Spyware‑Laden Aftermarket Car Head Units Ship with Voice Assistant, Call Recorder, and Baidu Services
What Happened — A consumer purchased a low‑cost aftermarket head unit from Amazon and installed it in a 2020‑era Civic. Reverse‑engineering (aided by AI) revealed that the device ships with a suite of pre‑installed applications that function as a voice assistant, a Baidu location service, a call recorder, a DAB radio client, and an Adobe Acrobat viewer. The voice assistant relies on Android’s WebView component, consuming roughly one‑third of the processor even while idle. None of these components are disclosed to the buyer, effectively turning the head unit into a telemetry‑heavy, privacy‑invasive IoT device.
Why It Matters for Trust & Control Assurance — The hidden software demonstrates a supply‑chain control gap: without rigorous third‑party oversight, devices can embed spyware that undermines privacy and performance.
Who Is Affected — Vehicle owners who install aftermarket infotainment hardware, aftermarket parts distributors, and OEMs that may later inherit compromised firmware.
Recommended Actions
- Conduct a vendor risk assessment of the head‑unit supplier, focusing on firmware provenance.
- Request a software bill of materials (SBOM) and verify that only approved components are present.
- Disable or remove unnecessary services (e.g., call recorder, third‑party location SDKs).
- Deploy network monitoring to detect unexpected outbound traffic from installed units.
- Update procurement policies to require security vetting of all IoT components.
Technical Notes — The head unit runs a customized Android OS. Pre‑installed components include:
- Voice assistant using Android WebView (continuous CPU usage ≈ 33%).
- Baidu location SDK (potential data export to China).
- Call‑recording module (audio capture without user consent).
- DAB radio client (non‑functional in the U.S.).
- Adobe Acrobat viewer (PDF rendering capability).
Source: https://www.schneier.com/blog/archives/2026/10/bloatware-in-aftermarket-auto-parts.html