I recently picked up a Volt which includes this OnStar 4G setup and have to say I'm extremely concerned at how quickly this "my car is on the internet" feature set is spreading.
Everything is managed by OnStar through their device that's factory installed into every new Chevy vehicle. They have had security breaches and had to fix white-hat reported vulnerabilities in the past[1]. This system isn't just "4G wifi as a hotspot", it has almost full access to every system in the car.
Chevy offers this mobile app called MyLink which lets you remote-start, lock, unlock your car using this same connection.
History shows that car manufacturers have not given near enough thought to the security of access to a vehicle. I'm afraid that it's only a matter of time before we have a bot net either using cars, a bot-net that attacks and takes over cars, or both, with the potential of lots of damage and loss of life.
As such I immediately told OnStar to disable service to my car and will be finding and disconnecting the OnStar box (as it still phones home periodically) as I just have no reason to trust such a thing at this time.
Obligatory story: I bought a Camaro when the new ones first came out (2009). I ran into some issues with the radio, found out via forums I was 3 firmware versions behind and then slowly found out car dealers were ill-prepared to be software vendors. They had no idea about the radio updates and their system showed nothing for me against my VIN. This was a common enough experience across the country that one of the coders working on the radio started giving the updates out via email. Which is how I wound up sitting in my car with two USB sticks full of C#. Put the first one in, turn the key, updates. Then open the driver's side door to reset the process (yes, seriously) and put the second USB stick in.
Before that experience I used to laugh off the idea of a weaponized mp3 file or people taking control of cars remotely. Now I think about that auto-boot USB port and the fact my driver's side door is a toggle to God-knows-what.
I've posted this before, but it's relevant so I'll post it again. Not sure if this has changed since I last posted, but it's a hell of a warning sign on how they practice:
So, I'm an Australian. We don't have OnStar but I've heard about it via the net.
I keep getting emails for 2 different people's OnStar accounts to my Email address... and OnStar won't do anything about it.
I have a pretty short Gmail address because I signed up early (6 characters), and Gmail's autocorrect/fuzzy email receiving means I get emails for all sorts of people that have mistyped their email and mine is "close" to what they typed.
To give you an idea of how bad this OnStar situation is:
- The emails have all the personal details inside each one. Name, home address, car make/model and various ID/registration details, home phone number, etc.
- It gives me full access to the cars maintenance records via monthly emails with EVERYTHING in the email relating to the car, INCLUDING LETTING ME EDIT IT via a link.
- It gives me a link directly to their OnStar account, and the password is the persons postcode, WHICH IS IN THE EMAIL. There's quicklinks to access the full account, change vehicle details, remotely access various aspects of the vehicle's features, etc.
- I can send directions to their GPS from my browser, which comes up on their screen.
- ... lots lots more "could" be done if I was inclined.
I've emailed OnStar support about it a few times, they don't reply. The closest I get to any form of reply is an automatic message telling me to call them on a "toll free number" (not free for me to call from here!)
PS, Mr Buchner, your 'tires' on your GMC Terrain are low and your oil needs changing urgently. It's overdue by months.
Your concern is valid and it's not lost on manufacturers. I am familiar with one manufacturer whose vehicles will have a bus level firewall in some new vehicles released later this year. Of course, eventually all vehicles will have it. Vehicle development cycles are usually multiple years so it takes time to roll this stuff out.
You might say an internet connected head unit should just be disconnected from the vehicle bus, and there's some merit to that. But, customers want to be able to control the volume from their steering wheel or the head unit should control the subwoofer amp in the back of the vehicle, or change vehicle settings from the head unit display... so the head unit needs to be on the bus to do all of these things.
The goal is to limit what the head unit has access to on the bus. For example, there's no reason the PCM (powertrain control module) should be allowed to receive anything other than high level configuration information from the head unit (switching between standard and sport mode driving profiles for example).
History shows that car manufacturers have not given near enough thought to the security of access to a vehicle.
Here's how GM could beat Tesla, along with why it won't happen. GM could just take a look at what Tesla is doing, and do all of the same things, then do certain key things better. From a sheer resources and capability standpoint, GM could beat the pants off of Tesla. I think Tesla is counting on: 1) GM and other big automakers being too set in their ways and 2) GM and other big automakers getting some key things very, very wrong. Security is probably a key example.
It's an oft-cited insurgency move to use the big power's culture against itself.
Stuff like this has been around forever. I once drove a 2007 BMW 7 series which let me unlock/lock my car from my phone. I also got weather data etc. on my dash.
