alt.hn

8/23/2026 at 1:05:38 PM

Malware infects Android-based automotive head unit firmware

 https://securelist.com/android-head-unit-malware/121106/

by campuscodi

8/23/2026 at 2:11:27 PM

The article does not make it particularly clear, but the malware in question is delivered through official first-party OTA updates on cheap Chinese aftermarket head units that happen to run Android. It cannot self-propagate to any Android-based head unit, nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit. This seems to be a very similar situation to that of cheap generic Android TV streaming boxes, which often come pre-infected from the factory with residential proxies and other malware as well; most of the infrastructure is likely shared.

by spicyjpeg

8/23/2026 at 6:53:46 PM

Why do they gloss right over how this was distributed? Barring details of any other kind of exploit we would have to assume the vendor's update server was compromised? If so why don't they just say so.

by ghostly_s

8/24/2026 at 4:44:14 AM

Cheap Android phones and tables often have built-in advertisement from manufacturer. One example of such software, it creates a window with Google Ads on top of browser window. The window is shown only when the browser is active to make it look like the ads is a part of the site. The ads appears only couple weeks after activation so that the user thinks it is a result of installation of some app and Youtube reviewers do not notice existence of malware. The adware consults a remote config which defines in what countries it should work. Another adware component automatically downloads and re-installs it if it is deleted.

I found all these details through examining the official firmware image and reverse engineering.

I don't remember if I reported Google Ads id to Google. It is interesting that Google doesn't notice and care about such use of their products.

by codedokode

8/24/2026 at 3:40:03 AM

> we would have to assume the vendor's update server was compromised

You say "compromised". I say "monetised".

:sigh:

by bigiain

8/23/2026 at 7:53:45 PM

To avoid charges of libel.

by supriyo-biswas

8/23/2026 at 8:51:24 PM

In America its not libel if it's true

by wbl

8/23/2026 at 9:21:14 PM

I see nothing at a glance about the author (Dmitry Kalinin) being American, so I can't imagine that is relevant.

by apublicfrog

8/23/2026 at 11:41:24 PM

there is the problem. We don't know what country is in question. There are some countries where the truth is not a defense against libel. Thus, depending on where the author is from, or for that matter the publisher or other people who might happen to be in the chain, there could be a libel case if the truth was stated.

by bluGill

8/24/2026 at 8:41:36 AM

> There are some countries where the truth is not a defense against libel

Germany, for example. Utterly bizarre and baffling that a democracy protects its politicians this way. /s

by scoot

8/24/2026 at 4:02:47 PM

It's important for people to be able to critize elected officials.

by wbl

8/23/2026 at 2:25:46 PM

Indeed this is an odd disclosure and I am not familiar with past posts by them.

Moreover, no CVE is associated with this claimed vulnerability. It's not even stated which Android version or automotive head-unit variant version is affected.

by manbash

8/23/2026 at 2:57:20 PM

https://en.wikipedia.org/wiki/Kaspersky_and_the_Russian_gove...

by _joel

8/23/2026 at 7:03:36 PM

Oh, I see I'm getting downvoted by the Russian bots, quelle surprise.

by _joel

8/23/2026 at 3:10:02 PM

[flagged]

by p-e-w

8/23/2026 at 3:46:24 PM

Wikipedia's source policy makes it nearly impossible to refer to anything that is not in the media, and any sensitive article has to use weasel words like this. Are you just noting the issue with the article, or actually doubting that Kaspersky Labs is a de-facto FSB branch since at least 2015?

by orbital-decay

8/24/2026 at 4:13:39 AM

Up until 2015 all was good with Kaspersky. But then in February of that year they posted a detailed writeup on malware created by the Equation Group, the NSA. [1] Within a month US media outlets, relying on anonymous sources, began posting endless claims that Kaspersky was a part of the Russian government. Over the next years Kaspersky opened a bunch of 'transparency centers' offering full code audits and inspection, relocated their core infrastructure and customer data to Switzerland - subsequently falling under their data regulations, and so on.

And if they were in any way affiliated with the Russian (or any) government, there seems no logical reason they'd publicly share their findings of the NSA malware, let alone the other transparency actions. Their data would be vastly more valuable if kept secret, because it'd open the door to greater exploitation of US cyber activities and being able to covertly secure desired systems. Instead their actions benefited everybody, but obviously embarrassed the NSA and as a result the US.

[1] - https://media.kasperskycontenthub.com/wp-content/uploads/sit...

by somenameforme

8/24/2026 at 6:53:22 AM

KL is a credible shop, they basically founded the modern anti-malware industry and pioneered most basic techniques in the 90's and early 2000's, together with some of their then-rivals like Dr. Web. There's a reason they were trusted, and there's a reason they tried to deny their takeover, they have a genuinely earned reputation.

