A failure to properly protect access to its AWS environment is one of the root causes of the recent massive Volkswagen data leak, according to a presentation on the incident at the Chaos Computer Club on Dec. 27(More details: https://www.youtube.com/watch?v=gKvtJiU-mi4&list=PL_IxoDz1Nq2YICxl-KtTHOjEwxIOIsPrs&index=28).

But the security analyst who helped expose the leak said the $351 billion car manufacturer violated its own terms of service as well as regulatory requirements, especially GDPR, by not truncating or encrypting sensitive customer data from more than 15 million enrolled vehicles.

“They were collecting far too much data,” an IT security analyst who goes by the name of Flüpke told the audience. “If you want to evaluate battery safety, then you don’t need location data.”

The data VW collected, he noted, included a wide range of information, including user data such as name, email address, birthdate and physical address, car data such as VIN, model, year, and full user ID, in addition to EV data points such as odometer, battery temperature, battery status, charging status and warning light data.

The problem of vehicles retaining terabytes of sensitive information about their drivers is hardly new, but it has gotten much worse recently partly because electric vehicles (EVs) collect far more information. Reports of vehicle data retention problems started surfacing more than four years ago.

The issue is that car manufacturers are required to retain some of that data. For example, Flüpke pointed out that the European Union has required some vehicle data collection and sharing since 2018, as part of an EU effort to automatically send help to a vehicle involved in a serious accident.

Flüpke said that he found the VW data problem by combining various coding tools, including Subfinder, GoBuster and Spring. Using the tools, Flüpke said that he was able to retrieve the heap dump from the VW internal environment because it was not password protected. A heap dump lists various objects within a Java Virtual Machine (JVM), which can reveal details about memory usage. That is supposed to be used for monitoring performance metrics and for introspection examinations.

Within that heap dump were listed, in plain text, various active AWS credentials. When Flüpke confronted VW with the discovery of those credentials, he quoted the company as saying, “the access to the data happened in a very complex multilayered process.”

While that is true, Flüpke said, and the backend is not meant for end users, rather used for token exchange, “you could take an arbitrary userID to generate a JWT token, which is an auth token without a password. That is useful because you can give it a userID and suddenly you are that user. We can’t pilot cars remotely with this, but we can authenticate with an API from this identity provider and access user data.”

Data journalist Michael Kreil, who also analyzed the data, said during his presentation at the conference that the 9.5TB of event data included geodata coordinates, some of which had accuracy within 10 centimeters. It revealed where people went to work, where they shopped and when, what schools they drive their children to, and information about where law enforcement agents live.

In a recent test of Waymo's robotaxis in Los Angeles, the lack of autonomous rides to LAX was a big drawback. The service is also not available for pick-ups or drop-offs at San Francisco International Airport (SFO) thanks to a separate permitting process, but executive emails show that Waymo is forging ahead despite recent setbacks.

Though Waymo got permission to operate commercially in LA, the San Francisco Peninsula, and on San Francisco freeways in March, it needs a separate approval from the San Francisco Airport Commission to operate there. That was rejected last year, but according to emails Waymo execs are once again pushing airport officials for permission to operate its robotaxis at SFO.

“Waymo riders in the Bay Area consistently ask Waymo to provide service to SFO. We would like to partner with airport leaders and staff to work towards that future goal," Waymo Chief Product Officer Saswat Panigrahi wrote to SFO General Manager Ivar Satero in April.

Waymo would need to map SFO before it provides service there. It got preliminary approval last year, but that was later delayed. SFO officials have indicated they want to see how Waymo performs in other areas before allowing it at the airport.

"We would first like to see them gain more experience safely serving our surrounding communities before entertaining any activity, even mapping, at the airport," SFO spokesperson Doug Yakel told...

Complicating matters further, SFO may need to "create a new permit structure, similar to what we did 10 years ago for companies like Uber and Lyft," Yakel says in the emails.

