You can take your tinfoil hat off now....

 

Yes, and no.

Personally, I wouldn't be concerned about VW spying, err, collecting, driving data on people if the CarNet wasn't even enabled. Because how would they get the data? Data transmission and storage costs money..... It's not like Verizon or whoever is the carrier will carry the data for free. Someone needs to pay for it.... This is after all the same VWoA who doesn't offer DCC on "S" trim level cars ostensibly because the margin isn't high enough.....

I would however be extremely concerned about theft and security with CarNet enabled. Check out this BMW hack which exploited the ConnectedDrive telematics to unlock the doors:
Beemer, Open Thyself!

As far as hacking the CarNet module, check out this thread:
HT-5 bluetooth hack to script your Volkswagen MFA display

 

There is no disabling of the sky- er... I mean carnet.


Sent from my iPhone using Tapatalk

 

Has any one disable the carnet?

I'm not familiar with this feature, because I believe that it is something that is only offered in the USA (I live in Canada, my Golf 7 did not come with CarNet).

But, if CarNet uses its own dedicated controller - which it probably does, if it is similar in concept to the OnStar systems that were installed in Phaetons and Touaregs in days gone by - a simple way of disabling the system would be to unplug the controller. To do that, you will first have to determine where the controller is (perhaps another forum member might know). Once you have unplugged it, it is probable that you will get fault codes generated. You can either disregard these fault codes, or perhaps eliminate them entirely by going to controller 19 (the CAN Gateway) and refreshing it so that the CAN Gateway no longer notes the presence of the unplugged controller.

The above is the most elegant way of doing the job. A cruder, though equally effective method of disabling the microphone would be to simply cut the microphone cord. The microphone is likely fitted up in the roof module, just aft of the forward cabin lights. Take the roof module apart with a trim tool, identify the microphone wire, then cut it.

Michael

 

Interested in the answer as well.

Not sure if there is a separate module. This may actually be connected and controlled by the event log unit a.k.a "black box" and disabling these is lately illegal.

 

It can be unplugged, where is it located?

http://forums.tdiclub.com/showthread.php?t=399090

 

what are the pictures showing? Where is this connector?

 

Impinging on Civil liberties

Has any one disable the carnet? That thing scares the hell out of me. Not a big fan of having a microphone in my car ..i know they are listening..at least someone could if they wanted to and they know where you are at all times. Watch out those who lease.carnet = location, audio, and speed.

Keep in mind too, the police that have cameras in their patrol cars (the chariots of justice) and also have various computerized camera software, have among other database use, license plate scanning software that creates "profiles" of when and where the make/model/plate has been seen - various locales, near crime scenes, late night bars, drag strips, parking violations.

I dont' want big brother near my car or truck OR monitoring me.

 

Keep in mind too, the police that have cameras in their patrol cars (the chariots of justice) and also have various computerized camera software, have among other database use, license plate scanning software that creates "profiles" of when and where the make/model/plate has been seen - various locales, near crime scenes, late night bars, drag strips, parking violations.

I dont' want big brother near my car or truck OR monitoring me.

If a system CAN be abused, sooner or later it WILL be abused.

 

Has any one disable the carnet? That thing scares the hell out of me. Not a big fan of having a microphone in my car ..i know they are listening..at least someone could if they wanted to and they know where you are at all times. Watch out those who lease.carnet = location, audio, and speed.

stlgti: Hi, we don't have CARNET down here in the very, very deep south, but I've been looking at some of the "on-line services" in you cars via the information in the telematics control module. There's some very sophisticated stuff happening in a NAR model car! Not sure if you have a VCDS cable, but if you do, it's worth a look (IMO). Here's and extract from the admap of a NAR car that I have in my data base (I've not included the settings in the list to protect the original owner:

