CARS.COM — Apple CarPlay and Android Auto have taken the auto industry by storm. The smartphone integration systems were unheard-of until early 2014; now they come in dozens of models from six major automakers.
Related: Which 2016 Cars Have Android Auto? Which 2016 Cars Have Apple CarPlay?
The problem? Not every car is yours. Car-sharing programs like Enterprise CarShare, Zipcar and Getaround have spread late-model vehicles to the masses. Even automakers have jumped in the ring, with GM launching its own car-sharing program in January. That comes atop traditional sharing, like getting a rental car or loaning the keys to a friend or relative.
But your smartphone carries a lot of personal data, and it's not just that secret stash of Smash Mouth. From financial information to emails, calendar appointments and business documents, many smartphones offer an easy path to identity theft.
What happens when you plug that device into Apple CarPlay or Android Auto in a borrowed car, or sell your CarPlay- or Android Auto-equipped car to someone else? What data stays in the car, and can strangers access that data?
We reached out to a range of experts to find out.
Little Threat From Android Auto, Apple CarPlay
Our sources were unanimous: You shouldn't lose sleep over the prospect of data theft from Apple CarPlay or Android Auto. The most that someone could potentially get is an identification code from your device, but that's virtually useless without the device itself.
"We store a device's ID based on parameters the phone provides over USB," Volkswagen spokesman Mark Gillies said. "We are using this ID to reconnect the phone with the technology last used by the customer. So if the customer last used CarPlay, it will be restarted when that phone is reconnected again."
Device IDs can be deleted with a factory reset of the multimedia system, Gillies said, but even if you don't do that, someone else couldn't scrape any phone data "unless they pair that phone," he added. "It lives, but can only be accessed when the phone is reconnected."
Honda spokesman Chris Martin said there's "no long-term storage of data from the phone in our cars" as a result of Apple CarPlay and Android Auto. "It's just mirroring what's in the phone," he said.
And Mercedes-Benz spokeswoman Beverly Rhodes said Apple's profile isn't stored in the vehicle; it only exists when you tether your phone.
Cars.com reached out to Apple and Google for information. Apple did not respond, but Google spokeswoman Liz Markman said the Android Auto interface is just a projection of what's on the phone: "Currently, no user account information from the phone is stored in the car itself," she said.
Your Car Has Data, Too
Colin Bird, a technology analyst at IHS Automotive, said he isn't aware of any risk of data exposure from CarPlay or Android Auto.
"They are both purely projection systems, though [users should] note that they both have the capability to extract data from embedded automotive systems and beam that info into the cloud," Bird said. That information includes vehicle speed and engine data to coolant or oil temperatures, he said.
Could a subsequent owner collect that information, including things like where you've driven? Sure, Bird said. But nothing in particular about Apple CarPlay or Android Auto appears to enable that.
"When it comes to software it's really just a matter of time and money," he said. "Anything is hackable. All cars today are supposed to have an event data recorder. This data can subpoenaed and used against you in the court of law, but data retrieval requires special tools."
It's unlikely that such data would be exposed because of Apple CarPlay or Android Auto: "There's no way that the data can be collected by a user through a phone [connected to Android Auto or Apple CarPlay], or at least it's very doubtful," Bird said.
Where's the Risk?
It turns out you're more likely to leave more data through a far older technology: Bluetooth. Pair your phone and most connections ask to download the phonebook to enable easy access to stored numbers. A lot of that can stay in the car.
"For every paired Bluetooth phone, the car stores the phone ID and pairing information," VW's Gillies explained. "The phonebook data and calling lists are transferred to the car. When you disconnect the phone, the call information is removed from the car's memory and updated on a following reconnect. The phonebook data persists in the car in order to be available immediately after a next reconnect."
Bird said the amount of information your car's Bluetooth system collects "varies by Bluetooth module but typically there is storage for hundreds if not thousands of phone numbers."
There's also "a limited amount of space for speed dials and call logs — though some systems record no logs," he added. "The transfer of this data is between the phone's memory and the SIM card to the embedded flash memory on the communications module, and what type of data that is transferred depends on the Bluetooth profile supported by the phone."
So-called "smart" Bluetooth can now handle additional data, "including keystroke data, wireless sensor reporting and the ability to transmit short data packets like messages, emails, calendar notifications, tasks, notes and reminders," Bird said. Although unlikely, "these in theory could be stored by the module depending on its design."
And all of that information could be hacked.
Someone could access the module and get your phonebook, recent messages and other basic information, like your phone's name and Bluetooth key, said Stefan Cross, communications manager for GM's connected-car division.
Cross said the data stored in the car excludes "any cloud-based information" like financial accounts, where the apps on your device are merely a portal to information online.
But for some, the prospect of another person seeing your call logs and address book is unsettling. That person would have to be "basically a computer hacker" to access the vehicle's hard drive and get it, Cross said. But he or she still could.
"You could extract some of the information, but it's going to be password-protected," he said. "If you leave it on there, it's very, very difficult to extract. ... Your average [person] or even your skilled engineer couldn't just extract this information. But it's on there."
"In theory, someone could hack in and remove that information," VW's Gillies said, though he added that he's "not quite sure why they would want to do that."
Honda claims its cars send Bluetooth information to a file that's constantly erased.
If you sync your device, "recent call history and the phonebook will be updated each time the phone connects with the car," Martin said. But "that information is stored in a temporary memory that is not saved when the connection between the phone and the car is lost. Thus, if you turn off the car, none of that data is stored in the car."
Before You Leave, Delete the Profile
Others suggest that you delete your phone from the list of paired devices to remove any potential access — an "extra precaution" consumers should take "just to be safe rather than sorry," Cross said.
"When you delete a phone, you delete the data," VW's Gillies said. "The data lives in the infotainment system if it recognizes the phone ID and, obviously, if you wipe the ID, you wipe the data."
Well, perhaps not quite.
Even if you delete your phone from the list of paired devices, Bird warned there's a slight possibility that information remains in the car. That's because the whole Bluetooth connection process "requires a small amount of embedded flash memory," he explained.
Bird said if you delete your phone, it erases what's called the "pointer" or "map" that shows where your Bluetooth file — with your address book and more — resides in the system's database. But it doesn't actually erase the file itself, which is "likely still on the embedded memory," Bird said.
In essence, you've burned the directions to your data. But if someone could search through all the data, they might still find it.
"The file is still there though until it is rewritten with a new file," Bird said. "This is the case with most types of memory storage. So the short answer is yes, someone could probably take your phone contacts even if you 'erased' it through the head unit."
from Cars.com News http://ift.tt/22U0p6I
No comments:
Post a Comment