Researchers drove a Chinese EV into an underground mine. It kept calling China anyway.
Researchers drove a NIO ES8 electric SUV deep into a Norwegian underground mine specifically to sever its external connections. The car kept attempting to reach servers, most of them located in China. These findings echo broader concerns about hidden data collection, similar to how a surveillance app was built to covertly target users without their knowledge.
That finding sits at the center of Project Lion Cage, a multi-year study initiated in 2022 by Tor Indstøy, a risk management and threat intelligence executive at Telenor Group. Indstøy purchased the NIO ES8 as a dedicated research platform.
The project arrives as Chinese EV brands expand across European markets with assurances about local data processing. Observed network behavior appears to contradict those assurances.
https://autos.yahoo.com/ev-and-future-tech/articles/researchers-drove-chinese-ev-underground-155725649.htmlOpen linkView original on lemmy.world
155 replies
Chinese ev bus behaves like every John Deere tractor, Tesla, amazon ring doorbell, windows pc, mac, smart tv, iphone and android device , and probably every other car made since 2020.
"But China bad" is getting pretty old and frail in comparison to the domestic and international predations and privacy invasions of US tech businesses and government
A couple things, you are absolutely correct about the hypocrisy. All modern major manufacturers are doing the same thing. Calling out China without mentioning this is definitely a disservice.
On the invasion of privacy through spying, China is undoubtedly the worst followed by the US and Russia.
When it comes international predations I think you are correct. The US is the worst. Russia next then Israel and China. France and Germany probably fit in here somewhere as well with the selling of arms around the world.
Your ranking is missing the top spot. Here is the revised list
I think the damage US corporations have done is truly unparalleled. When it comes to big tech China still pales in comparison in the Western world. That is until you consider Tik Tok, which is the most influential of social media for the under 30 market. Is Tik Tok really a bad influence or better or worse than something like Facebook is very debatable as well.
I would argue that Tiktok would not have such an outsized effect if US corporations had not turned people into wage slaves.
Wasn't the big concern with TikTok entirely around how people were talking about the Palestine Genocide while US controlled social media had effectively blacked it out?
Lol probably, Tik Tok is also a lot different for the American audience. Things that would never be allowed in China, especially for young adults, are permitted in the US. Of course you could argue they are just doing what US companies do in the free for all that is social media.
I'm sorry but there's no way china is worse that the US's big tech.
It is a matter of opinion of course, but the amount of surveillance, firewalls, and censorship combined with the fact that it is mostly state sponsored really puts China in its own category.
Certainly the US has caused much more overall harm on a global scale though.
They are, but only if you're using their products and live there. China has a bigger hold on China.
USA has a bigger hold globally, but spying to a slightly lesser degree.
USA wants to catch up to China on the local level though, and are definitely trying hard. But they didn't set up the camera infrastructure in time.
I doubt it. Russia doesn't have the infrastructure or the manpower to compete with a modern surveillance state. And the US doesn't operate alone, it's part of the Five Eyes network, including Australia, Canada, New Zealand, and the United Kingdom. Nevermind NISRF.
Part of what makes the US network horrifying is how many other countries are blithely along for the ride.
What they lack in technology they make up for in brutality. Also, they aren't that far behind building out their dystopian surveillance state.
https://therecord.media/russia-upgrades-rules-for-digital-spy-system-sorm
That's how surveillance works
and theres been tons of coverage about that, and how it can be used against you.
To pretend theres radio silence on it, and this is all just being big mean to china is the real hypocrisy.
ah, the "DON'T CRITICIZE CHINA" is getting even fucking older and frailer in comparison.
Especially when it says right in the article that its doing the exact opposite of what was promised.
Which, if any other countries product was doing that, you'd have a fit over it and not be sitting there going having a big whinge fest about the unfair persecution.
We put a machine with a radio in a room and the radio continued to try and function.
This is why we cannot import low priced, high quality foreign made electric engines.
