Jump to content

Subaru Starlink: Difference between revisions

From Consumer_Action_Taskforce
← Older edit
VisualWikitext
m Category:Consumer Rights → Category:Consumer rights (The latter has more pages (5 > 3))
 
(10 intermediate revisions by 8 users not shown)
Line 1: Line 1:
== Overview ==
{{InfoboxProductLine
Starlink is a connectivity service equipped on most modern Subaru vehicles, enabling extensive data collection from the vehicle and its occupants. The service has faced significant criticism and legal challenges over privacy concerns related to its data collection and sharing practices.<ref name="MozillaReview" />
| Title = Subaru Starlink
| Release Year = 2013
| Product Type = Software
| In Production = Yes
| Official Website = https://subaru.com/
| Logo = Subaru-starlink.png
}}


== Data Collection ==
==Overview==
=== Types of Data Collected ===
Starlink is a connectivity service equipped on most modern Subaru vehicles, enabling extensive data collection from the vehicle and its occupants. The service has faced significant criticism and legal challenges over privacy concerns related to its data-collection and -sharing practices.<ref name="MozillaReview" />
Subaru’s privacy policy and STARLINK terms of service specify that the following data may be collected:<ref name="SubaruPrivacy">{{cite web |url=https://www.subaru.com/support/privacy-policies.html |title=Subaru Privacy Policy |publisher=Subaru |access-date=2025-01-16}}</ref>


* '''Personal Information'''
==Incident==
** Names, addresses, and contact details
The exploit was achieved by intercepting the Starlink app's network requests which revealed the admin portal login screen. Using the "Reset password" feature of the admin portal which was hidden with javascript the hacker found an employee email off linkedin and successfully managed to login to the admin portal. Although implementing 2FA this too was entirely client-side and the modal window blocking further interaction without verification could also be hidden with javascript.
** Phone numbers and email addresses
** Social Security numbers (in specific cases)
** Driver's license numbers
** Vehicle Identification Numbers (VIN)
* '''Vehicle Data'''
** Location and GPS coordinates
** Speed, acceleration, & braking patterns
** Time & duration of trips
** Maintenance & diagnostic information
** Sensor data, such as crash severity, tire pressure & coolant temperature
* '''Audio/Biometric Data'''
** Audio recordings via onboard microphones
** Voice data from STARLINK service center calls
** Biometric data from driver attention monitoring systems
** Search content and commands issued by occupants


=== Collection Methods ===
Inside the admin portal any employee had access to a range of personal information, largely comprised of the personal information listed below. Additionally the employee the hacker had login as had level 2 access allowing them to remotely lock, unlock, honk, issue speeding warnings and more which they demonstrated on their own and a friend's Subaru car.
 
The incident was initially ethically disclosed to Subaru on 24-20-11 with a blog post detailing the exploit released on 25-23-01.<ref>{{Cite web |last=Curry |first=Sam |date=23 Jan 2025 |title=Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel |url=https://samcurry.net/hacking-subaru |access-date=2025-02-19 |website=samcurry.net}}</ref>
 
==Data collection==
===Types of data collected===
Subaru’s privacy policy and STARLINK terms of service specify that the following data may be collected:<ref name="SubaruPrivacy">{{Cite web |date= |title=Subaru Privacy Policy |url=https://www.subaru.com/support/privacy-policies.html |access-date=2025-01-16 |website=subaru.com}}</ref>
 
*'''Personal information'''
**Names, addresses, and contact details.
**Phone numbers and email addresses.
**Social-security numbers (in specific cases).
**Driver's license numbers.
**Vehicle identification numbers (VIN).
*'''Vehicle data'''
**Location and GPS coordinates.
**Speed, acceleration, and braking patterns.
**Time and duration of trips.
**Maintenance and diagnostic information.
**Sensor data, such as crash severity, tire pressure, and coolant temperature.
*'''Audio and biometric data'''
**Audio recordings through onboard microphones.
**Voice data from STARLINK service-center calls.
**Biometric data from systems that driver attention.
**Search content and commands issued by occupants.
 
