Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware infects Android-based automotive head unit firmware

securelist.com

Post reply on HN
Print view View original

111–120 of 154 posts

Re: Malware infects Android-based automotive head unit firmware

#111

Post by pdonis »

xp84 wrote: post #98
reaperducer wrote: post #59

Earlier quoted context omitted.

It cannot self-propagate to any Android-based head unit Remember that not that long ago viruses spread through floppy disks. Today, people share USB sticks full of music from one car to another all the time. They also bring their music from their home car to a rental car and back.

I’ve never met anyone irl who used USB sticks full of music. I know the capability is there in most cars, just never seen it. It seems like Bluetooth capability and Spotify/Apple Music landed in mainstream cars too soon after “play MP3s from USB” was added, for that to catch on.

> I’ve never met anyone irl who used USB sticks full of music.

I've been doing it for years, since it's so much more convenient than the alternatives: plug the stick into my car and I have my whole music library there and it Just Works.

Re: Malware infects Android-based automotive head unit firmware

#112

Post by pdonis »

charcircuit wrote: post #61
reaperducer wrote: post #59

Earlier quoted context omitted.

It cannot self-propagate to any Android-based head unit Remember that not that long ago viruses spread through floppy disks. Today, people share USB sticks full of music from one car to another all the time. They also bring their music from their home car to a rental car and back.

Most people just bring their phone between cars for music.

My phone is much clunkier to use for this than a USB stick. Plus my phone can't store my whole music library (because there's too much other stuff already on it), whereas a single USB stick does it easily with plenty of room to spare.

Re: Malware infects Android-based automotive head unit firmware

#113

Post by karlshea »

rootusrootus wrote: post #60
karlshea wrote: post #34

Earlier quoted context omitted.

Mine does. Its dashboard shows fuel level and a bunch of other things and I can bring up a speedometer/rpm app. I believe the connection exists because the steering wheel buttons/iDrive talk to the original head unit over CAN.

That’s wild, I’ve never run across a head unit that had me connect OBD2. I think I would just ignore that bit of the install instructions.

I did not connect ODB2. The HU I got puts itself as a passthrough to the stock BMW HU (which you still need to be able to use, you switch the screen to its output by holding down a button), and that connector includes CAN.

There are numerous reasons the HU needs CAN, for example to get the steering wheel angle to be able to draw the guides over the backup camera feed. Or to switch to the backup camera feed when you put the car in reverse.

Re: Malware infects Android-based automotive head unit firmware

#114

Post by jibal »

chrisjj wrote: post #65
spicyjpeg wrote: post #23

The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit.…

> It cannot self-propagate to any Android-based head unit Article does not say that.

So? spicyjpeg is pointing out what is true, not just regurgitating TFA.

Re: Malware infects Android-based automotive head unit firmware

#115

Post by zdragnar »

xp84 wrote: post #98
reaperducer wrote: post #59

Earlier quoted context omitted.

It cannot self-propagate to any Android-based head unit Remember that not that long ago viruses spread through floppy disks. Today, people share USB sticks full of music from one car to another all the time. They also bring their music from their home car to a rental car and back.

I’ve never met anyone irl who used USB sticks full of music. I know the capability is there in most cars, just never seen it. It seems like Bluetooth capability and Spotify/Apple Music landed in mainstream cars too soon after “play MP3s from USB” was added, for that to catch on.

I did it for a few years, back when I had a new car with the capability but not a phone with a good mobile data plan.

It had the benefit of an information center with physical buttons too, so I could navigate around my library without touch screen madness or voice commands constantly failing to understand band and song names.

Re: Malware infects Android-based automotive head unit firmware

#116

Post by russelg »

mschuster91 wrote: post #42
spicyjpeg wrote: post #23

The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit.…

> nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit Huh, how does that work anyway? And while we're at it, Apple CarPlay as well? Both can run wirelessly via Bluetooth, but BT is nowhere near capable enough to stream full bandwidth video?

Not sure about CarPlay, but Android Auto connects via wifi to the head unit for the video feed.

Re: Malware infects Android-based automotive head unit firmware

#117

Post by bigiain »

ghostly_s wrote: post #87
spicyjpeg wrote: post #23

The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit.…

Why do they gloss right over how this was distributed? Barring details of any other kind of exploit we would have to assume the vendor's update server was compromised? If so why don't they just say so.

> we would have to assume the vendor's update server was compromised

You say "compromised". I say "monetised".

:sigh:

Re: Malware infects Android-based automotive head unit firmware

#118

Post by charcircuit »

pdonis wrote: post #112
charcircuit wrote: post #61

Earlier quoted context omitted.

Most people just bring their phone between cars for music.

My phone is much clunkier to use for this than a USB stick. Plus my phone can't store my whole music library (because there's too much other stuff already on it), whereas a single USB stick does it easily with plenty of room to spare.

Phones can access the whole internet. A USB stick can't stream Spotify or connect to the cloud.

Re: Malware infects Android-based automotive head unit firmware

#119

Post by somenameforme »

orbital-decay wrote: post #56
p-e-w wrote: post #43

Earlier quoted context omitted.

[flagged]

Wikipedia's source policy makes it nearly impossible to refer to anything that is not in the media, and any sensitive article has to use weasel words like this. Are you just noting the issue with the article, or actually doubting that Kaspersky Labs is a de-facto FSB branch since at least 2015?

Up until 2015 all was good with Kaspersky. But then in February of that year they posted a detailed writeup on malware created by the Equation Group, the NSA. [1] Within a month US media outlets, relying on anonymous sources, began posting endless claims that Kaspersky was a part of the Russian government. Over the next years Kaspersky opened a bunch of 'transparency centers' offering full code audits and inspection, relocated their core infrastructure and customer data to Switzerland - subsequently falling under their data regulations, and so on.

And if they were in any way affiliated with the Russian (or any) government, there seems no logical reason they'd publicly share their findings of the NSA malware, let alone the other transparency actions. Their data would be vastly more valuable if kept secret, because it'd open the door to greater exploitation of US cyber activities and being able to covertly secure desired systems. Instead their actions benefited everybody, but obviously embarrassed the NSA and as a result the US.

[1] - https://media.kasperskycontenthub.com/wp-content/uploads/sit...

Re: Malware infects Android-based automotive head unit firmware

#120

Post by j16sdiz »

Retr0id wrote: post #4
davoneus wrote: post #3

The logical endpoint of the entire "the car as software" concept. Can't wait for the security vendors to start hawking "AV for your car"

I hope we see "de-smartification" conversion kits that replace the electronics with more straightforward (and repairable) offline equivalents. The ultimate AV.

Don't see this happens any time soon.

Many feedback loops in modern car is software based and interconnected with each other.

Kits that works half as good without software would be very expensive to make.

Post reply on HN