This doesn't mean they aren't a FSB branch, in the same way e.g. NSO Group is a Mossad branch, with one difference that KL sell themselves as defensive and NSO Group doesn't. It was confirmed by KL employees in their socials that the management has been largely taken over by actual FSB officers. Some have left the company out of protest because they felt it's getting raided (отжим in Russia is not like your usual corporate takeover...). It's impossible to link it now as most of these people are living abroad since 2022 or earlier and either removed all their stuff or their socials entirely, some have renounced their citizenship by this point. But as a general rule, assume every important business in Russia is taken over by the government since 2022, either directly or indirectly. In 2026, whitewashing Kaspersky Labs of all companies is weird.

>But then in February of that year they posted a detailed writeup on malware created by the Equation Group, the NSA. [1] Within a month US media outlets, relying on anonymous sources, began posting endless claims that Kaspersky was a part of the Russian government

There was also a war happening, which you aren't saying.

>Over the next years Kaspersky opened a bunch of 'transparency centers' offering full code audits and inspection, relocated their core infrastructure and customer data to Switzerland - subsequently falling under their data regulations

The audits are to check the checkboxes, they mean very little. Plenty of former Russian companies that moved abroad are keeping ties with the developers at home, despite all audits, fronting campaigns, and otherwise pretending they aren't (not all though, others did actually migrate).

>if they were in any way affiliated with the Russian (or any) government

I mean, YK himself is KGB and there are no former ones, as they say. KL is one of the main government cybersec contractors, for starters. In a country where the government controls most of the economy they are producing critical industrial security systems like data diodes and secure gateways with their own OS, you can go to their site and look at all this yourself.

Cybersec industry in general is heavily affiliated with their respective governments, I don't think it's a secret for anyone and denying this is just silly. Some of them are more than others.

>there seems no logical reason they'd publicly share their findings of the NSA malware ... Their data would be vastly more valuable if kept secret, because it'd open the door to greater exploitation of US cyber activities and being able to covertly secure desired systems.

What? This doesn't make any sense, sorry. Security agencies usually publish or leak actions of their adversaries.

>Instead their actions benefited everybody

Did their inaction benefited anyone? RuNet which has been great got basically destroyed and turned into a safe haven for half of world's cybercriminals on their proud watch, and they aren't writing anything on this. They serve as part of their "roof".

Note I'm not saying they aren't doing good things, you're right, it's pretty good when the spooks keep each other and cybercriminals in check, see the article in OP, Apple's hardware backdoors (Operation Triangulation), and many other cases.

by orbital-decay

8/23/2026 at 3:57:58 PM

FSB? Oh you mean Russian “Federal Security Service” ?

by atmosx

8/23/2026 at 5:17:42 PM

It's been a while since I thought about Front Side Bus

by _joel

8/23/2026 at 5:36:22 PM

As it says in the first line of the WP article: "Federal Security Service (FSB)"

by jibal

8/23/2026 at 5:42:11 PM

The article is about a controversy involving allegations. There is plenty of evidence presented that the controversy and the allegations exist. (And if you dig into the links, there is plenty of evidence that the allegations are not without basis.)

> “sources said”

Yes, that's how Wikipedia works. https://en.wikipedia.org/wiki/Wikipedia:Neutral_point_of_vie...

by jibal

8/23/2026 at 3:38:09 PM

Welcome to Wikipedia

by DaSHacka

8/23/2026 at 5:27:45 PM

This makes me think whether the whole chain is an intelligence side business — sell cheap electronics for profit and at the same time own them too.

by markus_zhang

8/24/2026 at 5:12:22 AM

Interesting how there is possibly a new category of residential proxy malware “automotive proxy malware”

by camkego

8/24/2026 at 2:39:42 PM

This is just another mobile device. It even has a SIM card.

by dolmen

8/23/2026 at 3:09:56 PM

> nor does it affect Android Auto which is a "dumb" screen mirroring protocol with the bulk of the software running on the connected phone rather than the head unit

Huh, how does that work anyway? And while we're at it, Apple CarPlay as well? Both can run wirelessly via Bluetooth, but BT is nowhere near capable enough to stream full bandwidth video?

by mschuster91

8/23/2026 at 4:00:14 PM

Wireless AA and CarPlay use a hotspot your car emits that your phone connects to and transfers the image/inputs/audio that way

by 306bobby

8/24/2026 at 9:00:08 AM

Got into a weird situation recently where my cheap android head unit was displaying Car Play from my phone, but (Google Maps) audio from my partner's.

Directions weren't coming from my phone's speaker or the car, but testing audio in the Maps app did (from the car).

