Unveiling Volkswagen's Data Practices: A Look into Millions of E-Car Records
1:09 Introduction: The talk, titled "We know where your car is parked," delves into the data collection practices of Volkswagen, particularly concerning their electric vehicle (EV) platform.
1:52 Affected Brands: The discussion centers on the MEB platform, utilized by various Volkswagen Group brands, including Volkswagen, Audi, SEAT, and Škoda.
3:49 Software Vulnerabilities: Highlighting that EVs inherently involve software, the speaker points out potential vulnerabilities, further complicated by the cars' online connectivity.
4:39 Always Online: Since 2018, EU regulations mandate that cars be "always online" due to the eCall system, designed for automatic emergency calls after accidents.
5:23 Data Journey: The speakers describe a "data journey" using tools like SubFinder and Gobuster to uncover exposed directories and files on Volkswagen's servers.
7:17 Spring Framework: The investigation reveals Volkswagen's use of the Spring framework, a Java-based web application framework, and a misconfiguration leading to data exposure.
8:47 Heap Dumps: Analysis of heap dumps (memory snapshots) from Volkswagen's servers uncovers AWS credentials and other sensitive information.
11:05 Client ID and Secret: Further analysis using the "strings" command reveals a client ID and secret, typically used for authentication, suggesting a potential token exchange vulnerability.
11:45 User Data Access: The vulnerability allows generating JWT tokens for arbitrary user IDs, enabling unauthorized access to user data via the API.
12:48 Data Retention: Volkswagen retains three types of data: user data (name, email, etc.), enrollment data (VIN, model year, etc.), and EV data (odometer, battery status, etc.).
15:36 Data Pool: Evidence suggests the exposed data comes from a larger data pool, with data being uploaded to AWS daily.
16:43 Warning Lights: Analysis of EV data includes warning light information, revealing potential issues like low tire pressure or even "high voltage battery risk of fire."
17:48 Battery Temperature: Examination of battery temperature data shows expected seasonal variations but also indicates that fire risk events occurred during charging.
18:32 Charging Behavior: Analysis of charging data reveals patterns in user behavior, such as a preference for manual charging and careful battery treatment.
20:01 Responsible Disclosure: The hacker responsible for the discovery contacted the Chaos Computer Club (CCC), leading to a professional disclosure process with Volkswagen.
22:15 Movement Data: The exposed data includes 9.5 terabytes of event data with geocoordinates, allowing for detailed analysis of car movements.
23:41 Affected Cars: The analysis focuses on 87,357 cars, with geocoordinates truncated for some but precise to within 10cm for others.
24:16 Geocoordinate Truncation: Volkswagen's terms and conditions claim to truncate GPS data, but this was not consistently applied, particularly to SEAT vehicles.
25:27 Privacy Concerns: To protect privacy, the presenters clustered and randomized the data, making individual car identification impossible in their visualizations.
26:29 European Map: A map of Europe is shown, visualizing the movement data of affected cars across the continent.
27:18 Hacker Ethics: The presenters emphasize their commitment to protecting private data, drawing an analogy to legal restrictions on photography in courtrooms.
28:03 Case Studies: Examples are presented, showcasing how the data could be used to infer individuals' routines, shopping habits, and even potentially sensitive information like visits to specific locations.
30:26 Government and Police: The data also includes information on vehicles used by government agencies, police departments, and even secret services, raising significant security concerns.
34:36 Unencrypted Geodata: The presenters express their bewilderment at Volkswagen's decision to store such a vast amount of geodata unencrypted.
34:58 Data Deletion: After informing Volkswagen and relevant authorities, the presenters deleted the data, emphasizing that they no longer possess it.
35:23 Legal Ramifications: Potential legal consequences for Volkswagen are discussed, including violations of their own terms of service and GDPR regulations.
36:43 Structural Problems: The incident is seen as indicative of structural problems within Volkswagen regarding data security and privacy.
37:24 Privacy by Design: The presenters advocate for "privacy by design" principles, such as encrypting all private data, to prevent similar incidents in the future.
37:57 Hacker Paragraph: The "hacker paragraph" in German law is criticized for hindering security research and potentially benefiting companies like Volkswagen by limiting scrutiny.
38:29 Call for Data Protection: The talk concludes with a call for better privacy and data protection, emphasizing that nobody should oppose stronger safeguards.