May 23, 2020
Your Car Could be Remotely Accessed by Prior Owners
Nowadays, many vehicle renters and owners can remotely lock/unlock, start and track locations of their cars using an app on their phones or computers.
It’s convenient, helpful and hi-tech. But what happens when those cars are sold or leased to a new driver?
Previous renters are instructed to unpair their apps from a vehicle when they return it to the rental place or leasing dealership. But many don’t. Maybe they forget. Maybe they don’t know how. Maybe they just can’t be bothered.
Or maybe they don’t want to for nefarious reasons. (Let’s be honest. We just can’t trust anyone anymore.)
Dealers are able to “master reset” these cars. And they should. But you can’t count on that.
According to a post by Krebson Security, a previous car owner discovered that he could still gain remote access to his old vehicle years after his lease ended.
The previous owner, Mathew Marulla, leased a Ford Focus in 2013. He returned the car to Ford at the end of his lease in 2016. Recently, he received an email from Ford.com telling that the clock in his car (that he had returned 4 years ago) was set incorrectly.
Surprised by the email, and curious about whether he could still use his old online credentials, Marulla logged on and found that he still had access to the car. He was able to track the vehicle, as well as remotely start, lock, and unlock the vehicle.
“It was a three-year lease from Ford and I turned it in to Ford four years ago, so Ford definitely knows I am no longer the owner,” Marulla said.
“I can track its movements, see where it plugs in [it’s an electric car]. Now I know where the current owner likely lives, and if I watch it tomorrow I can probably figure out where he works. [emphasis added] I have not been the owner of this vehicle for four years. Ford knows this, yet they took no action whatsoever to remove me as the owner in this application.”
It’s scary to think that previous owners/renters can find out that kind of information about you. Especially if any one of them decides to use the opportunity to their own advantage like stealing your car’s contents.
They could also likely find your home address in your vehicle and stop by your house. (As I said earlier, you can’t trust anyone nowadays.)
This isn’t an isolated incident
ARS Technica posted an article about another situation where this happened.
According to the post, five months after Masamba Sinclair returned the vehicle to the rental agency, his app still has control over the vehicle. Even though many other people have rented the vehicle after he turned it in, FordPass still allows Sinclair to track the location of the vehicle, lock and unlock it, and start or stop its engine.
Sinclair brought the matter to Ford’s attention, both through its website and multiple times on Twitter. So far, Ford has done nothing.
“I have been opening the app and tracking the vehicle almost every day to see if my access is still there, and sure enough, I can see exactly where my old rental, affectionately named ‘The Beast,’ is at any given moment. This means that I can not only find this rental car whenever I want, but I can also unlock the doors and help myself to anything inside.” ~Sinclair
The article by ARS Technica warns:
“It wouldn’t be surprising if remote apps from other third-party developers of car manufacturers also maintain access long after they’re rented or sold to new people. The lesson from Sinclair’s experience is a classic renter-and buyer-beware. The experience is also pertinent to survivors of abusive relationships or stalkers. Before anyone uses a new car, they should learn how to perform a full factory reset of the infotainment system and ensure it’s done.” [emphasis added]
If you’re thinking of buying a used car, make sure the previous owner’s control and/or information can be reset before purchasing it. If you’re purchasing through a dealership, ask them to help. If it’s a private sale, ask a manufacturer dealership for help.
Check out the FTC Consumer Information site for more information on clearing out your own information before selling your own car.
~Shereen
