Rental Cars and Bluetooth

I recently traveled far as hell and needed a rental car. Since most rental cars are up to date and NY has a “no cell phone” law while driving (you can't hold your phone in your hand) I decided to use the Bluetooth option and pair with the car’s onboard audio system, allowing me to play music and get phone calls.

As I got home I started to wonder how many other people used this feature and if they deleted their information after using the car. As expected, there was a long list of people who did not remove their information before turning the car in.

What could hackers find out about you

For the sake of not putting anyone's info out there, I have redacted everything but the fields in the picture below. Once you pair your mobile device with the car, anyone can see the phone manufacturer, model number, bluetooth MAC address, Carrier, and supported profiles.

Now the phone manufacturer, carrier, and supported profiles aren't overly important. However, the model number and bluetooth MAC address are important not to share.

The model number is usually not a big deal. These tend to be very generic and country/carrier specific. If you look at the Verizon iphone 7 the model number reads 'Keheira's iPhone' or 'iPhone A1660'.

Now the MAC address is even more dangerous than your name. When you get a new device whether it be a phone, computer, ipad, dvd player, tv, ect. it has a MAC address. A MAC address doesn't change and thus having it is equal to someone stealing your identity.

What is your Mac Address: It's a unique address given to a device. Ex: 'keheira.github.io' being assigned to only my laptop. Nobody else in the world would ever have that web address (this is actually partially true just because of how my name is spelled lol).

What one can do with your bluetooth information

MAC Spoofing is the biggest worry. For example, someone can use your MAC address and walk around pretending to be you. This could allow them to be verified by anything looking for your MAC address, like an Apple watch, car, computer, echo, google home, alarm system , or medical devices. Think about how much info those devices hold. If you work for a company where secret things are going on, then this can become a big professional risk.

Getting access to one's personal items can be the open door that an attacker is looking for. If we are talking medical devices or connected devices then you basically have given someone a free pass into your life.

Ex: Say your an important researcher working on a new super secret technology. I've been following you and you recently returned a rental car. After being sneaky to search the vehicle before it's cleaned I find that your device information is still stored. I take down the details and can now perform MAC Spoofing. I hang around your place of residence while your away at work and your computer autoconnects to my device. Using some other tools I can now go search your computer and find plans or emails about this super secret technology. Give me about a week or two more of information gathering and I can now send your boss an email a report on what I learned about the company and some suggestions on how to increase security.

Now, this is an extreme & maybe improbable situation but I do think people should be aware of how damaging these "leaks" could be.

The Lesson without Explanation

I know security isn't everyone's thing but as a day to day person unless a car is yours make sure you go back in and delete your information when you give it back. You might think it's harmless but with cars being so connected now you are taking a risk on your device and personal security.

Thanks to Adarsh & Amber for reviewing