Researchers drove a NIO ES8 electric SUV deep into a Norwegian underground mine specifically to sever its external connections. The car kept attempting to reach servers, most of them located in China. These findings echo broader concerns about hidden data collection, similar to how a surveillance app was built to covertly target users without their knowledge.

That finding sits at the center of Project Lion Cage, a multi-year study initiated in 2022 by Tor Indstøy, a risk management and threat intelligence executive at Telenor Group. Indstøy purchased the NIO ES8 as a dedicated research platform.

The project arrives as Chinese EV brands expand across European markets with assurances about local data processing. Observed network behavior appears to contradict those assurances.

top 96 comments

sorted by: hot top controversial new old
[–] 112 points 1 month ago (5 children)

Obviously it would keep calling...

The point was likely to see what would happen if they could be 100% sure it couldn't connect in anyway.

Before deciding if it's worth attempting to find every conney, you need to verify what happens if you did succeed.

Like, finding out it bricks every vehicle after 24 hrs means it's useless to bother and they need banned.

  • source
  • hideshow 5 child comments
  • [–] 84 points 1 month ago (2 children)

    Like the Polish trains that were remotely disabled when taken in at a competitor's maintenance shop https://hackaday.com/2023/12/14/polish-train-manufacturer-threatens-hackers-who-unbricked-their-trains/

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 1 month ago (1 child)

    The more we learn about this story the more interesting it becomes, as the Newag trains in question began failing after service as far back as 2021. In desperation after services were affected by the number of non-functional units, an employee searched online for Polish hackers and found a group called Dragon Sector. The group was able to find the issue, and are now being threatened with legal action by the manufacturer, who are citing possible safety issues.

    A lot of ground was covered with so little info. How did they the employee contact hackers? Are they white hat or did they scour The Dark Web for Polish tech support? What was the issue that unbricked a train?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 1 month ago

    did they scour The Dark Web for Polish tech support?

    yep, security departments of major corporations scour the dark web constantly looking for credentials that are stolen or other company assets for sale, or rumors about the company. Its a key part of finding out if you've been hacked. Hackers sell or brag about what they take. So finding hackers if you are already doing that activity is not too huge a project.

  • source
  • parent
  • [–] 52 points 1 month ago (2 children)

    The car kept attempting to reach servers

    To the surprise of whom?

    ANY device that relies on radio signal communication for any of its functionality, taken anywhere (underground mine, parking garage, Antarctica, Santa's workshop, etc), and it'll try to maintain it's connections. That's just what they do.

  • source
  • hideshow 2 child comments
  • [–] 22 points 1 month ago* (last edited 1 month ago)

    Step 1: make a PiHole

    Step 2: examine every thing the PiHole blocks from calling home

    Step 3: research small holdings

    Step 4: throw it all out and go farm Llamas

    Seriously, I own a Firestick as a jellyfin client. It's network access is limited to local only. Anyway, here's one entry from that Firestick on one PiHole:

    global.telemetry.insights.video.a2z.com 42590

    Number is the number of times my PiHole has smacked it down. One entry, from one stick, to one PiHole (I have a redundant one too).

  • source
  • [–] 58 points 1 month ago (8 children)

    Why on Earth wouldn't it keep trying? That's how signals work. If my router goes down my computer is going to keep trying to connect to it even though it's off. That's not fucking news.

  • source
  • hideshow 8 child comments
  • [–] 10 points 1 month ago (2 children)

    Yeah, I had the same thought when reading this

    What a weird article

  • source
  • parent
  • hideshow 2 child comments
  • [–] 22 points 1 month ago (1 child)

    My assumption would be that they drove the car into the mine to see what would (or wouldn't) work if the vehicle was cut off from the mothership. My hunch is they didn't really find anything of interest so this is what gets reported.

