How to disconnect the tracking telemetry on the 5th gen 4Runner

How can I disable the telemetry on my 2021 4Runner, I know it’s using the Verizon network to connect and report the vehicle activity, mileage, engine stats gps locations and so.

I’s pretty nasty intrusions on one’s privacy. I was able to disconnect telemetry on my friends Camaro there was a box behind the gloves compartment, I couldn’t just remove the box it was connected to the ignition, I had to open the box and unplug the antenna cable and remove a circuit board. Technically the GM corporate could disconnect the fuel pump remotely. The manufacturers claim it’s for our safety in case of an accident….. I say no thank you.

Anyways I’m not sure if my 4Runner is using a separate module that is hidden somewhere or all the functionality is built into the radio itself. I really don’t care for the radio, Bluetooth or the rear camera, I don’t use any of the electronic gadgets If I have to remove or completely disconnect the radio it’s ok with me.

Any help appreciated.

 

Set it on fire

 

See this post for possible disable
https://www.4runners.com/threads/vehicle-data-transmission.14184/#post-166505

In 2016, Verizon acquired a company called Fleetmatics for $2.4b. When they integrated the system for their phone customers, they renamed it 'Hum'. There are several other major phone companies that followed suit and acquired similar companies that build tracking devices and software for vehicles. For businesses, it's huge business. And for parents wanting to track their teens, it's huge business. And for law enforcement, these trackers can literally tell the story of collisions, who is at fault and everything. For everyone else, it's a serious invasion of privacy but data is everything these days in the business world.

I hate the stuff, but I've been following the tracking companies since 2012 and they are making a big push to have their products fully integrated at the factory level. No more dongle plugin required. The tracking companies are all trying to get in bed with the auto manufacturers and not just for premium vehicles. They are also lobbying congress to make their tracking devices mandatory on ALL new vehicles in the future. I hope they make it easy to disable in the future but I'm not holding my breath.

 

Do you have a smartphone?

 

Well aware of smart phone tracking via gps chips, silicon accelerometers, etc. Thanks.

 

Thanks r32

The functionality you're talking about is called "Event Data Recorder" (EDR) which I'm going to locate and disconnect also
more info here. https://www.sae.org/publications/technical-papers/content/2016-01-1495/

After doing some research there is a module called DCM and it's connected to the radio, there is also a fuse that cuts power to the DCM box
Supposedly if the DCM is disconnected from the power source the radio stops working and some cables need to be jumped in order to get the radio back
Also if the DCM is disconnected and the radio is paired with a cell phone via Bluetooth the car software will transmit the data via the paired cell phone ...... nasty
here is the forum post
https://www.rav4world.com/threads/2019-rav4-dcm-deactivate-procedure.304339/

At this point I'm thinking about replacing the factory radio with a Kenwood or Pioneer but first I need to locate the DCM box
Again any help appreciated

 

Thx r32
I thought that the DCM is going to be close to the radio
I'll work on this next weekend and post some pictures
I have to find out if the Kenwood radios fit and if there are some conversion plugs and trims to hide the stock radio side buttons

 

I copied wrong URL. Changed it. The DCM does appear to be close to the radio on the 4Runner. See updated diagram above.

 

As folks may have noticed from my posts on other threads about this, it's an issue of concern for me and think it should be for others (yes, yes, we all know that we can be tracked via our smartphones). What I think gets lost in the discussion sometimes is that the issue is much bigger than tracking. The issue is the ability of people to control your vehicle against your wishes. This includes starting or stopping the engine, applying the brakes, and listening to conversations happening inside the car. In more tech-heavy cars than the 4Runner, additional interventions are also possible.

The component that makes all that possible is the cellular chip that connects the car's computers to the Internet. This is the linchpin. If someone wants to worry about information collected by the car's computer and stored only inside the car's computer, and thus only accessible to someone with physical access, well ok. I don't love it either, but personally I don't have a big problem with Event Data Recorders. Or even systems like automated emergency braking, so long as they're designed well enough to prevent a lot more problems than they cause. In this respect they're very much like airbags. They're not perfect, and rarely they might do more harm than good. But all in all they're life savers.