===Collection methods===
Data collection is performed through:
Data collection is performed through:
* Vehicle sensors and diagnostic modules<ref name="MozillaReview">{{cite web |url=https://foundation.mozilla.org/en/privacynotincluded/subaru/ |title=Mozilla Foundation Privacy Review: Subaru |publisher=Mozilla Foundation |access-date=2025-01-16}}</ref>.
*Vehicle sensors and diagnostic modules.<ref name="MozillaReview">{{Cite web |last=Mozilla Research |first= |date=15 Aug 2023 |title=Mozilla Foundation Privacy Review: Subaru |url=https://foundation.mozilla.org/en/privacynotincluded/subaru/ |access-date=2025-01-16 |website=foundation.mozilla.org}}</ref>
* GPS tracking systems
*GPS tracking systems.
* Cellular connectivity modules
*Cellular-connectivity modules.
* STARLINK mobile apps & web portals<ref name="MozillaReview" />.
*STARLINK mobile apps and web portals.<ref name="MozillaReview" />


== Data Sharing and Sales ==
==Data sharing and sales==
=== Third Party Data Sharing ===
===Third-party data sharing===
Subaru shares data with several entities, including:
Subaru shares data with several entities, including:
* Data brokers, such as LexisNexis<ref>[https://www.subaru.com/support/privacy-policies/vehicle-privacy-notice.html https://www.subaru.com/support/privacy-policies/vehicle-privacy-notice.html]</ref> & Verisk<ref name="TorqueNews">{{cite web |url=https://www.torquenews.com/1084/subaru-now-involved-vehicle-data-collection-lawsuit-investigation |title=Vehicle Data Collection Lawsuit |publisher=Torque News |date=2024-05-21 |access-date=2025-01-16}}</ref><ref name="NYT">{{cite web |url=https://www.nytimes.com/2024/03/11/technology/carmakers-driver-tracking-insurance.html |title=Automakers Are Sharing Drivers’ Data |publisher=New York Times |date=2024-03-11 |access-date=2025-01-16}}</ref>.
*Data brokers, such as LexisNexis<ref name="SubaruPrivacy" /> and Verisk.<ref name="TorqueNews">{{Cite web |last=Flierl |first=Denis |date=21 May 2024 |title=Vehicle Data Collection Lawsuit |url=https://www.torquenews.com/1084/subaru-now-involved-vehicle-data-collection-lawsuit-investigation |access-date=2025-01-16 |website=torquenews.com}}</ref><ref name="NYT">{{Cite web |last=Hill |first=Kashmir |date=11 March 2024 |title=Automakers Are Sharing Drivers’ Data |url=https://www.nytimes.com/2024/03/11/technology/carmakers-driver-tracking-insurance.html |access-date=2025-01-16 |website=nytimes.com}}</ref>
* Insurance companies for risk assessment and pricing<ref name="TorqueNews" />.
*Insurance companies for risk assessment and pricing.<ref name="TorqueNews" />
* Marketing firms
*Marketing firms.
* Emergency services and law enforcement (when required by law)
*Emergency services and law enforcement (when required by law).
* Subaru dealerships and distributors
*Subaru dealerships and distributors.
* Third-party service providers<ref name="SubaruPrivacy" />.
*Third-party service providers.<ref name="SubaruPrivacy" />
 
===Insurance-industry usage===
 
=== Insurance Industry Usage ===
Data brokers aggregate and sell this information to insurance companies, who may:
Data brokers aggregate and sell this information to insurance companies, who may:
* Hike insurance premiums based on driving patterns
*Increase insurance premiums based on driving patterns.
* Monitor driving behaviors to assess risk
*Monitor driving behaviors to assess risk.
* Use driving data for personalized coverage offerings<ref name="NYT">{{cite web |url=https://www.nytimes.com/2024/03/11/technology/carmakers-driver-tracking-insurance.html |title=Automakers Are Sharing Drivers’ Data |publisher=New York Times |date=2024-03-11 |access-date=2025-01-16}}</ref>.
*Use driving data for personalized coverage offerings.<ref name="NYT" />


== Privacy Concerns ==
==Privacy concerns==
=== Consent Issues ===
===Consent issues===
Key concerns include:
Key concerns include:
* Simply being a passenger in a STARLINK-equipped vehicle constitutes consent<ref name="MozillaReview" />.
*Simply being a passenger in a STARLINK-equipped vehicle constitutes consent.<ref name="MozillaReview" />
* Lack of active notification during data collection.
*Lack of active notification during data collection.
* Limited opt-out options that might impact vehicle functionality.
*Limited opt-out options that might impact vehicle functionality.


=== Opt-Out Difficulties ===
===Difficulties in opting out===
Subaru’s opt-out process involves:
Subaru’s opt-out process involves:
* Submitting detailed personal information
*Submitting detailed personal information.
* Potentially long response times
*Potentially long response times.
* No verification mechanism for successful opt-out<ref name="ConsumerForum">{{cite web |url=https://www.subaruoutback.org/threads/privacy-not-included-subaru-report-connected-services-etc.556583/ |title=Privacy Report Discussion |publisher=Subaru Outback Forums |access-date=2025-01-16}}</ref>.
*No verification mechanism for successful opt-out.<ref name="ConsumerForum">{{Cite web |date=26 Jan 2025 |title=Privacy Report Discussion |url=https://www.subaruoutback.org/threads/privacy-not-included-subaru-report-connected-services-etc.556583/ |access-date=2025-01-16 |website=subaruoutback.org}}</ref>