  • source
  • parent
  • hideshow 1 child comment
  • [–] -5 points 1 month ago (3 children)

    If I’m reading correctly, they specifically tried to stop it from doing so and even in what is essentially a faraday cage it keeps trying to link with Beijing to spill the tea, not exactly what you want if you “own” a product

  • source
  • parent
  • hideshow 3 child comments
  • [–] 11 points 1 month ago (2 children)

    Yeah, and that's how connections work.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 37 points 1 month ago (4 children)

    My BMW checking if my bmw subscription is active when I'm trying to enable seat heater

  • source
  • hideshow 4 child comments
  • [–] 7 points 1 month ago (3 children)

    I wonder what the security is like. I'd love to know how difficult it would be to set up a mock-service to just tell it you have everything.

    You'd expect there to be encryption and some kind of certificate validation to check the response is trustworthy, but given what we now know about the CAN bus that many cars use, and how vulnerable it is to attack, it suggests the motor industry is way behind the times in terms of security.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 11 points 1 month ago*

    Somebody smarter than I will definitely delve into the guts of incoming Chinese EVs and figure out what part(s) to strip to stop this...

    And if you're in America and you have an EV, it's statistically likely to be a Tesla. Tesla has starlink compatibility baked into their cars too and you'd better believe that sweet juicy data is being shared around.

    If I was stuck with a Tesla against my will, I'd at least try the same thing for it, too.

  • source
  • [–] 40 points 1 month ago* (last edited 1 month ago) (6 children)

    This article is so stupid with the dumbest fearmongering clickbait title -

    Anything that calls home will try to call home. Connection or not. You put an LG tv (edit: just found out that when LG and TV are put together without a space, it gets censored?) in a faraday cage and it will try to phone home. There's no reason it would suddenly stop doing that because there's no point to adding another line of code to get it to stop when it doesn't need to.

    Not to mention that the important part is this:

    The critical caveat: the traffic was encrypted. Researchers could document destinations and data volumes, but not the content of the packets themselves. No evidence of specific personal data exfiltration was found, and the tests do not prove that NIO is transmitting sensitive information to Chinese authorities.

    Now compare that to a plethora of other car manufacturers that don't even bother to encrypt your data and explicitly say that you will be tracked by them and have your data sold.

    https://cybernews.com/privacy/mozilla-cars-track-sexual-activity-sell-data/

    cars track even sexual activity, sell user data to third parties

  • source
  • hideshow 6 child comments
  • [–] 14 points 1 month ago

    My takeaway was that this was the important bit

    The project arrives as Chinese EV brands expand across European markets with assurances about local data processing. Observed network behavior appears to contradict those assurances.

  • source
  • parent
  • [–] 6 points 1 month ago* (last edited 1 month ago)

    this. I seen people try to just use hostnames to block the LG telemetry, and the result is it just phone home harder, the logs just show it spams thousands of requests per second. Only way to stop it is to relay it to a fake server to return a fake response.

  • source
  • parent
  • [–] 10 points 1 month ago (3 children)

    just found out that when LG and TV are put together without a space, it gets censored?

    Iirc LG TV is a derogatory slang for LGBT, so maybe CA have the term censored.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 9 points 1 month ago

    And this is exactly why runor has it military installations in my country don't allow EVs to enter at all.

  • source
  • [–] 9 points 1 month ago (1 child)

    Can't this be solved with legislation? I mean, all they have to do is say "no vehicles may be sold within our borders if they attempt to communicate with any servers." Vehicles never did this 15 years ago and it's insane they operate like massive phones with wheels now.

  • source
  • hideshow 1 child comment
  • [–] 15 points 1 month ago

    The car kept attempting to reach servers, most of them located in China

    Now try the same experiment with cars from other countries.

    And then let's hear from someone who can tell the world how to disable this anti-feature without breaking the car that we bought and paid for.

  • source
  • [–] 13 points 1 month ago

    Oh no think of our own GDPR compliant surveillance. (it's still surveillance)

  • source
  • [–] 13 points 1 month ago

    If I take my cellphone into a cave it too will keep calling home.

  • source
  • [–] 6 points 1 month ago
    [–] 24 points 1 month ago (3 children)

    Ah, because neither Google nor Apple track their users and would never, ever share said data with US (or other) agencies... right? RIGHT?