For now, Waymo is doing overnight curbside pickups and drop-offs at Phoenix Sky Harbor International Airport.

In additional, Zoox operate a fleet of hybrid Toyota Highlanders to map, test, and validate their autonomous driving technology in Las Vegas, Nevada.

As autonomous vehicles become increasingly popular in San Francisco, some riders are wondering just how far they can push the vehicles’ limits—especially with no front-seat driver or chaperone to discourage them from questionable behavior.

For some, that’s a welcome invitation to test the autonomous vehicles’ limits. Megan, a woman in her 20s, took her first robotaxi ride on a recent late-night excursion. It was also her first time having sex in a driverless vehicle. She is not providing exact dates of the riders’ debauchery to protect her privacy...

“We got in and just got straight to it, making out,” said Megan, who got into the Cruise wearing nothing but a robe. “One thing led to another, and he made sure that I was taken care of, if you will. … I was like, ‘I have no underwear on, and I am ready to go in this kimono.’ And I was using his slippers that were like five sizes too big.”

Her accomplice? A man in his 30s, whom I’ll call Alex. By his estimates, Alex has performed at least six separate sex acts in robotaxis, ranging from impromptu make-out sessions to “full-on sex, no boundaries activities” a total of three times in a Cruise car.

“I mean, there’s no one to tell you, ‘You can’t do that,’” he said, laughing. “It gets to the point where you’re more and more and more comfortable, and if you’re with someone, like a more serious partner, it can escalate to other activities.”

I had spoken to four separate Cruise car riders who said they’ve had sex or hooked up in the driverless vehicles in San Francisco over recent months and have provided ride receipts. Also I was unable to find a source who said they’d had sex in a Waymo.

“The vast majority of our riders are respectful and follow our rider rules,” a Waymo spokesman said.

It’s not the first time this creative use of self-driving cars has come up: After Tesla released its autopilot feature nearly a decade ago, CEO Elon Musk went viral for reacting to a Pornhub video of a couple having sex in a Tesla while it was driving on autopilot.

Turns out these rumblings of covert robocar hook-ups might have some basis in science: A little-known 2018 study predicted that more autonomous vehicles would mean more sex on the road—and potentially other unseemly behaviors you likely wouldn’t want your Uber driver to bear witness to.

“It seems like I’m a trailblazer,” Alex said. “It’s also fun to realize that this is like the first place you can do this in the country—the first autonomous vehicles that exist.”

The rules and regulations surrounding robotaxis are murky, largely because the industry is so new. Here’s what you can and can’t do in a robotaxi, according to Cruise and Waymo experts, and a couple who has tested the limits of autonomous vehicle debauchery.

How much can you get away with in an autonomous vehicle if they’re effectively window-covered hotel rooms on wheels full of cameras that never stop recording?

“It was really funny because the Cruise got quite hot and fogged up to the point that the windshield was completely fogged over—in any other context, in any other vehicle, that would be an actual problem,” Alex said.

Unfortunately for the debaucherous among us, robotaxi companies currently use pretty extensive camera surveillance inside and outside of their cars.

“We record video inside of the car for added safety and support,” Cruise states on its website. “If something happened during your ride, we might review the recording to better understand what happened. We only record audio during active support calls.”

The company also told that it is in the “early stages” of developing new sensor features in its Origin cars—the larger, bus-like vehicles—that can detect trash or items left behind.

A Waymo spokesperson said its team might review recordings if there are concerns about cleanliness, safety, crashes or missing items. Yet these surveillance tactics have been met with resistance, particularly from those concerned about how the private companies will use footage collected from previous rides. In San Francisco, police have already made requests for driverless car footage from Waymo and Cruise to help solve crimes, according to Bloomberg reporting.

“I definitely have had anxiety post-situation the next day being like, ‘Oh that wasn’t the best idea,’” Alex said. “There’s a concern you might receive an email or contact from Cruise” banning users from the system.

