Security Issues in Nissan’s Mobile App, NissanConnect, Could Potentially Put Users’ Data at Risk
Submitted by Filip Chytry, security expert, seculu.cz
As technology continues to advance, cars are increasingly becoming integrated into our mobile devices. Automotive brands are now releasing mobile apps, allowing users to connect their music streaming services, social networks, and search engines into the car’s system. One app that I’d like to highlight is NissanConnect, a mobile application from Nissan.
I would like to make it clear that issues discussed in this article are not unique to Nissan's app. They can be found in other apps out there. However, since I own a Nissan car, I had the chance to familiarize myself with the brand’s mobile app. I purchased a Nissan several months ago after reading many user reviews and taking into consideration various technological features of the car. Nissan, the car, is great, but I can't say the same thing about NissanConnect, the app. The companies responsible for its Satnav and the mobile app didn't perform sufficient QA testing. In my opinion, the lack of QA resulted in some security holes in the mobile application.
After installing and configuring NissanConnect, I encountered some issues and read more on reviews from other reviews. I found that other app users were also running into some of the same issues that I had. This led me to disassemble the app to take a closer look at what went into the build and the implementation of its security features.
I became unpleasantly surprised by some of the data that are shared with Airbiquity over HTTP protocol. The app has the permission android.permission.GET_ACCOUNTS, which means it can access other logins you have on your device, such as Facebook, Pandora, etc., and all login information that can easily be obtained on rooted devices. I was left disappointed that Nissan/Airbiquity had cast aside the level of security in this app.
I contacted Nissan Customer Support, explained the security concerns I had discovered, and offered to come up with a plan to improve these issues. Unfortunately, for legal reasons, Nissan’s company policy prevents them from accepting technically-related improvements from users.
I feel that it’s imperative for a company to be concerned about user privacy issues, prioritize the level of security available to protect customer data, and consider user feedback. Unfortunately, in this case, I don’t feel that Nissan’s response has reflected this attitude.
My experience with NissanConnect has inspired me to investigate and review additional automotive mobile applications, paying close attention to their security features and permissions. In general, it’s important to keep in mind that many mobile apps we use on a daily basis could carry security risks that intrude into our privacy and personal data.
To get a FREE security audit of your mobile applications, drop us a line support@teskalabs.com. We'll hunt and find security holes in your apps for you.
Additional reading:
- Custom Made vs. Off-The-Shelf Mobile Apps – The Issue of Security
- You Can Build Apps for the Apple TV, But Do You Know How to Do It Securely?
- We Know Why 85% of Mobile Apps Suck in Security. Do You?
- 7 Reasons Why Testing the Security of Mobile Applications Is Crucial for Enterprises
- The Top 5 Mobile Application Security Issues You Need to Address When Developing Mobile Applications
- What Is a Mobile Application Containerization, or Wrapper, and Why Must It Die?
- Security Is Driving the Adoption of Connected Cars
Most Recent Articles
- A beginner-friendly intro to the Correlator for effective cybersecurity detection
- Inotify in ASAB Library
- From State Machine to Stateless Microservice
- Entangled ways of product development in the area of cybersecurity #3 - LogMan.io
- Entangled ways of product development in the area of cybersecurity #2 - BitSwan
You Might Be Interested in Reading These Articles

The Real Impacts of General Data Protection Regulation (GDPR) to EU Companies That Operate Mobile Applications
The General Data Protection Regulation (GDPR) is a new EU regulation aimed at protecting the personal data of EU citizens. Because of the broad definition of “personal data”, GDRP impacts almost every EU company, as well as non-EU companies that exchange data with them. The regulation takes effect in May 2018, which is still a long way in the future, but the complex requirements mean that companies need to start planning and taking action now.
Published on December 06, 2016

What Is Mobile Application Containerization or Wrapper, and Why It Needs to Go?
Containerization is an alternative for full machine virtualization. You probably know well-known containerization technology from Docker or Rocket. However, this article addresses the pros and cons of mobile “containerization” or wrapper used to isolate the mobile app from the mobile operating system or other applications installed on the same device. These type of “containerization” work in a different way.
Published on September 27, 2016

Industrial IoT Security: Cyber Security Implications for IT-OT Convergence
In June 2017, two information security firms researching the 2016 hack of the electricity grid in Ukraine announced that they had identified the malicious code used to shut down power stations and leave thousands of households and businesses in darkness for several hours. The malware used to target the Kiev power grid has been named Industroyer, and it serves as a sobering reminder about the dangers faced by the Industrial Internet of Things (IIoT).
Published on September 05, 2017