Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: can Wireless-CarPlay dongles steal your data?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 37 posts

Re: Ask HN: can Wireless-CarPlay dongles steal your data?

#11

Post by izacus »

fragmede wrote: post #8
runjake wrote: post #4

I can think of several ways to exfiltrate data, even with the limited information you provided, so, yes. But is it happening? Who knows. Maybe it doesn't now, but a future firmware update will. Who knows. Given your wise threat model, I'd avoid buying stuff from AliExpress.

Is it any better if it's Sony or Audi that has my data?

Of course, for Audi you're at least 100% sure your data (everywhere your car was, what its service status is and where you live) is already public. [0] No need to wonder anymore :P

[0]:https://www.bleepingcomputer.com/news/security/audi-volkswag...

Re: Ask HN: can Wireless-CarPlay dongles steal your data?

#12

Post by hackernudes »

I wondered about this exact scenario with my Android auto dongle.

I never could get the upgrade to work when connected to my phone. I did get it to work connecting my PC to the dongle (which acts as a wifi access point). My PC then loaded the firmware in a desktop browser window as I was connected to Ethernet and the dongle at the same time. I may have had to set some up routes manually.

They absolutely should not get Internet access through the phone. I really hope it doesn't work that way! I searched quite a bit but could not find a definitive answer.

Edit: I read the other replies and it makes sense. The browser on your phone can make a request over wifi and over cellular, so really the browser would do the fetching over the internet, not the device.

Re: Ask HN: can Wireless-CarPlay dongles steal your data?

#13

Post by mrobins »

fragmede wrote: post #8
runjake wrote: post #4

I can think of several ways to exfiltrate data, even with the limited information you provided, so, yes. But is it happening? Who knows. Maybe it doesn't now, but a future firmware update will. Who knows. Given your wise threat model, I'd avoid buying stuff from AliExpress.

Is it any better if it's Sony or Audi that has my data?

No but I think it’s more likely the data is going back to the original manufacturer and the white labeler has no idea it’s happening.

Despite assuredly rigid QC and security testing /s.

Re: Ask HN: can Wireless-CarPlay dongles steal your data?

#15

Post by niteshade »

joshstrange wrote: post #9
packtreefly wrote: post #3

If the dongle acts as a wifi AP with a DHCP server, it could give the iPhone an ip address but no gateway upon connection. This will cause the iPhone to talk directly to the dongle via the WiFi interface, but talk to the rest of the internet via the cellular connection. You can determine this by checking the WiFi network's properties after the connection is established. If there's no value in the "Router" field, that…

This is almost certainly the answer and clever as hell. You just have to make sure the server storing the firmware (which you control) has the right CORS headers (as you mention) and you are in business. This means that the CarPlay device has no "internet" (spoiler: it never had real internet access) unless you are on that page interacting with it. I'm not sure how these devices work, I mean I know they broadcast the…

> Does it hand along an encrypted stream that it can't decode or does it decode/re-encode?

It definitely does decode/re-encode audio streams, as music playback quality suffers quite a bit (both latency and quality).

Re: Ask HN: can Wireless-CarPlay dongles steal your data?

#16

Post by niteshade »

Something that might be useful to know with these devices is that they're quite liable to bricking during updates.

If you do install an update, make sure you reopen its' web portal and confirm the version number is different to what it was before. If it hasn't changed from before, you'll have to wait a while as its still flushing bytes to its flash memory, and if you accidentally trigger an update again here, you'll be left with a brick (speaking from experience).

Depending on the device you bought, you might also be able to flash custom firmware on it: https://github.com/ludwig-v/wireless-carplay-dongle-reverse-...

Re: Ask HN: can Wireless-CarPlay dongles steal your data?

#20

Post by kelnos »

I kinda just don't get wireless CarPlay/Android Auto at all. If I'm going to connect my phone to my car wirelessly for that, it's gonna drain the battery. So I'm going to plug it in so it can charge. So... now it's wired, so why do I need wireless?

I guess if you have a wireless charging pad in your car, then that's a little bit more convenient. But the big inconvenience for me is just to have to take it out of my pocket in the first place, not to plug it into the car. (And my car does have wireless charging, but my phone rarely seems to sit on it stably enough for it to charge all that well.)

To get fully back on topic: sure, a wireless dongle could exfil data, but unclear what data is all that valuable. The car (and thus the dongle) just gets video and audio streams, not the actual textual content of your text messages, for example. Sure, it could try to OCR the video and/or do voice recognition on the audio, but those are fairly computationally expensive. And sending all that video to a remote server would be... a lot.

Post reply on HN