Used cars? Try used car accounts: 15,000 up for grabs online at just $2 a pop

Researchers have found almost 15,000 automotive accounts for sale online and pointed at a credential-stuffing attack that targeted car makers. The team at Kasada did not name the car manufacturers in question, only saying that the first 10,000 accounts "targeted a single, large European automotive manufacturer with motorists …

[jmch]

Dealership questions....

Seems like rather than

- how many miles to the gallon?

- what's the horsepower?

- does it have <optional extra>??

customers should be asking

- does it work without an account?

- what data does it store and send?

- how can I stop it collecting / sending data?

[Roland6]

Re: Dealership questions....

For used vehicles Customers should be asking

- how do I take over the existing account?

It was a learning experience trying to do this for a Vauxhall I purchased outside of the Vauxhall dealer network, possessing the V5C was not sufficient…

[PRR]

Re: Dealership questions....

> ....customers should be asking .... - does it work without an account? ..... - what data does it store and send? .... - how can I stop it collecting / sending data?

Yes, yes yes.

And sadly, the dealer may not know. These data-back systems are new and still evolving. Asking an owner of a 2022 RAV4 may not reveal all about my 2023 RAV4. Even the different trim levels get different connection features.

[The Oncoming Scorn]

Hmmmm

Just as a precaution I think I'l cover the VIN\ Barcode thats mounted into the dash at the bottom of the windscreen.

[Anonymous Coward]

Re: Hmmmm

Exactly. The VIN is visible to every man and his dog at the bottom of the windscreen, and the make and model of a car is usually advertised prominently on the outside of the car. So what exactly can criminals do with this public information? If it's something significant then tell us what it is and start organising a movement to get laws changed!

[Great Bu]

Re: Hmmmm

But to get that data you have to physically go and look at every car, not just buy 15,000 numbers online.....also I am guessing the data may well have other identifiers linked to it such as owner details or email addresses.

[John Brown (no body)]

Re: Hmmmm

Put a high-vis vest on so you look like you are supposed to be there and just walk around any car park taking photos of the VINs and reg plates, simples! Of course, tying that to an address and owner is a little more difficult. You'd need to set up a "parking enforcement" company and then pay 20p per look-up or whatever it is to get info from DVLA.

[hoola]

Re: Hmmmm

It is easier to obtain and if it already includes other useful data it worth their while.

Sure, anyone can get a VIN but that involves going out and wandering round car parks with a camera. Most are infested with CCTV. This way they don't have to open the front door.

[Anonymous Anti-ANC South African Coward]

All your VIN are belong to us