Bhargab Acharya, Christos Papadopoulos, and Spiros Thanasoulas, University of Memphis
Used vehicle infotainment head units, routinely sold on secondary markets, retain Bluetooth pairing keys from prior owners alongside personally identifiable information (PII). We demonstrate that an attacker who recovers a BR/EDR link key from such a unit can impersonate the original head unit to a previously paired phone and exercise the Bluetooth profiles the phone had granted to the vehicle—most notably HFP, PBAP, and MAP—to exfiltrate contacts and call logs, intercept calls and SMS-based one-time passwords, and in some configurations invoke the phone’s voice assistant, in several cases against a locked phone. Co-recovered PII (home address, prior-owner names, GPS traces, paired-device names) makes targeting practical rather than opportunistic. We demonstrate the full chain live on a salvaged 2016 Honda Pilot head unit against an attacker-controlled test phone.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