(1)-Online_Services_Communication_Protocol-APN_Auth_Type
(2)-Online_Services_Communication_Protocol-GSM_Automatic_Operator
(3)-Online_Services_Communication_Protocol-PDP_Type
(4)-Online_Services_Communication_Protocol-TCP_Max_Receive_Window
(5)-Online_Services_Communication_Protocol-TCP_Max_Transmit_Window
(6)-Online_Services_Communication_Protocol-Keep_Connection_Alive_If_Event_Expected_Within
(7)-Online_Services_Communication_Protocol-TCPMS
(8)-Online_Services_Communication_Protocol-PDP_Grace_Time
(1)-Online_Services_Data_Roaming-Core_Service_Management
(2)-Online_Services_Data_Roaming-Remote_Speed_Alert
(3)-Online_Services_Data_Roaming-Geofencing
(4)-Online_Services_Data_Roaming-Remote_Vehicle_Tracking
(5)-Online_Services_Data_Roaming-Remote_Vehicle_Disabling
(6)-Online_Services_Data_Roaming-Core_Service_Telephony
(7)-Online_Services_Data_Roaming-JobMechanism
(8)-Online_Services_Data_Roaming-Remote_Door_Unlock
(9)-Online_Services_Data_Roaming-Remote_Honking_and_Flashing
(10)-Online_Services_Data_Roaming-Roadside_Assistance
(11)-Online_Services_Data_Roaming-Vehicle_Health_Report
(12)-Online_Services_Data_Roaming-POI_Address_Import
(13)-Online_Services_Data_Roaming-Remote_Battery_Charging_Management
(14)-Online_Services_Data_Roaming-Remote_Pre_Trip_Climatisation
(15)-Online_Services_Data_Roaming-Remote_Departure_Time_Programming
(16)-Online_Services_Data_Roaming-Remote_Vehicle_Status
(17)-Online_Services_Data_Roaming-Remote_Trip_Statistics
(1)-Online_Services_Timeouts-Transport_Protocol_Timeout
(2)-Online_Services_Timeouts-HTTP_Timeout
(3)-Online_Services_Timeouts-Secure_Connection_Timeout
(4)-Online_Services_Timeouts-PDP_Timeout
(5)-Online_Services_Timeouts-Network_Timeout
Online_Services_Voice_Roaming

 

Don:

You missed a few:

(18)-Online_Services_Data_Roaming-The_Driver_Has_Been_Drinking_Too_Much

and

(19)-Online_Services_Data_Roaming-There's_Action_In_The_Back_Seat.

Michael

 

This is a very good question as I wanted to disable this myself. I hate the fact that there is a system that connects to the internet to relay info back.

 

Who sees the data?




You should hate it. Who is watching the data? Accountants, warranty people, VIN# control techs? GPS analyzers. You know your cell phone (generally) does the same thing. A 'trace' signal tells the phone provider where you are, even if the phone just has a battery in it.

 

A VW service tech chimed in on this issue in another thread. IIRC he said it was located under the front passenger seat but that unplugging it would also disable the car's bluetooth module.

I would love if someone could figure out how to do this without gimping the car's bluetooth. In that thread the tech said that the cars registered with his dealership reported back to him when a CEL came on, when the car needed a service, etc and that it was within his discretion to contact the customer about it or not. If true I don't like the reporting at all, especially for those of us with tuned cars.

 

well, I think that last ditch effort would be to disassemble the roof gps antena/fin and cut the wires there.
I don't use XM radio anyway so i would not miss it anyway.

 

Watch out those who lease.carnet = location, audio, and speed.

really? wtf does the leasing company care about your location, audio and speed?

 

The Carnet app for iOS/Android lets you track the location of your car, set speed alerts, see fuel levels, which doors are open, which windows are down, and also can remotely lock/unlock (all the features from the code abovee). Even for cars without Navigation.

The Carnet GPS coordinate seems to be accurate to within about 15-20 feet. I wonder if it can be used for navigation purposes somehow ??

 

I am 99% sure that unplugging the carnet module will disable your microphone... which you use... for bluetooth calling.

 

... more reasons to tackle the sending/receiving portion of the system (antenna).

 

I kinda want to just pull the sim card out of the box. That would end all communications...

 

what sim card in the glove box

 

Sub'd. CarNet is overpriced anyway IMO, so I'd rather it be disabled too.

 

I just never activated mine, I keep getting letters telling me to do so. If I never activate the system, then it doesn't work lol. Why did you activate it if you were concerned? I looked at the fine print and decided not to.

Be an informed consumer and READ

 

It would be a mistake to assume that because you never activated it that they could not still collect all the same data from your car.

