4 ms·

> Important: Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and

> Important: Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota. How is this the case? I thought bluetooth was just sharing my phone's audio. Why would it allow requests over the internet? Surely there's a way to tell the phone not to give its internet connection to any connected bluetooth device?

stuckindoors 5mo ago
When reading the article I think he appears to be talking about car play/android auto connection not audio only connections. I think Bluetooth in AA and Carplay is used to configure a local network between the phone and the car to transmit the images to the cars screen. I would assume that that data capability can also be used for the car to communicate with the Internet.
- ezfe 5mo ago
  It does produce a local Wi-Fi network but there's no evidence that it supports internet communication. That would be considered a hotspot, which not all carriers even support.
  - rconti 5mo ago
    Plus it seems unlikely that the telematics module is even really related to the display screen stuff, let alone being configured to use alternate network connections to transmit data.
  - dotancohen 5mo ago
    How does the carrier know that the traffic is being proxied for another device, and not e.g. requested from the phone's web browser or another app? Does the phone add a proxy header? Can it be configured to not add the header?
    - ywain 5mo ago
      Mostly by looking at packets TTL. It gets decreased by 1 by the hotspot’s NAT so if the value is something like 63 or 127 (instead of 64 or 128 which are the defaults for most platforms) then it’s almost certain the packet originated from a device behind the phone and not from the phone itself.
    - svens_ 5mo ago
      There might be multiple methods and heuristics, but one way that I have encountered was based on packet TTL. Android and Linux use 64 by default - the block could be circumvented by setting the laptop to use 65 TTL.
  - zakisaad 5mo ago
    I've never understood how this can be limited in practice: surely as far as the carrier is concerned, all traffic from the mobile device is the same (unless there are identifiers on the traffic coming from hotspotted devices via the mobile device). Here in Australia we've never had any form of hotspot detection/segmentation - if you have a data plan, all data features work (across all carriers). I do recall lots of online chatter from the US though, especially years back when mobile data was more of a precious resource.
    - drtz 5mo ago
      > surely as far as the carrier is concerned, all traffic from the mobile device is the same Going on a bit of a tangent, but deep packet inspection can identify packets routed using NAT, so if the phone is operating as a typical hotspot it would be identifiable by your carrier. Carriers in the USA used to block / denylist / charge extra for tethering using this exact approach.
      - HDBaseT 5mo ago
        Deep Packet Inspection presumably requires a certificate to be installed on my device to allow my connection to be MiTM'd.
        codebje 5mo ago
        DPI can refer to inspecting beyond just the headers, but since it's more of a marketing term than a technical one, you could also say you're "deeply inspecting" the IP headers of a packet and no-one would show up to arrest you for bad terminology. Anyway, one way to detect NAT is to observe different TTLs originating from one device. Is that deep inspection? Probably depends on who you ask. The fact that you have to track information across multiple packets counts for something, though. Off the top of my head I wouldn't really expect there to be much value in a MITM inspection of the contents of HTTP traffic for the purposes of NAT detection. You could probably come up with some scenarios in which it might be possible, but I'd content those scenarios aren't very practical. Easier to compare TTLs between packets, say, or track connections to known OS "phone home" destinations. While these just use information from the IP layer, they're stateful observations requiring comparisons across multiple packets, and that might count for something. One way to detect a shitty carrier service, though, is that they're inspecting your traffic for "good" or "bad" uses of their service, because that is a good indicator that they're not just a carrier. I call it Dickish Practices Identification, or DPI.
- happyPersonR 5mo ago
  Does anyone have a flow log or pcap or something from the phone showing this tho?
IncandescentGas 5mo ago
Is this specific to carplay, or can other bluetooth devices also silently and nefariously hijack your cellular data connection?
- jrmg 5mo ago
  Neither CarPlay nor regular Bluetooth connections allow this. It’s not a thing. (There is the ability to set up a Bluetooth hotspot on a phone and allow Internet sharing over Bluetooth, but that’s a different thing entirely and you have to explicitly set it up and use it. It’s also slow compared to a modern WiFi hotspot).
pelotron 5mo ago
I think there are details being left out. But several people in the comments indicate that there is a Toyota app that provides various features. I bet the app implements some proprietary bluetooth service that the head unit connects to and feeds information through. Or maybe they give the head unit a straight pipe to the internet via that service.
- ezfe 5mo ago
  That very much could be the case, in which case deleting the (now useless, because your car is not connected) app would resolve that - no bluetooth restriction needed.
j45 5mo ago
The bluetooth protocol includes the ability to network, and share connections like a mobile/personal hotspot. Older versions of bluetooth may have other networking capabilities.
masfuerte 5mo ago
There is a bluetooth protocol for cars to piggyback on your phone's internet connection. There was an article about it here a couple of years ago but I've forgotten the name of the protocol, and trying to search for it turns up a lot of irrelevance. The fix for this is a phone that doesn't implement that protocol, i.e. not Android or iOS.