Still not sure what combination of connections it had managed to get itself into!

by scoot

8/23/2026 at 3:24:44 PM

Wireless CarPlay uses Bluetooth to exchange SSID and key info before switching over to WiFi for the duration of the session.

by m-s-y

8/23/2026 at 7:17:35 PM

Wow that's cursed, never realized that's how it worked.

by NewJazz

8/23/2026 at 9:40:46 PM

Cursed is exactly how I would describe it - because it works great until it doesn’t and it of course gives you zero clue why it won’t connect.

by xp84

8/24/2026 at 2:04:20 PM

Anecdotally, I just got back from a holiday trip across Europe and crossed four international borders. At every single border crossing, my CarPlay session disconnected, and I had to toggle CarPlay off and back on in my phone settings to reconnect. Very strange, and I still have no idea what caused it.

by NLMichel

8/23/2026 at 11:43:21 PM

It's a good idea actually, but it's also really complex to get right.

Early version of Android Auto could transfer over USB 2.0 instead of Bluetooth, which works, but it's not near as high bandwidth.

by bluGill

8/24/2026 at 8:15:09 AM

> Early version of Android Auto could transfer over USB 2.0 instead of Bluetooth, which works, but it's not near as high bandwidth.

This sentence doesn't make much sense - Auto (and CarPlay) still work in wired mode over USB 2.0 if the head unit supports it. They never worked over Bluetooth.

(And they use less than 15Mbps so USB 2.0s 480MBps are more than enough)

by izacus

8/24/2026 at 11:10:47 AM

They use Bluetooth to configure WiFi. Most people call that Bluetooth, but technically you are correct.

by bluGill

8/23/2026 at 3:21:15 PM

The way I understand it, the connection is negotiated via BT, but then wifi is used for the fat data pipe to run the display.

by dhc02

8/24/2026 at 2:55:11 PM

My car requires wired connectivity (USB) for Android Auto.

by dolmen

8/24/2026 at 8:59:57 PM

For a decent amount of the older android / CarPlay usb implementations - you can also buy little WiFi / USB dongles that perfectly enable wireless CarPlay - I’ve used them now on a few vehicles and they have been perfect !

by 3guk

8/23/2026 at 4:38:49 PM

They didn't run over BT. BT is used to initiate communication and share the password to a wifi-network. It then uses that Wi-Fi network for most communication, keeping the BT channel strictly for telephony.

by alphager

8/23/2026 at 3:34:58 PM

I thought the latest Bluetooth protocols were basically designed to hand off to an ad-hoc Wi-Fi connection between the two devices after the initial handshake. (Might be an oversimplification of the real protocol)

by StilesCrisis

8/23/2026 at 7:39:47 PM

It uses Bluetooth to stream audio, but everything else happens through a WiFi connection exposed by the car that the phone automatically pairs with after the Bluetooth handshake.

by iamjackg

8/24/2026 at 3:03:58 AM

Not sure about CarPlay, but Android Auto connects via wifi to the head unit for the video feed.

by russelg

8/24/2026 at 2:05:48 PM

Not sure about carplay, but Android Auto wireless uses wifi for the video stream.

by deaton

8/23/2026 at 4:48:11 PM

They actually run over WiFi (WiFi direct IIRC) - Bluetooth is mostly just used as a setup handshake and to help the head unit decide which phone in the car should be the one connected.

by izacus

8/23/2026 at 4:40:14 PM

> It cannot self-propagate to any Android-based head unit

Article does not say that.

by chrisjj

8/24/2026 at 12:51:16 AM

So? spicyjpeg is pointing out what is true, not just regurgitating TFA.

by jibal

8/23/2026 at 4:56:57 PM

Headline really quite clearly implies it, though. I think the correction is apt.

Bottom line is that lots of HN commenters here, as is our wont, will see this as a platform bug with a hated rival and not a bad third party integration that introduced vulnerabilities.

Like, if it was a Linux-based edge system from some fly-by-night contractor, would you be OK with a headline like "Malware infects Debian based refrigerators"? What'd Debian do?

by ajross

8/23/2026 at 6:32:20 PM

It’s no different than how the old Ford Sync or something else could have been compromised.

The two big things here in my mind are:

1. Android Automotive has gotten very popular since it provides so much and writing your own OS is very very hard and expensive as so many car makers found out

2. Aftermarket head units often use it (see #1) so it’s likely far easier to get out there than if you had to compromise Ford/VW/Volvo/whoever

by MBCook

8/23/2026 at 7:51:10 PM

This is not Android Auto though, which is an entirely different product suite designed to connect a OEM infotainment system to an Android device owned by the vehicle operator. That protocol is proprietary, Google-owned and managed, not part of AOSP, and not available to the integrator of the software in question.

The actually vulnerable system is a custom vehicle head unit that merely happens to be running a software stack based on AOSP. It's not even "Android" in a product marketing sense.

Again, it's like blaming Debian because some loon stuffed it in a wifi NAS or whatever and put a backdoor into their UI. It's insane.

by ajross

8/23/2026 at 9:23:18 PM

Do you mean Android Automotive?

by MBCook

8/23/2026 at 4:17:40 PM

It cannot self-propagate to any Android-based head unit

Remember that not that long ago viruses spread through floppy disks.

