Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware infects Android-based automotive head unit firmware

securelist.com

Post reply on HN
Print view View original

141–150 of 154 posts

Re: Malware infects Android-based automotive head unit firmware

#141

Post by deaton »

mschuster91 wrote: post #42
spicyjpeg wrote: post #23

The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit.…

> nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit Huh, how does that work anyway? And while we're at it, Apple CarPlay as well? Both can run wirelessly via Bluetooth, but BT is nowhere near capable enough to stream full bandwidth video?

Not sure about carplay, but Android Auto wireless uses wifi for the video stream.

Re: Malware infects Android-based automotive head unit firmware

#142

Post by dolmen »

camkego wrote: post #127
spicyjpeg wrote: post #23

The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit.…

Interesting how there is possibly a new category of residential proxy malware “automotive proxy malware”

This is just another mobile device. It even has a SIM card.

Re: Malware infects Android-based automotive head unit firmware

#143

Post by dolmen »

xp84 wrote: post #98
reaperducer wrote: post #59

Earlier quoted context omitted.

It cannot self-propagate to any Android-based head unit Remember that not that long ago viruses spread through floppy disks. Today, people share USB sticks full of music from one car to another all the time. They also bring their music from their home car to a rental car and back.

I’ve never met anyone irl who used USB sticks full of music. I know the capability is there in most cars, just never seen it. It seems like Bluetooth capability and Spotify/Apple Music landed in mainstream cars too soon after “play MP3s from USB” was added, for that to catch on.

We haven't met yet.

We use an USB key full of audio books: Harry Potter saga and The Quest of Ewilan among others. The whole family is hooked.

The car UI is much more reliable (no phone to unlock by the copilot, no Bluetooth disconnect). The phone battery is spared for navigation purposes.

Re: Malware infects Android-based automotive head unit firmware

#144

Post by dolmen »

charcircuit wrote: post #118
pdonis wrote: post #112

Earlier quoted context omitted.

My phone is much clunkier to use for this than a USB stick. Plus my phone can't store my whole music library (because there's too much other stuff already on it), whereas a single USB stick does it easily with plenty of room to spare.

Phones can access the whole internet. A USB stick can't stream Spotify or connect to the cloud.

You'll be surprised, but some places where a car can go have no phone connectivity.

Re: Malware infects Android-based automotive head unit firmware

#145

Post by dolmen »

mschuster91 wrote: post #42
spicyjpeg wrote: post #23

The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit.…

> nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit Huh, how does that work anyway? And while we're at it, Apple CarPlay as well? Both can run wirelessly via Bluetooth, but BT is nowhere near capable enough to stream full bandwidth video?

My car requires wired connectivity (USB) for Android Auto.

Re: Malware infects Android-based automotive head unit firmware

#146

Post by dolmen »

Retr0id wrote: post #2

> Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the device to recruit it into a botnet People do pair them with their phones, though. I could imagine a future version of malware like this propagating laterally.

Also cars are often near other cars. Which offer wireless connectivity. Car software is almost never updated and is years old.

Nothing could go wrong.

Re: Malware infects Android-based automotive head unit firmware

#147

Post by dolmen »

wildzzz wrote: post #100
Zigurd wrote: post #29

Earlier quoted context omitted.

I learned that not all electronics goes into low power mode even when designed to run off a car battery, from using a cheap Bluetooth OBDII dongle.

A lot of older cars didn't turn off their OBD port, have their headunits go into standby, or even turn off the cigarette lighter port. Early OBD ports connected to dealer computers for a few minutes, not an always on dongle. Plain headunits just play music, what could they possibly accomplish by staying on when you turn off the car? It was a convenience having the cigarette outlet left powered so you could light a ci…

> Other than maybe a bag phone, what would you possibly plug into that?

Car fridge is a thing.

Re: Malware infects Android-based automotive head unit firmware

#148

Post by wbl »

scoot wrote: post #132
bluGill wrote: post #106

Earlier quoted context omitted.

there is the problem. We don't know what country is in question. There are some countries where the truth is not a defense against libel. Thus, depending on where the author is from, or for that matter the publisher or other people who might happen to be in the chain, there could be a libel case if the truth was stated.

> There are some countries where the truth is not a defense against libel Germany, for example. Utterly bizarre and baffling that a democracy protects its politicians this way. /s

It's important for people to be able to critize elected officials.

Re: Malware infects Android-based automotive head unit firmware

#149

Post by rootusrootus »

karlshea wrote: post #113
rootusrootus wrote: post #60

Earlier quoted context omitted.

That’s wild, I’ve never run across a head unit that had me connect OBD2. I think I would just ignore that bit of the install instructions.

I did not connect ODB2. The HU I got puts itself as a passthrough to the stock BMW HU (which you still need to be able to use, you switch the screen to its output by holding down a button), and that connector includes CAN. There are numerous reasons the HU needs CAN, for example to get the steering wheel angle to be able to draw the guides over the backup camera feed. Or to switch to the backup camera feed when you p…

It is really exposing the CAN bus, it is not some adjacent subsystem overlaying the steering guides and rearview video by interrupting the video signal? It's actually entirely coming from the aftermarket HU? That's fascinating! I wouldn't expect an aftermarket system to be too good at that functionality, guides tend to be carefully tuned for specific car/steering/camera combos.

Ideally most cars should be relying heavily on data diodes to minimize the risk of a bad actor wreaking havoc. I know for sure some cars (there was a Jeep example as I recall) don't do that, but I kinda wonder which ones do. It seems like a pretty obvious attack vector worth protecting.

Re: Malware infects Android-based automotive head unit firmware

#150

Post by 3guk »

dolmen wrote: post #145
mschuster91 wrote: post #42

Earlier quoted context omitted.

> nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit Huh, how does that work anyway? And while we're at it, Apple CarPlay as well? Both can run wirelessly via Bluetooth, but BT is nowhere near capable enough to stream full bandwidth video?

My car requires wired connectivity (USB) for Android Auto.

For a decent amount of the older android / CarPlay usb implementations - you can also buy little WiFi / USB dongles that perfectly enable wireless CarPlay - I’ve used them now on a few vehicles and they have been perfect !
Post reply on HN