Security Risk When Buying a Second Hand App Connected Vehicle

How do you feel about this;-

• Your family or yourself is being stalked by a stranger who seems to know precisely where you are all the time?
• A stranger can access your vehicle any time and take what he/she wants without forcefully breaking in?
• Being locked out of your car without your consent?
• Your car being unlocked without you realizing it?

If at the very least you’re mildly uncomfortable with the thought, read on.

Consumer buying behavior is changing today and much of it is spurred by development of apps that touts CONVENIENCE as its main value.

Forgot your wallet? Just buy credit in numerous virtual wallets like Boost or GrabPay using your credit card and pay using those eWallets
Need a ride? e-Hailing apps aplenty
No coins for parking? Use apps like JomParking and Smart Selangor Parking

It’s no different when it comes to cars as several automakers brings convenience to smartphone users by developing apps that links their vehicles with their phones. Applications such as the PROTON Link and the BMW ConnectedDrive may allows users to;-

• Check fuel range
• Locate your vehicle via GPS
• Remote lock/lock
• Activate the horn
• Activate the headlights
• Open/close the windows
• Ventilate the vehicle
• Remote climate control
• Check oil pressure
• Charging status (for hybrids)
• Check electric range (for hybrids)

In some cases, you can even plan your travel destination and send the destination to the vehicle’s navigation system.

All done through the convenience of the vehicle app.

BUT

Such conveniences also poses a security risk.

The picture above is the BMW ConnectedDrive app that’s linked to a BMW 740Le xDrive in my phone. I changed my phone mid last year and forgot about the app until recently I took an X3 for review and wanted to link the SUV to the app to see how it contributes to the ownership experience.

Then I realized that my account was still linked to the 740Le – the model I took for review almost two years ago. (The review can be read HERE)

After two years, I am still able to know its whereabouts and though I didn’t try it, may still be able to access certain functionalities of the car.

I was thinking if I could do this, what would happen if some unscrupulous individuals who might have dubious intentions gain access to the car?

• Putting your laptop in the car, thinking it’s safe?
• Parking in a secluded spot believing yourself safe because no one knows you’re there?
• Placing your kids in the car thinking it’s ok for a short hop into the convenient store to buy stuff?

I suspect that in the future, we may be seeing more car manufacturers developing apps to enhance phone-vehicle integration. As it is, BMW has launched certain models that allows you to unlock and start your car using the smartphones Near Field Communication (NFC) function. Tap your phone to the door and leave it near the Start button and you’re good to go.

You could think of it this way; with new technology, you’re not getting two keys with your car but three. So if you’re buying a second hand car that has this feature, be sure you remove the third ‘virtual’ key.

How to rectify this?

The good news is most apps presently allows only one account to be connected to the vehicle. The moment a second account/phone logs in, the first account is automatically removed. This is the same for the BMW ConnectDrive app.

Here’s how you connect your phone to a BMW ConnectedDrive app

Connecting ConnectedDrive

In the case of the X3 where I logged in using another phone/account, I received the following email;-

Not only that but the ConnectedDrive app no longer lists the X3 as a vehicle I can select.

 

So always remember, especially in this modern era of virtual connectivity; log in to the pre-owned vehicle you’re buying as early as possible. If you’re not certain if it’s sufficient, consult the nearest authorized service centre. BMW models such as the F10 5-series and F48 X1 SUV has ConnectedDrive services and it won’t be long before we see X70s be sold as second hand models.

All things considered, you won’t hand over your phone without first erasing/logging out your account(s) to a second hand buyer; you should adopt the same cautious attitude when buying a second hand ‘smart’ car.