Hacker News

Why do they gloss right over how this was distributed? Barring details of any other kind of exploit we would have to assume the vendor's update server was compromised? If so why don't they just say so.

Indeed this is an odd disclosure and I am not familiar with past posts by them.

Moreover, no CVE is associated with this claimed vulnerability. It's not even stated which Android version or automotive head-unit variant version is affected.

This makes me think whether the whole chain is an intelligence side business — sell cheap electronics for profit and at the same time own them too.

It cannot self-propagate to any Android-based head unit

Remember that not that long ago viruses spread through floppy disks.

Today, people share USB sticks full of music from one car to another all the time. They also bring their music from their home car to a rental car and back.

> nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit

Huh, how does that work anyway? And while we're at it, Apple CarPlay as well? Both can run wirelessly via Bluetooth, but BT is nowhere near capable enough to stream full bandwidth video?

> It cannot self-propagate to any Android-based head unit

Article does not say that.

Almost, though I understand I am the exception rather than the rule: Personally I have an aftermarket android head unit since the standard one was incredibly basic, no real time navigation updates, updating maps was a pain in the ass and so on. Initially I did pair it with my phone but since it is an aftermarket unit from a company which apparently does not exist anymore, newer phones cannot be paired with it. So my only option was to go the opposite route and use my phone as a wireless hotspot(almost - there's a raspberry pi with openwrt between the two). And since I self-host everything, I had no choice but to hook it up to my vpn. That said, I understand the implications of doing this so ultimately the network access it gets is incredibly limited: everything that is not my music server and the maps provider has been cut off completely. The downside is that every now and then I get a "can't connect to google services" notification though that is technically reassuring from a security perspective.

Some automakers like Nissan bring their own 4G SIM, which makes the pairing of phone not important, as the head unit can access Internet by itself

"Pairing" with a head unit is not an open socket to dump anything you care to down the wire. That would require finding a rather remarkable vulnerability in one of the audio/address book/screen mirroring APIs the devices use.

Head units can log location, navigation start and end points, call logs, call audio, and scrape full contact lists.

Just off the top of my head.

It seems like this exploit is targeting those that keep their phones tethered for connectivity outwards or hooked a USB modem or a SIM card into a cell-equipped headunit.

The only valuable thing there is the relatively 'clean' mobile connection... and this malware's dropping a residential proxy endpoint on the headunit to take advantage of it. Bonus points if the headunit is always connected and always powered up to a +12v rail in the car, that's free and always-on real estate!

The car hacker's handbook [1] has a chapter on just using the infotainment system to access the CAN. Specifically mentions "attacking through the update system".

[1]https://opengarages.org/handbook/ebook/ (chapter 9)

An aftermarket head unit connects to the CAN bus? The aftermarket head unit I installed certainly doesn't. Are you sure what you are saying, which is true for OEM units, applies to aftermarket ones?

Manufacturers should be sued to absolute oblivion for doing what any developer would tell you is a security hole.

Android Automotive is the infotainment system’s OS and runs fully without a phone.

Android Auto is the Google equivalent of CarPlay and runs on your phone.

It’s easy to confuse. Like watching Apple TV on your Apple TV in Apple’s TV app.

I don’t believe this is Android auto running from a phone, but a situation where the manufacturer have used Android Automotive as operating system for the built in head unit. As e.g. on Volvo’s.

I hope we see "de-smartification" conversion kits that replace the electronics with more straightforward (and repairable) offline equivalents. The ultimate AV.

It's already in televisions. Not long now.

You had me until you started giving Tesla the thumbs-up, despite your caveat.

> "How has the automotive industry adapted to decades of computing best practices?"

Simple. It hasn't.

> Those PLCs monitoring water were ignored for a very long time because they couldn't click on ads.

Somehow I doubt it. They're ripe for ransomware attack.

no, the update servers at $sketchy_aliexpress_aftermarket_head_unit_company, probably somewhat easier

Even from this perspective, it's pretty easy to make things more secure by having less technology. Have the infotainment system just be a blank canvas for Carplay or AA to display on (there does need to be a bit back and fourth, phone needs to send audio to car, car needs to send GPS, speed and state of charge to phone (not strictly necessary, but there are user benefits from the phone having this information). The car itself doesn't need a whole internet-connected general purpose computer attached to it, but doing that is an easy way for the manufacturer to supposedly add value.

Similarly, the LG kerfuffle could be solved by their monitors just being monitors, and not throwing in pointless extras that just broadens their attack surface. Monitors don't need to be general purpose computing devices either. I shouldn't have to worry about general computing problems, like getting infected with malware, outside of computers that obviously are general purpose (i.e. phone, desktop, laptop, and anything else I intentionally set up with foreknowledge of it being general purpose and internet-connected, like a Raspberry Pi).