The problem arises when these kinds of systems can be hacked into remotely, whether by corporations like Toyota, or cybercriminals, or hostile nations, or in abusive / unconstitutional ways by law enforcement. Those things are no longer a practical concern if there's no connection between the car's computer and the Internet / cellular system.

This is why it's probably misplaced to focus on the GPS system. Someone can correct me if I'm wrong, but I'm also pretty darn sure that GPS is a signal passively received. Your car is not pushing information out to anyone or anything through the GPS system. Where it can push out your car's GPS location is through the car's cellular chip.

So, long story short, the diagrams etc showing the location of the antennas and antenna cables are all well and good, but the primary problem should be solvable without disabling GPS functionality, or the EDR, or the head unit etc etc -- the problem is the cell chip.

Soooo, does anyone know where the cell chip is located? Does anyone have a diagram for that?

PS -- For several reasons that have been stated elsewhere, tracking is exceedingly hard to prevent. Not saying no one should be concerned about it, just saying that completely preventing it might not be practical. We can make it harder, but can't prevent it without extraordinary measures that involve living like a technophobic hermit.

EDIT: I just followed the link to the DCM discussion on the Rav4 forum. That's the kind of info I'm looking for. If anyone can confirm that the system and procedures are the same in the 4Runner, that would be great.

 

Wouldn't the easiest solution be to disconnect the XM (shark fin) antenna coax at the radio?

Another question, for basic SR5's without the GPS, can they still be tracked?

 

Disconnecting the antenna may work, but I'm not sure we know how much it's really needed to connect to the cellular system if you're in an area with a strong signal. After all, your cell phone doesn't have a giant coax cable and sharkfin antenna attached to it. But the other issue is that we shouldn't need to interfere with GPS functionality to solve the privacy / hacking problem. Disconnecting the antenna would defeat the GPS. We just want to stop the car from pushing out data (inc conversations inside the car). And from allowing hackers et al to send commands into the car remotely, eg to start or stop the engine.

Not sure which models and years have what, but if your SR5 has an SOS button, then yes it has an Internet connection. And if it has an internet connection, then data can be pushed out and bad actors can send signals in to take remote control of your vehicle (inc., again, listening to conversations inside it).

 

Our trucks have cell phone chips hooked up to the internet? At what point in my purchase did I miss the small print?

 

Indeed they do. The SOS system is just a cell phone. The system that allows you to lock/unlock and remote start via an App uses the same connection. Any device connected to the cellular system is de facto connected to the Internet. And any device connected to the Internet is a device that can be hacked though the Internet.

I feel like a broken record, but everyone should be clear on this: it isn't theoretical. It's not tinfoil hat stuff. There are documented cases of these systems being used to not only locate people, but to shut off engines and to covertly listen to conversations inside the vehicle. There are examples of this occurring even after the subscription service has expired. Any system that can be turned off remotely (eg cause you didn't pay to renew it) can also be turned on remotely without your knowledge and consent.

 

I don't think my SR5 has the SOS function.

I have the basic SR5 without GPS.

The radio does have XM radio capability.

 

Hmm, good news on the SOS. One of the systems that have been hacked into in real life is the XM. It depends on what level of system you have. If it's just receiving satellite radio signals then I don't think that's a problem. I'm pretty sure that's one-way, passive communication. But some XM systems come with added features that require a cellular connection. In fact, it was one such system that's been documented to have been turned on remotely (after the subscription ended) in order to listen to a conversation inside the car. I'm sorry I don't know more about the SR5, but if yours is a 2018 I'm pretty sure you've escaped most of this problem.

 

Wrap you 4Runner in tin foil.

 

I'm 99.9 percent sure the XM receiver is strictly satellite.

To have a separate cellular antenna with receive and transmit capability without the owner of the vehicle not being charged a user fee doesn't pass the logic test.

