
Originally Posted by
Audibellybutton
It Is not safe because "I said it is" I have deemed it safe because of the reasons that I explained. I broke It down for you so you could come to the same conclusion. Each vulnerability you keep referring to, android auto and apple CarPlay are not native to the device. None of those are built in. It is at your discretion to add that feature and that 3rd party app if you choose to. But like I said the screen can be ran 100% without ever connecting to any form of internet or connection at all. It is an output device just like the screen that comes in the car and it can function exactly the same way with some additional features. As with most devices its only as safe as your usage of it.
Im not sure where you are getting this "unaudited code" stuff, the device runs on an android operating system, all of the code in its entirety is open source, you can audit it and see exactly how it functions if you wanted to. Android source code has been audited many times over and continues to be updated with security patches just like any other operating system, but there will always be vulnerabilities where internet connectivity is involved. The only "unaudited code" you may introduce to your device is from downloading an unaudited app from the Play Store. Or you could just... not do that.
This is not some alien Chinese technology, it is a regular android device that is manufactured In the same place as all the rest of them.
Your cautiousness is justified, but your statements are presumptuous if you have not owned one or are not familiar with the operation of android devices. I have been using these for years and have put one in almost every car ive had. I am very familiar with it and how it works, the vulnerabilities you pointed out (CarPlay/android auto) are not native to the device and are not necessary for the function of the device at all.
So with that being said, even someone like you could safely enjoy this device without an internet connection just as you would with your oem MMI. Then there are NO vulnerabilities therefore the device is completely safe from unwanted connectivity.
If you do choose to use internet and download apps on your device does this make it "unsafe"? No, but it means you have added more potential vulnerabilities.
If you cannot point out an actual exploit or vulnerability thats built in to the device, then you have to admit (even mentally) that you have no grounds to deem these android screens as "unsafe" and being Chinese is not a solid reason. All of our mobile devices are Chinese.
I must add that I can tell you are well versed in network functionality and network security. A great area of expertise for sure and im sure that you can at least agree that without any network connectivity there is no vulnerability unless someone directly inserted a malicious device into your android screen.
im happy to agree to disagree, thats fair. I just wanted to explain the device more for people who may be interested just as you wanted to explain the reasons why you aren't I think both of our explanations together will provide a good amount of info for anyone looking to come to a conclusion about getting one. Whatever that conclusion may be.
I'll bite on the last quote in the spirit of information, so let me break it down why I will not run one yet:
You can see here that all it requires is a simple entitlements XML file which is how most applications request permissions into things behind the scenes. Zero-day attacks on iOS specifically have used these calls successfully in the past. Apple had to lock them down but even then, that requires them to vet the walled garden. When you introduce the SDK that they are running from Android, it's running *SOMETHING* (whether that be XCode or an emulator for the SDK) essentially in the background or some variation in order to display the CarPlay elements.
Specifically, com.apple.developer.carplay-communication
https://developer.apple.com/document...y_entitlements
This is not deep diving on the fact that once you are entitled to communication, you have TCP/IP capabilities; this is how your phone communicates to the unit, does not matter if you are wired or wireless, that capability is how information flows back and forth both to the OS and Apps that you run on the OS. This is called adhoc internet and it's why CarPlay can even work wireless in the first place.
Every OEM that implements CarPlay in the past used a similar approach (the so called second screen in CarPlay world), which is why my 2017 BMW X5 that has CarPlay operates the *EXACT* way aftermarket units do (e.g. you can flip between "OEM/Vanilla" and "CarPlay" because BMW implements the same approach. The difference? BMW is highly audited in the code side of things and Apple will not allow them to sell a vehicle with a buggy system or something that may have security implications.
Anyone having access to the root of CarPlay OR Android Auto could very easily manipulate code and then re-lock people out from reinspecting with encryption. Could RSNAV or Seicane supply root code for us to audit? Doubtful because as you said, they are reselling and from what I can tell modifying things to make them stable or feature enhance. They may have a LOT of hours coding fixes into the OS to make certain elements work and would not want to show those to competitors for obvious reasons.
I am not accusing any current company/vendor of doing these practices, but my job is to literally tell people what they do not understand or how to beat something
before they've even thought of it and thus the reason why I said, hello everyone, just a side note here on these little cheap gadgets: cool, but be careful as no one has vetted these and I stand by that because no one has done a packet trace on these at the network level yet (and it's entirely possible to do so on Android, iOS with XCode). I have not bought one to roll the dice and test it myself as I have higher priority items on the list, but rest assured one day I will and then we will see.
To be clear, I'm not anti-Chinese or anti-Chinese products so please do not take it that way, 90% of what we run on daily is made in China and I have no issue with that or my friends and coworkers who are Chinese. I
do think this is 2022 and open source should be the standard these days with breach after breach of security and data, especially with something that has direct access to the backbone of my iPhone and microphone.
Elements of my job involve classified material, and I figure with the amount these cars cost, I'm not the only one in these forums that discusses such things that require my equipment to be clean. Better safe than sorry.
Who knows, perhaps one day, if things ever stop being chaotic, I will just design my own with a vanilla Android Auto image and open source it so people can see it from start to finish and build it themselves if they want with a RPi.
Bookmarks