Opportunities, Monetization, and Cybersecurity Threats in the Connected Vehicle Landscape

Technological advancements in the automotive industry have transformed modern vehicles into data hubs. These vehicles are continuously generating, consuming, and transmitting large volumes of data. The analysis and use of this vehicle data create many new opportunities, from the enhancement of vehicle functions to the generation of new revenue streams. However, this shift toward a data-centric ecosystem also brings with it a set of unique challenges and responsibilities for the automotive industry. This research paper delves into vehicle data and its generation, transmission, and usage. In particular, this paperhighlights the privacy and security concerns associated with vehicle data. Quite often, vehicle data is collected without the users’ explicit consent and/or knowledge, or the data collection details are hidden deep in the fine print of purchase agreements. This raises serious concerns about the potential of data misuse or abuse, including contraventions of data protection laws. This paper explores macro categories of vehicle data collected, ways in which this data could be used and monetized, and cybersecurity threats associated with this data. Our research found examples of vehicle data leakage via MQTT brokers and demonstrated that even small amounts of vehicle data could be used to profile drivers or fleets, highlighting privacy and security risks associated with unsecured data. An unexpected find was discovering vehicle API communications logs in Trend Micro telemetry data; these API calls could expose vulnerabilities that can be exploited by cybercriminals. All of our findings highlight the need for secure data transmission and stringent measures to protect data. The success of the connected car enterprise presents a lucrative target for cybercriminals, driving the need for robust data security measures. As the automotive industry evolves into a data-driven industry, it becomes crucial for stakeholders such as OEMs and Tier 1 and Tier 2 suppliers to strike a balance between innovation and data protection.