Subaru Starlink

Subaru Starlink

Basic Information
Release Year	2013
Product Type	Software
In Production	Yes
Official Website	https://subaru.com/

Overview

Starlink is a connectivity service equipped on most modern Subaru vehicles, enabling extensive data collection from the vehicle and its occupants. The service has faced significant criticism and legal challenges over privacy concerns related to its data-collection and -sharing practices.

Incident

The exploit was achieved by intercepting the Starlink app's network requests which revealed the admin portal login screen. Using the "Reset password" feature of the admin portal which was hidden with javascript the hacker found an employee email off linkedin and successfully managed to login to the admin portal. Although implementing 2FA this too was entirely client-side and the modal window blocking further interaction without verification could also be hidden with javascript.

Inside the admin portal any employee had access to a range of personal information, largely comprised of the personal information listed below. Additionally the employee the hacker had login as had level 2 access allowing them to remotely lock, unlock, honk, issue speeding warnings and more which they demonstrated on their own and a friend's Subaru car.

The incident was initially ethically disclosed to Subaru on 24-20-11 with a blog post detailing the exploit released on 25-23-01.

Data collection

Types of data collected

Subaru’s privacy policy and STARLINK terms of service specify that the following data may be collected:

• Personal information
  • Names, addresses, and contact details.
  • Phone numbers and email addresses.
  • Social-security numbers (in specific cases).
  • Driver's license numbers.
  • Vehicle identification numbers (VIN).
• Vehicle data
  • Location and GPS coordinates.
  • Speed, acceleration, and braking patterns.
  • Time and duration of trips.
  • Maintenance and diagnostic information.
  • Sensor data, such as crash severity, tire pressure, and coolant temperature.
• Audio and biometric data
  • Audio recordings through onboard microphones.
  • Voice data from STARLINK service-center calls.
  • Biometric data from systems that driver attention.
  • Search content and commands issued by occupants.

Collection methods

Data collection is performed through:

• Vehicle sensors and diagnostic modules.
• GPS tracking systems.
• Cellular-connectivity modules.
• STARLINK mobile apps and web portals.

Data sharing and sales

Third-party data sharing

Subaru shares data with several entities, including:

• Data brokers, such as LexisNexis and Verisk.
• Insurance companies for risk assessment and pricing.
• Marketing firms.
• Emergency services and law enforcement (when required by law).
• Subaru dealerships and distributors.
• Third-party service providers.

Insurance-industry usage

Data brokers aggregate and sell this information to insurance companies, who may:

• Increase insurance premiums based on driving patterns.
• Monitor driving behaviors to assess risk.
• Use driving data for personalized coverage offerings.

Privacy concerns

Consent issues

Key concerns include:

• Simply being a passenger in a STARLINK-equipped vehicle constitutes consent.
• Lack of active notification during data collection.
• Limited opt-out options that might impact vehicle functionality.

Difficulties in opting out

Subaru’s opt-out process involves:

• Submitting detailed personal information.
• Potentially long response times.
• No verification mechanism for successful opt-out.

Legal challenges

Subaru faces legal scrutiny for:

• Allegations of insufficiently disclosing its data-collection policies what it does with data.
• Potential non-compliance with privacy laws.
• Class-action lawsuit investigations over consent practices.

Technical details

System architecture

STARLINK is built upon:

• Embedded telematics devices.
• 4G LTE cellular networks.
• GPS receivers and cloud-based data-processing systems.

Data transmission

• Real-time data transmission through LTE networks.
• Local storage when connectivity is unavailable.

Consumer-protection issues

Privacy rights

Critics cite:

• Minimal control over data retention.
• Broad sharing permissions in privacy policies.
• Limited transparency about how data is used.

Economic harm

• Insurance-rate adjustments based on driving data.
• Subscription fees for connected services.
• Potential effects on vehicle resale value.