 

It is essentially a WWAN adapter over 3G that is connected to your CAN bus. These usually have no encryption if they are connected to the 3G network and is a way for outsiders to get in to cause havoc. I don't know. I really do not like having my CAN bus (not the drive train at least) exposed to the internet like this.

 

These parameters posted above indicate quite a bit about the communications used:

(1)-Online_Services_Timeouts-Transport_Protocol_Timeout
(2)-Online_Services_Timeouts-HTTP_Timeout
(3)-Online_Services_Timeouts-Secure_Connection_Timeout

If you can change those parameters, setting them to zero should disable the reporting function... at least the ones using the HTTP/HTTPS protocol.
It would be fascinating to sniff that connection and see what it's sending.

It could all be encrypted if they are using HTTPS for everything. But car manufacturers generally have a poor grasp of security so I would not be surprised to find they are sending important data in the clear and accepting commands from unauthenticated sources.

 

Eric: I'm with you, but I suspect that there might be a few other adaptation channels that need to be re-set. Incidentally, the 3 x adaptation channels that you identified all have a default setting of 120 s.

Here's the complete list of Adaptation channels in the control module (sans settings)

Acoustic warning for vehicle shut-down
(1)-After-run time-Long term energy budget
(2)-After-run time-Short term energy budget
(3)-After-run time-Waiting period from sleep to standby mode
(4)-After-run time-Waiting period from standby to stop mode
(5)-After-run time-Time period for cyclic stop mode in operating mode
(6)-After-run time-Time period for cyclic standby mode in operating mode
(7)-After-run time-Time period for operating mode
(8)-After-run time-Cyclic time after the operating mode
(9)-After-run time-Connection after T. 15 on
(10)-After-run time-Time period for connection after T. 15 on
Antenna for telephone status
Base volume of speech output
Deactivate production mode
(1)-Dimming charac. curve of green function illumination-X1
(2)-Dimming charac. curve of green function illumination-Y1
(3)-Dimming charac. curve of green function illumination-X2
(4)-Dimming charac. curve of green function illumination-Y2
(5)-Dimming charac. curve of green function illumination-X3
(6)-Dimming charac. curve of green function illumination-Y3
(7)-Dimming charac. curve of green function illumination-X4
(8)-Dimming charac. curve of green function illumination-Y4
(9)-Dimming charac. curve of green function illumination-X5
(10)-Dimming charac. curve of green function illumination-Y5
(11)-Dimming charac. curve of green function illumination-X6
(12)-Dimming charac. curve of green function illumination-Y6
(1)-Dimming charac. curve of red function illumination-X1
(2)-Dimming charac. curve of red function illumination-Y1
(3)-Dimming charac. curve of red function illumination-X2
(4)-Dimming charac. curve of red function illumination-Y2
(5)-Dimming charac. curve of red function illumination-X3
(6)-Dimming charac. curve of red function illumination-Y3
(7)-Dimming charac. curve of red function illumination-X4
(8)-Dimming charac. curve of red function illumination-Y4
(9)-Dimming charac. curve of red function illumination-X5
(10)-Dimming charac. curve of red function illumination-Y5
(11)-Dimming charac. curve of red function illumination-X6
(12)-Dimming charac. curve of red function illumination-Y6
Dimming coefficient of green function illumination
Dimming coefficient of red function illumination
Emergency telephone number
Fallback DNS Server
Fuel tank volume
Microphone sensitivity
Mobile network operator
(1)-Mobile Online services; activation threshold-Distance for activation
(2)-Mobile Online services; activation threshold-Lock time during deactivation
Mobile Online services; first host name
Mobile Online services; second host name
Number 1 for Info call
Number 1 for roadside assistance
Number 1 for roadside assistance
Number 2 for Info call
Number 2 for roadside assistance
Number 2 for roadside assistance
Production mode
Reference channel delay
Safety mode for activation vehicle shutdown
Safety mode for deactivation vehicle shutdown
SMS number 1 for call for help
Speed warning maximum speed
Status of GPS antenna
Test tel. number for roadside assistance
Threshold for vehicle movement recognition
User profile name
User profile password
(1)-Vehicle function list BAP-Time
(2)-Vehicle function list BAP-Charge manager