Why? It's the same tired story, used to scare people who know nothing about communications technology. It's all about making "Buy American" a national security issue.
If Brazil or Italy or even the dreaded Russia was being accused of this, why wouldn't we stare sideways?
I mean, remind me again why I'm trusting autos.yahoo.com on their reporting? Isn't Yahoo a subsidiary of Apollo Global Management, a company with deep ties to the Epstein human trafficking cartel?
Yeah I'd be more interested in what it's sending. Go into a mine with your smartphone (or just an LG TV) and it'll be continually reaching out as well... but WHAT it's trying to receive or transmit is important.
In a way that they promised it wouldnt.
Which is kind of the important thing all you tankies seem to be willfully overlooking.
If anyone else was promising device would do X, and did Y instead, it would also be a cause for concern. Regardless of who did it.
If it was brazil, or Italy, you wouldnt be having this same tantrum over calling them out, as you are over calling out Dear China.
he says, while having a tantrum over no one taking china, a notorious angel state that totally doesnt do horrific shit, at its word of being a good boy.
Is reminding you of the questionable history of Apollo Global a tantrum?
No,thats just a poor attempt to shift the narrative away from your tantruming and away from China so you can shut down critical discussion.
It absolutely is a national security issue!
It's not exclusive to the US, either. It's even worse when you use American digital services outside the US. I live in Europe and it is especially bad because we have very strong privacy laws and require companies which offer digital services to have their servers in Europe.
Tell it to Volkswagen
Never said they were doung the right thing, just pointing out that if the behaviour warrants complaint, then complaint shoud be levied agaisnt everyone behaving that way.
But hey, you keep on with your black and white opinions.
Yes, exactly.
And theres been extensive coverage of western cars spying and doing nasty stuff.
But we get a news story about Chinese cars, who promised local data processing, still trying to connect back to chinese servers, and suddenly the tankie hands start wringing about people being so mean to poor poor china.
because we can be big mean to western states, but we can't be factual about poor poor china. thats just racist.
Your arguments would carry more weight and might even be worth debating if you could make them objectively without attempts at petty insults, and pretentions of victimhood. As it stands, you're just kinda predictable and boring. Moving on...
I'm a lot more worried about what domestic companies are doing with my data than Chinese ones.
Yeah, I was just going to say, I honestly don't really care if the Chinese government knows where my car is.
the classic "Why should I care about my privacy, I'm not doing anything wrong" attitude.
No. The Chinese government has no power over me. It has nothing to do with "doing anything wrong, "
I couldn't care less if the Chinese government sees my car "doing something wrong" (whatever the fuck that even means in this context. Parking somewhere I'm not supposed to?). I'm not Chinese and have never been to China.
I'll worry more about my own government's very real creation of a dystopic surveillance state right here at home.
Have you ever heard about selling things, or data being leaked?
At this point, with literally every single company out there selling everything from my IP, to my toenail size to the lowest bidder, is there really anything left to sell?
I'm not saying we shouldn't fight for privacy, I'm saying for all practical purposes, we've already lost the fight. That's not a reason to not keep trying though.
But his perfect, wonderful china would never do that! Its only the vile, evil, western countries that do such vile evil things!
Yeah dude that's exactly what I said. Well done.
Assuming you are in a western nation, There is a degree of legitimacy to be taken with the fact that China are far less capable of weaponising that data against you personally, than the US
What about other things, like remotely stopping your car from operating?
To what end?
Mass disruption to transport during conflict with cascading effects. Or worse, mass casualties from remote control.
And again I ask... To what end?
Why does there need to be an end?
Obviously it would keep calling...
The point was likely to see what would happen if they could be 100% sure it couldn't connect in anyway.
Before deciding if it's worth attempting to find every conney, you need to verify what happens if you did succeed.
Like, finding out it bricks every vehicle after 24 hrs means it's useless to bother and they need banned.
