panthadori lion mascot

Secure a New Ford Vehicle by Disconnecting the TCU

cybersecurity posted 2023-02-04 (updated 2024-01-23)
Ford doesn't need to know when I accelerate

The What and Why behind the TCU

Purchasing a modern vehicle now requires that you own a smartphone and authenticate yourself to the new vehicle. Salesmen enforce enrollment in apps such as ‘FordPass’, ‘Toyota’, and ‘HondaLink’ which allow owners to remotely start, lock, unlock, and monitor their vehicle. These apps work by communicating with the TCU in the vehicle.

A TCU (Telematics Control Unit) is an embedded system in a vehicle that wirelessly connects the vehicle to cloud services or other vehicles over a cellular network.

This module allows car manufacturers to collect data from your vehicle, and upon connection, your phone.

As I have recently purchased a new Ford, this post will focus on Ford’s privacy policies, apps, and vehicles.

According to the FordPass privacy policy, Ford will collect:

FordPass does not have multi-factor authenticaion, so anyone who has your password and the VIN of your vehicle is able to start, lock, and unlock your car.

The TCU is also vulnerable to remote vehicle attacks.

These vulnerabilties can be remediated by disconnecting the TCU from its power source.

How to Disconnect the TCU

This process will vary depending on the specific make and model of the vehicle.

  1. In the owner’s manual, under ‘Fuses’, find the fuse labelled ‘Telematics control unit module’. Specific to my car, this is located under the passenger’s glovebox. owner’s manual fuse list
  2. If needed, remove the cover panel to reveal the fusebox. I took mine from the bottom and pulled gently to un-latch three tabs. covered fusebox
  3. Identify the fuse. fusebox panel
  4. Pull out the fuse. While the car is off, use pliers or fingers to gently remove the fuse. fusebox panel missing fuse pulled out fuse next to pliers
  5. Replace the panel cover.
  6. Ensure that the vehicle is disconnected. app showing remote start does not work
  7. Keep the fuse in a safe place in case of vehicle return, repair, or investigation.