Of course, whatever happens inside a Cruise car is largely visible to bystanders who can peer into the robotaxi’s fishbowl-like cab. Megan said that during their robotaxi tryst, once their car took a spin through Golden Gate Park, the recently set-up stage lights for Outside Lands lit up the couple and their “activities.”

“In one instance, an individual outside of the car, in another car, looked in and basically had an understanding of what was happening—and he smiled,” Alex said. “It was not like a negative reaction; it was almost humorous. Certain people have a different threshold of concerns about public ‘situations.’”

But where there’s a will, there’s a way. The 2018 study about sex in autonomous vehicles notes that even as self-driving vehicle companies scale up their surveillance tactics, the truly savvy will always find a way around it—especially in privately owned cars.

“While autonomous vehicles will likely be monitored to deter passengers having sex or using drugs in them, and to prevent violence, such surveillance may be rapidly overcome, disabled or removed,” the study said. “Private autonomous vehicles may also be put to commercial use, as it is just a small leap to imagine Amsterdam’s Red Light District ‘on the move.’”

When asked, both Cruise and Waymo sidestepped commenting directly on what is or isn’t allowed in their cars. Megan and Alex, on the other hand, knew what they were up to wasn’t exactly in the terms and conditions.

“Was it the most comfortable? Was it the most ideal? Probably not,” Megan said. “But the fact that we were out and about in public, the whole taboo of it being kind of wrong made it more fun and exciting.”

Cruise, for example, pleads riders to not do anything in an AV that would “potentially make others uncomfortable” and to avoid activity that could be classified as “threatening, confrontational, discriminatory, harassing, disrespectful, offensive or inappropriate toward others,” according to its terms of service.

“We’re working hard to make sure our service is safe, clean, and open to everyone, and riders agree to do their part when they sign up to use our service,” a Cruise spokesperson said. “We will take appropriate action against anyone who violates those guidelines,” which could include suspending or terminating their Cruise accounts.

Still, it appears most of what you can and cannot do in a regular taxicab is also allowed in a Cruise or Waymo: Both companies permit eating in their cars, though the two companies say riders may have to pay an extra service fee if they leave the robotaxis trashed or dirty.

“Waymo One riders are allowed to eat and drink nonalcoholic beverages during their rides,” a Waymo spokesperson said. “There is a reasonable expectation of cleanliness from riders to not leave trash or debris, but the occasional crumbs are human nature.”

Cruise and Waymo like to tout that their cars will never drive drunk, high, or impaired—a position Cruise, in particular, has plugged in its partnership with Mothers Against Drunk Driving.

But what about passengers?

The state vehicle code is pretty clear on that front: Drivers and passengers are prohibited from drinking alcohol, smoking marijuana or possessing open containers of either substance in cars while on public roads.

A small loophole may exist Under California law: open-container laws do not apply to passengers in a “bus, taxicab, or limousine for hire.” Cruise received permits to operate paid rides in 2022, effectively making its cars driverless taxicabs. Yet the company has apparently cracked down on users its cameras have caught drinking in its vehicles.

One such passenger, a writer with popular tech social media account Whole Mars Catalog, apparently received a slap on the wrist—a written warning from Cruise—for drinking a beer can in the back seat of a Cruise car.

Waymo also explicitly prohibits substance use in its vehicles, “including bringing an open container” on board, the company states on its support site. Though this could easily be a rule required only by the private company, Waymo and other driverless car companies on Thursday won state approval to operate across San Francisco 24/7 and charge passengers for rides.

The California Highway Patrol, which regulates the state vehicle code, was unable to confirm how the code applies to robotaxis.

Both companies also urge riders not to smoke or vape in their cars, and animals are unfortunately not allowed in either’s vehicles.

As for our adventurous couple, Alex and Megan, they said they’d do it all over again.

“I was just along for the ride,” Megan said. “Literally.”

The German publication Handelsblatt is in possession of more than 23,000 internal files and documents from Tesla after an employee leaked the data. The files include personal information on more than 100,000 current and former employees, as well as thousands of reports of problems with Tesla's advanced driving assistance systems, Autopilot, and "Full Self-Driving."