Like the Polish trains that were remotely disabled when taken in at a competitor's maintenance shop https://hackaday.com/2023/12/14/polish-train-manufacturer-threatens-hackers-who-unbricked-their-trains/
A lot of ground was covered with so little info. How did they the employee contact hackers? Are they white hat or did they scour The Dark Web for Polish tech support? What was the issue that unbricked a train?
yep, security departments of major corporations scour the dark web constantly looking for credentials that are stolen or other company assets for sale, or rumors about the company. Its a key part of finding out if you've been hacked. Hackers sell or brag about what they take. So finding hackers if you are already doing that activity is not too huge a project.
As long as it doesn't brick the thing I'm willing to go hunting with a hammer and chisel to cut the thing off, not like I need more GPS than my phone or anything like that
LMK your test results. Mod IS LIfe!
Why on Earth wouldn't it keep trying? That's how signals work. If my router goes down my computer is going to keep trying to connect to it even though it's off. That's not fucking news.
Yeah, I had the same thought when reading this
What a weird article
My assumption would be that they drove the car into the mine to see what would (or wouldn't) work if the vehicle was cut off from the mothership. My hunch is they didn't really find anything of interest so this is what gets reported.
Also all us cars do the same thing and I would much rather have my data in China than the US.
Thank you!!!
If I’m reading correctly, they specifically tried to stop it from doing so and even in what is essentially a faraday cage it keeps trying to link with Beijing to spill the tea, not exactly what you want if you “own” a product
Yeah, and that's how connections work.
It doesn’t specify in the article if they toggled the WiFi switch off in the OS, one would assume they did before driving it into a mountain.
If so, not cool to keep calling home. If not, PEBKAC error
You really think a car tries to "call home" using WiFi?
To the surprise of whom?
ANY device that relies on radio signal communication for any of its functionality, taken anywhere (underground mine, parking garage, Antarctica, Santa's workshop, etc), and it'll try to maintain it's connections. That's just what they do.
Okay, but China Bad
It would be extremely noteworthy if it stopped once it was out of range, because how would it know?
This article is so stupid with the dumbest fearmongering clickbait title -
Anything that calls home will try to call home. Connection or not. You put an LG tv (edit: just found out that when LG and TV are put together without a space, it gets censored?) in a faraday cage and it will try to phone home. There's no reason it would suddenly stop doing that because there's no point to adding another line of code to get it to stop when it doesn't need to.
Not to mention that the important part is this:
Now compare that to a plethora of other car manufacturers that don't even bother to encrypt your data and explicitly say that you will be tracked by them and have your data sold.
https://cybernews.com/privacy/mozilla-cars-track-sexual-activity-sell-data/
My takeaway was that this was the important bit
Iirc LG TV is a derogatory slang for LGBT, so maybe CA have the term censored.
What? Really? I thought you were joking. For context, why is calling people LG TV a slur?
News to me, but I could easily see someone using LG TV to refer to the LGBT as a way to demean the use of LGBT.
Today I learnt! Thanks
this. I seen people try to just use hostnames to block the LG telemetry, and the result is it just phone home harder, the logs just show it spams thousands of requests per second. Only way to stop it is to relay it to a fake server to return a fake response.
My BMW checking if my bmw subscription is active when I'm trying to enable seat heater
I wonder what the security is like. I'd love to know how difficult it would be to set up a mock-service to just tell it you have everything.
You'd expect there to be encryption and some kind of certificate validation to check the response is trustworthy, but given what we now know about the CAN bus that many cars use, and how vulnerable it is to attack, it suggests the motor industry is way behind the times in terms of security.
It would just be easier to wire it directly to a switch.
Yeah, that’s the thing. It’s not like a transistor in a microchip or something; it’s a wire you can work with.
I bet BMW makes the disassembly needed an absolute pain, though.
Fbi wants to know your location
Oh NO! China might harvest the kind of data that Google, Meta, Tesla, and other US companies have had a monopoly on stealing.
