2

I have an older cheapo JVC car stereo with bluetooth. I used an app to check for Blueborne vulnerability ("Blueborne Vulnerability Scanner," no longer available) which said the stereo was high risk. It is very unlikely to get any kind of software update to protect against Blueborne, due to its age. (I don't know if they even built in a way to update firmware.) It has no network connection except the bluetooth, but it does have permission to access my phone's contacts, phone and call history. The stereo has the option to run Pandora and iHeartRadio, but I have never set up the internet connection that would be necessary for those to work.

Clarification: This stereo is an aftermarket module that doesn't interact with the car in any way except receiving power, driving the speakers, and detecting the headlights on/off status through a dedicated line tat older cars have for that single purpose. I am not concerned about blueborne compromising my car - just my phone.

Question: Is it possible that someone could inject malware into my phone via an attack on the stereo? Is it realistic?

  • @TripeHound Thanks - fixed – Adam Jun 18 at 5:06
1

It's possible, but it would depend on a lot of factors: Most cars have two different processing units - one for the music system itself and a second for the car's internals - brakes, gauges etc. In many cars, there's no connection between the main audio player and the car itself - just power cables. This makes it possible for you to replace the music system that your car shipped with with another one. In this case, it's also likely that there won't be any external control for the music system's controls - this means no controls for volume on your steering wheel etc.

However, in the off chance that your manufacturer has your car rigged up to a central processing unit, and has all the devices in the car controlled by it, there's a pretty good chance that someone could really mess your car up by exploiting the Bluetooth vulnerability. Even if they aren't able to execute commands remotely, a DoS condition in a vehicle that you put your life in isn't very comforting.

So to summarize:

  • Look out for any connections between the player and the car's systems themselves. You can do this by just checking to see if you can control the car from your music player or the player from controls that are not directly on it.

  • If you can, physically remove the unit from its dock and check to see if there's any wires that aren't just supplying power. If there are, they mostly go to your car's internal processor and are likely a threat.

  • 1
    related reading: An attack on a car using a malicious audio file burned onto a CD in the car’s stereo. wired.com/2014/08/car-hacking-chart – iainpb Sep 13 '17 at 8:55
  • 3
    Seems that the question is about hacking into a paired phone via the insecure bluetooth, not about hacking into the minimally-connected car. – sq33G Sep 13 '17 at 9:21
  • This is an interesting answer, and I appreciate it, but @sq33G is correct that it doesn't really get at the question of whether my phone is at risk, – Adam Sep 13 '17 at 14:21
1

In theory, everything is possible.

In practice, the way your phone and your car stereo communicate is normalized throught bluetooth profiles.

For example, my bluetooth headset have the following bluetooth profiles implemented:

UUID: Headset                   (00001108-0000-1000-8000-00805f9b34fb)
UUID: Audio Sink                (0000110b-0000-1000-8000-00805f9b34fb)
UUID: A/V Remote Control Target (0000110c-0000-1000-8000-00805f9b34fb)
UUID: Advanced Audio Distribu.. (0000110d-0000-1000-8000-00805f9b34fb)
UUID: A/V Remote Control        (0000110e-0000-1000-8000-00805f9b34fb)
UUID: Handsfree                 (0000111e-0000-1000-8000-00805f9b34fb)

I guess profiles implemented by your car radio are slightly the sames. You can see profiles more or less like protocols: it defines a common languages between devices to be able to interact.

Being able to spawn malware from the radio to the phone would, at first looks impossible since:

  • Implemented profiles don't necessary allow it (but i'm not a bluetooh expert, may be you should check better).
  • There's no profile implemented to "push" some files or something similar (same remarks as previous: i'm not an expert ;-))

Moreoever, have a "generic" attack (for Android 4, 5, 6, 7, iOS XX, ...) would be very complicated and maybe impossible to implement on a hardware very limited like an car radio...

To finish, at least using Android (i don't own any i-device), you can select which informations and which "profiles" you want to enable for a given paired device.

Given all this, i would answer your question with a "no at 90%" :-)

Nevertheless:

  • a threat in a profile remain "possible".
  • I remembering reading in the past some reports about a "hidden profile" on some phones that allowed too much stuff (ie: taking full control using the AT command set).

Unless you're an dangerous terrorist or hacktivist, i would tell you're ok :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.