=== Legal Challenges ===
===Legal challenges===
Subaru faces legal scrutiny for:
Subaru faces legal scrutiny for:
* Allegations of insufficiently dislcosing their data collection policies & what they are doing
*Allegations of insufficiently disclosing its data-collection policies what it does with data.
* Potential non-compliance with privacy laws
*Potential non-compliance with privacy laws.
* Class-action lawsuit investigations over consent practices<ref name="TorqueNews" />.
*[[Class-action lawsuit]] investigations over consent practices.<ref name="TorqueNews" />


== Technical Details ==
==Technical details==
=== System Architecture ===
===System architecture===
STARLINK is built upon:
STARLINK is built upon:
* Embedded telematics devices
*Embedded telematics devices.
* 4G LTE cellular networks
*4G LTE cellular networks.
* GPS receivers & cloud-based data processing systems<ref name="StarlinkTerms">{{cite web |url=https://www.subaru.com/support/terms-and-conditions/subaru-starlink/subaru-starlink-services.html |title=Subaru STARLINK Terms and Conditions |publisher=Subaru |access-date=2025-01-16}}</ref>.
*GPS receivers and cloud-based data-processing systems.<ref name="StarlinkTerms">{{Cite web |title=Subaru STARLINK Terms and Conditions |url=https://www.subaru.com/support/terms-and-conditions/subaru-starlink/subaru-starlink-services.html |access-date=2025-01-16 |website=subaru.com}}</ref>


=== Data Transmission ===
===Data transmission===
* Real-time data transmission via LTE networks
*Real-time data transmission through LTE networks.
* Local storage when connectivity is unavailable<ref name="StarlinkTerms" />.
*Local storage when connectivity is unavailable.<ref name="StarlinkTerms" />


== Consumer Protection Issues ==
==Consumer-protection issues==
=== Privacy Rights ===
===Privacy rights===
Critics cite:
Critics cite:
* Minimal control over data retention
*Minimal control over data retention.
* Broad sharing permissions in privacy policies
*Broad sharing permissions in privacy policies.
* Limited transparency about how data is used<ref name="MozillaReview" />.
*Limited transparency about how data is used.<ref name="MozillaReview" />


=== Economic Harm ===
===Economic harm===
* Insurance rate adjustments based on driving data
*Insurance-rate adjustments based on driving data.
* Subscription fees for connected services
*Subscription fees for connected services.
* Potential effects on vehicle resale value<ref name="NYT" />.
*Potential effects on vehicle resale value.<ref name="NYT" />


== References ==
==References==
<references />
<references />


== External Links ==
[[Category:Automotive privacy]]
* [https://foundation.mozilla.org/en/privacynotincluded/subaru/ Mozilla Foundation Privacy Review]
[[Category:Data collection]]
* [https://www.nytimes.com/2024/03/11/technology/carmakers-driver-tracking-insurance.html New York Times Investigation]
* [https://www.subaruoutback.org/threads/forced-lack-of-privacy-with-starlink-and-constant-tracking-of-your-car-with-no-opt-out.569216/ Consumer Forum Thread]
* [https://www.subaru.com/support/terms-and-conditions/subaru-starlink/subaru-starlink-services.html Subaru STARLINK Terms and Conditions]
* [https://www.torquenews.com/1084/subaru-now-involved-vehicle-data-collection-lawsuit-investigation Torque News Lawsuit Report]
 
[[Category:Privacy]]
[[Category:Automotive Technology]]
[[Category:Data Collection]]
[[Category:Consumer rights]]
[[Category:Consumer rights]]

Latest revision as of 08:41, 11 March 2025

Subaru Starlink
Basic Information
Release Year 2013
Product Type Software
In Production Yes
Official Website https://subaru.com/

Overview[edit | edit source]

Starlink is a connectivity service equipped on most modern Subaru vehicles, enabling extensive data collection from the vehicle and its occupants. The service has faced significant criticism and legal challenges over privacy concerns related to its data-collection and -sharing practices.[1]

Incident[edit | edit source]

The exploit was achieved by intercepting the Starlink app's network requests which revealed the admin portal login screen. Using the "Reset password" feature of the admin portal which was hidden with javascript the hacker found an employee email off linkedin and successfully managed to login to the admin portal. Although implementing 2FA this too was entirely client-side and the modal window blocking further interaction without verification could also be hidden with javascript.

Inside the admin portal any employee had access to a range of personal information, largely comprised of the personal information listed below. Additionally the employee the hacker had login as had level 2 access allowing them to remotely lock, unlock, honk, issue speeding warnings and more which they demonstrated on their own and a friend's Subaru car.

