Attached: 1 image
As it turns out, Volkswagen has been collecting extensive geo data from all their electric cars and made them available online in an AWS bucket. Almost 10TB of geo traces from 15 MiO cars. Amazing detail and patterns. This is why I don't want a smart car 🤯 https://events.ccc.de/congress/2024/hub/en/event/wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen/ #Volksdaten
All you have to do is monitor the network traffic and then scan any AWS subdomains/IPs that pop up.
[edit] this makes me think… it’s not really possible for a secure connection from all of VW’s vehicles to an S3 bucket, is it? Anyone can pull the key from any of the millions of vehicles making the connection. Then they can dump whatever they want into the bucket.
You could secure it using an IAM user with credentials but then those credentials would be available on all vehicles.
If the vehicles had direct access to S3, maybe that’s why the bucket was public? But you could also just leave it available to the public.
But if that was the design, you should sweep the bucket on a regular basis to make sure there aren’t any objects over x hours old or something like that.
All you have to do is monitor the network traffic and then scan any AWS subdomains/IPs that pop up.
[edit] this makes me think… it’s not really possible for a secure connection from all of VW’s vehicles to an S3 bucket, is it? Anyone can pull the key from any of the millions of vehicles making the connection. Then they can dump whatever they want into the bucket.
You could secure it using an IAM user with credentials but then those credentials would be available on all vehicles.
If the vehicles had direct access to S3, maybe that’s why the bucket was public? But you could also just leave it available to the public.
But if that was the design, you should sweep the bucket on a regular basis to make sure there aren’t any objects over x hours old or something like that.