Now it is finally making it to normal cars. My 2014 Passat has it as well. However, I didn't activate it since it is tracking my location.
On the other hand, stuff like Onstar can save lives.
I can't find the article anymore, but around 2003 or 2004 there was an article on the NYT about law enforcement using OnStar to spy on what people are talking about in the car (on the phone, etc).
You are probably vulnerable even if you don't subscribe too... There needs to be an "airplane mode" that completely disables wireless communications...
Do their cars come with decent in-car entertainment that can actually use the Internet?
When I got my new 2016 Honda Accord I was looking forward to some good streaming music in the car. I read that the built-in stereo comes with Pandora. I also knew that the built-in stereo can also access the Internet. "Cool," I thought. "I can fire up the hotspot on my phone, connect the car to the Internet, then the Pandora will connect and do its thing."
Nope. Turns out that the stereo can connect to the Internet. It's got Android. But the most useful thing I can do is browse the Web on my car stereo screen. Something I have never, ever wanted to do. Apparently it also connects to some useless thing called Aha Radio, which hasn't been updated in years. The Pandora can't even use the Internet connection! It only works through Bluetooth or, apparently, though hooking up my phone via a cable.
So the stereo's Internet connection is practically useless, and my only streaming options work through the phone, which is generally a glitchy experience. Though I must say, the Pandora built in to the car is generally better than Apple CarPlay, which has been a huge disappointment.
So hopefully Chevy has something decent in their car other than an Android web browser on the car screen, and hopefully it's not just Apple CarPlay or Android Auto or anything like them, because in my experience the phone makers are all about stripping away hardware buttons. When I'm driving the hardware buttons are far superior to finicky on-screen buttons.
I have the same car, as well as a Pixel phone, and I'm really pleased with streaming radio apps on Android Auto. The voice controls work for Spotify and not just Google Music. To control music I'm generally using voice control or the steering wheel stereo controls.
CarPlay really seems to suck for any audio app that isn't Apple Music. It does seem to work _great_ for Apple Music, so if that's your preferred music app then you'd be pretty happy.
The infotainment system in my new Volt beats the pants off the system in my new Mazda. Those are the only two I have direct experience with, but based on a bunch of reviews I read, Ford and GM appear to have the best infotainment systems, at least for the US market, Tesla excluded most likely.
It is however touch screen based. And I'm thankful for CarPlay since Mazda doesn't support CarPlay nor Android Auto and Mazda's UI is awful.
Got a 2014 Honda and had the same experience, hate to hear they have not improved. It had the same Pandora and aHa radio "features" and the in-car system was terrible in general. It interrupted the music with voice prompts, and randomly wouldn't let you do certain things while the car was in motion. It's like a UX designer threw up... and then that throw up designed a car stereo.
I have to wonder how useful this unlimited data plan will be in 10-15 years when you're still driving the vehicle. What are the chances Chevy is going to even have an option to upgrade the radio when the one built into the car is obsolete?
My coworker's <10yo Nissan Leaf has a now-useless remote access radio, because it depends on the 2G network that AT&T shut down. $300 for an upgraded radio, which is a lot to drop on something that didn't break.
If they had offered it 10 years ago when 3G was available in most places, it would still be pretty useful today. 3G is good enough for 95% of what I use mobile data for.
Definitely feels like you're getting locked in. Sort of like buying a combo stereo unit with radio/phono/8 track in to one box instead of buying separate components that could be swapped out.
Good points, ATT is planning on sunsetting 3G next 3-5 years and move everything to 4G. So it wouldn't surprise me if 4G gets dropped within the car lifespan.
I don't get it, though. The article makes it seem like the primary use case is to connect your phones to the car via WiFi, so they can all use the car's 4g connection.
But don't most people that can afford this already have unlimited (or close to it) data direct from the phone?
Or is the data connection used by the car in some other way?
I think having an always-connected car would be really useful. On certain cell phone networks, such as Verizon's in the US, you cannot make a phone call and use data at the same time. I often take calls while in the car and find that I need access to critical data at the same time. I've considered adding a hot spot semi-permanently to the car just as a work around for this issue. Also keep in mind there are passengers who do have tablets, but don't have cell phones ( such as kids ). Finally, how cool would it be to put some always on devices in your car such as a Nest Cam / Dropcam!
I have two kids with Fire tablets who would really appreciate a connection. I think I will be switching to Verizon's new unlimited plan with some amount of hotspot access because of this.
> I don't get it, though. The article makes it seem like the primary use case is to connect your phones to the car via WiFi, so they can all use the car's 4g connection.
Not sure where you got that idea, the article didn't even mention phones.
