Prismix
Hacker News — AI on Front Page · · 5 min read

Automatic Transmission – a data-privacy study of connected vehicles

Mirrored from Hacker News — AI on Front Page for archival readability. Support the source by reading on the original site.

228 pts · 189 comments on Hacker News

Like Read original ↗

This diagram shows the data flows to and from a vehicle and its companion mobile app. Both devices send data, including private consumer data, to different 1st and 3rd party servers using Wi-Fi and cellular service. Solid arrows represent flows that were intercepted through our experiments.

The Problem

Once the data gets sent to these servers, it is up to the companies that receive the consumer information to make decisions on what they do with it. Unfortunately, in many cases, this includes sharing or selling consumer data to other undisclosed 3rd parties.
Consumers have no control over their data once it has left their device

In this paper, we take the first steps to address the limited visibility into the privacy implications of the connected vehicle ecosystem. We identify two vantage points in the ecosystem where we can gain insight into the data that connected vehicles are sharing with both manufacturers and third parties: the vehicles themselves and the mobile apps provided by manufacturers.
We ask the following guiding questions:

Methods

We investigated 21 vehicles from the U.S. market in a controlled environment along with 30 companion mobile apps instrumented with on-site vehicles between October 2024 and August 2025. Below is a description of the experiments we ran and our setup.

Vehicle Testing

Testing Setup
Photo is not loading images/rpi.png

Wi-Fi Testing Setup

To collect Wi-Fi traffic from vehicles, we configured a custom access point (AP) on a Raspberry Pi and used tcpdump to log all packets that were sent or received via this AP.
This allowed us to see all the destinations the vehicles were sending data to but not the information within the packets as it was encrypted.

Vehicles at the testing facility
Photo is not loading images/test-facility.jpg

Stationary Tests

Idle Baseline
vehicle on — no activity
Active Test
perform all possible actions

Driving Test

drive 5–45 mph with acceleration & hard braking

Isolating Cellular Traffic

Faraday tent used to block cellular signals
Photo is not loading images/faraday-tent.jpg

One hypothesis we tested was whether blocking a vehicle’s ability to communicate over its cellular network would force more Wi-Fi communication. To block external cellular signals, we drove 11 EVs in the sample into a car-sized Faraday tent providing ≈93 dB of attenuation, blocking their cellular connection entirely. Stationary Idle and Active tests were repeated inside the tent to see whether traffic that normally goes out over cellular rerouted to Wi-Fi instead.

App Testing

In total, we experimented with 30 connected vehicle companion apps that were paired with the vehicles at Consumer Reports’s testing facility.

Device Setup

  • 01We used a combination of test phones and iOS versions for our experiments: an iPhone 8/iOS 16.6, an iPhone X/iOS 16.7.11, and an iPhone 13/iOS 18.5.
  • 02To minimize background traffic, we deleted all non-essential apps on the test phones and tested apps one-by-one, including deleting each vehicle app and restarting the phone before downloading the next app.
  • 03We used the iOS native screen recording feature to record our interactions with each app for later review.
  • 04To capture and decrypt network traffic from the companion mobile apps, we used iPhones with custom root certificates connected to mitmproxy.

Process for Testing Each App

  • 01During app installation and login we accepted all permission requests (e.g., tracking, location, calendar access, Bluetooth, notifications) that the application requested
  • 02We had a Consumer Reports employee log into the app using their existing credentials associated with a vehicle on the lot.
  • 03Once we were logged-in, we manually exercised all available functionality, such as looking for nearby charging staions, geolocating the vehicle, viewing vehicle data and service history (e.g., tire pressure), viewing notifications (e.g., “doors are unlocked”), and viewing in-app privacy policies.
  • 04Some apps allowed us to perform physical interactions on the vehicle, such as remotely opening the trunk. We performed all such actions and verified that the vehicle completed each request.

Vehicle Dataset

$1.2M+
estimated cost to independently procure this fleet, only possible due to Consumer Reports partnership
Manufacturer Brand Year Model Vehicle Tests
Driving Idle In-Tent Cellular
General Motors (GM) Buick2024Envista✓✓––
Cadillac2024Lyriq✓✓✓–
Chevrolet2024Blazer✓✓✓–
Stellantis Dodge2023Hornet-✓––
Fiat2024500e✓✓✓–
RAM20251500 Bighorn✓✓––
Fisker Fisker2023Ocean✓✓-–
Ford Motor Co. Ford2022F150 Lightning✓✓-–
Ford2024Mustang GT Fastback✓✓––
Honda Motor Co. Honda2024Prologue Touring AWD✓✓✓–
Tata Motors Land Rover2023Range Rover Sport✓✓––
Toyota Motor Corp. Lexus2024NX450H+ PHEV✓✓––
Toyota2023Corolla Cross✓✓––
Subaru2023Solterra✓✓✓–
Lucid Lucid2023Air Touring✓✓✓–
Mercedes-Benz Group AG Mercedes2023EQS450 4Matic✓✓-–
Renault-Nissan-Mitsubishi Alliance Nissan2023Ariya Platinum✓✓✓–
Rivian Rivian2022R1S✓✓✓–
Tesla Tesla2024Cybertruck✓✓✓–
Tesla2024Model 3✓✓✓✓
Zhejiang Geely Holding Group Volvo2024C40✓✓✓–

*While we tested a wide range of vehicles, we did not cover every manufacturer in the U.S. market. As with all empirical studies, our results should be interpreted as a snapshot in time, and may not generalize to vehicles outside our sample or outside the U.S.

Discussion (0)

Sign in to join the discussion. Free account, 30 seconds — email code or GitHub.

Sign in →

No comments yet. Sign in and be the first to say something.

More from Hacker News — AI on Front Page