Why Android Auto scares me

For those who do not know, Android Auto, is a car information/entertainment system, that allows car owners to connect to their Android devices. Then, through the car’s dashboard unit, Android Auto provides access to compatible apps, as well as data and features on the device. Android Auto provides a means for users to answer and make calls using voice commands, receive and have messages read to them, dictate and send new messages, as well as access to the device’s maps and navigation. Android Auto is designed to minimize distractions for drivers, by providing a means for users to perform essential actions, without necessary taking their hands off the steering wheels, or their eyes off the road. It accomplishes this by using large widgets that can be easily touched without a need for high precision, voice assisted commands, and by offering apps a limited API set. After all, we don’t want drivers playing Flappy Bird while at the wheel. Talk about road rage! But I digress.

The manufacturers that have signed up to support Android Auto reads like a who’s who of the auto industry, and includes Abarth, Acura, Alfa Romeo, Audi, Bentley, Chevrolet, Chrysler, Dodge, Fiat, Ford, Honda, Hyundai, Infiniti, Jeep, Kenwood, Kia, Maserati, Mazda, Mitsubishi, Nissan, Opel, Pioneer, RAM, Renault, SEAT, Škoda, Subaru, Suzuki, Volkswagen and Volvo.

Without a doubt, Android Auto is a fantastic idea. Rather than drivers taking their eyes off the road, searching for their phone when it rings and trying to answer a call, all while driving with one hand, using Android Auto, the driver simply glances over at the dashboard, sees who is calling, and can answer or reject the call with a simple voice command as appropriate. Drivers can also have incoming messages read to them, as well as dictate and send messages. Another great feature of Android Auto is access to your media files, as well as streaming services. There is a lot to be excited about regarding Android Auto, and I was one of it’s biggest fans. However, a few recent developments have left me questioning the readiness of both Google and the car manufacturers. Recently, my disquiet has grown into outright fear at the prospect of Android Auto and the increased use of software in modern cars.

HackingTeam and RCS Android

But what is worse is that Hacking Team itself was hacked.

Hacking Team is a company based in Italy that sells intrusion and surveillance software to governments around the globe. Their software suite includes tools to compromise Windows, Macs, iOS and Android devices. For Android, they could gain control of a device through the installation of a seemingly innocuous app, that initially contains no malicious code. However, once installed, the app uses dynamic loading to download and execute their spyware payload. This spyware, called RCS Android (Remote Control System Android) has been described as the most sophisticated Android malware so far exposed. RCS Android can listen to and record conversations using the device’s microphone, capture screenshots and photos, record voice calls, track the device’s location, capture both WiFi and online account passwords, collect SMS, MMS, Gmail and IM messages, as well as device contacts. In addition, it can upload all this data to a command server, upgrade itself, gain root access, and uninstall itself.

It is scary enough that there is malware out there that can do all this, but what is worse is that Hacking Team itself was hacked, and over 400GB of company data was posted online. This data trove contains the source code for their apps, spyware, botnets, as well as company emails and other data. Thanks to Hacking Team, all this code is in the wild, and will be studied, modified, and used.

Stagefright (and others)

Stagefright, is a truly frightening Android vulnerability. It was discovered by Joshua Drake, a researcher from Zimperium’s zLabs. Drake discovered that a specially crafted MMS can be sent to a vulnerable Android device, and, before a notification is even shown, the device can be compromised. The Stagefright vulnerability uses the fact that by default, messenger apps automatically download MMS images.

It is estimated that approximately 95% (950 million) of Android devices where vulnerable at the time of it’s disclosure to the press. The 5% of devices not vulnerable are really old devices, running Android versions less than Android 2.2. Stagefright is every hackers wet dream, wherein a device is compromised completely remotely, without user interaction, allows an arbitrary payload delivery, and all traces of the hack can be completely wiped.

Although Drake has been in contact with Google regarding the vulnerabilities, and sent patches to Google as early as April 9th, Google Nexus devices (the poster children for fast updates and upgrades) are just getting patched five months later.

Although the Chrysler hack is the most recent, there has been a steady stream of car related software glitches in the past few years.

