Vehicle-based surveillance tools | Kaspersky official blog
Source Kaspersky Security Blog
Description
An inside look at who uses built-in automotive tracking and how you can avoid being monitored
Impact
The impact is primarily a privacy risk due to the potential for extensive vehicle-based surveillance by law enforcement and intelligence agencies. This surveillance can reveal detailed information about a driver's movements, habits, contacts, and even enable real-time eavesdropping if covert activation of microphones or cameras were possible. There is no indication of direct exploitation or compromise of vehicle safety systems. No known exploits in the wild or software vulnerabilities are reported. The threat affects users of modern connected vehicles globally.
Defensive guidance
Users should limit data sharing by avoiding syncing smartphones with vehicles, declining contact and call history sharing, and periodically clearing stored data from vehicle systems. Avoid using manufacturer mobile apps or opt out of data sharing in app and vehicle settings. Refrain from using voice commands in the car. Advanced mitigations include using older non-connected vehicles or disabling telematics hardware, though these may reduce vehicle functionality and violate warranty or laws. These measures should be balanced against personal risk and convenience.
Summary
This threat concerns privacy risks arising from the extensive data collected and stored by modern connected vehicles. Law enforcement and intelligence agencies use Car Intelligence (CARINT) tools to extract and analyze vehicle telemetry and sensor data, sometimes without warrants. Data sources include GPS history, call logs, voice commands, paired devices, and driving statistics. Some vendors sell surveillance software exclusively to government agencies. Additionally, tire pressure monitoring systems transmit unencrypted unique IDs that can be used for tracking. While remote hacking of vehicles is difficult and no public evidence exists of factory-installed covert surveillance features, the aggregation of vehicle data with other datasets enables comprehensive monitoring. Mitigation focuses on reducing data sharing and connectivity rather than patching a specific vulnerability.