38c3: Wir wissen wo dein Auto steht - Volksdaten von Volkswagen (Michael Kreil, Flüpke)
1:55 Introduction to Volkswagen AG: The presentation focuses on Volkswagen AG and its brands, including VW, Audi, Skoda, and Cupra, which share a common electric vehicle platform known as the modularer elektrobastelkasten (modular electric drive matrix).
3:43 Software in Electric Vehicles: The inherent connection between electric vehicles and software is highlighted, as is the "always online" nature of modern vehicles due to the 2018 eCall EU directive.
5:20 Security Vulnerabilities: A hacker discovered vulnerabilities in the backend systems of Volkswagen's connectivity services, leading to the exposure of a significant amount of data.
5:45 Data Discovery Process: The data discovery process involved using tools like Subfinder and Gobuster to identify subdomains and directories, eventually leading to the discovery of an open "actuator" endpoint in a Spring Boot application.
8:33 Actuator Endpoint: The actuator endpoint, intended for monitoring and management, was accessible without a password, revealing sensitive information, including AWS credentials.
11:19 Client ID and Secret: Further analysis using "strings" revealed a client ID and secret, typically used for authentication in web technologies like OAuth.
11:50 Authentication Bypass: It was discovered that a JSON Web Token (JWT) could be obtained from Volkswagen's identity provider for any user ID without a password, granting access to user data through an API.
12:57 Exposed Data: The exposed data included enrollment data (15 million records with vehicle information), user data (600,000 individuals with names, emails, and some addresses), and event data (9.5 TB of status messages with geocoordinates).
23:40 Geolocation Data: Approximately 800,000 vehicles had associated geolocation data, with varying degrees of accuracy. Volkswagen and Seat vehicles had precise locations down to 10 cm.
24:58 Data Anonymization: Due to privacy concerns, the presenters anonymized the data using a clustering method (Gaussian Mixture Model) to prevent the identification of individual vehicles.
27:53 Visualization by Stella: An artist named Stella visualized the data to illustrate the potential insights that could be gleaned from it, such as identifying individuals' homes, workplaces, and routines.
31:08 Sensitive Locations: The data revealed visits to sensitive locations like brothels, government buildings, and even a covert Volkswagen testing facility.
33:03 Law Enforcement and Security Agencies: The data also included information about vehicles used by law enforcement agencies across Europe and even personnel working at security agencies like the BND (German Federal Intelligence Service).
35:16 Legal Implications: Potential legal implications for Volkswagen include violations of their own terms of service and the General Data Protection Regulation (GDPR), particularly regarding the storage of sensitive personal data and the lack of encryption.
36:40 Volkswagen's Response: The presenters criticized Volkswagen's response to the security breach, highlighting that the company had failed to properly secure the data, rotate credentials effectively, and address the issue promptly.
37:23 Call for Privacy by Design: The presentation concluded with a call for privacy by design, advocating for the encryption of all private data and greater control over data collection practices.
37:47 Criticism of "Hacker Paragraph": The presenters also criticized the "hacker paragraph" (Section 202c of the German Criminal Code), which they argued hinders IT security research and the investigation of data breaches.
38:28 Data Deletion: All data obtained during the research has been deleted.