CarsBlues Vehicle Hack Exploits Vehicle Infotainment Systems Allowing Access to Call Logs, Text Messages and More

New mass cyber vulnerability identified in vehicles cannot be ascribed to a single automaker or single component manufacturer; Estimated tens of millions of vehicles affected worldwide

News provided by

Privacy4Cars

Nov 15, 2018, 09:06 ET

ATLANTA, Nov. 15, 2018 /PRNewswire/ -- Privacy4Cars, the first and only mobile app designed to help erase Personally Identifiable Information (PII) from modern vehicles, publicly disclosed today the existence of a concerning vehicle hack, titled CarsBlues, that exploits infotainment systems of several makes via the Bluetooth protocol. The attack can be performed in a few minutes using inexpensive and readily available hardware and software and does not require significant technical knowledge.

Privacy4Cars, the first and only mobile app designed to help erase Personally Identifiable Information (PII) from modern vehicles, publicly disclosed today the existence of a concerning vehicle hack, titled CarsBlues, that exploits infotainment systems of several makes via the Bluetooth protocol. The attack can be performed in a few minutes using inexpensive and readily available hardware and software and does not require significant technical knowledge.

As a result of these findings, it is believed that users across the globe who have synced a phone to a modern vehicle may have had their privacy threatened. It is estimated that tens of millions of vehicles in circulation are affected worldwide, with that number continuing to rise into the millions as more vehicles are evaluated.

The hack was discovered by Privacy4Cars founder Andrea Amico during development of the namesake Privacy4Cars app in February 2018. Upon discovery, Amico, a vehicle privacy and cybersecurity advocate, immediately notified the Automotive Information Sharing and Analysis Center (Auto-ISAC), the organization established by the automotive industry to share and analyze intelligence about emerging cybersecurity risks among its members. Amico worked for months with Auto-ISAC to help its affected members understand how an attacker might access stored contacts, call logs, text logs, and in some cases even full text messages without the vehicle's owner/user being aware - and without the user's mobile device being connected to the system. Amico recently noticed that at least two manufacturers have made systematic updates to their new 2019 models, making those new models immune to CarsBlues.

"Now that we have completed our ethical disclosure with the Auto-ISAC, we are turning our focus to educating the industry and the public about the risks associated with leaving personal information in vehicle systems," said Andrea Amico. "The CarsBlues hack, given its ease to replicate, the breadth of situations in which it can be performed against unsuspecting targets, and the difficulty in detecting the exploitation, is a clear indication that industry and consumers alike need to be proactive when it comes to deleting personally identifiable information from vehicle infotainment systems."

Those most at risk of having their personal information exposed include people who have synced their phones in vehicles that are no longer under their direct oversight, including but not limited to vehicles that have been rented, shared through a fleet or subscription service, loaned, sold, returned at the end of a lease, repossessed, or deemed a total loss. Additionally, people who have synced their phones and given others temporary access to their personal vehicle, such as at dealerships' service centers, repair shops, peer-to-peer exchanges, and valets may also be at risk for CarsBlues.

Vehicle users should consider deleting personal data from any and all vehicle infotainment systems before allowing anyone access to their vehicle. Industry players should consider instituting a policy to protect consumer data, either by helping customers delete their personal information or by performing the operation themselves – similarly to how telecom carriers handle returned smartphones.

For more information about Privacy4Cars and/or CarsBlues, please visit www.privacy4cars.com.

NOTE: At the time of this release Pricacy4Cars believes that for the many makes, models, and years affected by CarsBlues, deleting the personal data from the vehicle is the most reliable protection. To fulfill its social mission and commitment to vehicle privacy, Privacy4Cars has decided to continue to offer its namesake app available as a free download for consumers on iOS and Android devices.

ABOUT PRIVACY4CARS
Privacy4Cars is the first and only mobile app designed to help erase Personally Identifiable Information, including phone numbers, call logs, location history and garage door codes, from modern vehicle infotainment systems. Developed by a cybersecurity and vehicle privacy advocate, Privacy4Cars lets users select car make, model and year, and provides customized, visual step-by-step tutorials to quickly clear vehicle users' personal information while building a compliance log. Privacy4Cars' patent-pending process is available to consumers and small fleets as a stand-alone app for iOS and Android, and to manufacturers and businesses owning, servicing, or managing large amount of vehicles as a SDK [software development kit] that can be embedded into their existing apps. For more information, please visit: privacy4cars.com.

SOURCE Privacy4Cars