3 ms·
> Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the de
by Retr0id 2mo ago
> Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the device to recruit it into a botnet
People do pair them with their phones, though. I could imagine a future version of malware like this propagating laterally.
- buckle8017 2mo agoHead units can log location, navigation start and end points, call logs, call audio, and scrape full contact lists. Just off the top of my head.
- Retr0id 2mo agoThat's scary from a user perspective, but harder to monetise at scale as an attacker. Proxy endpoints are just another commodity (and offer recurring revenue).
- stymaar 2mo agoYeah, especially since most of these are already available for purchase from data brokers.
- Zigurd 2mo agoThey're called data brokers because they have a buy side, too. That might be peanuts to you, but to an AliExpress seller, it could be most of their profit.
- wongarsu 2mo agoIf you infect tens of vehicles that's not that valuable. But if you infect ten thousand vehicles, convinced a trusted member of one of the bigger black hat forums it's real and have him vouch for your marketplace post, there should be some buyers for full movement profiles, call logs and address books of ten thousand people And doing that doesn't really interfere with also setting up and selling proxy endpoints
- carstenhag 2mo agoSome head units (working with a 1st party one atm) have two networks: OEM-paid (unlimited data) and user-paid. A 3rd party apk would be consuming all bought traffic quite soon. Also typical Android permissions still apply. The user would need to grant the malicious app contacts, call logs, etc permissions.
- kotaKat 2mo agoIt seems like this exploit is targeting those that keep their phones tethered for connectivity outwards or hooked a USB modem or a SIM card into a cell-equipped headunit. The only valuable thing there is the relatively 'clean' mobile connection... and this malware's dropping a residential proxy endpoint on the headunit to take advantage of it. Bonus points if the headunit is always connected and always powered up to a +12v rail in the car, that's free and always-on real estate!
- brookst 2mo agoHead units aren’t always-on. Typically they go into a low power standby 2-5 minutes after ignition / accessory mode turns off, and go completely power-off 30-ish minutes later. Otherwise any car sitting unused for a week or two would have a dead battery.
- Zigurd 2mo agoI learned that not all electronics goes into low power mode even when designed to run off a car battery, from using a cheap Bluetooth OBDII dongle.
- smilespray 2mo agoIf that was one of those ELM327 dongles, yes they have 12V and are known to drain your battery. They're only meant for short diagnostic runs.
- wildzzz 2mo agoA lot of older cars didn't turn off their OBD port, have their headunits go into standby, or even turn off the cigarette lighter port. Early OBD ports connected to dealer computers for a few minutes, not an always on dongle. Plain headunits just play music, what could they possibly accomplish by staying on when you turn off the car? It was a convenience having the cigarette outlet left powered so you could light a cigarette without turning on the car. Other than maybe a bag phone, what would you possibly plug into that?
- axegon_ 2mo agoAlmost, though I understand I am the exception rather than the rule: Personally I have an aftermarket android head unit since the standard one was incredibly basic, no real time navigation updates, updating maps was a pain in the ass and so on. Initially I did pair it with my phone but since it is an aftermarket unit from a company which apparently does not exist anymore, newer phones cannot be paired with it. So my only option was to go the opposite route and use my phone as a wireless hotspot(almost - there's a raspberry pi with openwrt between the two). And since I self-host everything, I had no choice but to hook it up to my vpn. That said, I understand the implications of doing this so ultimately the network access it gets is incredibly limited: everything that is not my music server and the maps provider has been cut off completely. The downside is that every now and then I get a "can't connect to google services" notification though that is technically reassuring from a security perspective.
- madduci 2mo agoSome automakers like Nissan bring their own 4G SIM, which makes the pairing of phone not important, as the head unit can access Internet by itself
- drnick1 2mo agoKeep in mind however that the 4G SIM is not there for the driver's benefit, but for Nissan's. It collects extremely invasive telemetry that is then sold to data brokers and consumed by car insurers and government agencies, among others. This is why I won't drive a car that I own without first removing the onboard modem.
- madduci 2mo agoExactly and with the malware is much worse
- bluGill 2mo agoHow long until the 4G networks are turned off? There are a lot of cars that have a 3G sim or even a 2G sim. They can do nothing because those networks have been turned off. At least I'm not aware of any car where they updated the radio in the car when the network got turned off. By contrast, I work for John Deere and just down the hall from me are people who made a ton of money when the 2G network got turned off because a lot of customers paid $1,000 upgrade to a newer radio. I think most people would agree that there is no future that their car radio does that is worth paying money to upgrade when the cell network turns off. At John Deere, we're lucky that we have found pictures that customers find valuable enough that they are willing to pay to upgrade the radio when it goes obsolete.
- toast0 2mo ago> How long until the 4G networks are turned off? There are a lot of cars that have a 3G sim or even a 2G sim. They can do nothing because those networks have been turned off. There's a good chance it will last longer than 3G. 5G was designed to coexist with 4G so a 5G base station can (optionally) use a 4G compatible beacon and use 4G for some timeslots and 5G for others. Even if 6G doesn't do the same, 4G can live until 5G is turned off. 2G and 3G needed a whole channel allocated, which was too much in the US anyway. I understand in some countries they turned off 3G but left one channel of 2G for industrial/embedded devices; maybe one channel per network or maybe one channel that all networks could roam to ... roaming seems more permissive outside the US, too.
- ghostly_s 2mo ago"Pairing" with a head unit is not an open socket to dump anything you care to down the wire. That would require finding a rather remarkable vulnerability in one of the audio/address book/screen mirroring APIs the devices use.
- Retr0id 2mo agoBluetooth RCEs have happened in the past and will happen again.
- dolmen 2mo agoAlso cars are often near other cars. Which offer wireless connectivity. Car software is almost never updated and is years old. Nothing could go wrong.