> Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the device to recruit it into a botnet

People do pair them with their phones, though. I could imagine a future version of malware like this propagating laterally.

The logical endpoint of the entire "the car as software" concept. Can't wait for the security vendors to start hawking "AV for your car"

For whatever reason, the idea of this being in my car is relatively scarier for me than if this was just my phone ?

I think partially as my mental model of both android auto and CarPlay is that they operate as a passthrough of my device rather than as an separate installation of the OS entirely (I wasn’t aware the head unit itself had the ability to install APKs independently).

Also, feel like John Gruber is going to have a field day with this one

One more reason cars should not be internet connected. They last for decades and manufactures don't want to support their cars that long. Always proxy to a phone and the attack surface is limited to things that are updated.

..to add to a botnet for click fraud.

The duality of cybersecurity is interesting. Sometimes the high bar is cleared just to enable a low bar to go lower. Those PLCs monitoring water were ignored for a very long time because they couldn't click on ads. It took a war for them to become a target.

So to do this the attacker has to compromise the update servers at $CAR_COMPANY?