7 ms·

There are a lot of cars out there where the head unit has connection to the CAN bus. Which means this malware vector could be used to directly cause crashes. E.

by dzdt 25d ago

There are a lot of cars out there where the head unit has connection to the CAN bus. Which means this malware vector could be used to directly cause crashes. E.g. https://news.ycombinator.com/item?id=19751872 https://news.ycombinator.com/item?id=19751872

01100011 25d ago
An aftermarket head unit connects to the CAN bus? The aftermarket head unit I installed certainly doesn't. Are you sure what you are saying, which is true for OEM units, applies to aftermarket ones?
- karlshea 25d ago
  Mine does. Its dashboard shows fuel level and a bunch of other things and I can bring up a speedometer/rpm app. I believe the connection exists because the steering wheel buttons/iDrive talk to the original head unit over CAN.
  - rootusrootus 25d ago
    That’s wild, I’ve never run across a head unit that had me connect OBD2. I think I would just ignore that bit of the install instructions.
    - karlshea 25d ago
      I did not connect ODB2. The HU I got puts itself as a passthrough to the stock BMW HU (which you still need to be able to use, you switch the screen to its output by holding down a button), and that connector includes CAN. There are numerous reasons the HU needs CAN, for example to get the steering wheel angle to be able to draw the guides over the backup camera feed. Or to switch to the backup camera feed when you put the car in reverse.
      - rootusrootus 24d ago
        It is really exposing the CAN bus, it is not some adjacent subsystem overlaying the steering guides and rearview video by interrupting the video signal? It's actually entirely coming from the aftermarket HU? That's fascinating! I wouldn't expect an aftermarket system to be too good at that functionality, guides tend to be carefully tuned for specific car/steering/camera combos. Ideally most cars should be relying heavily on data diodes to minimize the risk of a bad actor wreaking havoc. I know for sure some cars (there was a Jeep example as I recall) don't do that, but I kinda wonder which ones do. It seems like a pretty obvious attack vector worth protecting.
        karlshea 23d ago
        Yes, the BMW NBT quadlock connector has K-CAN2 (so only body bus, no engine/chassis which is on a different CAN bus). (in true German over-engineering fashion it also has fiber for audio and Ethernet for diagnostics) I brought up the backup camera as another reason the head unit has CAN, since in my car that's what's handling drawing the backup guide lines. The aftermarket HU would have enough data to do so, but in my case it doesn't (although it does read CAN for buttons/iDrive). The original HU is still there and functioning, but the aftermarket Android is between the vehicle harness and the original HU with some passthrough and swapping of video cables. I can hold down the Menu button on my iDrive and the Android HU switches the screen to show the original HU output and I can interact with it normally. And when I put the car into reverse it also switches so I can see the original backup camera feed, then switches back to Android after I drive forward again. Of course I use none of the Android functionality at all, the whole ridiculous system is solely for CarPlay.
    - BoorishBears 24d ago
      As the other comment points out, if you've installed more than a few, you've definitly connected to the CAN bus. Few headunits will ask you to connect to the OBD2 port for practical reasons, but the miscilanous manufacturer specific connectors you hook up often include CAN bus connections. OBD2 port is just 1 of multiple ports with access to the network, even your headlights can be on the bus
  - kanbankaren 25d ago
    > speedometer/rpm This is available on standard OBD-II. Maybe, it is accessible over CAN?
    - dx4100 25d ago
      My OBD-II connector has CAN-C (500kbit) and CAN-B (50kbit) - I use CAN-B primarily because I can control windows, doors, etc + get the speed & rpm.
- RealityVoid 25d ago
  Can't vouch for all car architectures, but in most cases the head unit is QM and safety domains are usually segmented from each other. So even if the head unit talks CAN (it needs to get car data somehow) it will only communicate with the rest of the car through a gateway that will not allow it to take any dangerous actions.
  - bluGill 25d ago
    That's true for most cars, but some, particularly the older cars, they weren't as concerned about security as they should have been. And so sometimes the radio can talk to things that it probably shouldn't be able to talk to.
- dx4100 25d ago
  Many do - the one I was looking at for my vehicle in particular uses it to restore the steering wheel controls (which are broadcast over the CAN-B low speed bus)
- wildzzz 25d ago
  The expensive ones do so you get more of an OEM infotainment experience. I guess you could potentially cause a crash over the CAN bus but there's a very small overlap between cars that allow you to swap out headunits and cars that can be controlled enough over CAN to cause a crash. Other than commercial vehicles, I don't think there are any new cars that have DIN stereos anymore.
- scoot 24d ago
  I'm not aware of an aftermarket head unit that can't connect to CAN bus with the appropriate adapter (which are widely available).
jiaosdjf 25d ago
Manufacturers should be sued to absolute oblivion for doing what any developer would tell you is a security hole.
Ccecil 25d ago
The car hacker's handbook [1] has a chapter on just using the infotainment system to access the CAN. Specifically mentions "attacking through the update system". [1]https://opengarages.org/handbook/ebook/ https://opengarages.org/handbook/ebook/ (chapter 9)

by dzdt 25d ago

01100011 25d ago

An aftermarket head unit connects to the CAN bus? The aftermarket head unit I installed certainly doesn't. Are you sure what you are saying, which is true for OEM units, applies to aftermarket ones?