To compound the issue, there is CVE-2015-3825, discovered by IBM’s X-Force Application Security Research Team. It affects Android devices from 4.3 and above, including the as yet unreleased Android M version. An app with no permissions (yes you read that right), can escalate it’s privileges and become a super app, essentially owning the device (almost like Hacking Team’s app, but even more sinister). This covers about 55% of Android devices available today. Thankfully, this vulnerability is still under wraps, but we can only hope and pray that the bad guys haven’t found and/or are not currently exploiting it.

With Stagefright and RCS Android, an attacker could infect virtually every Android phone on the planet, without anyone noticing. In the movie Ex-Machina, Nathan (who owns a Google-type search engine) says he hacked every cell phone on the planet to get camera and audio. What should be just fiction, now doesn’t sound that far fetched any more.

Chrysler Hack and Ford Recall

Wired’s Andy Greenberg also had a run in with a couple of hackers, Charlie Miller and Chris Vasalek, who demonstrated their ability to compromise a Jeep Cherokee completely remotely. In case you are too busy to go read the full article, the hackers sent commands through the car’s entertainment system, and ordered the car to turn on it’s AC at maximum, changed the radio station, changed the dashboard display to a picture of themselves, turned on the windshield wipers, cut the car’s transmission and disengaged the brakes. Note that this was a car they had not modified in any way, and all the above was done over the internet, using a vulnerability in the entertainment system. Allow me to emphasize that, over the internet, hackers where able to cut the car’s transmission and disengage the car’s brakes.

While the researchers have been sharing their work with Chrysler over the past nine months, it doesn’t inspire much confidence in me as far as the future of connected cars go.

Although the Chrysler hack is the most recent, there has been a steady stream of car related software glitches in the past few years. In June, for example, Ford had to recall more than 430,000 cars (including the 2015 Focus, C-Max and Escape models) to update the software, because removing the ignition key may not be enough to turn off the car’s engine!

None of these hacks, so far, involve Android Auto, however they are worth mentioning to show that auto makers have issues with software in vehicles. Although I cannot help but acknowledge that software in vehicles has incredible benefits (ABS, improved fuel efficiency, etc).

Why so serious?

With the amount of information our smartphones hold related to our lives and finances, a hacked smartphone is a major source of worry and headache. However, having a completely compromised smartphone is not necessarily life threatening, for either myself or the people around me.

When a car decides to arbitrarily break these given set of rules, it poses a great danger not just to its occupants, but to other vehicles, as well as pedestrians.

Admittedly, a lot of my activities using my smartphone, or in close proximity of my phones, could be embarrassing if made public. More importantly, a very high number of smartphone owners perform financial transactions through their phones, and a hacked phone can result in massive financial losses. With a hacked automobile, the potential for damage, injuries and loss of life is far greater.

At the moment, Android Auto is a strictly information/entertainment system, and cannot be used to control, manage and/or monitor car operations. However, the Android Auto APIs indicate that querying car diagnostics is part of the future plans. Both the Auto makers and Google have to take extra steps to ensure Android Auto is properly isolated and sandboxed. Unfortunately, with their track record thus far, I’m not holding my breath.

Conclusion

The scary part of this is not the software in automobiles or Android itself. Individually, they are a concern, but the idea of both together is quite troubling. And the same can be said of both Apple’s CarPlay and Microsoft’s Windows Automotive.

Microsoft, arguably the biggest and most important software company in the world today, still has issues surrounding it’s most lucrative software (Windows if you haven’t guessed), and this is with their ability to push out updates regularly. How frequently can auto companies push out updates? How are the updates going to be installed? Can users decide to reject an update? Who becomes accountable when a user rejects an update, for whatever reasons, and the car is compromised in the middle of a commute? Who is accountable if the car is compromised using Android Auto?

Don’t forget that even if you refrain from purchasing one of these monsters, any other car on the road can be one of these, and happen to be the unlucky machine infiltrated by the bored teenager in his mother’s basement in East Africa (replace with virtually any where else in the world). The safety of our roads are predicated on the belief that every driver follows a set of rules. When a car decides to arbitrarily break these given set of rules, it poses a great danger not just to its occupants, but to other vehicles, as well as pedestrians.