Almost, though I understand I am the exception rather than the rule: Personally I have an aftermarket android head unit since the standard one was incredibly basic, no real time navigation updates, updating maps was a pain in the ass and so on. Initially I did pair it with my phone but since it is an aftermarket unit from a company which apparently does not exist anymore, newer phones cannot be paired with it. So my only option was to go the opposite route and use my phone as a wireless hotspot(almost - there's a raspberry pi with openwrt between the two). And since I self-host everything, I had no choice but to hook it up to my vpn. That said, I understand the implications of doing this so ultimately the network access it gets is incredibly limited: everything that is not my music server and the maps provider has been cut off completely. The downside is that every now and then I get a "can't connect to google services" notification though that is technically reassuring from a security perspective.
replySome automakers like Nissan bring their own 4G SIM, which makes the pairing of phone not important, as the head unit can access Internet by itself
replyKeep in mind however that the 4G SIM is not there for the driver's benefit, but for Nissan's. It collects extremely invasive telemetry that is then sold to data brokers and consumed by car insurers and government agencies, among others. This is why I won't drive a car that I own without first removing the onboard modem.
reply"Pairing" with a head unit is not an open socket to dump anything you care to down the wire. That would require finding a rather remarkable vulnerability in one of the audio/address book/screen mirroring APIs the devices use.
replyBluetooth RCEs have happened in the past and will happen again.
replyHead units can log location, navigation start and end points, call logs, call audio, and scrape full contact lists.
replyJust off the top of my head.
That's scary from a user perspective, but harder to monetise at scale as an attacker. Proxy endpoints are just another commodity (and offer recurring revenue).
replyIf you infect tens of vehicles that's not that valuable. But if you infect ten thousand vehicles, convinced a trusted member of one of the bigger black hat forums it's real and have him vouch for your marketplace post, there should be some buyers for full movement profiles, call logs and address books of ten thousand people
replyAnd doing that doesn't really interfere with also setting up and selling proxy endpoints
Yeah, especially since most of these are already available for purchase from data brokers.
replyThey're called data brokers because they have a buy side, too. That might be peanuts to you, but to an AliExpress seller, it could be most of their profit.
replySome head units (working with a 1st party one atm) have two networks: OEM-paid (unlimited data) and user-paid. A 3rd party apk would be consuming all bought traffic quite soon.
replyAlso typical Android permissions still apply. The user would need to grant the malicious app contacts, call logs, etc permissions.
It seems like this exploit is targeting those that keep their phones tethered for connectivity outwards or hooked a USB modem or a SIM card into a cell-equipped headunit.
replyThe only valuable thing there is the relatively 'clean' mobile connection... and this malware's dropping a residential proxy endpoint on the headunit to take advantage of it. Bonus points if the headunit is always connected and always powered up to a +12v rail in the car, that's free and always-on real estate!
Head units aren’t always-on. Typically they go into a low power standby 2-5 minutes after ignition / accessory mode turns off, and go completely power-off 30-ish minutes later.
replyOtherwise any car sitting unused for a week or two would have a dead battery.
I'm pretty certain my car could go months running Android in low power mode just from the 12v battery, never mind the traction battery. But no, they had to have the head unit boot on every start and everything is slow for a minute, especially since the last update. These people can't code for shit.
replyI learned that not all electronics goes into low power mode even when designed to run off a car battery, from using a cheap Bluetooth OBDII dongle.
replyA lot of older cars didn't turn off their OBD port, have their headunits go into standby, or even turn off the cigarette lighter port. Early OBD ports connected to dealer computers for a few minutes, not an always on dongle. Plain headunits just play music, what could they possibly accomplish by staying on when you turn off the car? It was a convenience having the cigarette outlet left powered so you could light a cigarette without turning on the car. Other than maybe a bag phone, what would you possibly plug into that?
replyIf that was one of those ELM327 dongles, yes they have 12V and are known to drain your battery. They're only meant for short diagnostic runs.
replyThey are always wired to battery power though. The point is that it could look powered off, and still be running a proxy.
replyYou would hope that the ignition switch really cuts the power to the head unit when it is switched to off.
replyNo you wouldn’t, because then you always have a cold boot of the headunit, even if you just accidentally hit the ignition. Users want the head unit to resume within a few seconds. Just like their phone.
replyThat’s why head units stay in low power mode for 30ish minutes when you turn off the car.
replyThey do not stay in low power for weeks. Car batteries are really not that big, and cranking an engine takes some amps. I had a Subaru crosstrek that was recalled because their cellular modem was drawing IIRC 10ma 24/7, which would kill the car if it sat 3 or 4 days.
Some of these Android units also double as DVRs and dashcam recorders (parking mode!) as well so may be hooked onto the normal +12v rail.
reply