My thought would be more towards using the car's wifi for iPads and laptops. Makes total sense when I look at how my nieces and nephews use technology. They're obsessed with iPads, and thats the primary way they consume media.
Also, up until recently, one of the most expensive phone plans you could get (Verizon) didn't even offer unlimited data, and the rates are only 1/4th the price of my car lease. Even without kids, $20/mo for data usage in my car would actually make it so I could downgrade my plan and save money (lots of podcasts on my drive in to work).
I think the main use case is for other devices, like tablets and laptops, that don't have their own radios. Even though most people can in theory tether to their phones, most people also either don't know how to do that, or have data plans that make it difficult or impossible.
With an in-car hotspot, my kids could bring their tablets with them and stream movies, even when I'm not in the car to set up a hotspot on my phone.
I'd also think this would be a big hit for road warriors - the kind of people who live out of their car, and today tend to post up at Starbucks in between meetings to grab some free WiFi. Now, they can just sit in their comfy cars with their favorite music, use the car's hands-free for calls, and work from their laptops.
(Incidentally, one of the things I love about EV's and hybrids is the ability to leave the climate control and entertainment on when parked indefinitely without having to run the engine)
I have a prepaid phone, because I don't want to spend $hundreds/month on an unlimited data plan that I'm only rarely going to use.
But $20/month for unlimited data in my car? That would be worth it just for the 3-4 road trips I take each year. My kid could sit in the back watching numberphile videos the whole time? Yes plz.
> Or is the data connection used by the car in some other way?
They probably will be collecting diagnostic data like Tesla does and it'll be written in the fine print. That is likely the real reason for the 4G modem installed in the car and the rest is just PR spin to encourage people to buy the always-connected vehicles. I fully expect this "free feature" to be paid for by these cars recording which parking lots you visit for Big Box store analytics as well as LEO per-request-fees.
They probably have some navigation stuff, radio, etc. built into the car that would use it as well for the dashboard.
The $20 a month, I suspect, covers Chevrolet's network costs so they can be paid on both ends.
I agree that it is pointless. Much more useful would be the other way around (your car getting data access from your phone). But that doesn't make anyone extra money. I removed the SIM in my car as soon as the free trial ran out.
i think that's a flawed assumption. many don't have close to an unlimited data plan. it would be great to drive while one's kids can play on their ipad in the back. (with the wifi)
So can you just leave your car's electrical system turned on in your garage and use that to provide unlimited Internet service for the whole house when you're not driving?
Sure. I suspect the expense of new car batteries and the inconvenience of having them run down twice a day or so might make it a less optimal choice than just buying internet service.
Sounds like a total gift to folks like ADAC - the German group that publicized their ability to use an available device to breach and make off with 24 cars tested out of a field of <50. Article: https://www.wired.com/2016/03/study-finds-24-car-models-open...
Another point of entry? Eeek. At least it keeps fiction writers like me busy, because, let's face it, creativity is what theorizes holes in systems, then followed by skill to test if they're really there.
They are putting a consumer spin on this but I am willing to bet that this is more important for their future self-driving car and the accompanying logistics. Smart.
Sorry but I don't need a $20 monthly bill on top of my cell bell and everything else. I am curious if this is addition to Onstar costs beyond the first three months? That can be 19.95 on its own (Safe and Sound).
Just make it simple to let my car use my phone's data connection. Volt support Apple Carplay and Android Auto so that shouldn't be all that difficult.
What's the best way to have the OnStar, Car-net, etc hardware removed from the vehicle? I don't want my car connected to the fucking internet. I'm tempted to just pry out the hardware myself, but am curious if the dealer or mechanics will do it for you.
For times when I'm away from my car, a long-range, local 802.11ah network (more than a mile range) would be great. That would allow it sync when parked on the street and connect when you're in the parking lot looking for it.
[+] [-] jameskilton|9 years ago|reply
Everything is managed by OnStar through their device that's factory installed into every new Chevy vehicle. They have had security breaches and had to fix white-hat reported vulnerabilities in the past[1]. This system isn't just "4G wifi as a hotspot", it has almost full access to every system in the car.
Chevy offers this mobile app called MyLink which lets you remote-start, lock, unlock your car using this same connection.
History shows that car manufacturers have not given near enough thought to the security of access to a vehicle. I'm afraid that it's only a matter of time before we have a bot net either using cars, a bot-net that attacks and takes over cars, or both, with the potential of lots of damage and loss of life.
As such I immediately told OnStar to disable service to my car and will be finding and disconnecting the OnStar box (as it still phones home periodically) as I just have no reason to trust such a thing at this time.
