TCFDONMEZandClaude Opus 5
444732438d
Ports WinClose's SWI69 window control as an opt-in foreground service that is independent of ABRP: no token, no GPS, no upload cadence. The driver opening a door while the car is in P at a readable 0 km/h pulses UP at all four areas for five seconds, then STOP. Only the parts that serve that one behaviour are taken. WinClose's speed and time arming, configurable delay, warning beep, per-window modes and position reads are all absent — the target car is a Comfort trim whose motors carry no position sensor, so a close can be neither verified nor cancelled. The pulse, the door edge detector and the eligibility policy are pure classes with unit tests. STOP is attempted from a finally block on every exit, including an interrupted sleep, a refused write and a sender that throws, because a pulse that stops arriving leaves the motors wherever they were. Guards worth naming, several of them learned from reading WinClose rather than from the port itself: - A wake lock spans the pulse. This fires as the driver leaves, which is exactly when the head unit suspends; without it the glass can stop halfway with no STOP sent. - A fresh listener registration replays the door's current state. That replay seeds the edge detector instead of triggering it, or a binder reconnect while the door stands open would close the windows on someone halfway out. - WinClose's 60-second cooldown, so reaching back into the car does not run a second pulse. - The service stops itself on a non-SWI69 generation, and the switch is disabled unless the process holds system uid — only the unstable flavor declares android.uid.system, so a stable build could otherwise offer a toggle whose every command would fail. This is the project's first write to the vehicle. README, SECURITY, AGENTS, CONTRIBUTING and DISCLAIMER all claimed the app never writes; that claim is retracted and scoped rather than quietly left standing. Untested on a car. The feature is off by default. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
42 lines
2.1 KiB
Markdown
42 lines
2.1 KiB
Markdown
# Security policy
|
|
|
|
This app runs on a car. It reads vehicle data and holds credentials for a third-party
|
|
service, so security reports are welcome and taken seriously.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please **do not** open a public issue for a vulnerability. Use GitHub's
|
|
[private vulnerability reporting](../../security/advisories/new) instead.
|
|
|
|
Include what you were able to do, on which firmware generation, and whether the vehicle
|
|
was moving. A proof of concept helps; a working exploit is not required.
|
|
|
|
## What is in scope
|
|
|
|
- Anything that lets another app on the head unit read the stored ABRP credentials.
|
|
- Anything that gets attacker-controlled code installed through the unstable updater.
|
|
- Any vehicle write outside the explicitly enabled SWI69 WinClose feature, or a window
|
|
close that bypasses P/readable-zero-speed checks, exceeds its five-second pulse, or
|
|
fails to attempt STOP on every window after interruption or failure.
|
|
- Telemetry that leaks credentials into logs, URLs or crash reports.
|
|
|
|
## What is not in scope
|
|
|
|
- Requiring physical access to an unlocked head unit with developer mode enabled.
|
|
- The stable channel not auto-updating. That is deliberate; see `LICENSE.md` and the
|
|
README's channel table.
|
|
- Vulnerabilities in the OEM firmware itself. Report those to SAIC.
|
|
|
|
## Design decisions you should know about
|
|
|
|
- Credentials live in `EncryptedSharedPreferences` and are sent in a POST body, never a
|
|
URL. `allowBackup` is off and both preference files are excluded from backup rules.
|
|
- The unstable updater accepts an APK only over https, only from an exact-match GitHub host
|
|
allowlist, and only when its signing certificate matches the running app's. All three
|
|
checks fail closed. The stable channel does not contain the updater at all.
|
|
- The VHAL probe helpers, which enumerate the whole vehicle abstraction layer, exist only
|
|
in debug builds.
|
|
- Window closing uses WinClose's SWI69 CarState callback and VSM commands. Its service is
|
|
not exported, has its own opt-in switch, and holds no wake lock or alarm. It does not
|
|
assert that a sensorless window has physically closed or that anti-pinch is available.
|