Here's Why You Shouldn't Connect Your Phone To A Mazda Rental Car

While the researchers, Stefan Tanase and Gabriel Cirlig of cybersecurity firm Ixia, didn't release the brand of the vehicle in question, it's obvious the infotainment system pictured in the above video is that of Mazda. The pair will release their findings at the Kaspersky Analyst Summit in Cancun. Mazda couldn't comment on the specific vulnerability as the researchers hadn't divulged specifics of it to the automaker. "What we can say is that cybersecurity and protecting our customers' privacy is of the utmost importance to Mazda, and we take all concerns very seriously," a Mazda spokesperson told Forbes.

It's unlikely to be an issue for those who own Mazdas as physical access is needed to perform the exploit, but it could be of concern to those who connect their phones to Mazda rentals and other shared cars. As the automaker fits nearly all its models with GPS chipsets, whether those vehicles have navigation activated or not, the researchers were able to leverage the hardware to send "pings" from the car to show its location in addition to grabbing personal data from the infotainment system. "What we discovered is that the car is crawling the phone," said Tanase. "The sky is the limit, it's a Linux box and you can do whatever you want on it."

What's even worse is Mazda can't roll out an over-the-air update like Tesla can with its cars, so the only way to patch the vulnerability would be to issue a recall and load the updated software manually. QNX, a division of Blackberry, provides software for Mazda vehicles, though it's unclear if it provides the subsystems involved in the exploit. QNX also built the underlying systems for Uconnect, the system previously hacked in Jeeps, and provides software to many other automakers.