[1] https://www.wired.com/2015/09/gm-took-5-years-fix-full-takeo...
[+] [-] tclancy|9 years ago|reply
Before that experience I used to laugh off the idea of a weaponized mp3 file or people taking control of cars remotely. Now I think about that auto-boot USB port and the fact my driver's side door is a toggle to God-knows-what.
[+] [-] Andrenid|9 years ago|reply
So, I'm an Australian. We don't have OnStar but I've heard about it via the net. I keep getting emails for 2 different people's OnStar accounts to my Email address... and OnStar won't do anything about it.
I have a pretty short Gmail address because I signed up early (6 characters), and Gmail's autocorrect/fuzzy email receiving means I get emails for all sorts of people that have mistyped their email and mine is "close" to what they typed.
To give you an idea of how bad this OnStar situation is:
- The emails have all the personal details inside each one. Name, home address, car make/model and various ID/registration details, home phone number, etc.
- It gives me full access to the cars maintenance records via monthly emails with EVERYTHING in the email relating to the car, INCLUDING LETTING ME EDIT IT via a link.
- It gives me a link directly to their OnStar account, and the password is the persons postcode, WHICH IS IN THE EMAIL. There's quicklinks to access the full account, change vehicle details, remotely access various aspects of the vehicle's features, etc.
- I can send directions to their GPS from my browser, which comes up on their screen.
- ... lots lots more "could" be done if I was inclined.
I've emailed OnStar support about it a few times, they don't reply. The closest I get to any form of reply is an automatic message telling me to call them on a "toll free number" (not free for me to call from here!)
PS, Mr Buchner, your 'tires' on your GMC Terrain are low and your oil needs changing urgently. It's overdue by months.
[+] [-] bonestamp2|9 years ago|reply
You might say an internet connected head unit should just be disconnected from the vehicle bus, and there's some merit to that. But, customers want to be able to control the volume from their steering wheel or the head unit should control the subwoofer amp in the back of the vehicle, or change vehicle settings from the head unit display... so the head unit needs to be on the bus to do all of these things.
The goal is to limit what the head unit has access to on the bus. For example, there's no reason the PCM (powertrain control module) should be allowed to receive anything other than high level configuration information from the head unit (switching between standard and sport mode driving profiles for example).
[+] [-] stcredzero|9 years ago|reply
Here's how GM could beat Tesla, along with why it won't happen. GM could just take a look at what Tesla is doing, and do all of the same things, then do certain key things better. From a sheer resources and capability standpoint, GM could beat the pants off of Tesla. I think Tesla is counting on: 1) GM and other big automakers being too set in their ways and 2) GM and other big automakers getting some key things very, very wrong. Security is probably a key example.
It's an oft-cited insurgency move to use the big power's culture against itself.
[+] [-] chrisper|9 years ago|reply
Now it is finally making it to normal cars. My 2014 Passat has it as well. However, I didn't activate it since it is tracking my location.
On the other hand, stuff like Onstar can save lives.
http://www.mercurynews.com/2014/10/14/san-jose-mount-hamilto...
[+] [-] mtgx|9 years ago|reply
[+] [-] nommm-nommm|9 years ago|reply
Yeah! No kidding!
I read last year about how Nissan's Leaf API was entirely unauthenticated, all you needed was the VIN to mess with people's climate control.
https://www.troyhunt.com/controlling-vehicle-features-of-nis...
[+] [-] awqrre|9 years ago|reply
[+] [-] js2|9 years ago|reply
[+] [-] massysett|9 years ago|reply
When I got my new 2016 Honda Accord I was looking forward to some good streaming music in the car. I read that the built-in stereo comes with Pandora. I also knew that the built-in stereo can also access the Internet. "Cool," I thought. "I can fire up the hotspot on my phone, connect the car to the Internet, then the Pandora will connect and do its thing."
Nope. Turns out that the stereo can connect to the Internet. It's got Android. But the most useful thing I can do is browse the Web on my car stereo screen. Something I have never, ever wanted to do. Apparently it also connects to some useless thing called Aha Radio, which hasn't been updated in years. The Pandora can't even use the Internet connection! It only works through Bluetooth or, apparently, though hooking up my phone via a cable.
So the stereo's Internet connection is practically useless, and my only streaming options work through the phone, which is generally a glitchy experience. Though I must say, the Pandora built in to the car is generally better than Apple CarPlay, which has been a huge disappointment.
