upvote

points

by spicyjpeg8 hours ago |
comments
upvoteby ghostly_s4 hours ago|
next
[-]
Why do they gloss right over how this was distributed? Barring details of any other kind of exploit we would have to assume the vendor's update server was compromised? If so why don't they just say so.
reply
upvoteby supriyo-biswas3 hours ago|
parent|
[-]
To avoid charges of libel.
reply
upvoteby wbl2 hours ago|
parent|
[-]
In America its not libel if it's true
reply
upvoteby apublicfrog1 hours ago|
parent|
[-]
I see nothing at a glance about the author (Dmitry Kalinin) being American, so I can't imagine that is relevant.
reply
upvoteby manbash8 hours ago|
prev|
next
[-]
Indeed this is an odd disclosure and I am not familiar with past posts by them.

Moreover, no CVE is associated with this claimed vulnerability. It's not even stated which Android version or automotive head-unit variant version is affected.

reply
upvoteby _joel8 hours ago|
parent|
[-]
https://en.wikipedia.org/wiki/Kaspersky_and_the_Russian_gove...
reply
upvoteby _joel3 hours ago|
parent|
next
[-]
Oh, I see I'm getting downvoted by the Russian bots, quelle surprise.
reply
upvoteby p-e-w7 hours ago|
parent|
prev|
[-]
It’s astonishing how this relatively long article contains not a shred of actual evidence that any of this is true. It’s all “alleged”, “raised concerns”, “sources said” etc.
reply
upvoteby orbital-decay7 hours ago|
parent|
next
[-]
Wikipedia's source policy makes it nearly impossible to refer to anything that is not in the media, and any sensitive article has to use weasel words like this. Are you just noting the issue with the article, or actually doubting that Kaspersky Labs is a de-facto FSB branch since at least 2015?
reply
upvoteby atmosx7 hours ago|
parent|
[-]
FSB? Oh you mean Russian “Federal Security Service” ?
reply
upvoteby _joel5 hours ago|
parent|
next
[-]
It's been a while since I thought about Front Side Bus
reply
upvoteby jibal5 hours ago|
parent|
prev|
[-]
As it says in the first line of the WP article: "Federal Security Service (FSB)"
reply
upvoteby jibal5 hours ago|
parent|
prev|
next
[-]
The article is about a controversy involving allegations. There is plenty of evidence presented that the controversy and the allegations exist. (And if you dig into the links, there is plenty of evidence that the allegations are not without basis.)

> “sources said”

Yes, that's how Wikipedia works. https://en.wikipedia.org/wiki/Wikipedia:Neutral_point_of_vie...

reply
upvoteby DaSHacka7 hours ago|
parent|
prev|
[-]
Welcome to Wikipedia
reply
upvoteby markus_zhang5 hours ago|
prev|
next
[-]
This makes me think whether the whole chain is an intelligence side business — sell cheap electronics for profit and at the same time own them too.
reply
upvoteby reaperducer6 hours ago|
prev|
next
[-]
It cannot self-propagate to any Android-based head unit

Remember that not that long ago viruses spread through floppy disks.

Today, people share USB sticks full of music from one car to another all the time. They also bring their music from their home car to a rental car and back.

reply
upvoteby xp841 hours ago|
parent|
next
[-]
I’ve never met anyone irl who used USB sticks full of music. I know the capability is there in most cars, just never seen it. It seems like Bluetooth capability and Spotify/Apple Music landed in mainstream cars too soon after “play MP3s from USB” was added, for that to catch on.
reply
upvoteby charcircuit6 hours ago|
parent|
prev|
[-]
Most people just bring their phone between cars for music.
reply
upvoteby mschuster917 hours ago|
prev|
next
[-]
> nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit

Huh, how does that work anyway? And while we're at it, Apple CarPlay as well? Both can run wirelessly via Bluetooth, but BT is nowhere near capable enough to stream full bandwidth video?

reply
upvoteby 306bobby7 hours ago|
parent|
next
[-]
Wireless AA and CarPlay use a hotspot your car emits that your phone connects to and transfers the image/inputs/audio that way
reply
upvoteby m-s-y7 hours ago|
parent|
prev|
next
[-]
Wireless CarPlay uses Bluetooth to exchange SSID and key info before switching over to WiFi for the duration of the session.
reply
upvoteby NewJazz3 hours ago|
parent|
[-]
Wow that's cursed, never realized that's how it worked.
reply
upvoteby xp841 hours ago|
parent|
[-]
Cursed is exactly how I would describe it - because it works great until it doesn’t and it of course gives you zero clue why it won’t connect.
reply
upvoteby iamjackg3 hours ago|
parent|
prev|
next
[-]
It uses Bluetooth to stream audio, but everything else happens through a WiFi connection exposed by the car that the phone automatically pairs with after the Bluetooth handshake.
reply
upvoteby dhc027 hours ago|
parent|
prev|
next
[-]
The way I understand it, the connection is negotiated via BT, but then wifi is used for the fat data pipe to run the display.
reply
upvoteby alphager6 hours ago|
parent|
prev|
next
[-]
They didn't run over BT. BT is used to initiate communication and share the password to a wifi-network. It then uses that Wi-Fi network for most communication, keeping the BT channel strictly for telephony.
reply
upvoteby StilesCrisis7 hours ago|
parent|
prev|
next
[-]
I thought the latest Bluetooth protocols were basically designed to hand off to an ad-hoc Wi-Fi connection between the two devices after the initial handshake. (Might be an oversimplification of the real protocol)
reply
upvoteby izacus6 hours ago|
parent|
prev|
[-]
They actually run over WiFi (WiFi direct IIRC) - Bluetooth is mostly just used as a setup handshake and to help the head unit decide which phone in the car should be the one connected.
reply
upvoteby chrisjj6 hours ago|
prev|
[-]
> It cannot self-propagate to any Android-based head unit

Article does not say that.

reply
upvoteby ajross6 hours ago|
parent|
[-]
Headline really quite clearly implies it, though. I think the correction is apt.

Bottom line is that lots of HN commenters here, as is our wont, will see this as a platform bug with a hated rival and not a bad third party integration that introduced vulnerabilities.

Like, if it was a Linux-based edge system from some fly-by-night contractor, would you be OK with a headline like "Malware infects Debian based refrigerators"? What'd Debian do?

reply
upvoteby MBCook4 hours ago|
parent|
[-]
It’s no different than how the old Ford Sync or something else could have been compromised.

The two big things here in my mind are:

1. Android Automotive has gotten very popular since it provides so much and writing your own OS is very very hard and expensive as so many car makers found out

2. Aftermarket head units often use it (see #1) so it’s likely far easier to get out there than if you had to compromise Ford/VW/Volvo/whoever

reply
upvoteby ajross3 hours ago|
parent|
[-]
This is not Android Auto though, which is an entirely different product suite designed to connect a OEM infotainment system to an Android device owned by the vehicle operator. That protocol is proprietary, Google-owned and managed, not part of AOSP, and not available to the integrator of the software in question.

The actually vulnerable system is a custom vehicle head unit that merely happens to be running a software stack based on AOSP. It's not even "Android" in a product marketing sense.

Again, it's like blaming Debian because some loon stuffed it in a wifi NAS or whatever and put a backdoor into their UI. It's insane.

reply
upvoteby MBCook1 hours ago|
parent|
[-]
Do you mean Android Automotive?
reply