YOUR CAR IS A SMARTPHONE ON WHEELS. HERE'S WHO'S LISTENING

Summary from the TLDR InfoSec newsletter

Northeastern researchers and Consumer Reports captured Wi-Fi traffic from 21 vehicles through a Raspberry Pi access point, decrypted 30 companion iOS apps with mitmproxy, and found that 19 vehicles contacted at least one third party, including ad and tracking domains. Seven apps sent VINs, emails, phone numbers, or precise location to trackers, and GM's four apps shared VINs with ten companies, including Meta, Google, and Acxiom. Pairing a companion app roughly doubled a vehicle's tracker exposure on average, and of 17 manufacturers contacted, most shifted responsibility to owners. One notable exception: Honda improved its data collection practices to avoid sending precise geolocation information to a third party involved in user tracking.