Today, people share USB sticks full of music from one car to another all the time. They also bring their music from their home car to a rental car and back.

by reaperducer

8/23/2026 at 9:36:54 PM

I’ve never met anyone irl who used USB sticks full of music. I know the capability is there in most cars, just never seen it. It seems like Bluetooth capability and Spotify/Apple Music landed in mainstream cars too soon after “play MP3s from USB” was added, for that to catch on.

by xp84

8/24/2026 at 2:16:40 AM

I did it for a few years, back when I had a new car with the capability but not a phone with a good mobile data plan.

It had the benefit of an information center with physical buttons too, so I could navigate around my library without touch screen madness or voice commands constantly failing to understand band and song names.

by zdragnar

8/24/2026 at 12:10:24 AM

> I’ve never met anyone irl who used USB sticks full of music.

I've been doing it for years, since it's so much more convenient than the alternatives: plug the stick into my car and I have my whole music library there and it Just Works.

by pdonis

8/24/2026 at 2:51:40 PM

We haven't met yet.

We use an USB key full of audio books: Harry Potter saga and The Quest of Ewilan among others. The whole family is hooked.

The car UI is much more reliable (no phone to unlock by the copilot, no Bluetooth disconnect). The phone battery is spared for navigation purposes.

by dolmen

8/24/2026 at 1:10:26 PM

I have 256GB of FLAC in my car, and it's great.

by creaturemachine

8/23/2026 at 11:19:16 PM

My hand is raised. I like having 8GB of music on an old (USB2 is fine) flash drive in my car as a fallback. On longer trips I'll hookup the Android Auto, but if I don't need maps and it's a quick ride, shuffle & repeat all enabled on the USB source.

Sure beats the radio, which plays 2 songs and then 5 min of commercials/sweepers, and has the gall to run ads on the HD text transmission on FM designed for song information.

by briHass

8/23/2026 at 4:31:20 PM

Most people just bring their phone between cars for music.

by charcircuit

8/24/2026 at 12:13:08 AM

My phone is much clunkier to use for this than a USB stick. Plus my phone can't store my whole music library (because there's too much other stuff already on it), whereas a single USB stick does it easily with plenty of room to spare.

by pdonis

8/24/2026 at 4:04:05 AM

Phones can access the whole internet. A USB stick can't stream Spotify or connect to the cloud.

by charcircuit

8/24/2026 at 1:58:07 PM

Which doesn't matter to me since the music I'm talking about is music I already have on the USB stick (because it's music I've collected over years and years of buying CDs, mostly before ways of streaming music over the Internet even existed), and I mostly want to listen to that. If I want something else, I can just use XM radio.

by pdonis

8/24/2026 at 2:52:47 PM

You'll be surprised, but some places where a car can go have no phone connectivity.

by dolmen

8/23/2026 at 1:30:12 PM

> Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the device to recruit it into a botnet

People do pair them with their phones, though. I could imagine a future version of malware like this propagating laterally.

by Retr0id

8/23/2026 at 2:21:03 PM

Almost, though I understand I am the exception rather than the rule: Personally I have an aftermarket android head unit since the standard one was incredibly basic, no real time navigation updates, updating maps was a pain in the ass and so on. Initially I did pair it with my phone but since it is an aftermarket unit from a company which apparently does not exist anymore, newer phones cannot be paired with it. So my only option was to go the opposite route and use my phone as a wireless hotspot(almost - there's a raspberry pi with openwrt between the two). And since I self-host everything, I had no choice but to hook it up to my vpn. That said, I understand the implications of doing this so ultimately the network access it gets is incredibly limited: everything that is not my music server and the maps provider has been cut off completely. The downside is that every now and then I get a "can't connect to google services" notification though that is technically reassuring from a security perspective.

by axegon_

8/23/2026 at 6:48:31 PM

Some automakers like Nissan bring their own 4G SIM, which makes the pairing of phone not important, as the head unit can access Internet by itself

by madduci

8/23/2026 at 11:47:05 PM

How long until the 4G networks are turned off? There are a lot of cars that have a 3G sim or even a 2G sim. They can do nothing because those networks have been turned off.

At least I'm not aware of any car where they updated the radio in the car when the network got turned off. By contrast, I work for John Deere and just down the hall from me are people who made a ton of money when the 2G network got turned off because a lot of customers paid $1,000 upgrade to a newer radio. I think most people would agree that there is no future that their car radio does that is worth paying money to upgrade when the cell network turns off. At John Deere, we're lucky that we have found pictures that customers find valuable enough that they are willing to pay to upgrade the radio when it goes obsolete.

by bluGill

8/24/2026 at 4:41:44 AM

> How long until the 4G networks are turned off? There are a lot of cars that have a 3G sim or even a 2G sim. They can do nothing because those networks have been turned off.