(3)-Vehicle function list BAP-Multifunction indicator
Vehicle shut-down; maximum speed
Waiting period for activation vehicle shutdown
(1)-Cycle_Data_Log_Level-Core_Service_Management
(2)-Cycle_Data_Log_Level-Remote_Door_Unlock
(3)-Cycle_Data_Log_Level-Remote_Honking_and_Flashing
(4)-Cycle_Data_Log_Level-Vehicle_Health_Report
(5)-Cycle_Data_Log_Level-Roadside_Assistance_Dealer_Maintenance_Scheduling
(6)-Cycle_Data_Log_Level-Manual_Emergency_Call
(7)-Cycle_Data_Log_Level-Remote_Speed_Alert
(8)-Cycle_Data_Log_Level-Remote_Vehicle_Disabling
(9)-Cycle_Data_Log_Level-Remote_Vehicle_Tracking
(10)-Cycle_Data_Log_Level-Geofencing
(11)-Cycle_Data_Log_Level-Remote_Trip_Statistics
(12)-Cycle_Data_Log_Level-Remote_Vehicle_Status
(13)-Cycle_Data_Log_Level-Remote_Battery_Charging_Management
(14)-Cycle_Data_Log_Level-Remote_Pre_Trip_Climatisation
(15)-Cycle_Data_Log_Level-Remote_Departure_Time_Programming
(16)-Cycle_Data_Log_Level-Information_Call
(17)-Cycle_Data_Log_Level-Automatic_Crash_Notification
(18)-Cycle_Data_Log_Level-POI_Address_Import
Driving_Follow_Up_Time
Emergency_Call_Trigger_Condition
(1)-Geofencing_Area_First_Radius-Maximum value
(2)-Geofencing_Area_First_Radius-Minimum value
(1)-Geofencing_Area_Highth-Maximum value
(2)-Geofencing_Area_Highth-Minimum value
(1)-Geofencing_Area_Latitude-Maximum value
(2)-Geofencing_Area_Latitude-Minimum value
(1)-Geofencing_Area_Longitude-Maximum value
(2)-Geofencing_Area_Longitude-Minimum value
(1)-Geofencing_Area_Second_Radius-Maximum value
(2)-Geofencing_Area_Second_Radius-Minimum value
(1)-Geofencing_Area_Width-Maximum value
(2)-Geofencing_Area_Width-Minimum value
(1)-Manual_Emergency_Call-Radio_On_Trigger
(2)-Manual_Emergency_Call-Vehicle_Termination
Number_Of_Navigation_Destinations
(1)-Online_Services_Communication_Protocol-APN_Auth_Type
(2)-Online_Services_Communication_Protocol-GSM_Automatic_Operator
(3)-Online_Services_Communication_Protocol-PDP_Type
(4)-Online_Services_Communication_Protocol-TCP_Max_Receive_Window
(5)-Online_Services_Communication_Protocol-TCP_Max_Transmit_Window
(6)-Online_Services_Communication_Protocol-Keep_Connection_Alive_If_Event_Expected_Within
(7)-Online_Services_Communication_Protocol-TCPMS
(8)-Online_Services_Communication_Protocol-PDP_Grace_Time
(1)-Online_Services_Data_Roaming-Core_Service_Management
(2)-Online_Services_Data_Roaming-Remote_Speed_Alert
(3)-Online_Services_Data_Roaming-Geofencing
(4)-Online_Services_Data_Roaming-Remote_Vehicle_Tracking
(5)-Online_Services_Data_Roaming-Remote_Vehicle_Disabling
(6)-Online_Services_Data_Roaming-Core_Service_Telephony
(7)-Online_Services_Data_Roaming-JobMechanism
(8)-Online_Services_Data_Roaming-Remote_Door_Unlock
(9)-Online_Services_Data_Roaming-Remote_Honking_and_Flashing
(10)-Online_Services_Data_Roaming-Roadside_Assistance
(11)-Online_Services_Data_Roaming-Vehicle_Health_Report
(12)-Online_Services_Data_Roaming-POI_Address_Import
(13)-Online_Services_Data_Roaming-Remote_Battery_Charging_Management
(14)-Online_Services_Data_Roaming-Remote_Pre_Trip_Climatisation
(15)-Online_Services_Data_Roaming-Remote_Departure_Time_Programming
(16)-Online_Services_Data_Roaming-Remote_Vehicle_Status
(17)-Online_Services_Data_Roaming-Remote_Trip_Statistics
(1)-Online_Services_Timeouts-Transport_Protocol_Timeout
(2)-Online_Services_Timeouts-HTTP_Timeout
(3)-Online_Services_Timeouts-Secure_Connection_Timeout
(4)-Online_Services_Timeouts-PDP_Timeout
(5)-Online_Services_Timeouts-Network_Timeout
Online_Services_Voice_Roaming
(1)-Pearl_Chain_Generation_Criteria-Distance
(2)-Pearl_Chain_Generation_Criteria-Driving direction
(3)-Pearl_Chain_Generation_Criteria-Speed
(4)-Pearl_Chain_Generation_Criteria-Height
(5)-Pearl_Chain_Generation_Criteria-Time
(6)-Pearl_Chain_Generation_Criteria-Debounce
(1)-Remote_Vehicle_Status-Remote_Vehicle_Status_Clamp_15_On_Delay
(2)-Remote_Vehicle_Status-Remote_Vehicle_Status_Clamp_15_Off_Delay
(1)-Remote_Vehicle_Tracking_Mileage_Trigger-Maximum value
(2)-Remote_Vehicle_Tracking_Mileage_Trigger-Minimum value
(1)-Remote_Vehicle_Tracking_Time_Trigger-Maximum value
(2)-Remote_Vehicle_Tracking_Time_Trigger-Minimum value
Roof_Crash_Detection_Speed_Limit
Serial_Tracing
Vehicle_Health_Report
(1)-Voice_Connection_Timeouts-Call_Failed_Timer
(2)-Voice_Connection_Timeouts-Wait_Tone_Timer
(3)-Voice_Connection_Timeouts-Redial_Attempts
(4)-Voice_Connection_Timeouts-Redial_ACN_MEC_If_Failed
(5)-Voice_Connection_Timeouts-Redial_Timer
(6)-Voice_Connection_Timeouts-Voice_Data_Transfer_Failed_Timer