 

I recall now that I researched this before and this whole thing is pretty much a non issue on pre-2020 4Runners -- below Limited grade that is. The Limited has had a cell connection for Safety Connect services since 2015. This is SOS call functionality and location transmission to Toyota, for example in case you're in an accident that no one's witnessed and you need emergency responders. So that means a microphone in the cabin, your GPS coords and a way into the car's computer via the Internet. But the car's computer presumably didn't contain software for manipulating systems such as the brakes.

It wasn't until 2020 that two big things happened: all models of the 4Runner got both Safety Connect and TSS active safety features, like automated emergency braking (complete with a camera looking out your windshield). Also, some trims got additional features such as Remote Connect, which is the ability to start and stop the engine, and lock/unlock doors, via an app that connects to the car over the internet. So here, the software to control major functions of your car is already present. All a hacker would need to do is break into Toyota's computer system in order to mess with people's cars (or Toyota could give someone that power, eg in response to a government request). Unknown to me is whether this software is installed on all 2020 and later models, regardless of whether Toyota is letting you personally access it via their smartphone app.

I'd assume that someone who did hack in to pre-2020 Limiteds could in theory re-program the car's computer to manipulate systems that are wired into the computer. But prior to Remote Connect, that wouldn't include the brakes. Presumably the steering continues to be a non issue because it's an old-school hydraulic, mechanical system. Many new cars have electric steering that can be manipulated by the computer (and thus a hacker). Lane keep assist and self-parking features are common examples.

Anyway, the bottom line is these systems enhance safety and convenience, which is great. I've used Remote Connect services via Toyota's app many times. I've liked being able to lock the doors when my spouse forgot to, to see where the vehicle is when it was borrowed by a kid, to confirm it hadn't been stolen when it was parked in a sketchy area, to start the car to get the AC going on a hot day, to check the tire pressure, to see how much gas is in the tank, etc. This is all really cool stuff. And I don't think it's intended for bad purposes (well, other than to make money off of your data). People should just be aware that such systems do get abused, whether by corporations or hackers or hostile nations or local law enforcement. So it's only prudent to know how to defeat the cellular connection. Espec if you don't plan to pay Toyota every month to continue these services after expiration of the trial period. In that scenario, all you have is the risks these systems pose -- and none of the upside.

 

This is why I bought a 2020. It is also the risk I have to run to have those features especially the door locking and starting the vehicle from out of the range of the key fob. I routinely remote start the vehicle while in a store for longer than the original 10 minutes. I do this so my dog can be comfortable and not die. I'm always concerned that it won't work or malfunction so I make sure windows are down and I park in shade or I don't take him. This feature is very important for me to keep so hopefully I don't get exposed for saying something that someone doesn't like.

 

That makes perfect sense to me. I'm certainly not bashing anyone who values these systems. As indicated, I often use them myself. I just think people should understand the risks that come with these conveniences so they can make informed decisions.

Personally, my plan is to kill the cellular connection once my trial period expires for Safety Connect and Remote Connect. Ideally, there's a way to do so that I can easily reverse (but no one else can reverse without physical access to my vehicle).

I'd like to keep this option open should external conditions change.

For example, if we had good laws to protect citizens from the exploitation of their data for profit, and from law enforcement intrusion without a warrant, and that forced companies to do a better job of preventing hacking. If all that happened I'd consider turning the system back on and paying monthly to use it.

 

believe me I have the same concerns as you do about privacy.

 

Good perspective, but I wouldn't hold your breath on any upcoming "good" laws to protect the citizens.

So those of you that have the cellular connectivity, is it addressed in the owners manual?

And do you have to pay a subscription fee for the service? like the Sirius XM.

 

Manual for connected services.

https://www.toyota.com/t3Portal/document/omnav-s/OM21Multimedia/pdf/OM22Multimedia.pdf

And

Page 219

https://www.toyota.com/t3Portal/document/omnav-s/OM35B62U/pdf/OM35B62U.pdf

 

Lol yeah, believe me I'm not counting on reforms that will really address these problems. We may kinda sorta get something out of Congress, but it'll prob have truck-sized loopholes. Some of the data privacy stuff has been addressed by seemingly-strict laws in Europe, but I'm not sure how effective they are in practice. Regardless, there are still the other issues like warrantless searches. My larger point was that I'm not opposed to the technology per se, just how easy it is to abuse it in ways that would really suck if you're on the receiving end.