There's a good chance it will last longer than 3G. 5G was designed to coexist with 4G so a 5G base station can (optionally) use a 4G compatible beacon and use 4G for some timeslots and 5G for others. Even if 6G doesn't do the same, 4G can live until 5G is turned off. 2G and 3G needed a whole channel allocated, which was too much in the US anyway. I understand in some countries they turned off 3G but left one channel of 2G for industrial/embedded devices; maybe one channel per network or maybe one channel that all networks could roam to ... roaming seems more permissive outside the US, too.

by toast0

8/24/2026 at 11:09:51 AM

3g was turned off long ago, 2g is now disappearing worldwide. I decline to speculate how how long they will keep that theoretical 4g active as devices using it disappear

by bluGill

8/23/2026 at 8:51:41 PM

Keep in mind however that the 4G SIM is not there for the driver's benefit, but for Nissan's. It collects extremely invasive telemetry that is then sold to data brokers and consumed by car insurers and government agencies, among others. This is why I won't drive a car that I own without first removing the onboard modem.

by drnick1

8/24/2026 at 4:44:44 AM

Exactly and with the malware is much worse

by madduci

8/24/2026 at 1:17:14 PM

[dead]

by Telaneo

8/24/2026 at 3:00:48 PM

Also cars are often near other cars. Which offer wireless connectivity. Car software is almost never updated and is years old.

Nothing could go wrong.

by dolmen

8/23/2026 at 6:52:22 PM

"Pairing" with a head unit is not an open socket to dump anything you care to down the wire. That would require finding a rather remarkable vulnerability in one of the audio/address book/screen mirroring APIs the devices use.

by ghostly_s

8/23/2026 at 6:55:10 PM

Bluetooth RCEs have happened in the past and will happen again.

by Retr0id

8/23/2026 at 1:37:11 PM

Head units can log location, navigation start and end points, call logs, call audio, and scrape full contact lists.

Just off the top of my head.

by buckle8017

8/23/2026 at 1:38:28 PM

That's scary from a user perspective, but harder to monetise at scale as an attacker. Proxy endpoints are just another commodity (and offer recurring revenue).

by Retr0id

8/23/2026 at 2:16:31 PM

If you infect tens of vehicles that's not that valuable. But if you infect ten thousand vehicles, convinced a trusted member of one of the bigger black hat forums it's real and have him vouch for your marketplace post, there should be some buyers for full movement profiles, call logs and address books of ten thousand people

And doing that doesn't really interfere with also setting up and selling proxy endpoints

by wongarsu

8/23/2026 at 1:47:54 PM

Yeah, especially since most of these are already available for purchase from data brokers.

by stymaar

8/23/2026 at 2:24:21 PM

They're called data brokers because they have a buy side, too. That might be peanuts to you, but to an AliExpress seller, it could be most of their profit.

by Zigurd

8/23/2026 at 5:56:36 PM

Some head units (working with a 1st party one atm) have two networks: OEM-paid (unlimited data) and user-paid. A 3rd party apk would be consuming all bought traffic quite soon.

Also typical Android permissions still apply. The user would need to grant the malicious app contacts, call logs, etc permissions.

by carstenhag

8/23/2026 at 1:52:48 PM

It seems like this exploit is targeting those that keep their phones tethered for connectivity outwards or hooked a USB modem or a SIM card into a cell-equipped headunit.

The only valuable thing there is the relatively 'clean' mobile connection... and this malware's dropping a residential proxy endpoint on the headunit to take advantage of it. Bonus points if the headunit is always connected and always powered up to a +12v rail in the car, that's free and always-on real estate!

by kotaKat

8/23/2026 at 2:01:26 PM

Head units aren’t always-on. Typically they go into a low power standby 2-5 minutes after ignition / accessory mode turns off, and go completely power-off 30-ish minutes later.

Otherwise any car sitting unused for a week or two would have a dead battery.

by brookst

8/23/2026 at 2:27:16 PM

I learned that not all electronics goes into low power mode even when designed to run off a car battery, from using a cheap Bluetooth OBDII dongle.

by Zigurd

8/23/2026 at 10:14:30 PM

A lot of older cars didn't turn off their OBD port, have their headunits go into standby, or even turn off the cigarette lighter port. Early OBD ports connected to dealer computers for a few minutes, not an always on dongle. Plain headunits just play music, what could they possibly accomplish by staying on when you turn off the car? It was a convenience having the cigarette outlet left powered so you could light a cigarette without turning on the car. Other than maybe a bag phone, what would you possibly plug into that?

by wildzzz

8/24/2026 at 3:06:17 PM

> Other than maybe a bag phone, what would you possibly plug into that?

