Security Insight: Understanding the Mechanics of Apple CarPlay

The DMN Security Bite is proudly presented by Mosyle, the sole Apple Unified Platform. Our focus is on preparing Apple devices for work and ensuring enterprise security. With our unique comprehensive approach, we combine cutting-edge Apple-specific security solutions for automated Hardening & Compliance, Next Generation EDR, AI-driven Zero Trust, and exclusive Privilege Management with the most robust and advanced Apple MDM available. The outcome is a fully automated Apple Unified Platform that over 45,000 organizations trust to prepare millions of Apple devices effortlessly and cost-effectively. Secure your EXTENDED TRIAL today and discover why Mosyle is essential for working with Apple.

This week, I want to discuss an intriguing presentation I came across on social media regarding an Apple service that often flies under the radar: CarPlay. Although Apple hasn’t published the exact number of CarPlay users, I dare say it’s among their most extensively utilized services. A primary concern, however, is the potential for threats to driver safety and privacy. So, just how secure is CarPlay?

At the TROOPERS24 IT conference in Heidelberg, Germany, security expert Hannah Nöttgen delivered a thought-provoking presentation titled “Apple CarPlay: What’s Under the Hood.” During her session, Nöttgen examined the fundamental security architecture of CarPlay to assess its level of security. She elaborated that CarPlay depends on two main protocols: Apple’s proprietary IAPv2 (iPod Accessory Protocol version 2) for authentication and AirPlay for media streaming. Together, these protocols support the seamless experience we’ve come to appreciate, allowing drivers to access messages, phone calls, music, order food, and various features without needing to unlock their devices.

However, this convenience does present certain risks.

In her analysis, Nöttgen scrutinized various attack vectors and highlighted the dangers of unauthorized access to personal data, which could compromise driver privacy and safety. Although CarPlay’s authentication system is solidly designed to thwart replay attacks, Nöttgen identified other vulnerabilities, such as DoS attacks targeting third-party AirPlay adapters, which are feasible, albeit challenging to implement.

Another noteworthy aspect is Apple’s stringent control over CarPlay hardware via its Made for iPhone (MFi) program. All authorized CarPlay devices must incorporate an Apple authentication chip, which manufacturers pay to include in their vehicles. While Apple’s closed ecosystem has sparked criticism for restricting third-party access, it also poses a significant barrier for potential attackers. Conducting a sophisticated attack, such as extracting a private key, would necessitate physical access to the MFi chip.

Nöttgen wrapped up her presentation by indicating areas that warrant additional investigation, such as potential techniques for extracting private keys and performing more extensive testing of CarPlay’s protocols. Her concern is that, should attackers manage to acquire these keys, they could intercept and decrypt sensitive data.

Unfortunately, the proprietary nature of both IAPv2 and Apple’s version of AirPlay complicates independent security assessments. I strongly encourage readers to check out Hannah Nöttgen’s talk below—it’s indeed both enlightening and engaging!

For those interested, you can download the full presentation here.

About Security Bite: Security Bite is a weekly column dedicated to security on DMN. Each week, Arin Waichulis shares insights on data protection, uncovers vulnerabilities, or illuminates emerging threats within Apple’s expansive ecosystem of over 2 billion active devices to help keep you secure.