There are a lot of cars out there where the head unit has connection to the CAN bus. Which means this malware vector could be used to directly cause crashes. E.g. https://news.ycombinator.com/item?id=19751872
Malware infects Android-based automotive head unit firmware
21–30 of 154 posts
Re: Malware infects Android-based automotive head unit firmware
#22Um so which car is this? tw.com doesn't seem to be in use.
Re: Malware infects Android-based automotive head unit firmware
#23The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit. This seems to be a very similar situation to that of cheap generic Android TV streaming boxes, which often come pre-infected from the factory with residential proxies and other malware as well; most of the infrastructure is likely shared.
Re: Malware infects Android-based automotive head unit firmware
#24Earlier quoted context omitted.
Head units can log location, navigation start and end points, call logs, call audio, and scrape full contact lists. Just off the top of my head.
That's scary from a user perspective, but harder to monetise at scale as an attacker. Proxy endpoints are just another commodity (and offer recurring revenue).
If you infect tens of vehicles that's not that valuable. But if you infect ten thousand vehicles, convinced a trusted member of one of the bigger black hat forums it's real and have him vouch for your marketplace post, there should be some buyers for full movement profiles, call logs and address books of ten thousand people
And doing that doesn't really interfere with also setting up and selling proxy endpoints
Re: Malware infects Android-based automotive head unit firmware
#25> Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the device to recruit it into a botnet People do pair them with their phones, though. I could imagine a future version of malware like this propagating laterally.
Almost, though I understand I am the exception rather than the rule: Personally I have an aftermarket android head unit since the standard one was incredibly basic, no real time navigation updates, updating maps was a pain in the ass and so on. Initially I did pair it with my phone but since it is an aftermarket unit from a company which apparently does not exist anymore, newer phones cannot be paired with it. So my only option was to go the opposite route and use my phone as a wireless hotspot(almost - there's a raspberry pi with openwrt between the two). And since I self-host everything, I had no choice but to hook it up to my vpn. That said, I understand the implications of doing this so ultimately the network access it gets is incredibly limited: everything that is not my music server and the maps provider has been cut off completely. The downside is that every now and then I get a "can't connect to google services" notification though that is technically reassuring from a security perspective.
Re: Malware infects Android-based automotive head unit firmware
#26Earlier quoted context omitted.
That's scary from a user perspective, but harder to monetise at scale as an attacker. Proxy endpoints are just another commodity (and offer recurring revenue).
Yeah, especially since most of these are already available for purchase from data brokers.
They're called data brokers because they have a buy side, too. That might be peanuts to you, but to an AliExpress seller, it could be most of their profit.
Re: Malware infects Android-based automotive head unit firmware
#27[flagged]
Re: Malware infects Android-based automotive head unit firmware
#28The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit.…
Indeed this is an odd disclosure and I am not familiar with past posts by them.
Moreover, no CVE is associated with this claimed vulnerability. It's not even stated which Android version or automotive head-unit variant version is affected.
Re: Malware infects Android-based automotive head unit firmware
#29Earlier quoted context omitted.
It seems like this exploit is targeting those that keep their phones tethered for connectivity outwards or hooked a USB modem or a SIM card into a cell-equipped headunit. The only valuable thing there is the relatively 'clean' mobile connection... and this malware's dropping a residential proxy endpoint on the headunit to take advantage of it. Bonus points if the headunit is always connected and always powered up to…
Head units aren’t always-on. Typically they go into a low power standby 2-5 minutes after ignition / accessory mode turns off, and go completely power-off 30-ish minutes later. Otherwise any car sitting unused for a week or two would have a dead battery.
I learned that not all electronics goes into low power mode even when designed to run off a car battery, from using a cheap Bluetooth OBDII dongle.
Re: Malware infects Android-based automotive head unit firmware
#30For whatever reason, the idea of this being in my car is relatively scarier for me than if this was just my phone ? I think partially as my mental model of both android auto and CarPlay is that they operate as a passthrough of my device rather than as an separate installation of the OS entirely (I wasn’t aware the head unit itself had the ability to install APKs independently). Also, feel like John Gruber is going to…
Android Automotive is the infotainment system’s OS and runs fully without a phone. Android Auto is the Google equivalent of CarPlay and runs on your phone. It’s easy to confuse. Like watching Apple TV on your Apple TV in Apple’s TV app.
Did they hire their branding person from Microsoft? And how about AppFunctions (Google) and AppIntents (Apple)?