karlshea 25d ago
Mine does. Its dashboard shows fuel level and a bunch of other things and I can bring up a speedometer/rpm app. I believe the connection exists because the steering wheel buttons/iDrive talk to the original head unit over CAN.
- rootusrootus 25d ago
  That’s wild, I’ve never run across a head unit that had me connect OBD2. I think I would just ignore that bit of the install instructions.
  - karlshea 25d ago
    I did not connect ODB2. The HU I got puts itself as a passthrough to the stock BMW HU (which you still need to be able to use, you switch the screen to its output by holding down a button), and that connector includes CAN. There are numerous reasons the HU needs CAN, for example to get the steering wheel angle to be able to draw the guides over the backup camera feed. Or to switch to the backup camera feed when you put the car in reverse.
    - rootusrootus 24d ago
      It is really exposing the CAN bus, it is not some adjacent subsystem overlaying the steering guides and rearview video by interrupting the video signal? It's actually entirely coming from the aftermarket HU? That's fascinating! I wouldn't expect an aftermarket system to be too good at that functionality, guides tend to be carefully tuned for specific car/steering/camera combos. Ideally most cars should be relying heavily on data diodes to minimize the risk of a bad actor wreaking havoc. I know for sure some cars (there was a Jeep example as I recall) don't do that, but I kinda wonder which ones do. It seems like a pretty obvious attack vector worth protecting.
      - karlshea 23d ago
        Yes, the BMW NBT quadlock connector has K-CAN2 (so only body bus, no engine/chassis which is on a different CAN bus). (in true German over-engineering fashion it also has fiber for audio and Ethernet for diagnostics) I brought up the backup camera as another reason the head unit has CAN, since in my car that's what's handling drawing the backup guide lines. The aftermarket HU would have enough data to do so, but in my case it doesn't (although it does read CAN for buttons/iDrive). The original HU is still there and functioning, but the aftermarket Android is between the vehicle harness and the original HU with some passthrough and swapping of video cables. I can hold down the Menu button on my iDrive and the Android HU switches the screen to show the original HU output and I can interact with it normally. And when I put the car into reverse it also switches so I can see the original backup camera feed, then switches back to Android after I drive forward again. Of course I use none of the Android functionality at all, the whole ridiculous system is solely for CarPlay.
  - BoorishBears 24d ago
    As the other comment points out, if you've installed more than a few, you've definitly connected to the CAN bus. Few headunits will ask you to connect to the OBD2 port for practical reasons, but the miscilanous manufacturer specific connectors you hook up often include CAN bus connections. OBD2 port is just 1 of multiple ports with access to the network, even your headlights can be on the bus
- kanbankaren 25d ago
  > speedometer/rpm This is available on standard OBD-II. Maybe, it is accessible over CAN?
  - dx4100 25d ago
    My OBD-II connector has CAN-C (500kbit) and CAN-B (50kbit) - I use CAN-B primarily because I can control windows, doors, etc + get the speed & rpm.
RealityVoid 25d ago
Can't vouch for all car architectures, but in most cases the head unit is QM and safety domains are usually segmented from each other. So even if the head unit talks CAN (it needs to get car data somehow) it will only communicate with the rest of the car through a gateway that will not allow it to take any dangerous actions.
- bluGill 25d ago
  That's true for most cars, but some, particularly the older cars, they weren't as concerned about security as they should have been. And so sometimes the radio can talk to things that it probably shouldn't be able to talk to.
dx4100 25d ago
Many do - the one I was looking at for my vehicle in particular uses it to restore the steering wheel controls (which are broadcast over the CAN-B low speed bus)
wildzzz 25d ago
The expensive ones do so you get more of an OEM infotainment experience. I guess you could potentially cause a crash over the CAN bus but there's a very small overlap between cars that allow you to swap out headunits and cars that can be controlled enough over CAN to cause a crash. Other than commercial vehicles, I don't think there are any new cars that have DIN stereos anymore.
scoot 24d ago
I'm not aware of an aftermarket head unit that can't connect to CAN bus with the appropriate adapter (which are widely available).

jiaosdjf 25d ago

Manufacturers should be sued to absolute oblivion for doing what any developer would tell you is a security hole.

Ccecil 25d ago

The car hacker's handbook [1] has a chapter on just using the infotainment system to access the CAN. Specifically mentions "attacking through the update system". [1]https://opengarages.org/handbook/ebook/ https://opengarages.org/handbook/ebook/ (chapter 9)