By design, in-car telematics systems are a two-way street. Only after collecting data about a driver’s coordinates can they offer the location of the nearest gas station or a recommendation for a nearby pizzeria. But as the owner of a Nissan Leaf recently discovered, once a service possesses a motorist’s data, it is unclear how it might be used.
Casey Halverson, a self-described free-lance security blogger who was profiled on June 14 by the Web site for Computer World magazine, discovered what he thought was a security loophole in the Leaf’s onboard communications and navigation system. He found that information about Leaf owners could be culled and transmitted without their knowledge.
Called Carwings, the system can be configured to pull down breaking news and information to the car using a built-in cellular data connection. Owners can select specific Web-based news updates that are sent using RSS feeds, a widespread form of concise automated news alerts. Such updates can keep a driver informed about severe weather conditions ahead, or looming traffic jams. However, through a bit of tinkering, Mr. Halverson discovered that information about his car also was being sent back to the RSS feed provider.
This meant that any RSS feed provider, including Mr. Halverson himself, could cull information about Leaf owners. That information could in turn be used for any purpose, legitimate or otherwise, without restrictions.
“They pretty much left it wide open,” Mr. Halverson said in a telephone interview.
