limit even if you push really hard, because they know that you'll then want a price match on all the stuff identified on the eVHC - or just take it to a local indy to have it bodged for a third of the price with the nastiest possible aftermarket parts.

There's vehicles in dealers compounds that have been sat there for years waiting for work to be done because the owners have taken it there as a last resort after every other option has been exhausted and they haven't the funds to get it fixed, so the cheapest option is to SORN it and park it for free at the 'stealers' until they can be arsed to do something about it - which is usually get the local scrappie to tow it away after the fourth quarterly letter from the service manager threatening to charge them storage!.

So no, getting private buyers into a dealers isn't ever going to generate another customer for life.

What might work is registering your 'newly purchased' vehicle on the manufacturers portal, which would then generate a message to the existing registrant, if not answered within a week or two or answered with a 'no, don't change the owner' type response, the new owners details would default over to the online service.

[Charles 9]

Re: Ho hum

One, dealers CAN be forced into repair stuff by the manufacturer, on pain of lawsuits, etc. That's how recall campaigns are conducted. If the manufacturer is under legal onus, they can pass the onus onto the dealer, money or no.

Two, without knowledge of who bought the car, how can the manufacturer change the owner of the car. Also, things get lost in the mail all the time. A forced reset is bound to draw lawyers.

[Anonymous Coward]

Re: Ho hum

"One, dealers CAN be forced into repair stuff by the manufacturer..."

Dealers like nothing more than repairing stuff for manufacturers - recall actions, service actions, quality campaigns etc. etc. They get paid at a defined rate for carrying out specific actions on vehicles in a VIN range or exhibiting certain symptoms - at one time, there were eighteen 'quality enhancement actions' applicable to each and every instance of a certain model of a premium car manufacturers product, most were cosmetic or minor, some were bordering on safety recall territory - most owners were unaware of the rework as it was all classed as service action (but took 3.6 hours to complete) so there was no letter in the post, those that chose to use the 'EU block exemption' and get their vehicle serviced outside of the dealer network whilst in warranty would only get the individual items reworked 'upon customer complaint'.

Not withstanding the above, warranty, recall and service / quality campaign work is lucrative 'bread & butter' work for the dealers - Nissan have spent years replacing engines because one person on the engine assembly line was OCD enough to line up all the gaps in the piston rings 'because it looked better' in the absence of being told otherwise... PSA have replaced 16k engines, mostly on a Dealer Hold Order due to a second tier Turkish manufacturer supplying substandard pistons for the 1.6 litre diesel engine, Ford Mustang 5.2l have an oil supply problem to the RH cylinder head / camshafts, mainly due to being built in America - their words, not mine, BMW are replacing battery wiring looms on 180k vehicles in the UK alone, should take about two years to complete - All of which is great news for the dealers!

BTW, JLR use SDD & DoIP not ETIS and have done for some time. The last shared diagnostic platform with Ford was IDS and went out of the door with Discovery 3 so the chances of a JLR dealer (not indy) being able to / want to do stuff to a Ford is slim to feck all, even if they still have the interfaces, SDD simply won't recognise it!

[aks]

How is this different from selling a PC or mobile when you don't wipe the data and disconnect from the cloud/server?

On the other hand, if some data was always gathered and couldn't be disconnected, any stolen car could be tracked. Maybe accessible only by the police using superuser login.

[Fred Dibnah]

When you sell a phone with your data still on it, the buyer gets access to your data. In this case the seller gets access to information about the buyer such as location data, with the added ‘bonus’ of being able to remotely control the vehicle they sold.

[Fonant]

Mainly because you *can* wipe a PC or mobile just by being in possession of the device.

The problem in the case discussed is purely that you *can't* wipe the data collected by the vehicle manufacturer, even if you have the car keys.

[HWwiz]

Same for newer Mercedes

Same with newer Mercedes cars from approx 2014 onwards.

If the last owner does not login online and remove the car from their Mercedes Me account, then they can continue to remotely monitor the car. Lock / Unlock doors, etc.

Non-Mercedes dealers have no control over this. Where as main dealers can terminate the accounts during re-sale.

[Stork]

Somehow I feel less and less need for a connected car

Are they still sold, or can you disable it?