Whatabout the US? Uigher death camps? Whatabout ICE? Single-party rule? Whatabout neither top 2 party in the US being socialist?
The thing is, you agreed that google and meta could have that data. Nobody signed any terms for the bus..
“You agreed that Google and meta…”
You sure about that? Did you read every term and condition? Did you agree that they would keep a complete record of your exact location? Did you agree that they will record your voice using the Bluetooth hack? Did you agree that Facebook should be able to buy your medical data off the data market and combine it with your profile?
Gee, no, I didn't agree. It's a major part of why we are talking on this platform, and not Meta nor Alphabet's platforms.
It's been known for years that Meta has ghost profiles on people who have never signed up for Facebook.
What? No no. Why would they ever do that?! Didn’t you read @tar_alcaran’s comment which I replied to? That we give data to Facebook after agreeing to it!
In the US, cars collect all kinds of data on everyone in them including passengers and manufacturers claim it's okay because getting in the vehicle counts as consent..
I'm thinking to mod my garage to be a faraday cage, that is, after I build my garage. Maybe it should be portable, too.
I remember reading that meta tracks you even if you don't have a Facebook account. It collects information on you from any photos your friends add with you in it or by taking your contact information from your friends phone or the wide net of meta trackers that are spread around the internet. Meta collects that information to create a shadow profile of you without you even knowing.
So meta does the exact same thing as the bus.
Worse imo. Particularly for someone who isn't from (or in) China.
did I though? In that 100 page small print doc designed to hide everything from the user? That they gave me a check box to agree to after I bought the device?
Ah, because neither Google nor Apple track their users and would never, ever share said data with US (or other) agencies... right? RIGHT?
Sure. Don't worry about this bad behavior, because others engage in it, and it's not like anyone calls out US tech privacy issues. I struggle to imagine someone naturally reacting this way. Are you for real?
I agree it is something we should worry about and pay attention too, but just because something occurs doesn't mean it was nefarious on purpose. Apple is better than many, but let's say you have an iPhone. The iPhone is constantly reaching out and reporting it's location to the findmy app that is only accessible by the users. If that phone is in a cave performing this test, it will be reaching out continuously similar to this car. Apple doesn't sell that data, but where it becomes a breach of privacy is that if a judge gives a warrant, Apple has to turn it over. (So suddenly it isn't only accessible to the user meaning verification is NORMALLY required to allow Apple to access the data, but they could bypass said verification.
So does that mean no one should ever enable find my on their devices... Maybe, but people weigh it against whatever they find useful about it.
What I'm saying is just because it's China doesn't make it any worse than devices and cars phoning home to US agencies/corporate entities. Might be fuckery from both sides but I don't get the disproportionate uproar.
Step 1: make a PiHole
Step 2: examine every thing the PiHole blocks from calling home
Step 3: research small holdings
Step 4: throw it all out and go farm Llamas
Seriously, I own a Firestick as a jellyfin client. It's network access is limited to local only. Anyway, here's one entry from that Firestick on one PiHole:
global.telemetry.insights.video.a2z.com 42590Number is the number of times my PiHole has smacked it down. One entry, from one stick, to one PiHole (I have a redundant one too).
Lol wut. What kind of scaremongering BS article is this?
"FIRE UP THE PRESSES!"
I have no doubts that my Japanese car would do the same. It's probably sending my conversations that it is constantly recording through the hands free calling microphone too. The world needs to wake up and realized we lost this battle years ago.
Have to assume that all the info has been fed into some LLM somewhere at this point. Somewhere there's probably a computer better at replicating people's voices to other computers than the people they're mimicking. Existing databases are the new world now in terms of stripping them for resources, and new ways of thinking of chopping them up and packaging them are where all the innovation is.
Next will be injecting fake records into all the databases so another program will think the record as a whole is real. A person won't be the person, they'll be the database entry.
The point was to try what happens when the telemetry system fails to contact home for a prolonged time.