So hopefully Chevy has something decent in their car other than an Android web browser on the car screen, and hopefully it's not just Apple CarPlay or Android Auto or anything like them, because in my experience the phone makers are all about stripping away hardware buttons. When I'm driving the hardware buttons are far superior to finicky on-screen buttons.
[+] [-] ben1040|9 years ago|reply
CarPlay really seems to suck for any audio app that isn't Apple Music. It does seem to work _great_ for Apple Music, so if that's your preferred music app then you'd be pretty happy.
[+] [-] js2|9 years ago|reply
It is however touch screen based. And I'm thankful for CarPlay since Mazda doesn't support CarPlay nor Android Auto and Mazda's UI is awful.
[+] [-] mti27|9 years ago|reply
[+] [-] jandrese|9 years ago|reply
[+] [-] vollmond|9 years ago|reply
[+] [-] p49k|9 years ago|reply
[+] [-] mti27|9 years ago|reply
[+] [-] mr337|9 years ago|reply
[+] [-] tyingq|9 years ago|reply
But don't most people that can afford this already have unlimited (or close to it) data direct from the phone?
Or is the data connection used by the car in some other way?
[+] [-] beamatronic|9 years ago|reply
[+] [-] TYPE_FASTER|9 years ago|reply
[+] [-] lojack|9 years ago|reply
Not sure where you got that idea, the article didn't even mention phones.
My thought would be more towards using the car's wifi for iPads and laptops. Makes total sense when I look at how my nieces and nephews use technology. They're obsessed with iPads, and thats the primary way they consume media.
Also, up until recently, one of the most expensive phone plans you could get (Verizon) didn't even offer unlimited data, and the rates are only 1/4th the price of my car lease. Even without kids, $20/mo for data usage in my car would actually make it so I could downgrade my plan and save money (lots of podcasts on my drive in to work).
[+] [-] empath75|9 years ago|reply
[+] [-] URSpider94|9 years ago|reply
With an in-car hotspot, my kids could bring their tablets with them and stream movies, even when I'm not in the car to set up a hotspot on my phone.
I'd also think this would be a big hit for road warriors - the kind of people who live out of their car, and today tend to post up at Starbucks in between meetings to grab some free WiFi. Now, they can just sit in their comfy cars with their favorite music, use the car's hands-free for calls, and work from their laptops.
(Incidentally, one of the things I love about EV's and hybrids is the ability to leave the climate control and entertainment on when parked indefinitely without having to run the engine)
[+] [-] lotharbot|9 years ago|reply
But $20/month for unlimited data in my car? That would be worth it just for the 3-4 road trips I take each year. My kid could sit in the back watching numberphile videos the whole time? Yes plz.
[+] [-] fictioncircle|9 years ago|reply
They probably will be collecting diagnostic data like Tesla does and it'll be written in the fine print. That is likely the real reason for the 4G modem installed in the car and the rest is just PR spin to encourage people to buy the always-connected vehicles. I fully expect this "free feature" to be paid for by these cars recording which parking lots you visit for Big Box store analytics as well as LEO per-request-fees.
They probably have some navigation stuff, radio, etc. built into the car that would use it as well for the dashboard.
The $20 a month, I suspect, covers Chevrolet's network costs so they can be paid on both ends.
[+] [-] myowncrapulence|9 years ago|reply
Also, this way you can add another middle man that makes money data-mining your browsing habits.
[+] [-] unknown|9 years ago|reply
[deleted]
[+] [-] bonestamp2|9 years ago|reply
[+] [-] nissimk|9 years ago|reply
[+] [-] jonknee|9 years ago|reply
[+] [-] oculusthrift|9 years ago|reply
[+] [-] nradov|9 years ago|reply
[+] [-] in_the_sticks|9 years ago|reply
[+] [-] lgleason|9 years ago|reply
[+] [-] brandon272|9 years ago|reply
[+] [-] 6stringmerc|9 years ago|reply
Another point of entry? Eeek. At least it keeps fiction writers like me busy, because, let's face it, creativity is what theorizes holes in systems, then followed by skill to test if they're really there.
[+] [-] phkahler|9 years ago|reply
https://www.forbes.com/sites/thomasbrewster/2017/01/15/polic...
The TLAs use things like OnStar to spy on people.
[+] [-] csours|9 years ago|reply
//disclaimer: I work for GM, but not in this area.
[+] [-] davis|9 years ago|reply
[+] [-] Shivetya|9 years ago|reply
Just make it simple to let my car use my phone's data connection. Volt support Apple Carplay and Android Auto so that shouldn't be all that difficult.
[+] [-] MorePowerToYou|9 years ago|reply
[+] [-] matt_wulfeck|9 years ago|reply