Car fridge is a thing.

by dolmen

8/23/2026 at 3:27:37 PM

If that was one of those ELM327 dongles, yes they have 12V and are known to drain your battery. They're only meant for short diagnostic runs.

by smilespray

8/23/2026 at 2:56:34 PM

They are always wired to battery power though. The point is that it could look powered off, and still be running a proxy.

by olyjohn

8/23/2026 at 5:36:50 PM

You would hope that the ignition switch really cuts the power to the head unit when it is switched to off.

by lmz

8/23/2026 at 5:57:58 PM

No you wouldn’t, because then you always have a cold boot of the headunit, even if you just accidentally hit the ignition. Users want the head unit to resume within a few seconds. Just like their phone.

by carstenhag

8/23/2026 at 11:23:18 PM

That’s why head units stay in low power mode for 30ish minutes when you turn off the car.

They do not stay in low power for weeks. Car batteries are really not that big, and cranking an engine takes some amps. I had a Subaru crosstrek that was recalled because their cellular modem was drawing IIRC 10ma 24/7, which would kill the car if it sat 3 or 4 days.

by brookst

8/24/2026 at 4:44:20 AM

Lots of head units will lose presets when they lose power.

by toast0

8/23/2026 at 11:23:44 PM

I'm pretty certain my car could go months running Android in low power mode just from the 12v battery, never mind the traction battery. But no, they had to have the head unit boot on every start and everything is slow for a minute, especially since the last update. These people can't code for shit.

by speed_spread

8/24/2026 at 4:45:49 AM

> I'm pretty certain my car could go months running Android in low power mode just from the 12v battery, never mind the traction battery.

Most traction batteries are behind a relay or something and won't be available for full time use...

by toast0

8/23/2026 at 3:32:07 PM

Some of these Android units also double as DVRs and dashcam recorders (parking mode!) as well so may be hooked onto the normal +12v rail.

by kotaKat

8/23/2026 at 2:05:52 PM

There are a lot of cars out there where the head unit has connection to the CAN bus. Which means this malware vector could be used to directly cause crashes. E.g. https://news.ycombinator.com/item?id=19751872

by dzdt

8/23/2026 at 3:10:08 PM

The car hacker's handbook [1] has a chapter on just using the infotainment system to access the CAN. Specifically mentions "attacking through the update system".

[1]https://opengarages.org/handbook/ebook/ (chapter 9)

by Ccecil

8/23/2026 at 2:33:36 PM

An aftermarket head unit connects to the CAN bus? The aftermarket head unit I installed certainly doesn't. Are you sure what you are saying, which is true for OEM units, applies to aftermarket ones?

by 01100011

8/23/2026 at 2:46:45 PM

Can't vouch for all car architectures, but in most cases the head unit is QM and safety domains are usually segmented from each other. So even if the head unit talks CAN (it needs to get car data somehow) it will only communicate with the rest of the car through a gateway that will not allow it to take any dangerous actions.

by RealityVoid

8/24/2026 at 12:06:06 AM

That's true for most cars, but some, particularly the older cars, they weren't as concerned about security as they should have been. And so sometimes the radio can talk to things that it probably shouldn't be able to talk to.

by bluGill

8/23/2026 at 2:46:06 PM

Mine does. Its dashboard shows fuel level and a bunch of other things and I can bring up a speedometer/rpm app.

I believe the connection exists because the steering wheel buttons/iDrive talk to the original head unit over CAN.

by karlshea

8/23/2026 at 4:20:25 PM

That’s wild, I’ve never run across a head unit that had me connect OBD2. I think I would just ignore that bit of the install instructions.

by rootusrootus

8/24/2026 at 12:44:21 AM

I did not connect ODB2. The HU I got puts itself as a passthrough to the stock BMW HU (which you still need to be able to use, you switch the screen to its output by holding down a button), and that connector includes CAN.

There are numerous reasons the HU needs CAN, for example to get the steering wheel angle to be able to draw the guides over the backup camera feed. Or to switch to the backup camera feed when you put the car in reverse.

by karlshea

8/24/2026 at 4:27:40 PM

It is really exposing the CAN bus, it is not some adjacent subsystem overlaying the steering guides and rearview video by interrupting the video signal? It's actually entirely coming from the aftermarket HU? That's fascinating! I wouldn't expect an aftermarket system to be too good at that functionality, guides tend to be carefully tuned for specific car/steering/camera combos.

Ideally most cars should be relying heavily on data diodes to minimize the risk of a bad actor wreaking havoc. I know for sure some cars (there was a Jeep example as I recall) don't do that, but I kinda wonder which ones do. It seems like a pretty obvious attack vector worth protecting.

by rootusrootus

8/24/2026 at 10:34:31 PM

As the other comment points out, if you've installed more than a few, you've definitly connected to the CAN bus.

Few headunits will ask you to connect to the OBD2 port for practical reasons, but the miscilanous manufacturer specific connectors you hook up often include CAN bus connections.