The earliest complaints in the data trove date back to 2015, and the most recent to March 2022. Most of the complaints arise from the US, although European and Asian customer problems are also reflected in the data.

More than 2,400 complaints allege sudden unintended acceleration problems. Although Autopilot and FSD have been the focus of headlines for the last few years, during the mid-2010s there were plenty of reports of Teslas taking off on their own accord—at least 232 cases have been reported in the US, although (as often turns out in cases like these) the National Highway Traffic Safety Administration found no evidence for a hardware or software problem, instead blaming driver error.

More than 1,500 complaints allege problems braking, including 139 cases of phantom braking and 383 cases of phantom stops. In February 2022, we learned that the National Highway Traffic Safety Administration had opened a safety investigation into Tesla's phantom braking problem after it received hundreds of complaints after an article in The Washington Post drew attention to the issue. But the problem has persisted, causing an eight-car collision over Thanksgiving after Tesla opened up its FSD Beta program to all owners.

Handelsblatt says there were more than 1,000 crashes linked to brake problems and more than 3,000 entries where customers reported safety concerns with the driver assists.

The German publication even went to the trouble of contacting Tesla owners to confirm the data was correct.

A doctor from California, for example, who wishes to remain anonymous, told the Handelsblatt about an incident from autumn 2021. She was about to turn in a parking lot when her Tesla suddenly accelerated like a racing car. "I tried to steer but crashed into a cement bollard," the customer recalls.
 "He fell over, but the car didn't stop. I drove into the nearest bollard. The airbag went off and I was stunned."
Between January and October 2021, the Swiss Thomas Karl complained to Tesla about a dozen incorrect braking attempts with his vehicle. Karl was a regular customer, had been for ten years. But his new Model S made him nervous, as email correspondence with Tesla makes clear.

"Hello gentlemen, believe me that I'm starting to lose my nerve?" Karl wrote on July 26, 2021 about another incident. His Tesla had an accident on the Swiss A3 between Flums and Sargans "after being overhauled vehicle made an emergency stop that scared and worried".

According to Manfred Schon, he experienced something similar on the M14 highway. The former
 Bosch employee was on his way to a meeting in the US state of Michigan on June 1, 2019 when his Tesla "suddenly slammed on the brakes, as hard as you can imagine," Schon told the Handelsblatt. "I was pushed into the seat belt and the car almost came to a stop. Then another car hit me from behind."

The Tesla files contain similar cases in Germany. One customer complained that his Tesla had "driven into a median barrier on the freeway". The reason was the autopilot's emergency braking. Another reported to customer service about his Model S: "Drives into oncoming traffic."

Beyond the customer complaints, the data leak also shows how Tesla responded to these problems—by committing to as little as possible in writing.

For each incident there are key points for the "technical review". The employees who enter this review into the system regularly make it clear that the report is intended for "internal use only". Each entry also contains the note in bold type that information, if at all, may only be passed on "VERBALLY to the customer".
"Do not copy the report below into an email, text message or leave it in a voicemail to the customer," it continues. Vehicle data should also not be released without permission. If, despite the advice, "a legal involvement cannot be prevented", this must be recorded.

Customers that Handelsblatt spoke to have the impression that Tesla employees avoid written communication. "They never sent emails, everything was always oral," says the doctor from California, whose Tesla said it accelerated on its own in the fall of 2021 and crashed into two concrete pillars.

As anyone who covers Tesla would be able to tell you, Handelsblatt got no reply from the company when it queried it on the problems listed above. However, the automaker did demand its data back, according to an accompanying note from Handelsblatt's editor.

More details: https://www.handelsblatt.com/unternehmen/industrie/elektromobilitaet-mein-autopilot-hat-mich-fast-umgebracht-tesla-files-naehren-zweifel-an-elon-musks-versprechen/29166564.html