786
Volkswagen has been collecting geolocation data from their smart cars, which were accidentally made public (infosec.exchange)
submitted 2 years ago by to c/privacy@lemmy.ml
77 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 2 years ago* (last edited 2 years ago) (1 child)

All you have to do is monitor the network traffic and then scan any AWS subdomains/IPs that pop up.

[edit] this makes me think… it’s not really possible for a secure connection from all of VW’s vehicles to an S3 bucket, is it? Anyone can pull the key from any of the millions of vehicles making the connection. Then they can dump whatever they want into the bucket.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 2 years ago

    You could secure it using an IAM user with credentials but then those credentials would be available on all vehicles.

    If the vehicles had direct access to S3, maybe that's why the bucket was public? But you could also just leave it available to the public.

    But if that was the design, you should sweep the bucket on a regular basis to make sure there aren't any objects over x hours old or something like that.

  • permalink
  • fedilink
  • source
  • parent