The rapid advancement of intelligent connected vehicles (ICVs) in the automotive sector has significantly intensified security and privacy issues. Particularly, the previous studies have indicated that the ICV users (owners) are deeply concerned about the extensive data gathered by these vehicles. However, current research into vehicle security predominantly concentrates on the analysis and discussion of sensitive data from ICVs of specific brands or models. There is a notable lack of studies that conduct a comprehensive, large-scale investigation into the sensitive data collected by ICVs and assess the privacy implications of such data collection. In this article, we undertake an extensive investigation to comprehend the privacy risks associated with Internet-connected vehicles (ICVs) through their companion mobile apps. To accomplish this, we have devised a semi-automatic pipeline leveraging program analysis and large language model (LLM) to identify and track sensitive data across these apps. Specifically, we begin by constructing a detailed knowledge base of ICV sensitive data extracted from the privacy policies of companion apps. Subsequently, we conduct static analysis on the car companion apps, pinpointing instances of sensitive data usage within the app code and analysing their potential privacy risks. Our analysis, covering 401 car companion apps spanning 271 unique vehicle brands, unveils several noteworthy findings concerning the usage of user sensitive data in the ICV ecosystem. For instance, various entities within the ICV ecosystem collect a wide array of sensitive data, including brake status, passenger occupancy, and insurance details. Alarmingly, we discover that 37.91% of car companion apps fail to adequately disclose their data usage practices. Moreover, we observe extensive involvement of entities beyond vehicle manufacturers in the handling of vehicle sensitive data, including data analytics companies, charging service providers, and cloud service vendors.

中文翻译：

---

通过配套移动应用程序了解智能互联汽车的隐私风险


智能网联汽车 （ICV） 在汽车行业的快速发展显著加剧了安全和隐私问题。特别是，以前的研究表明，ICV 用户（车主）对这些车辆收集的大量数据深表担忧。然而，目前对车辆安全的研究主要集中在分析和讨论来自特定品牌或型号的 ICV 的敏感数据。明显缺乏对 ICV 收集的敏感数据进行全面、大规模调查并评估此类数据收集对隐私影响的研究。在本文中，我们进行了广泛的调查，以了解通过其配套移动应用程序与联网汽车 （ICV） 相关的隐私风险。为了实现这一目标，我们设计了一个半自动管道，利用程序分析和大型语言模型 （LLM） 来识别和跟踪这些应用程序中的敏感数据。具体来说，我们首先构建了一个详细的知识库，其中包含从配套应用的隐私政策中提取的 ICV 敏感数据。随后，我们对汽车伴侣应用程序进行静态分析，查明应用程序代码中敏感数据使用的实例，并分析其潜在的隐私风险。我们的分析涵盖了 271 个独特汽车品牌的 401 个汽车伴侣应用程序，揭示了关于 ICV 生态系统中用户敏感数据使用的几个值得注意的发现。例如，ICV 生态系统中的各种实体收集各种敏感数据，包括制动状态、乘客占用率和保险详细信息。令人震惊的是，我们发现 37.91% 的汽车伴侣应用程序未能充分披露其数据使用做法。 此外，我们观察到汽车制造商以外的实体广泛参与车辆敏感数据的处理，包括数据分析公司、充电服务提供商和云服务供应商。