  • source
  • hideshow 3 child comments
  • [–] 8 points 1 month ago (2 children)

    Sure. Don't worry about this bad behavior, because others engage in it, and it's not like anyone calls out US tech privacy issues. I struggle to imagine someone naturally reacting this way. Are you for real?

  • source
  • parent
  • hideshow 2 child comments
  • I agree it is something we should worry about and pay attention too, but just because something occurs doesn't mean it was nefarious on purpose. Apple is better than many, but let's say you have an iPhone. The iPhone is constantly reaching out and reporting it's location to the findmy app that is only accessible by the users. If that phone is in a cave performing this test, it will be reaching out continuously similar to this car. Apple doesn't sell that data, but where it becomes a breach of privacy is that if a judge gives a warrant, Apple has to turn it over. (So suddenly it isn't only accessible to the user meaning verification is NORMALLY required to allow Apple to access the data, but they could bypass said verification.

    So does that mean no one should ever enable find my on their devices... Maybe, but people weigh it against whatever they find useful about it.

  • source
  • parent
  • [–] 1 point 1 month ago

    What I'm saying is just because it's China doesn't make it any worse than devices and cars phoning home to US agencies/corporate entities. Might be fuckery from both sides but I don't get the disproportionate uproar.

  • source
  • parent
  • [–] 16 points 1 month ago (3 children)

    I have Chinese manufactured IP cameras. they do not connect to the internet. yet, they still attempt to connect to Chinese servers at least once a minute.

    this has been going on for at least 15 years.

  • source
  • hideshow 3 child comments
  • [–] 2 points 1 month ago (1 child)

    I have an Chinese manufactured American developed phone. It connects to an American server frequently.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 35 points 1 month ago (11 children)

    Oh NO! China might harvest the kind of data that Google, Meta, Tesla, and other US companies have had a monopoly on stealing.

  • source
  • hideshow 11 child comments
  • [+] -22 points 1 month ago (9 children)

    The thing is, you agreed that google and meta could have that data. Nobody signed any terms for the bus..

  • source
  • parent
  • hideshow 9 child comments
  • [–] 18 points 1 month ago (1 child)

    In the US, cars collect all kinds of data on everyone in them including passengers and manufacturers claim it's okay because getting in the vehicle counts as consent..

  • source
  • parent
  • hideshow 1 child comment
  • [–] 32 points 1 month ago (3 children)

    “You agreed that Google and meta…”

    You sure about that? Did you read every term and condition? Did you agree that they would keep a complete record of your exact location? Did you agree that they will record your voice using the Bluetooth hack? Did you agree that Facebook should be able to buy your medical data off the data market and combine it with your profile?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 12 points 1 month ago (1 child)

    I remember reading that meta tracks you even if you don't have a Facebook account. It collects information on you from any photos your friends add with you in it or by taking your contact information from your friends phone or the wide net of meta trackers that are spread around the internet. Meta collects that information to create a shadow profile of you without you even knowing.

    So meta does the exact same thing as the bus.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 15 points 1 month ago (18 children)

    It's weird that they didn't use a Faraday cage which should have been way cheaper.

  • source
  • hideshow 18 child comments
  • [–] 26 points 1 month ago* (last edited 1 month ago) (14 children)

    How is that weird? Do you know how much metal costs these days? The man hours to build a bus sized faraday cage and make sure it’s 100% secure? What do you do with your massive cage when you’re done, how much effort to scrap or resell it or store it?

    They just had to spend a few bucks on petrol with this solution. It’s elegant, cheap, wastes almost nothing. Repeatable. Works with any size vehicle. It’s perfect.

  • source
  • parent
  • hideshow 14 child comments
  • [–] 16 points 1 month ago (6 children)
  • [–] 14 points 1 month ago (5 children)

    Oh right it’s an EV lol 🤦‍♀️

  • source
  • parent
  • hideshow 5 child comments
  • [–] -2 points 1 month ago (4 children)

    No, but how did they get it into the underground space? Elevator? Or there’s a way to drive in which still prevents all signals getting out?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 month ago* (last edited 1 month ago) (1 child)

    They could probably just drape the whole bus with a bunch of chicken wire (or wrap it) for a makeshift Faraday cage. I doubt that would take more than an hour or so.