 

So, I went into the controller and made some changes.

I set all of these from Active to not active:
(1)-Online_Services_Data_Roaming-Core_Service_Management
(2)-Online_Services_Data_Roaming-Remote_Speed_Alert
(3)-Online_Services_Data_Roaming-Geofencing
(4)-Online_Services_Data_Roaming-Remote_Vehicle_Tracking
(5)-Online_Services_Data_Roaming-Remote_Vehicle_Disabling
(6)-Online_Services_Data_Roaming-Core_Service_Telephony
(7)-Online_Services_Data_Roaming-JobMechanism
(8)-Online_Services_Data_Roaming-Remote_Door_Unlock
(9)-Online_Services_Data_Roaming-Remote_Honking_and_Flashing
(10)-Online_Services_Data_Roaming-Roadside_Assistance
(11)-Online_Services_Data_Roaming-Vehicle_Health_Report
(12)-Online_Services_Data_Roaming-POI_Address_Import
(13)-Online_Services_Data_Roaming-Remote_Battery_Charging_Management
(14)-Online_Services_Data_Roaming-Remote_Pre_Trip_Climatisation
(15)-Online_Services_Data_Roaming-Remote_Departure_Time_Programming
(16)-Online_Services_Data_Roaming-Remote_Vehicle_Status
(17)-Online_Services_Data_Roaming-Remote_Trip_Statistics

Online_Services_Voice_Roaming from Active to Not Active

And from Active to Not active:
(1)-Vehicle function list BAP-Time
(3)-Vehicle function list BAP-Multifunction indicator

No change....

It does seem to think that my hatch and hood is unlocked though :screwy: but I am not sure if this was me or not.... I have a feeling not.

I did notice that Ross-Tech has not mapped the coding on this yet (or the Infotainment and CANGateway) so I am wondering if there is an option from within the long coding. Something along the lines of "SIM card enable" or "WWAN Connectivity".

