Can sending a hidden Text/SMS messages be considered a security issue?

Question

tl;dr: My Toyota Aygo sends Text/SMS messages through Bluetooth and my mobile phone. These messages are delivered to the recipient, but there is no sign of them in my Messages app.

Should I be concern? Is this some kind of security issue?

---

My car (Toyota Aygo 2019+), when connected with my phone (Motorola Moto Z2 Play) through paired Bluetooth connection, is able to send "hidden" Text/SMS messages. That is:

• message is written and sent by me through car's navigation panel,
• the fact that message was sent is confirmed on panel's screen and
• message is delivered to the recipient, but
• there's no sign of that message on my phone.

It is like that -- when browsing through history of the messages sent by me to a particular recipient, I can see messages sent from by me, from my phone only, i.e.:

• all the messages sent before any message sent by Toyota and
• all the messages sent after any message sent by Toyota, but
• no message ever sent using Toyota's panel, through Bluetooth.

At first, I thought that this is a bug in Toyota and car isn't actually send anything (despite confirmation message). But then I have realised that messages are actually sent and delivered.

I understand that this could be caused by a variety of factors:

• bug in Toyota's implementation of Bluetooth protocol*,
• bug in Messages application on my Motorola,
• some technical issues at my mobile carrier side,
• bug in Android 7 (?),
• bug in Bluetooth protocol (???) etc.

But, still... shouldn't I be concerned that (at a high level) something is able to send Text/SMS messages through Bluetooth and my phone without me knowing anything about that fact?

I have, of course, contacted Toyota support, but I have got only a template-like answer that their implementation of Bluetooth is as close to standard as possible, but even so they cannot assure that any Bluetooth-enabled phone is compatible with their cars.

I have contacted my mobile carrier, but I have got even worse answer in "never heard of" style.

^{*Unfortunately, I do not have any other Bluetooth device, capable of sending Text/SMS messages, to verify whether this is caused by Bluetooth protocol or Toyota's implementation of it.}

Answer 1

What happens is that your phone "exports" a modem. This is visible via Bluetooth and can be programmed using AT commands (in this case, AT+CMGW).

And those can be used by the SMS App to send SMSs, and also by the Toyota to do the same.

This can be done by any device that is paired (trusted) and has access to the Bluetooth stack.

Since SMSs are not stored by the modem but by the app, you won't see any messages from any app from any other app (unless the two apps "agree" to a protocol and store messages where they both can access them).

Checking what was done by such applications is probably possible but would require a specific utility to do so.

To verify that no unknown stranger is abusing your radio modem console, you need to not pair with any untrusted device, ever, and periodically verify what devices your phone has paired with.