stuckindoors 5mo ago

When reading the article I think he appears to be talking about car play/android auto connection not audio only connections. I think Bluetooth in AA and Carplay is used to configure a local network between the phone and the car to transmit the images to the cars screen. I would assume that that data capability can also be used for the car to communicate with the Internet.

ezfe 5mo ago
It does produce a local Wi-Fi network but there's no evidence that it supports internet communication. That would be considered a hotspot, which not all carriers even support.
- rconti 5mo ago
  Plus it seems unlikely that the telematics module is even really related to the display screen stuff, let alone being configured to use alternate network connections to transmit data.
- dotancohen 5mo ago
  How does the carrier know that the traffic is being proxied for another device, and not e.g. requested from the phone's web browser or another app? Does the phone add a proxy header? Can it be configured to not add the header?
  - ywain 5mo ago
    Mostly by looking at packets TTL. It gets decreased by 1 by the hotspot’s NAT so if the value is something like 63 or 127 (instead of 64 or 128 which are the defaults for most platforms) then it’s almost certain the packet originated from a device behind the phone and not from the phone itself.
  - svens_ 5mo ago
    There might be multiple methods and heuristics, but one way that I have encountered was based on packet TTL. Android and Linux use 64 by default - the block could be circumvented by setting the laptop to use 65 TTL.
- zakisaad 5mo ago
  I've never understood how this can be limited in practice: surely as far as the carrier is concerned, all traffic from the mobile device is the same (unless there are identifiers on the traffic coming from hotspotted devices via the mobile device). Here in Australia we've never had any form of hotspot detection/segmentation - if you have a data plan, all data features work (across all carriers). I do recall lots of online chatter from the US though, especially years back when mobile data was more of a precious resource.
  - drtz 5mo ago
    > surely as far as the carrier is concerned, all traffic from the mobile device is the same Going on a bit of a tangent, but deep packet inspection can identify packets routed using NAT, so if the phone is operating as a typical hotspot it would be identifiable by your carrier. Carriers in the USA used to block / denylist / charge extra for tethering using this exact approach.
    - HDBaseT 5mo ago
      Deep Packet Inspection presumably requires a certificate to be installed on my device to allow my connection to be MiTM'd.
      - codebje 5mo ago
        DPI can refer to inspecting beyond just the headers, but since it's more of a marketing term than a technical one, you could also say you're "deeply inspecting" the IP headers of a packet and no-one would show up to arrest you for bad terminology. Anyway, one way to detect NAT is to observe different TTLs originating from one device. Is that deep inspection? Probably depends on who you ask. The fact that you have to track information across multiple packets counts for something, though. Off the top of my head I wouldn't really expect there to be much value in a MITM inspection of the contents of HTTP traffic for the purposes of NAT detection. You could probably come up with some scenarios in which it might be possible, but I'd content those scenarios aren't very practical. Easier to compare TTLs between packets, say, or track connections to known OS "phone home" destinations. While these just use information from the IP layer, they're stateful observations requiring comparisons across multiple packets, and that might count for something. One way to detect a shitty carrier service, though, is that they're inspecting your traffic for "good" or "bad" uses of their service, because that is a good indicator that they're not just a carrier. I call it Dickish Practices Identification, or DPI.
happyPersonR 5mo ago
Does anyone have a flow log or pcap or something from the phone showing this tho?

IncandescentGas 5mo ago

Is this specific to carplay, or can other bluetooth devices also silently and nefariously hijack your cellular data connection?

jrmg 5mo ago
Neither CarPlay nor regular Bluetooth connections allow this. It’s not a thing. (There is the ability to set up a Bluetooth hotspot on a phone and allow Internet sharing over Bluetooth, but that’s a different thing entirely and you have to explicitly set it up and use it. It’s also slow compared to a modern WiFi hotspot).

pelotron 5mo ago

I think there are details being left out. But several people in the comments indicate that there is a Toyota app that provides various features. I bet the app implements some proprietary bluetooth service that the head unit connects to and feeds information through. Or maybe they give the head unit a straight pipe to the internet via that service.

ezfe 5mo ago
That very much could be the case, in which case deleting the (now useless, because your car is not connected) app would resolve that - no bluetooth restriction needed.

j45 5mo ago

The bluetooth protocol includes the ability to network, and share connections like a mobile/personal hotspot. Older versions of bluetooth may have other networking capabilities.

masfuerte 5mo ago

There is a bluetooth protocol for cars to piggyback on your phone's internet connection. There was an article about it here a couple of years ago but I've forgotten the name of the protocol, and trying to search for it turns up a lot of irrelevance. The fix for this is a phone that doesn't implement that protocol, i.e. not Android or iOS.