Last week, a Jeep driver turned to Reddit to do what people do best on the site—complain. Every time they hit the brakes on their Jeep, they wrote, a promotion for an extended warranty plan popped up in the center console. “Press the ‘call’ button to speak to a specialist,” they say the ad encouraged, welcoming the user to use their Bluetooth connection to complete the upsell then and there.

Ads are annoying and occasionally insidious; an ad that repeatedly appears inside one’s own car more so. According to other online posts on Reddit and Jeep forums, the issue goes back several years, affecting several models of Jeeps.

Stellantis, which owns Jeep, says the repetitive nature of the promotion was a glitch. “This is an isolated incident affecting fewer than ten vehicles at this time limited to the US,” Dan Reid, a spokesperson for the automaker, wrote in a statement. He acknowledged, though, that Stellantis shows other drivers in-vehicle promotions, too. Dodge owners, for example, get an infotainment push after 60 days of purchase offering the Dodge Complete Performance Package, a comprehensive warranty offering. Stellantis says that, on average, customers receive about two in-vehicle messages annually, containing safety, maintenance, or marketing information.

Read full article

Comments

Plans to block new vehicles with software and hardware linked to either China or Russia are moving ahead. Today, the Department of Commerce published a final rule in the Federal Register that will prohibit the import of vehicles with Chinese or Russian connected-car vehicle software from model year 2027 and Chinese or Russian hardware from model year 2030.

While the move will no doubt protect domestic auto manufacturing from the threat of cheap imports, the ban has been proposed on national security grounds. Specifically, the US government has determined that "malign actors and foreign adversaries" could exploit the "progressively more complex hardware and software systems" on new cars. It also determined that the danger of that happening when that software or hardware is made by a company owned or controlled by either China or Russia is unacceptably high.

The proposed rule covers hardware and software that enable connectivity above 450 MHz and automated driving system software—the sensors or other ADS hardware is not covered by the rule. Originally, the government had also wanted to include OSes, telematics, battery management systems, and advanced driver assistance systems but narrowed the scope in response to public comments. (It also notes that while telematics are indeed a prime attack surface for a foreign adversary since they operate over cellular protocols, that's already covered.)

Read full article

Comments

Connected cars are great—at least until some company leaves unencrypted location data on the Internet for anyone to find. That's what happened with over 800,000 EVs manufactured by the Volkswagen Group, after Cariad, an automative software company that handles much of the development tasks for VW, left several terabytes of data unprotected on Amazon's cloud.

According to Motor1, a whistleblower gave German publication Der Spiegel and hacking collective Chaos Computer Club a heads-up about the misconfiguration. Der Spiegel and CCC then spent some time sifting through the data, with which allowed them to tie individual cars to their owners.

"The security hole allowed the publication to track the location of two German politicians with alarming precision, with the data placing a member of the German Defense Committee at his father’s retirement home and at the country’s military barracks," wrote Motor1.

Read full article

Comments