Your Car Could be Remotely Accessed by Prior Owners

Nowadays, many vehicle renters and owners can remotely lock/unlock, start and track locations of their cars using an app on their phones or computers.

It’s convenient, helpful and hi-tech. But what happens when those cars are sold or leased to a new driver?

Previous renters are instructed to unpair their apps from a vehicle when they return it to the rental place or leasing dealership. But many don’t. Maybe they forget. Maybe they don’t know how. Maybe they just can’t be bothered.

Or maybe they don’t want to for nefarious reasons. (Let’s be honest. We just can’t trust anyone anymore.)

Dealers are able to “master reset” these cars. And they should. But you can’t count on that.

According to a post by Krebson Security, a previous car owner discovered that he could still gain remote access to his old vehicle years after his lease ended.

The previous owner, Mathew Marulla, leased a Ford Focus in 2013. He returned the car to Ford at the end of his lease in 2016. Recently, he received an email from Ford.com telling that the clock in his car (that he had returned 4 years ago) was set incorrectly.

Surprised by the email, and curious about whether he could still use his old online credentials, Marulla logged on and found that he still had access to the car. He was able to track the vehicle, as well as remotely start, lock, and unlock the vehicle.

“It was a three-year lease from Ford and I turned it in to Ford four years ago, so Ford definitely knows I am no longer the owner,” Marulla said.

“I can track its movements, see where it plugs in [it’s an electric car]. Now I know where the current owner likely lives, and if I watch it tomorrow I can probably figure out where he works. [emphasis added] I have not been the owner of this vehicle for four years. Ford knows this, yet they took no action whatsoever to remove me as the owner in this application.”

It’s scary to think that previous owners/renters can find out that kind of information about you. Especially if any one of them decides to use the opportunity to their own advantage like stealing your car’s contents.

They could also likely find your home address in your vehicle and stop by your house. (As I said earlier, you can’t trust anyone nowadays.)

This isn’t an isolated incident

ARS Technica posted an article about another situation where this happened.

According to the post, five months after Masamba Sinclair returned the vehicle to the rental agency, his app still has control over the vehicle. Even though many other people have rented the vehicle after he turned it in, FordPass still allows Sinclair to track the location of the vehicle, lock and unlock it, and start or stop its engine.

Sinclair brought the matter to Ford’s attention, both through its website and multiple times on Twitter. So far, Ford has done nothing.

“I have been opening the app and tracking the vehicle almost every day to see if my access is still there, and sure enough, I can see exactly where my old rental, affectionately named ‘The Beast,’ is at any given moment. This means that I can not only find this rental car whenever I want, but I can also unlock the doors and help myself to anything inside.” ~Sinclair

The article by ARS Technica warns:

“It wouldn’t be surprising if remote apps from other third-party developers of car manufacturers also maintain access long after they’re rented or sold to new people. The lesson from Sinclair’s experience is a classic renter-and buyer-beware. The experience is also pertinent to survivors of abusive relationships or stalkers. Before anyone uses a new car, they should learn how to perform a full factory reset of the infotainment system and ensure it’s done. [emphasis added]

If you’re thinking of buying a used car, make sure the previous owner’s control and/or information can be reset before purchasing it. If you’re purchasing through a dealership, ask them to help. If it’s a private sale, ask a manufacturer dealership for help.

Check out the FTC Consumer Information site for more information on clearing out your own information before selling your own car.

~Shereen

Join Personal Defense Connection on MeWe and/or Tumblr

Helping people learn threat awareness, defensive mindset and defensive skills. Follow PDC on MeWe or Tumblr

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

ETH Berlin + Asure.Network = Social impact

Solana Wallet Q&A

Decentralizing the Front Page of the Internet

Ancient Uses of Cryptography: Four Examples that Pre-Date the Internet

Marketing IDO platform CRODO

Episodic Memory and Blockchain

Summeris Launchpad: $SUM Launching on Pinksale

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Personal Defense Connection

Personal Defense Connection

Helping people learn threat awareness, defensive mindset and defensive skills. Follow PDC on MeWe or Tumblr

More from Medium

No wonder no one feels like living

Visiting a friend

The Hardest Conversation of My Life

Sarah and Patrick

The Art of You