Hello!

 

Recently, I tried to figure out how the MyŠkoda app works in terms of its technical aspects, and I conducted a small experiment.

 

I wanted to understand how my phone communicates with the car when, for example when I unlock it remotely.

 

I know the car has an LTE antenna and module with built in SIM car.  I assumed that the app sends a request (such as unlocking or locking the car) to Škoda/VW servers via the internet, and then the servers communicate with the car using LTE. This would explain why it takes around 20 seconds to unlock or lock the car using the app.

 

To confirm this theory, I set up an SDR device (Software Defined Radio—basically a scanner for radio communication) and monitored the EU LTE frequencies. After several attempts, I didn’t detect any signals on the LTE frequencies, which left me without an answer.

I also tried searching Google for information on how the Škoda or VW app works, but I couldn't find anything conclusive.

 

I’m reaching out to you with a kind request: Does anyone know how the app communicates with the vehicle? 😃

 

Thank you!

 

 

After your tests I can only guess it’s sending get and put requests via API and your active subscription is the API key

Thanks for your answer!

 

Are you saying that the car communicates with the servers via an API? That’s probably correct, but I still don’t understand whether it’s using GSM, LTE, GPS, or an RF signal for this communication.

 

My goal is to figure out how the request reaches the car because I’m trying to identify security vulnerabilities for my master’s thesis.

Ah I see what you mean, not sure tbh

 

i’m sure having kali Linux on a laptop and an LTE receiver you’ll see something but not sure

Since it's clearly a service you can execute remotely - it must be cellurar. GSM is dying, so my best bet is LTE.

Oh, I didn’t think about that!  I will try that and get back with the results.

5 minutes ago, Danoid said:

Ah I see what you mean, not sure tbh

 

i’m sure having kali Linux on a laptop and an LTE receiver you’ll see something but not sure

 

 Yes the LTE is the way to go. 

2 minutes ago, komoornik said:

Since it's clearly a service you can execute remotely - it must be cellurar. GSM is dying, so my best bet is LTE.

 

I found out that every module has its own IMEI, so I might remove the rear bumper to see if I can find something there.

Does your car support connection over Wi-Fi? I know lot of VW group systems can.  Try connecting via a laptop hotspot with a network analyser. 
I’ve always assumed the app works as you suggest but ny current car doesn’t support it. When I get the replacement I’ll try this.