    Certainly cheaper and easier than building up a bus-sized Ferriday cage.

  • source
  • parent
  • hideshow 1 child comment
  • [–] -2 points 1 month ago (1 child)

    What do you do with your massive cage when you’re done

    I've seen big Faraday cages in large companies when I was young. It's never a one-shot project and it doesn't cost that much.

    Telenor ASA (Norwegian pronunciation: [ˈtêːlənuːr] or [tɛləˈnuːr])[2] is a Norwegian majority state-owned multinational telecommunications company

    Net income is multiple billions. Hence my question.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 1 month ago (1 child)

    A more honest researcher would say "bought any vehicle from x country and it kept trying to contact servers in x country even after driving it into a mine". They lose credibility when they try to insinuate that this only happens with EVs and only with China made vehicles.

  • source
  • hideshow 1 child comment
  • [–] 3 points 1 month ago (1 child)

    With all our formidable intelligence and NSA capability and massive massive funding, no one can tell whats in those communications after all this time huh. We even have physcial access to the devices and we still cant figure it out. Next time we are told the government needs to remove citizens constitional rights to privacy or needs us to use insecure encryption keys, we should all question what the hell for. And next time I hear "Israel helps us with our intelligence" I want to hear what they came up with in understyanding what chinese devices are sending home, or they can shut the hell up. So far all we seem capable of is spying on our own citizens, IF we all use insecure communications and allow our every movement in public to be videoed. I am not impressed.

  • source
  • hideshow 1 child comment
  • [–] 19 points 1 month ago (9 children)

    Lol wut. What kind of scaremongering BS article is this?

    Telemetry system attempts to phone home during connectivity interruption

    "FIRE UP THE PRESSES!"

  • source
  • hideshow 9 child comments
  • [–] 7 points 1 month ago (1 child)

    I have no doubts that my Japanese car would do the same. It's probably sending my conversations that it is constantly recording through the hands free calling microphone too. The world needs to wake up and realized we lost this battle years ago.

  • source
  • parent
  • hideshow 1 child comment
  • we lost this battle years ago

    Have to assume that all the info has been fed into some LLM somewhere at this point. Somewhere there's probably a computer better at replicating people's voices to other computers than the people they're mimicking. Existing databases are the new world now in terms of stripping them for resources, and new ways of thinking of chopping them up and packaging them are where all the innovation is.

    Next will be injecting fake records into all the databases so another program will think the record as a whole is real. A person won't be the person, they'll be the database entry.

  • source
  • parent
  • [–] 5 points 1 month ago (6 children)

    The point was to try what happens when the telemetry system fails to contact home for a prolonged time.

  • source
  • parent
  • hideshow 6 child comments
  • [–] -1 points 1 month ago (5 children)

    So they proved that a telemetry system attempts to phone home in areas with limited connection? Truly groundbreaking. Nobel Prize incoming.

    So if I take my phone into a parking garage, and I see the little icon for roaming, have I suddenly done an experiment worthy of publishing?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 5 points 1 month ago (2 children)

    If you have had a reason to assume that the phone might get bricked by you doing that, yes. How is that not obvious?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 1 month ago (1 child)

    Are you being purposely obtuse? It was to see if ANYTHING would happen specifically after it has been "offline" for an extended period of time. Its really not that hard to understand.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 month ago

    It has a kill switch, too

    (I have no evidence other than The Odyssey and everything that has happened since)

  • source
  • [–] 2 points 1 month ago

    Am I the only one in this thread that feels like a vehicle here shouldn't even have any form of internet connection regardless what nation it is from? The fact that this is from China doesn't matter. Why does a vehicle even need network equipment (other than a FM radio at most)?

  • source
  • [–] 2 points 1 month ago

    My Chev calls the US!

  • source
  • [–] 1 point 1 month ago
    load more comments
    view more: next ›