I see that a link was just provided for the owners manual for Connected Services. But yes, the way it works is you get some or all of these services for free for a trial period after buying the vehicle, typically one year, and then have to pay $8 per month for each service you want to keep. The main ones are Safety Connect (the SOS calling and geolocation service) and Remote Connect (eg monitoring vehicle status and locking/unlocking and remote engine start via a smartphone app).

 

Here are screenshots of some of what you can do with the app for Remote Connect. Though not shown in one of these shots, the app includes a map showing the current location of your vehicle; data on your driving habits (I opted out of this); an option to share that data with insurers in hopes of getting a lower rate (again, no thanks); a link to call Roadside Assistance; links to electronic versions of your owners manuals, etc.

 

Looks like a cool feature.

I wish they would have displayed the tire pressures on the little screen between the tach and speedo on my 2018.

When I scroll through the pages, there is a blank unused page where they could have put the tire pressures.

Oh well, first world problems.

 

L

lol yeah, a nice feature to have but not that big of a deal. Oh, not to rub it in, but on the Limited the dashboard screen also displays the pressure of the spare mounted under the truck. I do like that.

 

Ok guys, I've got really good info on the cellular connection issue.

I located the fusebox under the driver-side dash. It has a 7.5 AMP fuse in the slot labeled DCM. The DCM is the module that contains the cellular chip and manages communication between the vehicle and Toyota / the Internet. The fuse is at the top of the middle row. I pulled the fuse. I then started up the truck. No error messages or lights or anything amiss. A small "DCM" icon remained visible at the top right of the infotainment screen as per normal, but the signal-strength meter next to it was grayed out and showed no bars.

I then pressed the SOS button up in the panel above the rearview mirror. Nothing happened. It did not make a call. It is also displayed no lights, neither the green it normally shows, nor the red.

I then went into Apps on the infotainment system and opened Remote Connect. It said it would send me a text message with an activation code, but I didn't get one. It just cycled with a spinning wheel. I closed it.

I then opened the app for the WIFI Hotspot. It generated an error message.

I then opened Maps and navigated to a destination. It worked normally. I hoped for that, as I hadn't disconnected GPS -- just the cellular connection.

I then shut down the car and opened the Toyota Remote Services app on my smartphone. It would not show any updated info since I last used it, which was prior to pulling the fuse. It would not show my door lock status, it just cycled when I tried to refresh that view. It wouldn't connect when I tried to lock the car from the app. It just cycled then gave me an error message. Same thing when I tried to remote start the truck. I also couldn't get remote start from the keyfob to work. I've read elsewhere on the forum that it stops working when your Remote Services subscription expires. So that's lame of Toyota, but not a surprise.

I then reinstalled the fuse and restarted the truck. The SOS green light came back on. The WIFI app in the infotainment system showed it was ready for action. The signal strength bar next to the DCM logo at the top of the screen now showed it had a signal. Little arrows appeared beneath the DCM logo indicating it was sending and receiving data.

I then used the keyfob to successfully remote start the truck.

I then reopened the Toyota app on my phone. It showed updated info on the status of the truck and successfully sent a command to unlock the doors.

My conclusion: pulling the DCM fuse is a super simple and reversible method of disabling the truck's cellular connection and thus its ability to send data to Toyota, or to receive unwanted instructions from Toyota or hackers.

YES!

Will follow up later if anything goes wrong, but this looks to me like a very, very easy solution to this problem.

 

Thanks for doing the research. I opted out of all the Toyota online services after I saw the driving history (don't remember what they call it in the app) that I'm sure will be sold to insurance companies. Tons of "excessive accelerations", sudden stops, sharp turns, etc, that I'd rather not have recorded. But I've been wondering if my opting out just means I don't see this data but it continues to be monitored. So I'll be pulling the fuse on the DCM to at least be sure it isn't captured remotely. I suppose some can still could be recorded in onboard memory but perhaps that's more limited.