On being mobbed

When I recounted this story to the tech removing the Blue&Me module at JG Audio & Alarm in West Berkeley, he thought it was funny too. But this time the laugh was on the snotty service representative who didn’t get that when criminals leverage their victims’ automotive “infotainment” systems to harass them, it’s not a case of “If it ain’t broke, don’t fix it.” In fact, given the lack of understanding of mobile stalking and harassment, the closest you may get to a “fix” for the vulnerabilities of even a sparsely featured modern car, is to remove the infotainment module itself—if you can.

The Blue&Me module integrates “infotainment” into makes and models including Alfa Romeo, Fiat, and Lancia sold by Fiat Chrysler Automobiles (FCA) from 2006 to 2017. For our purposes, “infotainment” is the convergence of information and entertainment systems built for the automotive market. In-car infotainment systems provide the hardware, software and networking capabilities required to support these media services.

My interaction with the service representative is yet another example of the difficulty of getting help when you’re a victim of digital harassment. To be fair—if fairness is expected of one who is being victimized while those who have the luxury of skepticism look away—it doesn’t take much to understand the failure to connect reports of in-car harassment to in-vehicle infotainment systems. After all, there are antennas and radios to consider, and the smart phone too. Of course, none of these will be considered when the reporter is not believed. It’s true, however, that the removal of an infotainment module is not included on the typical automotive service menu. Most of us don’t know there is a module or what that means. So long as our devices, our appliances, and our automobiles “just work,” we can ignore their troublesome components. Our expectations for performance are based on design and common use, not on a hack.

When we’re harassed in our cars, it’s difficult to understand what is being used to harm us and whether it comes from inside or outside the vehicle. We don’t know whether our own vehicle has been enlisted in harassing us. We can’t be sure which features are being used to hurt us. But when rogue signal is forced onto the interfaces of your car to harass, the harassment may necessarily be physical. Harassment based on radio frequency may not be intended to sound at all but to instead be felt. This may depend on whether those harassing you prefer to avoid implicating themselves with the use of their own voices in the harassment and instead transmit sound effects to frighten you out of your home or unsettle you with silence as your electrical system is overrun with data you can’t hear. The act of introducing rogue signal into an electrical or electronic system in a manner for which it is not designed likely results in radio frequency (RF) interference that has physical effects. And given the failure to believe those who may report this harm and try to articulate what it feels like to be harassed using signal and antennas, electricity and electronics, it’s unlikely the victims are heard or understood. Those who understand the theoretical underpinnings of the technologies fail to comprehend what it feels like to be abused with them. Mobbing, like other victimizations, shows how lack of experience can limit empathy.

Even if the nature and the probable origin of the rogue sound are understood there’s the confusion over who services the electronic components that support the sound system. When it comes to “infotainment,” it may be difficult to figure out whether the electronic component must be serviced by a automotive mechanic or an audio installer turned computer tech. With digitization, the installation of automotive radio is increasingly like building a computer, something more commonly done by laypersons in the 1990s when the alternative to buying an expensive desktop computer was to mail order a “box,” a CPU (central processing unit) with the component parts from an electronics outfit and put them together. So it makes sense that DIYers and people who like to take things apart—in the digital world, to “reverse-engineer” them—are hacking their cars.

Ω

Despite the selection of a car that appeals to the minimalist, music was always a given. I did the research and learned that the Blue&Me steering wheel integration required the installation of the Blue&Me app on a phone that could then be “paired” with the car’s audio system. Even before I showed up at the California dealership to drive my shiny little car off the lot, the Blue&Me app was ready to go.

The mobbers were too. From the first day of ownership, the mobbers did their best to cover every contingency in their drive to create a world of seamless, end-to-end harassment for me. First I got rid of the free year’s subscription to satellite radio. Then I abandoned the use of Bluetooth and connected the iPhone to the stock radio using an auxiliary cable. I minimized the attack surface of my music player by moving to an iPod Touch without cellular capabilities. WiFi, as usual, remained off. As I had done in older cars, I started to play with the antenna components. The antenna with satellite radio support was unscrewed and removed from the roof. Next I disabled antenna amplification. The stock radio was pulled out and replaced with one of the few models I could find on Amazon.com without Bluetooth or USB. What I couldn’t do was to remove or disable the components that supported the minimal wireless capabilities of the vehicle, capabilities that a salesman at another dealership had assured me were harmless. In another experiment I abandoned the iPhone for an Android. It was a few years before I realized that though I was no longer using the iPhone that was paired with the car’s infotainment services, someone else might be (Your TV doesn’t have to be smart to be hacked (part 2)). At least, they might be using the Bluetooth pairing between the iPhone and the car. I took the iPhone out of the cabinet, charged and booted it up, and then removed the pairing. But none of these methods made that much difference. I came up with countermeasures; they found ways around them.

Ω

While researching the Radiohead blogs a few years back, I was struck by a comment in Lisa Parks’ introduction to an article in Media Fields Journal, “Rise of the IMSI Catcher.” Citing the words of a security researcher, Parks remarked,”cellphone interception could become as common as cellphone use” (Radiohead: Cell phones are radios; mobbing is radio-based harassment (part 1)). Cellphone interception by IMSI catcher is a “Man In The Middle” (MITM) exploit in which the attacker inserts himself into the message stream and assumes control of the exchange, sometimes replacing the messages with his own; at other times simply gathering information. To say that the interception of cell phone calls could parallel the use of these devices that have become handheld computers is to theorize a culture shift in which the interiority of the self is supplanted by a need, at every opportunity, to monitor and control the other. Those within proximity (WiFi range) are regarded as ready victims. Neighbor mobbing represents a deterioration of culture in which the sphere of domestic abuse is no more contained within the abuser’s home but extends to proximal dwellings and is displaced onto neighbors.

Real estate mobbing as performed by shady speculators, corrupt neighborhood watch groups and the tawdry two-bit criminals who take up criminal harassment and stalking as a sideline, makes extensive use of man-in-the-middle tactics. These stalkers might record calls or use walkie-talkies or smart speakers to inject harassment into the background of calls. But property mobbing is a man-in-the-middle attack on your life. Surveillance and monkey-wrenching relationships and communications are core tasks in property mobbing, whether the communication is data over the wire or the victim’s report to the police.

Wikipedia gives the example that “an attacker within the reception range of an unencrypted Wi-Fi access point could insert themselves as a man-in-the-middle” (“Man-in-the-middle attack,” Wikipedia, https://en.wikipedia.org/wiki/Man-in-the-middle_attack). When it comes to mobbing with WiFi extenders, the mobbers provide their own WiFi access points and make use of the pesky public access points provisioned with the routers within range of the victim home–maybe yours, or maybe the ones they provision for you. If they’re able to use home networking standards or powerline technology to create an illicit powerline connection and ride your household electrical wires, they don’t need to socially engineer you out of your public key like as the Wikipedia example goes on to describe. They man-in-the-middle you with signal. Mobbing is a signal hack and the greatest signal wins. At home, they run WiFi extenders like the Eero over your conductive copper wires and devices. They boost signal, increasing the antenna effect of your wires, shunting radio frequency into your environment, and ensuring the ingress of their rogue data onto your wires, your appliances, and your digital devices. And when your car implements a decades-old communications protocol that failed to anticipate the network, it doesn’t take much for criminals like mobbers to “man-in-the-middle” your car.

Check back for part 2 of Blue, the mobbers & me, hopefully in the next 48 hours.