The incident was initially ethically disclosed to Subaru on 24-20-11 with a blog post detailing the exploit released on 25-23-01.[2]

Data collection[edit | edit source]

Types of data collected[edit | edit source]

Subaru’s privacy policy and STARLINK terms of service specify that the following data may be collected:[3]

  • Personal information
    • Names, addresses, and contact details.
    • Phone numbers and email addresses.
    • Social-security numbers (in specific cases).
    • Driver's license numbers.
    • Vehicle identification numbers (VIN).
  • Vehicle data
    • Location and GPS coordinates.
    • Speed, acceleration, and braking patterns.
    • Time and duration of trips.
    • Maintenance and diagnostic information.
    • Sensor data, such as crash severity, tire pressure, and coolant temperature.
  • Audio and biometric data
    • Audio recordings through onboard microphones.
    • Voice data from STARLINK service-center calls.
    • Biometric data from systems that driver attention.
    • Search content and commands issued by occupants.

Collection methods[edit | edit source]

Data collection is performed through:

  • Vehicle sensors and diagnostic modules.[1]
  • GPS tracking systems.
  • Cellular-connectivity modules.
  • STARLINK mobile apps and web portals.[1]

Data sharing and sales[edit | edit source]

Third-party data sharing[edit | edit source]

Subaru shares data with several entities, including:

  • Data brokers, such as LexisNexis[3] and Verisk.[4][5]
  • Insurance companies for risk assessment and pricing.[4]
  • Marketing firms.
  • Emergency services and law enforcement (when required by law).
  • Subaru dealerships and distributors.
  • Third-party service providers.[3]

Insurance-industry usage[edit | edit source]

Data brokers aggregate and sell this information to insurance companies, who may:

  • Increase insurance premiums based on driving patterns.
  • Monitor driving behaviors to assess risk.
  • Use driving data for personalized coverage offerings.[5]

Privacy concerns[edit | edit source]

Consent issues[edit | edit source]

Key concerns include:

  • Simply being a passenger in a STARLINK-equipped vehicle constitutes consent.[1]
  • Lack of active notification during data collection.
  • Limited opt-out options that might impact vehicle functionality.

Difficulties in opting out[edit | edit source]

Subaru’s opt-out process involves:

  • Submitting detailed personal information.
  • Potentially long response times.
  • No verification mechanism for successful opt-out.[6]

Legal challenges[edit | edit source]

Subaru faces legal scrutiny for:

  • Allegations of insufficiently disclosing its data-collection policies what it does with data.
  • Potential non-compliance with privacy laws.
  • Class-action lawsuit investigations over consent practices.[4]

Technical details[edit | edit source]

System architecture[edit | edit source]

STARLINK is built upon:

  • Embedded telematics devices.
  • 4G LTE cellular networks.
  • GPS receivers and cloud-based data-processing systems.[7]

Data transmission[edit | edit source]

  • Real-time data transmission through LTE networks.
  • Local storage when connectivity is unavailable.[7]

Consumer-protection issues[edit | edit source]

Privacy rights[edit | edit source]

Critics cite:

  • Minimal control over data retention.
  • Broad sharing permissions in privacy policies.
  • Limited transparency about how data is used.[1]

Economic harm[edit | edit source]

  • Insurance-rate adjustments based on driving data.
  • Subscription fees for connected services.
  • Potential effects on vehicle resale value.[5]

References[edit | edit source]

  1. ↑ 1.0 1.1 1.2 1.3 1.4 Mozilla Research (15 Aug 2023). "Mozilla Foundation Privacy Review: Subaru". foundation.mozilla.org. Retrieved 2025-01-16.
  2. ↑ Curry, Sam (23 Jan 2025). "Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel". samcurry.net. Retrieved 2025-02-19.
  3. ↑ 3.0 3.1 3.2 "Subaru Privacy Policy". subaru.com. Retrieved 2025-01-16.
  4. ↑ 4.0 4.1 4.2 Flierl, Denis (21 May 2024). "Vehicle Data Collection Lawsuit". torquenews.com. Retrieved 2025-01-16.
  5. ↑ 5.0 5.1 5.2 Hill, Kashmir (11 March 2024). "Automakers Are Sharing Drivers' Data". nytimes.com. Retrieved 2025-01-16.
  6. ↑ "Privacy Report Discussion". subaruoutback.org. 26 Jan 2025. Retrieved 2025-01-16.
  7. ↑ 7.0 7.1 "Subaru STARLINK Terms and Conditions". subaru.com. Retrieved 2025-01-16.
Retrieved from "https://consumerrights.wiki/index.php?title=Subaru_Starlink&oldid=11563"