Many new cars infotainment systems come with a WLAN hotspot by default. Owners can use it for media consumption and internet access on the road and of course never change the SSID. Such access-points are quite noisy and constantly broadcast their SSID, MAC addresses, a fact that might be interesting for multiple reasons:
- Polluting frequencies within areas that are already short on channels
- Tracking individual vehicles using a set of APs or large networks like Freifunk or even a TelCo
- Checking if a certain vehicle gets close to certain “etablissements” (hello cheaters)
- Estimating the worth of equipment when selecting a car to steal
- Traffic census
- …
Checking the last 30 days of my access-points “neighbouring access points” log did reveal quite interesting data about drive-by cars:
- 77 Mercedes Benz (SSID: “MB WLAN XXXXX” or “MB Hotspot XXXXXX”, MAC vendor “Harman/B”)
- 73 Opel (SSID “WiFi Hotspot XXXX”, MAC vendor “MitsumiE”)
- 14 Skoda (SSID “SmartGate_XXXXXX”, MAC vendor “Universa”)
- 7 Audi (SSID “Audi_MMI_XXXX”, MAC vendor “WistronN”)
- 6 Volvo (SSID “MyVolvoXXXX”, MAC vendor “Actia”)
When using a WLAN enabled car, the first thing to do would be changing the SSID, disable broadcasting or change the MAC but since cars are not quite hacker-friendly such options are most certainly disabled.