I did notice these, since these are what give the WWAN controller access to the 3G network for data (think of an APN on a mobile phone but unsure if this is the case).
Mobile network operator == aprd3.hughestelematics.com.attz
Mobile Online services; first host name == vw.us.p.tos.hughestelematics.net
Mobile Online services; second host name == vw.us.p.tos.hughestelematics.net

Now, I looked into just changing it to a different string but alas, it stated that it needed to be a exact amount of alphanumeric characters, which matched the coded strings length. Then I tried to code with with an exact copy of the string in place. Same error again. I, again, tried the same string but substituting the periods with letters.... That worked... (did not actually change it though). Theoretically, you should be able to change this to something which is the exact same length as the factory coding to disable the WWAN but it seems that you will never be able to return to the factory coding.

Also, I did check under both seats and there is no module under either so now the next question is where is it? I am still curious if this is something that can be just unplugged and jumper a wire to allow the microphone to pass to the infotainment/bluetooth (which I am starting to think the BT is built into the infotainment because of the lack of bluetooth options within the controller), if this is even needed at all.

Thoughts?

 

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Tom: You do ask the most interesting of questions!!

Again, I'm not sure about the quaint "surveillance -rich" telematics units on NAR models but down here (where mobile telephone modules do just that), the physical unit (affectionately called the "mobile telephone interface -R265" by VW) is installed in the front part of the compartment in the centre console (see pic below)

As you say, much of the "smarts" for the mobile phone happens in the information electronics unit (J794) for which Mr RT has yet to provide a label file (work in progress I understand). You are correct in your assertion that this is where the Bluetooth hands free functionality really happens.

Alas, your suggestion to bi-pass the telematics unit via a jumper wire is pretty much a forlorn hope (refer to my diagram below). My suspicion is that any mods that can be made will need to be done via software changes. Can you confirm that any of the changes that you made to the adaptation channels have had an effect?

Interested to hear of any developments/discoveries that occur

 

Interesting diagram! (as always). If this is right and the fuse is in the same position, I might be able to just pull the fuse in SC16 to just kill the entire unit off. I will check to see if this fuse does indeed exist, give it a pull, and see what happens. Ill give this a try tomorrow and report back. I guess I should also revert the coding since it did not seem to change anything at all.

I am really curious why it would be mounted right there though. The only reason I can think of is that since the bluetooth signal can only travel so far (30ft at max), it helps to be in the center of the car.

Any chance you can procure a copy of the Telematics wire diagram? (since you seem to have a copy of every single device!)

Update!! No fuse in that position so that kills that idea....

 

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

TOM: Now that's real strange!! Here's what VW says (albeit it's clearly different in NAR models)

 

A pulled fuse would be great. Thanks to you guys exploring this. People on here think its no big deal to be monitored by who knows who, but i don't like it. I do believe the car can be disabled thru this system. That is what i dont want on the property i own. Yes a phone does the same stuff and i can also disable it if i want.

 

There is the micro, then there is the macro.

Micro: there is another thread on this topic. My car does not have Sky…er, CarNet, so I didn't pay close attention to it.

Macro: you are already being tracked. Any time you go through a toll booth, you are tracked. Any time you drive on a major highway, you are tracked. Any time you go past an LEO, you are being tracked. Any time you use WiFi, you are being tracked. If you own a cellphone, you are being tracked. You started this thread; you're being tracked.

Several years ago, I drove into Manhattan. I took the Henry Hudson Parkway, as I have done since the tolls were ten cents (!). This time, the cash toll booths were gone. Now it's either E-ZPass, or they take a photo of your license plate and send you a bill for double the E-ZPass amount. I received the bill, paid it, and have not driven into New York City across a tolled bridge since. Nor will I ever again.

Disabling CarNet may make you feel good, but that's about all the good it will do for you.

 

Bump! I'm following this thread for a solution.

 

Anyone have aNy updates to this? It has been too cold to look for it but I figure that somebody in the warmer climates must have looked.

 

I got a chance and some good weather to tinker with this. I started to look at the fuse boxes to try to locate the fuse for it. Im sorry to say i couldnt find the right one and there is no schematic for the fuse boxes. I dont know what fuse goes where. Hopefully someone on here can post a schematic for the fuse boxes ...