More and more vehicle manufacturers are adopting Android Automotive OS as the platform for their infotainment systems. The advantages are clear: a mature ecosystem and fast development cycles. Manufacturers that additionally license Google Automotive Services (GAS) gain access to the Google Play Store and Google services in the vehicle. But the platform also brings Android-typical security risks into the vehicle.

The Biggest Attack Surfaces

1. App Permissions and Sandboxing

The Android permission model must be particularly restrictively configured in the automotive context. Apps can request access to location data, microphone, or vehicle APIs through their manifest. The challenge is that OEMs must define the permission groups and access restrictions for vehicle-specific APIs themselves – and this configuration is often not restrictive enough.

2. Inter-App Communication

Intents, Content Providers, and Bound Services form the foundation of Android inter-process communication. In the vehicle context, insufficiently protected intent filters can lead to safety-critical vehicle data being passed to arbitrary apps.

3. System Partition and SELinux Policies

Hardening the system partition is critical. Misconfigured SELinux policies or disabled Verified Boot undermine the entire security architecture. In practice, we frequently see OEM customizations weakening standard security mechanisms.

4. OTA Update Security

Over-the-air updates are standard with Android Automotive. The integrity and authenticity of update packages must be cryptographically ensured – including rollback protection and secure communication with the update server.

Our Recommendations

  • Least Privilege: Grant apps only the absolutely necessary permissions
  • Harden Intent Filters: Explicitly secure all exported components
  • SELinux Enforcing: No exceptions for production builds
  • Regular Penetration Tests: Test new app versions and system updates before rollout

proofnet offers specialized Android System & App Security Tests for automotive platforms. Get in touch.