OBD2 port is just 1 of multiple ports with access to the network, even your headlights can be on the bus

by BoorishBears

8/23/2026 at 5:24:11 PM

> speedometer/rpm

This is available on standard OBD-II. Maybe, it is accessible over CAN?

by kanbankaren

8/23/2026 at 5:53:17 PM

My OBD-II connector has CAN-C (500kbit) and CAN-B (50kbit) - I use CAN-B primarily because I can control windows, doors, etc + get the speed & rpm.

by dx4100

8/23/2026 at 10:23:52 PM

The expensive ones do so you get more of an OEM infotainment experience. I guess you could potentially cause a crash over the CAN bus but there's a very small overlap between cars that allow you to swap out headunits and cars that can be controlled enough over CAN to cause a crash. Other than commercial vehicles, I don't think there are any new cars that have DIN stereos anymore.

by wildzzz

8/23/2026 at 5:52:21 PM

Many do - the one I was looking at for my vehicle in particular uses it to restore the steering wheel controls (which are broadcast over the CAN-B low speed bus)

by dx4100

8/24/2026 at 11:37:41 AM

I'm not aware of an aftermarket head unit that can't connect to CAN bus with the appropriate adapter (which are widely available).

by scoot

8/23/2026 at 2:50:19 PM

Manufacturers should be sued to absolute oblivion for doing what any developer would tell you is a security hole.

by jiaosdjf

8/23/2026 at 1:39:13 PM

For whatever reason, the idea of this being in my car is relatively scarier for me than if this was just my phone ?

I think partially as my mental model of both android auto and CarPlay is that they operate as a passthrough of my device rather than as an separate installation of the OS entirely (I wasn’t aware the head unit itself had the ability to install APKs independently).

Also, feel like John Gruber is going to have a field day with this one

by jackdecker

8/23/2026 at 1:57:15 PM

Android Automotive is the infotainment system’s OS and runs fully without a phone.

Android Auto is the Google equivalent of CarPlay and runs on your phone.

It’s easy to confuse. Like watching Apple TV on your Apple TV in Apple’s TV app.

by MBCook

8/23/2026 at 2:34:57 PM

So I can use android auto on an android automotive head unit - got it but also this seems needlessly confusing naming structure. Apple TV comparison is apt lol

by jackdecker

8/23/2026 at 10:36:15 PM

They are intended for different market segments. The consumers use Android Auto to project their phones. The headunit manufacturers build devices to run Android Automotive with custom skins. It's like knowing whether a smartphone running Chrome is using Blink or Webkit. The user probably doesn't know or care, they'll use it the same way regardless.

by wildzzz

8/23/2026 at 6:20:41 PM

It makes perfect sense in isolation. It’s a good name.

Unfortunately Android Auto already existed. So it’s confusing.

by MBCook

8/24/2026 at 12:08:03 AM

Normally you can use Android Auto on an Android AutoMorph head unit, however that's not required. GM regularly disables Android Auto on all their head units even though it's included in the base Android automotive OS.

I have such a car and I am so disappointed that I regularly tell people I would not buy another one and I would not recommend you buy a GM because they do that trip.

by bluGill

8/23/2026 at 2:30:34 PM

Did they hire their branding person from Microsoft? And how about AppFunctions (Google) and AppIntents (Apple)?

by Zigurd

8/23/2026 at 4:49:10 PM

How would you name them?

by izacus

8/23/2026 at 5:06:44 PM

Android Connect instead of Android Auto, and any word other than recycling the android app communication nomenclature "Intent." But hey I'm no branding genius so let's workshop this to close the loop.

by Zigurd

8/23/2026 at 1:52:35 PM

I don’t believe this is Android auto running from a phone, but a situation where the manufacturer have used Android Automotive as operating system for the built in head unit. As e.g. on Volvo’s.

by dybber

8/23/2026 at 2:05:46 PM

[dead]

by inquirerGeneral

8/23/2026 at 2:46:51 PM

"How has the automotive industry adapted to decades of computing best practices?"

- Head units connected to CAN bus with bluetooth vulnerabilities allowing attacker to remotely activate locks and windows and sometimes even driving controls

- Unsecured CAN bus cables everywhere allowing cars to be stolen through headlights and behind mud guard flaps

- Keyless entry basically a shit show of faraday pouches

- OBD port allowing thieves to clone a full key in seconds

- Even cars in decent neighbourhoods have to use steering locks

Sorry but this is a fucking joke and the automotive industry is cancer.

At least Tesla actually bothers with user updates and production improvements, most other manufacturers just shit out the same model 5 years in a row with an extra cup holder and USB port (probably rootable) if you're lucky. That said, Tesla's insistence that everything be done by touch screen is dog shit.

