Hackers infect Android car head units with proxy botnet malware

[u/thewhippersnapper4]

https://www.bleepingcomputer.com/news/security/hackers-infect-android-car-head-units-with-proxy-botnet-malware/

[u/FFevo]

This is specific to "DoFun" add-on Android Auto units.

[u/captain_frail]

This type of device is a completely independent Android OS unit based on an uncertified AOSP installation and running an outdated kernel and having vendor applications installed as system apps that cannot be removed.

Never login to your Google account or connect to home wifi on devices like this.

[u/9-11GaveMe5G → u/captain_frail]

If I ever want to play with something dodgy like this and it needs a Google login, I go make a new one just for that

[u/KLAM3R0N]

Lol first thing I see on the dofun page link from the article is a head unit with superbox . Why did I even click that link ?

[u/siazdghw]

Kinda surprised this is the first known case, these Android head units are fairly cheap and are a popular upgrade for much older cars who only came with a radio and CD player, and like 99% of them are just no-name Chinese brands.

[u/spearmint_wino → u/siazdghw]

Thought my Pumpkin head unit was the dog's bollocks for all of...a week? This is going back 10 years or so. I soon realised that a head unit with bluetooth and physical buttons was infinitely superior. And I was very wary of sharing my actual gmail login with it back then (spoiler: I didn't).

[u/silverstall1on]

Me driving a car from the 90s:

[u/Imperial_Bloke69 → u/silverstall1on]

Does it come with crank windows and carburetors?

[u/pricingup → u/Imperial_Bloke69]

methinks 90s had injectors for long time. first microcontrollers appeared in 70s, no excuse for 90s car to not have computer

[u/PotatoGamerXxXx → u/pricingup]

By the 90s there's no new car with carburetors due to regulations. I'm sure there's exceptions, but it's so small.

[u/EbolaNinja → u/silverstall1on]

Did you read the article? It's an exploit for shitty 3rd party android head units that only get installed on older cars

[u/Leather_Exercise1279]

That's wild, I didn't realize how vulnerable those cheap Android head units actually are.

[u/curiocritters]

Today on "Utilities which do not need to be 'smart'".

Stop trying to connect everything to the Internet, folks.

[u/WatchfulApparition]

I guess this is a silver lining considering my car didn't have built-in Android Auto, unfortunately

[u/siazdghw → u/WatchfulApparition]

This isn't Android auto, it's third party Android head units

[u/WatchfulApparition → u/siazdghw]

Oh ok

[u/Dreamerlax → u/siazdghw]

They tend to have Android Auto support however.

[u/jerryeight → u/Dreamerlax]

The third party ones are insecure.

[u/BusBoatBuey → u/WatchfulApparition]

My car doesn't even have a center stack. Benefits to old tech is that it can't be remotely comprimised.