So they proved that a telemetry system attempts to phone home in areas with limited connection? Truly groundbreaking. Nobel Prize incoming.
So if I take my phone into a parking garage, and I see the little icon for roaming, have I suddenly done an experiment worthy of publishing?
Are you being purposely obtuse? It was to see if ANYTHING would happen specifically after it has been "offline" for an extended period of time. Its really not that hard to understand.
And nothing happened... This whole attempt at a gotcha is self-defeating at best, vacuous at worst.
If you have had a reason to assume that the phone might get bricked by you doing that, yes. How is that not obvious?
I don't have any reason to assume this.
Then why would you even make that experiment in the first place?
I have Chinese manufactured IP cameras. they do not connect to the internet. yet, they still attempt to connect to Chinese servers at least once a minute.
this has been going on for at least 15 years.
Via?
I have an Chinese manufactured American developed phone. It connects to an American server frequently.
difference is, China has been caught multiple times creating backdoors into their hardware through software.
I guess that means America is just better at foreign espionage than China 🤣
Now try the same experiment with cars from other countries.
And then let's hear from someone who can tell the world how to disable this anti-feature without breaking the car that we bought and paid for.
Oh no think of our own GDPR compliant surveillance. (it's still surveillance)
I'd like to not be spied on. But if forced to choose, I would rather be spied on by a foreign goverment than a domestic one.
Why not both? You're only choosing your data broker.
We shouldn't be capitualting to any form of spying either way. In the first place, why is a vehicle phoning home? While I disagree, it's still somewhat thinly understandable if the CarPlay or Android Auto system is doing it but if not, why?
Maybe it's because I have an old Mitsubishi from almost a decade ago with a fully offline third party car entertainment system that came with it but it runs perfectly fine without any of this nonsense.
Why? At least with a domestic government you can vote and lobby for data controls. GDPR, etc.
If I take my cellphone into a cave it too will keep calling home.
It's weird that they didn't use a Faraday cage which should have been way cheaper.
How is that weird? Do you know how much metal costs these days? The man hours to build a bus sized faraday cage and make sure it’s 100% secure? What do you do with your massive cage when you’re done, how much effort to scrap or resell it or store it?
They just had to spend a few bucks on petrol with this solution. It’s elegant, cheap, wastes almost nothing. Repeatable. Works with any size vehicle. It’s perfect.
Few bucks of petrol eh
Oh right it’s an EV lol 🤦♀️
No, but how did they get it into the underground space? Elevator? Or there’s a way to drive in which still prevents all signals getting out?
It's Norway, we love tunnels and tunnel accessories. I'd not be surprised if they had to turn down offers of places to do it.
Yes, mining tunnels tend to have ways to drive in.
Also, they are inside mountains.
There are doors in mines to seal off areas(and keep balrogs from disturbing crews), so drive it deep, close to the doors and you got signal isolation
Petrol you say? Is this not an EV bus?
Petrol is for the driver
Fair. I'm not gonna "yuck" someone else's "yum".
They could probably just drape the whole bus with a bunch of chicken wire (or wrap it) for a makeshift Faraday cage. I doubt that would take more than an hour or so.
Certainly cheaper and easier than building up a bus-sized Ferriday cage.
Faraday cage has to be designed with the wavelength in mind. Chicken wire makes a remarkably shitty faraday cage.
I've seen big Faraday cages in large companies when I was young. It's never a one-shot project and it doesn't cost that much.
Net income is multiple billions. Hence my question.
It does not cost much, but it costs many times more than just driving a bus into a mine.
Do you think they mined out a mountain just for this project?
I highly suspect they used and already existing mine. Which is cheaper still. Unless it said somewhere in the story about them digging the mine specifically for this.
Cheaper than driving it into a mine?
Somebody smarter than I will definitely delve into the guts of incoming Chinese EVs and figure out what part(s) to strip to stop this...
