In a world of connected cars (providing several remote management functions) , Do you remember to revoke "remote management access (which include lock/unlock) " to the previous owner?. You may have the rights but, you may not be able to do it.

Here is a lesson we can learn from one buyer - In a resale scenario, a previous owner could continue to have access to the online account – with all the new owner’s information stored within.

The problem is that once a vehicle has been linked to that online account and app, the previous owner must specifically disconnect his or her access to the account in order for a new owner to link up to it


Matt Watts, data strategist and director of technology at NetApp, discovered after buying a used car that a previous owner could access a range of his personal information via the app that connects with the vehicle

“When trying to link the vehicle to my account, the website informed me that the vehicle was currently linked to another users account,” Watts said. From there, he contacted the dealer and the manufacturer, who were unable to help him, saying that “We are not in a position to remove owner without their permission, previous owners would normally disconnect before they sell the car or if we took in part-ex we would have their written authority to remove from system.” The dealer then suggested tracking down the previous owner to ask them to disconnect from the account.

Watts noted that the implications are significant: “The previous owner of my car has control over it, they can unlock it, they can remotely set the climate control without me knowing about it, even when the car isn’t running, they potentially can even look at the sat-nav system, they can also call break down services to the vehicle and all of this without me knowing anything about it,” he said. “Someone else has access to a significant amount of data about myself and my vehicle and there appears to be nothing that the manufacturer is prepared to do about it.”


https://threatpost.com/connected-car-apps-open-privacy-hole-for-used-car-buyers/134549/

You worry about "weakest link in security chain" how about, "high-risk link", your cloud app admin. Need evidence?

(1)Universal Music Group contractor neglected to protect an Apache Airflow server 

(2) Honda affiliate in India left two Amazon S3 buckets misconfigured for more than a year


The Honda mistake affects 50,000 users of the Honda Connect App, which is used to manage automobile service and maintenance. It can also pair with the car to offer vehicle health monitoring, “find my car” capability, trip analysis and an SOS function for emergencies.

A cybercriminal could know “where someone’s car is currently located, where they went, where they typically drive, how they drive, and where they start and stop


https://threatpost.com/honda-universal-music-group-expose-sensitive-data-in-misconfig-blunders/132451/

Cars with Internet bring Internet related risks to cars - Are the car manufacturers ready for the challenge?

Many parts of cars — like the accelerator pedal or the turn signal — are designed to feel mechanical despite being run by tiny microprocessors that are connected through a network within the vehicle. Even so, vehicle software security hasn't really been a concern because cars have always been isolated and self-contained entities

Now that they connect to the Internet, they expose a new attack surface


Autonomous driving isn't limited to making knowledge workers' windshield time more productive. Logistics companies, for example, will benefit tremendously from autonomous vehicles, but imagine an attacker compromising and shutting down those vehicles: the results would be disastrous not only to the logistics company but to all of the businesses that rely on them as a vendor

https://www.darkreading.com/endpoint/connected-cars-pose-new-security-challenges/a/d-id/1331166?_mc=sm_dr&hootPostID=55d0e82932ac4cae8ebf0aee77f0657e