Technology and Science29 September, 20263 min read
Northeastern University Study Finds Connected Cars Share Data With Microsoft, Adobe, and Advertisers
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
21 late-model vehicles and 30 companion apps shed data to advertisers and tech giants. Locations and VINs among identifiers transmitted from cars and apps.
5 outlets told this the same way.
Cars send data outward
Northeastern University researchers, working with Consumer Reports, tested 21 cars from 19 different brands and found patterns of traffic to advertisers and trackers, along with data shared with Big Tech firms like Microsoft and Adobe. The study also found that using a car’s companion app can multiply the problem, and it reported that the network traces still yielded “valuable information, including the domains contacted via DNS traffic, Server Name Indication (SNI) in TLS handshakes, the volume and timing of transmissions, and differences in behavior across experimental scenarios,”.
The researchers even parked 11 cars, just the electric ones, in a Faraday tent to see if the loss of a cellular signal would push that traffic to the car’s Wi-Fi connection instead, and they reported that attempts to actually see what was in the data packets using modified certificates failed in every case. The study reported that all the cars contacted a first-party domain, the OEM, and it singled out examples where the Buick Envista and Mercedes-Benz EQS “didn’t appear to reach out to anywhere else,” while Tesla’s Model 3 contacted 34 advertising, tracking, and analytic domains and 37 domains from apps integrated into the infotainment system.
Apps expose more identifiers
Consumer Reports’ auto test center in Connecticut hosted the study’s controlled setup, where researchers watched 21 late-model vehicles and 30 companion apps to see who was receiving driver data. The researchers built a Faraday tent at the test center, and they parked one vehicle at a time inside it while they “quietly recorded every digital conversation the vehicles tried to have with the outside world.”
The study reported that 28 of the 30 apps sent data to at least one outside advertising or analytics company, and it reported that seven of them transmitted at least one piece of personally identifiable information, including “the vehicle owner’s name, the car’s VIN, or its precise geographic location.” The study also reported that pairing an app with its vehicle roughly doubled the number of advertising and tracking companies exposed to the data, and it identified four GM companion apps, myCadillac, myChevrolet, myBuick, and myGMC, along with the HondaLink, MyNissan, and Lincoln apps, as sharing VINs paired with either email addresses or location data.
Scale and policy pressure
David Choffnes, project lead and former director of Northeastern’s Cybersecurity and Privacy Institute, said the study’s goal was to reveal the sheer scale of modern vehicle data tracking and highlight how little visibility or control owners truly have over it. Choffnes told an interview, “I think the conclusion is that there’s a lot to be worried about,” and the study described that for traffic sent directly from the cars, researchers identified destination domains but could not decrypt the encrypted payload data without hacking the vehicles.
The study reported that every single one of the 21 vehicles transmitted data to at least one third-party domain over Wi-Fi, and it reported that over half contacted domains specializing in advertising, tracking, or analytics. The study also described mobile apps as an equally insecure vector, and it said seven companion apps transmitted sensitive details like vehicle identification numbers (VINs), phone numbers, and precise locations directly to advertising networks, while it noted that Honda requested that its analytics provider Amplitude delete all collected location data and updated the HondaLink app to cease.