Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware infects Android-based automotive head unit firmware

securelist.com

Post reply on HN
Print view View original

101–110 of 154 posts

Re: Malware infects Android-based automotive head unit firmware

#101

Post by wildzzz »

01100011 wrote: post #31
dzdt wrote: post #21

There are a lot of cars out there where the head unit has connection to the CAN bus. Which means this malware vector could be used to directly cause crashes. E.g. https://news.ycombinator.com/item?id=19751872

An aftermarket head unit connects to the CAN bus? The aftermarket head unit I installed certainly doesn't. Are you sure what you are saying, which is true for OEM units, applies to aftermarket ones?

The expensive ones do so you get more of an OEM infotainment experience. I guess you could potentially cause a crash over the CAN bus but there's a very small overlap between cars that allow you to swap out headunits and cars that can be controlled enough over CAN to cause a crash. Other than commercial vehicles, I don't think there are any new cars that have DIN stereos anymore.

Re: Malware infects Android-based automotive head unit firmware

#102

Post by wildzzz »

jackdecker wrote: post #32
MBCook wrote: post #16

Earlier quoted context omitted.

Android Automotive is the infotainment system’s OS and runs fully without a phone. Android Auto is the Google equivalent of CarPlay and runs on your phone. It’s easy to confuse. Like watching Apple TV on your Apple TV in Apple’s TV app.

So I can use android auto on an android automotive head unit - got it but also this seems needlessly confusing naming structure. Apple TV comparison is apt lol

They are intended for different market segments. The consumers use Android Auto to project their phones. The headunit manufacturers build devices to run Android Automotive with custom skins. It's like knowing whether a smartphone running Chrome is using Blink or Webkit. The user probably doesn't know or care, they'll use it the same way regardless.

Re: Malware infects Android-based automotive head unit firmware

#103

Post by briHass »

xp84 wrote: post #98
reaperducer wrote: post #59

Earlier quoted context omitted.

It cannot self-propagate to any Android-based head unit Remember that not that long ago viruses spread through floppy disks. Today, people share USB sticks full of music from one car to another all the time. They also bring their music from their home car to a rental car and back.

I’ve never met anyone irl who used USB sticks full of music. I know the capability is there in most cars, just never seen it. It seems like Bluetooth capability and Spotify/Apple Music landed in mainstream cars too soon after “play MP3s from USB” was added, for that to catch on.

My hand is raised. I like having 8GB of music on an old (USB2 is fine) flash drive in my car as a fallback. On longer trips I'll hookup the Android Auto, but if I don't need maps and it's a quick ride, shuffle & repeat all enabled on the USB source.

Sure beats the radio, which plays 2 songs and then 5 min of commercials/sweepers, and has the gall to run ads on the HD text transmission on FM designed for song information.

Re: Malware infects Android-based automotive head unit firmware

#104

Post by brookst »

carstenhag wrote: post #82
lmz wrote: post #74

Earlier quoted context omitted.

You would hope that the ignition switch really cuts the power to the head unit when it is switched to off.

No you wouldn’t, because then you always have a cold boot of the headunit, even if you just accidentally hit the ignition. Users want the head unit to resume within a few seconds. Just like their phone.

That’s why head units stay in low power mode for 30ish minutes when you turn off the car.

They do not stay in low power for weeks. Car batteries are really not that big, and cranking an engine takes some amps. I had a Subaru crosstrek that was recalled because their cellular modem was drawing IIRC 10ma 24/7, which would kill the car if it sat 3 or 4 days.

Re: Malware infects Android-based automotive head unit firmware

#105

Post by speed_spread »

brookst wrote: post #19
kotaKat wrote: post #14

Earlier quoted context omitted.

It seems like this exploit is targeting those that keep their phones tethered for connectivity outwards or hooked a USB modem or a SIM card into a cell-equipped headunit. The only valuable thing there is the relatively 'clean' mobile connection... and this malware's dropping a residential proxy endpoint on the headunit to take advantage of it. Bonus points if the headunit is always connected and always powered up to…

Head units aren’t always-on. Typically they go into a low power standby 2-5 minutes after ignition / accessory mode turns off, and go completely power-off 30-ish minutes later. Otherwise any car sitting unused for a week or two would have a dead battery.

