BMW Garage BMW Meets Register Search Today's Posts Mark Forums Read
BIMMERPOST Universal Forums > General BMW News and Cars Discussion > BMW Connected App Security Issue - Past owners can still access data/remote options

Post Reply
 
Thread Tools Search this Thread
      11-19-2019, 01:30 AM   #1
srim3
V8 M Power
srim3's Avatar
United_States
34
Rep
48
Posts

Drives: E85 Z4
Join Date: Jul 2009
Location: Austin, TX

iTrader: (0)

BMW Connected App Security Issue - Past owners can still access data/remote options

Past owners can still access car data/remote control options from BMW Connected App!

I sold my M2 in 2016 but never got to remove it from my profile in the BMW Connected iOS app. Just now I happen to check the app, and I still have the M2 profile and am able to access it. The new owner may not know about it that who ever bought it from the dealership I sold it to.

It also gives me option to remote lock/unlock, flash headlights too under the remote app.

And it does show the current mileage, Fuel Level etc.

This is crazy! I will call BMW Connected and let them know. Seems like they don't have a way to automatically disable the profile from BMW connected app when the previous owner sold their cars.

Thought I would let you all know and please make sure to update with BMW connected app and make sure they disable the previous owners from accessing the info.
Attached Images
  
Appreciate 4
DocL1922.50
Poochie9099.00
      11-21-2019, 07:43 PM   #2
siegester
Captain
siegester's Avatar
341
Rep
751
Posts

Drives: '20 M340i
Join Date: Jan 2011
Location: USA

iTrader: (0)

Garage List
2020 BMW M340i  [0.00]
Oh hey, I can still see my old F06 too... Yikes!
Appreciate 0
      11-21-2019, 08:36 PM   #3
DocL
Captain
DocL's Avatar
United_States
1923
Rep
863
Posts

Drives: 2018 M3
Join Date: Jan 2019
Location: Delray Beach

iTrader: (2)

That is a serious flaw.
__________________
2018 F80 M3. YMB/BLK. ZCP. Three Pedals.
"Education will never be as expensive as ignorance."
Appreciate 0
      11-21-2019, 08:59 PM   #4
Killed by Death
Brigadier General
Killed by Death's Avatar
12140
Rep
3,456
Posts

Drives: '23 X3 M40i
Join Date: Aug 2017
Location: North Carolina

iTrader: (0)

Dude, u gotta F with them and start honking the horn before disconnecting
Appreciate 1
Poochie9099.00
      11-22-2019, 10:06 AM   #5
wrickem
Big Beaver Smile
wrickem's Avatar
2101
Rep
3,790
Posts

Drives: What he wants to
Join Date: Mar 2006
Location: lambertville nj

iTrader: (0)

When I traded in my '11 335, my good friends went to the dealership and bought it as a CPO.

For 6 months, I was able to mess around with them through Connected, sending directions to crazy places (message parlors, high end spas, funeral homes, Taco Bell when they were on diets). Sometimes I'd lock it if I saw it was in their driveway unlocked. Sometimes I'd beep the horn. It was fun

I had to confess to them when I couldn't keep a straight face when they asked me if it did weird things like that to me when it was mine.
__________________
______________________________________________
Current- '21 430 , '19 911, 07 M6 ,'17 Jeep Wrangler, "23 Bronco OBXluxsquatch
Appreciate 2
      11-23-2019, 08:29 AM   #6
srim3
V8 M Power
srim3's Avatar
United_States
34
Rep
48
Posts

Drives: E85 Z4
Join Date: Jul 2009
Location: Austin, TX

iTrader: (0)

Quote:
Originally Posted by wrickem View Post
When I traded in my '11 335, my good friends went to the dealership and bought it as a CPO.

For 6 months, I was able to mess around with them through Connected, sending directions to crazy places (message parlors, high end spas, funeral homes, Taco Bell when they were on diets). Sometimes I'd lock it if I saw it was in their driveway unlocked. Sometimes I'd beep the horn. It was fun

I had to confess to them when I couldn't keep a straight face when they asked me if it did weird things like that to me when it was mine.
That is funny! If I knew who the current M2 owner I would have done the same.
Appreciate 0
      11-23-2019, 11:17 AM   #7
xlover
Colonel
No_Country
2191
Rep
2,554
Posts

Drives: 2023 X7 40i
Join Date: Aug 2011
Location: Boston

iTrader: (0)

Think the dealer is supposed to contact bmw to reset the car....
Appreciate 2
clee1982796.00
ried791.50
      11-23-2019, 11:48 AM   #8
IAmATeaf
Captain
IAmATeaf's Avatar
United Kingdom
238
Rep
878
Posts

Drives: 2015 F30 335i
Join Date: Nov 2017
Location: UK

iTrader: (0)

Garage List
2015 BMW 335i  [0.00]
When I got my car I couldn’t connect because the previous owner had the car under his/her account, I had to jump through quite a few hoops and email them copies of the cars registration document and my passport. By that time I got sick of the whole thing as around 6 weeks had gone by so I let the subscription lapse.
Appreciate 0
      11-23-2019, 12:40 PM   #9
omera60
First Lieutenant
omera60's Avatar
Turkey
195
Rep
366
Posts

