myChevrolet Android App Vulnerabilities

App

I recently sold my 2016 Corvette, and previously I had set up my car with the myChevrolet app on my Android phone. This app lets you lock and unlock your car, turn on the horn, and if your car is an automatic transmission (mine was a manual), you can remote start your car. Pretty sweet, right?

Well, it turns out you never lose access to your car, even after you sell it. I sold my Vette on October 29, 2019. It has been over 90 days since I sold my car to Sarasota Ford, and then they sold the car to another customer. However, I still have access to unlock and lock my old car, turn on the horn, and more importantly see the location of the car!

App

Background

Chevy and OnStar partner to sell you location data in the app, which I never paid for. However there is a feature of the app that lets you track your driving habits, in order to get discounts on insurance. The app will tell you when and where your car performed hard braking, hard acceleration, when you drove at night, etc. It can send this info to Progressive or other insurance providers to prove you drive safe, and should get a discount. This was useful info when I used Turo to rent my Vette, before the Great Turo Fiasco of 2019.

You can also view this data yourself, apparently even after you sell the car. So I can see where and when my old Corvette was driven, where the new buyer lives, where the new buyer works, what locations the new buyer visits, all of which are shown in a censored screenshot below. The uncensored version shows me the full address. I can unlock the car. If it was an automatic transmission, I could also start the car.

App

Replication Steps

Here are the steps to replicate this in the myChevrolet app.

1. Open the app

App

2. Click Smart Driver

App

3. Click More Trip Detail Views. App App App

4. Click timeline to see exact address App

You can also view other trips from the same day, or select other days to see location data and driving habits App

This is a major security flaw. Chevrolet and GM need a process to verify that owners of cars linked to app still own their car regularly. I have reported this security issue to GM on HackerOne, there is no bug bounty for GM vulnerabilities.

Written on January 10, 2020

Other Posts

Mazda Miata - Infotainment Tweaks | cars | November 19, 2020

Lexus GX470 - Rhino Lined Roof Rack | cars | November 15, 2020

Mazda Miata - Sound Tube Delete | cars | November 14, 2020

Mazda Miata - LEDs | cars | November 13, 2020

How to Drive Cool Cars on a Budget | cars | November 11, 2020

Suzuki Cappuccino - Spark Plug Replacement | cars | October 16, 2020

Pixel 4a Case Mod | tech | September 15, 2020

Suzuki Cappuccino - Fix Second Gear | cars | September 11, 2020

Pixel 4a on Visible Wireless | tech | September 4, 2020

Suzuki Cappuccino - Reverse LED Light Bar | cars | August 16, 2020

Lexus GX470 - Reset Maint Reqd Light | cars | August 4, 2020

Suzuki Cappuccino - Interpreting the Japanese License Plate | cars | July 21, 2020

Suzuki Cappuccino - Exterior LEDs | cars | July 13, 2020

Suzuki Cappuccino - Oil Change | cars | July 11, 2020

Honda S2000 - 25mm Rear Spacers | cars | June 9, 2020

Recipe - Keto Canned Tuna Poke Bowl | etc | May 16, 2020

Recipe - Keto Canned Tuna Ceviche | etc | May 16, 2020

Lexus GX470 - Paint New Rims! | cars | May 12, 2020

Garage Storage Solutions | renovations | May 3, 2020

Architecture of Money | finance | April 24, 2020

Honda S2000 - Exterior LED Swap | cars | January 15, 2020

myChevrolet Android App Vulnerabilities | tech | January 10, 2020

Kitchen Remodel | renovations | December 10, 2019

Honda S2000 - Interior LED Swap | cars | November 12, 2019

Lexus GX470 - Running Board Removal | cars | November 12, 2019

Lexus GX470 - Rear Door Table | cars | November 12, 2019

Lexus GX470 - Tinting the Fog Lights | cars | October 25, 2019

Lexus GX470 - Ditch Lights Install | cars | October 21, 2019

Lexus GX470 - Blackout All Chrome | cars | October 16, 2019

Lexus GX470 - Change Heated Seat Bulbs | cars | October 16, 2019

Lexus GX470 - Radar Detector Hardwire | cars | October 7, 2019

Lexus GX470 - Custom Webbing Dog Divider | cars | August 9, 2019

C7 Corvette - Format an Audio USB from a Mac | cars | July 29, 2019

How To Save Money on Large Purchases | finance | July 18, 2019

Recipe - Keto Chocolate Milkshake | etc | July 12, 2019

Pros and Cons of Working From Home | etc | July 10, 2019

Honeymoon in Costa Rica | etc | June 18, 2019

Keto Recipe Collection | etc | June 17, 2019

Lexus GX470 - Plasti Dip Grill | cars | May 7, 2019

My Georgia Tech OMSCS Experience So Far | tech | April 22, 2019

Lexus GX470 - Android Headunit and Backup Camera Install | cars | March 7, 2019

My Turo Claim Horror Story | cars | February 21, 2019

Lexus GX470 - New Keys | cars | February 7, 2019

Lexus GX470 - Cleaning Headlights and Other Improvements | cars | January 28, 2019

Lexus GX470 - LED Exterior Lights | cars | January 15, 2019

Final Bedroom Remodel | renovations | January 4, 2019

2019 Goals | finance | January 2, 2019

2018 Goals Revisited | finance | January 1, 2019

Lexus GX470 - LED Interior Lights | cars | December 13, 2018

Front Door Remodel | renovations | October 17, 2018

Recipe - Keto Cookie Dough Balls | etc | September 13, 2018

Using Rakuten for More Cash Back | finance | September 12, 2018

Vanity Drains Replaced with Pop Up Drains | renovations | September 10, 2018

Matching Your Net Worth with Your Lifetime Earnings | finance | August 10, 2018

Simple Guide to Raising Your Credit Score | finance | July 26, 2018

Recipe - Pepper Steak | etc | July 12, 2018

Recipe - Shrimp and Sausage Cajun Bowl | etc | July 12, 2018

Cost of a Dog, Itemized | finance | June 25, 2018

Citrus Paint Colors | renovations | June 25, 2018

Optimize Everything | finance | May 25, 2018

Calculating My Savings Rate | finance | May 22, 2018

Hallway Bookshelves | renovations | May 22, 2018

Fiat 500 - Steering Column Fix | cars | May 21, 2018

Pool Enclosure Replacement | renovations | May 16, 2018

$500 Weekend Bathroom Remodel | renovations | April 30, 2018

C7 Corvette - Grill Mod | cars | April 19, 2018

High Interest Checking Account | finance | April 18, 2018

Don't Get Overinvested in Your Employer | finance | April 16, 2018

Robinhood - Buying Stocks with no Fees | finance | April 12, 2018

rskelton.com Tech Stack Details | tech | April 11, 2018

Personal Capital - Finance Aggregator | finance | April 4, 2018

Rent Other Peoples Cars with Turo | cars | April 3, 2018