All this and still for 99% of cars my iPhone stuck to the dashboard provides better maps and entertainment and yet they can't even make a fucking phone holder standard, not even a fucking mounting point so I don't have to block an air vent.

by jiaosdjf

8/23/2026 at 3:30:07 PM

You had me until you started giving Tesla the thumbs-up, despite your caveat.

by smilespray

8/23/2026 at 5:40:51 PM

> "How has the automotive industry adapted to decades of computing best practices?"

Simple. It hasn't.

by Telaneo

8/23/2026 at 1:32:04 PM

The logical endpoint of the entire "the car as software" concept. Can't wait for the security vendors to start hawking "AV for your car"

by davoneus

8/23/2026 at 1:34:26 PM

I hope we see "de-smartification" conversion kits that replace the electronics with more straightforward (and repairable) offline equivalents. The ultimate AV.

by Retr0id

8/24/2026 at 4:28:52 AM

Don't see this happens any time soon.

Many feedback loops in modern car is software based and interconnected with each other.

Kits that works half as good without software would be very expensive to make.

by j16sdiz

8/24/2026 at 6:41:31 AM

I didn't say without any software at all.

by Retr0id

8/23/2026 at 3:17:47 PM

It's already in televisions. Not long now.

by doublerabbit

8/23/2026 at 2:38:52 PM

Can't be safer than the non-entertainment system from WV Up! that's just a built-in head mount for your phone. Grab one with a large screen and it's the safest thing you can get. Android still has an auto mode for this where it controls the car's audio system through headless bindings, not sure this malware would target this, but just by being a simpler system chances are it's safer too

by gchamonlive

8/24/2026 at 5:04:46 AM

Could these proxies be sold to AI companies for scraping websites?

by codedokode

8/23/2026 at 1:51:13 PM

..to add to a botnet for click fraud.

The duality of cybersecurity is interesting. Sometimes the high bar is cleared just to enable a low bar to go lower. Those PLCs monitoring water were ignored for a very long time because they couldn't click on ads. It took a war for them to become a target.

by 1970-01-01

8/23/2026 at 4:32:40 PM

> Those PLCs monitoring water were ignored for a very long time because they couldn't click on ads.

Somehow I doubt it. They're ripe for ransomware attack.

by chrisjj

8/23/2026 at 1:42:49 PM

One more reason cars should not be internet connected. They last for decades and manufactures don't want to support their cars that long. Always proxy to a phone and the attack surface is limited to things that are updated.

by bluGill

8/23/2026 at 1:58:49 PM

So to do this the attacker has to compromise the update servers at $CAR_COMPANY?

by MBCook

8/23/2026 at 2:57:13 PM

no, the update servers at $sketchy_aliexpress_aftermarket_head_unit_company, probably somewhat easier

by timmmmmmay

8/23/2026 at 3:33:11 PM

Concise and useful, rare combo

by hndbwksam7

8/23/2026 at 3:13:19 PM 

    Norton AntiVirus for your car ECU's. Protect your carfor just $220.95/month *
    * Cars without subscription causes acceleration to be restricted to 60mph.
After discovering the new OLED televisions come with antivirus, I'm done with thinking technology will ever be secure.

by doublerabbit

8/23/2026 at 5:50:04 PM

Even from this perspective, it's pretty easy to make things more secure by having less technology. Have the infotainment system just be a blank canvas for Carplay or AA to display on (there does need to be a bit back and fourth, phone needs to send audio to car, car needs to send GPS, speed and state of charge to phone (not strictly necessary, but there are user benefits from the phone having this information). The car itself doesn't need a whole internet-connected general purpose computer attached to it, but doing that is an easy way for the manufacturer to supposedly add value.

Similarly, the LG kerfuffle could be solved by their monitors just being monitors, and not throwing in pointless extras that just broadens their attack surface. Monitors don't need to be general purpose computing devices either. I shouldn't have to worry about general computing problems, like getting infected with malware, outside of computers that obviously are general purpose (i.e. phone, desktop, laptop, and anything else I intentionally set up with foreknowledge of it being general purpose and internet-connected, like a Raspberry Pi).

by Telaneo

8/23/2026 at 2:49:06 PM

I'd not consider it malware if its sole purpose is to do ad/click fraud. The user is not the target here, the user's enemies are :)

by zb3

8/23/2026 at 2:07:20 PM

Um so which car is this? tw.com doesn't seem to be in use.

by IshKebab

8/23/2026 at 1:43:39 PM

[flagged]

by miohtama

8/23/2026 at 2:25:12 PM

[flagged]

by promptspheree

8/24/2026 at 7:14:00 AM

[flagged]

by coachdaniel2026

8/23/2026 at 1:38:16 PM

[dead]

by lvbyte

8/23/2026 at 1:56:50 PM

[dead]

by sehw

8/23/2026 at 4:34:14 PM

this is crazy

by waazy

8/23/2026 at 3:16:00 PM

Apple's gatekeeping doesn't make IPhone users any safer.

by tiahura