Drives: 218i Coupe
Join Date: Mar 2017
Location: Istanbul

iTrader: (0)

Garage List
Believe it or not this happens quite a lot. I know from experience with my dealer. It is actually both parties (buyer & seller) responsibility to transfer it. BMW does not have any responsibility whatsoever.
Appreciate 0
      11-23-2019, 12:52 PM   #10
CSL335i
Lieutenant
Hungary
207
Rep
422
Posts

Drives: M2 and...
Join Date: Mar 2010
Location: Budapest/Hungary/Europe

iTrader: (0)

Quote:
Originally Posted by srim3 View Post
Past owners can still access car data/remote control options from BMW Connected App!

I sold my M2 in 2016 but never got to remove it from my profile in the BMW Connected iOS app. Just now I happen to check the app, and I still have the M2 profile and am able to access it. The new owner may not know about it that who ever bought it from the dealership I sold it to.

It also gives me option to remote lock/unlock, flash headlights too under the remote app.

And it does show the current mileage, Fuel Level etc.

This is crazy! I will call BMW Connected and let them know. Seems like they don't have a way to automatically disable the profile from BMW connected app when the previous owner sold their cars.

Thought I would let you all know and please make sure to update with BMW connected app and make sure they disable the previous owners from accessing the info.
If you sell your car, you should DELETE your car under your BMW Connected app or under connected drive web site (both of them requires your connected drive account, which used during the car registration).

If the new user register the car with connected app or under Connected Drive site, i think this registration also removes the car from your profile, but to be on the safe side, you should remove it first.
Appreciate 0
      11-26-2019, 05:09 PM   #11
bimmer456
Major General
2940
Rep
5,983
Posts

Drives: 340i
Join Date: Nov 2016
Location: Pasadena, CA

iTrader: (0)

Yes I noticed this when adding my loaner but now it is disabled for fleet vehicles. The app security isn't all that great.
Appreciate 0
      11-26-2019, 07:58 PM   #12
pennsiveguy
Major
pennsiveguy's Avatar
United_States
3552
Rep
1,062
Posts

Drives: F15 xDrive50i M-sport
Join Date: Apr 2019
Location: Edina, MN

iTrader: (0)

Garage List
Quote:
Originally Posted by wrickem View Post
When I traded in my '11 335, my good friends went to the dealership and bought it as a CPO.

For 6 months, I was able to mess around with them through Connected, sending directions to crazy places (message parlors, high end spas, funeral homes, Taco Bell when they were on diets). Sometimes I'd lock it if I saw it was in their driveway unlocked. Sometimes I'd beep the horn. It was fun

I had to confess to them when I couldn't keep a straight face when they asked me if it did weird things like that to me when it was mine.
That's fantastic. Hopefully they were able to laugh about it along with you.
__________________
2017 F15 xDrive50i M Sport | Superformance GT40 Roush 511 IR FE
Appreciate 1
wrickem2101.00
      11-26-2019, 10:27 PM   #13
premier3is
Major
premier3is's Avatar
1627
Rep
1,002
Posts

Drives: 2019 BMW 330i M-Sport
Join Date: Jul 2019
Location: CA

iTrader: (0)

I wish the app actually worked...
Appreciate 1
      11-27-2019, 04:03 AM   #14
wrickem
Big Beaver Smile
wrickem's Avatar
2101
Rep
3,790
Posts

Drives: What he wants to
Join Date: Mar 2006
Location: lambertville nj

iTrader: (0)

Quote:
Originally Posted by pennsiveguy View Post
Quote:
Originally Posted by wrickem View Post
When I traded in my '11 335, my good friends went to the dealership and bought it as a CPO.

For 6 months, I was able to mess around with them through Connected, sending directions to crazy places (message parlors, high end spas, funeral homes, Taco Bell when they were on diets). Sometimes I'd lock it if I saw it was in their driveway unlocked. Sometimes I'd beep the horn. It was fun

I had to confess to them when I couldn't keep a straight face when they asked me if it did weird things like that to me when it was mine.
That's fantastic. Hopefully they were able to laugh about it along with you.
They loved it, I couldn't have friends that didn't have a great sense of humor.

In an unexpected twist, I ended up buying back that car on Saturday from them for my daughter. One of the first things I did was check their connected drive app to see if it's still on it. It was. I'm sure they'll mess with her for a bit.
__________________
______________________________________________
Current- '21 430 , '19 911, 07 M6 ,'17 Jeep Wrangler, "23 Bronco OBXluxsquatch
Appreciate 1
Post Reply

Bookmarks

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



All times are GMT -5. The time now is 05:02 PM.




m2
Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2024, vBulletin Solutions Inc.
1Addicts.com, BIMMERPOST.com, E90Post.com, F30Post.com, M3Post.com, ZPost.com, 5Post.com, 6Post.com, 7Post.com, XBimmers.com logo and trademark are properties of BIMMERPOST