Malware infects Android-based automotive head unit firmware(securelist.com)
106 pointsby campuscodi3 hours ago19 comments
  • spicyjpegan hour ago
    The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit. This seems to be a very similar situation to that of cheap generic Android TV streaming boxes, which often come pre-infected from the factory with residential proxies and other malware as well; most of the infrastructure is likely shared.
    • manbashan hour ago
      Indeed this is an odd disclosure and I am not familiar with past posts by them.

      Moreover, no CVE is associated with this claimed vulnerability. It's not even stated which Android version or automotive head-unit variant version is affected.

    • mschuster9129 minutes ago
      > nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit

      Huh, how does that work anyway? And while we're at it, Apple CarPlay as well? Both can run wirelessly via Bluetooth, but BT is nowhere near capable enough to stream full bandwidth video?

      • StilesCrisis4 minutes ago
        I thought the latest Bluetooth protocols were basically designed to hand off to an ad-hoc Wi-Fi connection between the two devices after the initial handshake. (Might be an oversimplification of the real protocol)
      • m-s-y14 minutes ago
        Wireless CarPlay uses Bluetooth to exchange SSID and key info before switching over to WiFi for the duration of the session.
      • dhc0218 minutes ago
        The way I understand it, the connection is negotiated via BT, but then wifi is used for the fat data pipe to run the display.
  • Retr0id2 hours ago
    > Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the device to recruit it into a botnet

    People do pair them with their phones, though. I could imagine a future version of malware like this propagating laterally.

    • axegon_an hour ago
      Almost, though I understand I am the exception rather than the rule: Personally I have an aftermarket android head unit since the standard one was incredibly basic, no real time navigation updates, updating maps was a pain in the ass and so on. Initially I did pair it with my phone but since it is an aftermarket unit from a company which apparently does not exist anymore, newer phones cannot be paired with it. So my only option was to go the opposite route and use my phone as a wireless hotspot(almost - there's a raspberry pi with openwrt between the two). And since I self-host everything, I had no choice but to hook it up to my vpn. That said, I understand the implications of doing this so ultimately the network access it gets is incredibly limited: everything that is not my music server and the maps provider has been cut off completely. The downside is that every now and then I get a "can't connect to google services" notification though that is technically reassuring from a security perspective.
    • buckle80172 hours ago
      Head units can log location, navigation start and end points, call logs, call audio, and scrape full contact lists.

      Just off the top of my head.

      • Retr0id2 hours ago
        That's scary from a user perspective, but harder to monetise at scale as an attacker. Proxy endpoints are just another commodity (and offer recurring revenue).
        • wongarsuan hour ago
          If you infect tens of vehicles that's not that valuable. But if you infect ten thousand vehicles, convinced a trusted member of one of the bigger black hat forums it's real and have him vouch for your marketplace post, there should be some buyers for full movement profiles, call logs and address books of ten thousand people

          And doing that doesn't really interfere with also setting up and selling proxy endpoints

        • stymaar2 hours ago
          Yeah, especially since most of these are already available for purchase from data brokers.
          • Zigurdan hour ago
            They're called data brokers because they have a buy side, too. That might be peanuts to you, but to an AliExpress seller, it could be most of their profit.
    • kotaKat2 hours ago
      It seems like this exploit is targeting those that keep their phones tethered for connectivity outwards or hooked a USB modem or a SIM card into a cell-equipped headunit.

      The only valuable thing there is the relatively 'clean' mobile connection... and this malware's dropping a residential proxy endpoint on the headunit to take advantage of it. Bonus points if the headunit is always connected and always powered up to a +12v rail in the car, that's free and always-on real estate!

      • brookst2 hours ago
        Head units aren’t always-on. Typically they go into a low power standby 2-5 minutes after ignition / accessory mode turns off, and go completely power-off 30-ish minutes later.

        Otherwise any car sitting unused for a week or two would have a dead battery.

        • kotaKat7 minutes ago
          Some of these Android units also double as DVRs and dashcam recorders (parking mode!) as well so may be hooked onto the normal +12v rail.
        • olyjohn42 minutes ago
          They are always wired to battery power though. The point is that it could look powered off, and still be running a proxy.
        • Zigurdan hour ago
          I learned that not all electronics goes into low power mode even when designed to run off a car battery, from using a cheap Bluetooth OBDII dongle.
          • smilespray11 minutes ago
            If that was one of those ELM327 dongles, yes they have 12V and are known to drain your battery. They're only meant for short diagnostic runs.
  • dzdt2 hours ago
    There are a lot of cars out there where the head unit has connection to the CAN bus. Which means this malware vector could be used to directly cause crashes. E.g. https://news.ycombinator.com/item?id=19751872
    • Ccecil29 minutes ago
      The car hacker's handbook [1] has a chapter on just using the infotainment system to access the CAN. Specifically mentions "attacking through the update system".

      [1]https://opengarages.org/handbook/ebook/ (chapter 9)

    • 01100011an hour ago
      An aftermarket head unit connects to the CAN bus? The aftermarket head unit I installed certainly doesn't. Are you sure what you are saying, which is true for OEM units, applies to aftermarket ones?
      • RealityVoidan hour ago
        Can't vouch for all car architectures, but in most cases the head unit is QM and safety domains are usually segmented from each other. So even if the head unit talks CAN (it needs to get car data somehow) it will only communicate with the rest of the car through a gateway that will not allow it to take any dangerous actions.
      • karlsheaan hour ago
        Mine does. Its dashboard shows fuel level and a bunch of other things and I can bring up a speedometer/rpm app.