And if you're in America and you have an EV, it's statistically likely to be a Tesla. Tesla has starlink compatibility baked into their cars too and you'd better believe that sweet juicy data is being shared around.
If I was stuck with a Tesla against my will, I'd at least try the same thing for it, too.
A more honest researcher would say "bought any vehicle from x country and it kept trying to contact servers in x country even after driving it into a mine". They lose credibility when they try to insinuate that this only happens with EVs and only with China made vehicles.
I have no idea what the point is of driving it into a mine? Of course the client will keep trying to reconnect to the server, that's how software usually works...
Can't this be solved with legislation? I mean, all they have to do is say "no vehicles may be sold within our borders if they attempt to communicate with any servers." Vehicles never did this 15 years ago and it's insane they operate like massive phones with wheels now.
that would be the only sensible approach, but we all know it will never happen
And this is exactly why runor has it military installations in my country don't allow EVs to enter at all.
China isn’t the only one
https://wikileaks.org/vault7/
With all our formidable intelligence and NSA capability and massive massive funding, no one can tell whats in those communications after all this time huh. We even have physcial access to the devices and we still cant figure it out. Next time we are told the government needs to remove citizens constitional rights to privacy or needs us to use insecure encryption keys, we should all question what the hell for. And next time I hear "Israel helps us with our intelligence" I want to hear what they came up with in understyanding what chinese devices are sending home, or they can shut the hell up. So far all we seem capable of is spying on our own citizens, IF we all use insecure communications and allow our every movement in public to be videoed. I am not impressed.
look up QWAC
Am I the only one in this thread that feels like a vehicle here shouldn't even have any form of internet connection regardless what nation it is from? The fact that this is from China doesn't matter. Why does a vehicle even need network equipment (other than a FM radio at most)?
My Chev calls the US!
It has a kill switch, too
(I have no evidence other than The Odyssey and everything that has happened since)
I would recycle all the CCP/PLA made buses until West Taiwan is Free.
Ni hao
Neo-Yellow peril gibberish fearmongering.
Ever notice this trend?
Furthermore:
Protect human rights. Fuck big tech. Fuck Chinese and American fascists.
Or, maybe, it's because the Chinese government is very closely linked to all the major businesses? Of course the same should be said for pretty much every other big brother country out there. China isnt unique in that effect
You are much more interesting to your own government than you are to the Chinese government
Then they shouldn't need the data
This is also a problem, it doesn't excuse anything
Agreed.
agreed. Although I'm sure they are likely as evil as our own government/industry. If the chinese government wants to see me whack off or drive to work all they needed to do was ask me and offer me a few bucks off the low end devices they are selling that we both know I will buy anyway.
Yes, and data is the new gold. I dont want my data going anywhere, but there isnt much I can do about that. Regardless, it shouldn't be sent to China, or my government, or the us etc
it's almost as if corporations in China are forced to comply with state affairs...
I wouldnt be surprised if ALL devices (chinese or not) are spying on us, just like these chinese ones and all this complaining is from industry people who dont want competition from cheap chinese tech. The western world is run by the rich capitalists, and that includes the management and PR announcers from our intelligence services.
Um... I'm not sure if you've noticed, but as of late there has been rising concerns about any involuntary, unprompted data gathering. Not just from China, but America and Russia too.
And considering how these data gathering elements have pretty strong connections to the government where their servers are located, it's not out of place to simply refer to the country.
No shit? A communist country that has more camera than people, tracks all communication, and blocks the Internet/all major apps from their entire countrys cars they manufactured track everything you do...... I'm so shocked /s
These people that cry about wanting Chinese EVs in the US are the same people that cry when they have thermal runaway, no warranty, and are built cutting every corner possible. I fucking hate Trump, but in case in hate to say he's right.
All of that has nothing to do with communism. China isn't even communist.
Can we please stop telling tge rest of the world about what the PRC actually does. You are giving the rest of the governance in the world ideas.