I'm pretty certain my car could go months running Android in low power mode just from the 12v battery, never mind the traction battery. But no, they had to have the head unit boot on every start and everything is slow for a minute, especially since the last update. These people can't code for shit.

Re: Malware infects Android-based automotive head unit firmware

#106

Post by bluGill »

apublicfrog wrote: post #96
wbl wrote: post #94

Earlier quoted context omitted.

In America its not libel if it's true

I see nothing at a glance about the author (Dmitry Kalinin) being American, so I can't imagine that is relevant.

there is the problem. We don't know what country is in question. There are some countries where the truth is not a defense against libel. Thus, depending on where the author is from, or for that matter the publisher or other people who might happen to be in the chain, there could be a libel case if the truth was stated.

Re: Malware infects Android-based automotive head unit firmware

#107

Post by bluGill »

NewJazz wrote: post #90
m-s-y wrote: post #49

Earlier quoted context omitted.

Wireless CarPlay uses Bluetooth to exchange SSID and key info before switching over to WiFi for the duration of the session.

Wow that's cursed, never realized that's how it worked.

It's a good idea actually, but it's also really complex to get right.

Early version of Android Auto could transfer over USB 2.0 instead of Bluetooth, which works, but it's not near as high bandwidth.

Re: Malware infects Android-based automotive head unit firmware

#108

Post by bluGill »

madduci wrote: post #85
Retr0id wrote: post #2

> Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the device to recruit it into a botnet People do pair them with their phones, though. I could imagine a future version of malware like this propagating laterally.

Some automakers like Nissan bring their own 4G SIM, which makes the pairing of phone not important, as the head unit can access Internet by itself

How long until the 4G networks are turned off? There are a lot of cars that have a 3G sim or even a 2G sim. They can do nothing because those networks have been turned off.

At least I'm not aware of any car where they updated the radio in the car when the network got turned off. By contrast, I work for John Deere and just down the hall from me are people who made a ton of money when the 2G network got turned off because a lot of customers paid $1,000 upgrade to a newer radio. I think most people would agree that there is no future that their car radio does that is worth paying money to upgrade when the cell network turns off. At John Deere, we're lucky that we have found pictures that customers find valuable enough that they are willing to pay to upgrade the radio when it goes obsolete.

Re: Malware infects Android-based automotive head unit firmware

#109

Post by bluGill »

RealityVoid wrote: post #35
01100011 wrote: post #31

Earlier quoted context omitted.

An aftermarket head unit connects to the CAN bus? The aftermarket head unit I installed certainly doesn't. Are you sure what you are saying, which is true for OEM units, applies to aftermarket ones?

Can't vouch for all car architectures, but in most cases the head unit is QM and safety domains are usually segmented from each other. So even if the head unit talks CAN (it needs to get car data somehow) it will only communicate with the rest of the car through a gateway that will not allow it to take any dangerous actions.

That's true for most cars, but some, particularly the older cars, they weren't as concerned about security as they should have been. And so sometimes the radio can talk to things that it probably shouldn't be able to talk to.

Re: Malware infects Android-based automotive head unit firmware

#110

Post by bluGill »

jackdecker wrote: post #32
MBCook wrote: post #16

Earlier quoted context omitted.

Android Automotive is the infotainment system’s OS and runs fully without a phone. Android Auto is the Google equivalent of CarPlay and runs on your phone. It’s easy to confuse. Like watching Apple TV on your Apple TV in Apple’s TV app.

So I can use android auto on an android automotive head unit - got it but also this seems needlessly confusing naming structure. Apple TV comparison is apt lol

Normally you can use Android Auto on an Android AutoMorph head unit, however that's not required. GM regularly disables Android Auto on all their head units even though it's included in the base Android automotive OS.

I have such a car and I am so disappointed that I regularly tell people I would not buy another one and I would not recommend you buy a GM because they do that trip.

Post reply on HN