        I believe the connection exists because the steering wheel buttons/iDrive talk to the original head unit over CAN.

    • jiaosdjfan hour ago
      Manufacturers should be sued to absolute oblivion for doing what any developer would tell you is a security hole.
  • jiaosdjfan hour ago
    "How has the automotive industry adapted to decades of computing best practices?"

    - Head units connected to CAN bus with bluetooth vulnerabilities allowing attacker to remotely activate locks and windows and sometimes even driving controls

    - Unsecured CAN bus cables everywhere allowing cars to be stolen through headlights and behind mud guard flaps

    - Keyless entry basically a shit show of faraday pouches

    - OBD port allowing thieves to clone a full key in seconds

    - Even cars in decent neighbourhoods have to use steering locks

    Sorry but this is a fucking joke and the automotive industry is cancer.

    At least Tesla actually bothers with user updates and production improvements, most other manufacturers just shit out the same model 5 years in a row with an extra cup holder and USB port (probably rootable) if you're lucky. That said, Tesla's insistence that everything be done by touch screen is dog shit.

    All this and still for 99% of cars my iPhone stuck to the dashboard provides better maps and entertainment and yet they can't even make a fucking phone holder standard, not even a fucking mounting point so I don't have to block an air vent.

    • smilespray9 minutes ago
      You had me until you started giving Tesla the thumbs-up, despite your caveat.
  • hndbwksam76 minutes ago
    Concise and useful, rare combo
  • jackdecker2 hours ago
    For whatever reason, the idea of this being in my car is relatively scarier for me than if this was just my phone ?

    I think partially as my mental model of both android auto and CarPlay is that they operate as a passthrough of my device rather than as an separate installation of the OS entirely (I wasn’t aware the head unit itself had the ability to install APKs independently).

    Also, feel like John Gruber is going to have a field day with this one

    • MBCook2 hours ago
      Android Automotive is the infotainment system’s OS and runs fully without a phone.

      Android Auto is the Google equivalent of CarPlay and runs on your phone.

      It’s easy to confuse. Like watching Apple TV on your Apple TV in Apple’s TV app.

      • Zigurdan hour ago
        Did they hire their branding person from Microsoft? And how about AppFunctions (Google) and AppIntents (Apple)?
      • jackdeckeran hour ago
        So I can use android auto on an android automotive head unit - got it but also this seems needlessly confusing naming structure. Apple TV comparison is apt lol
    • dybber2 hours ago
      I don’t believe this is Android auto running from a phone, but a situation where the manufacturer have used Android Automotive as operating system for the built in head unit. As e.g. on Volvo’s.
    • inquirerGeneral2 hours ago
      [dead]
  • gchamonlivean hour ago
    Can't be safer than the non-entertainment system from WV Up! that's just a built-in head mount for your phone. Grab one with a large screen and it's the safest thing you can get. Android still has an auto mode for this where it controls the car's audio system through headless bindings, not sure this malware would target this, but just by being a simpler system chances are it's safer too
  • davoneus2 hours ago
    The logical endpoint of the entire "the car as software" concept. Can't wait for the security vendors to start hawking "AV for your car"
    • Retr0id2 hours ago
      I hope we see "de-smartification" conversion kits that replace the electronics with more straightforward (and repairable) offline equivalents. The ultimate AV.
    • doublerabbit21 minutes ago
      It's already in televisions. Not long now.
  • MBCook2 hours ago
    So to do this the attacker has to compromise the update servers at $CAR_COMPANY?
    • timmmmmmay42 minutes ago
      no, the update servers at $sketchy_aliexpress_aftermarket_head_unit_company, probably somewhat easier
  • doublerabbit26 minutes ago

        Norton AntiVirus for your car ECU's. Protect your carfor just $220.95/month *
    * Cars without subscription causes acceleration to be restricted to 60mph.
    After discovering the new OLED televisions come with antivirus, I'm done with thinking technology will ever be secure.
  • 1970-01-012 hours ago
    ..to add to a botnet for click fraud.

    The duality of cybersecurity is interesting. Sometimes the high bar is cleared just to enable a low bar to go lower. Those PLCs monitoring water were ignored for a very long time because they couldn't click on ads. It took a war for them to become a target.

    • 2 hours ago
      undefined
  • bluGill2 hours ago
    One more reason cars should not be internet connected. They last for decades and manufactures don't want to support their cars that long. Always proxy to a phone and the attack surface is limited to things that are updated.
  • zb3an hour ago
    I'd not consider it malware if its sole purpose is to do ad/click fraud. The user is not the target here, the user's enemies are :)
  • tiahura23 minutes ago
    Apple's gatekeeping doesn't make IPhone users any safer.
  • IshKebab2 hours ago
    Um so which car is this? tw.com doesn't seem to be in use.
  • promptsphereean hour ago
    [flagged]
  • miohtama2 hours ago
    [flagged]
  • lvbyte2 hours ago
    [dead]
  • sehw2 hours ago
    [dead]