Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The audiconnect component provides an integration with the Audi Connect cloud service. It adds presence detection, sensors such as range, mileage, and fuel level, and provides car actions such as locking/unlocking and setting the pre-heater.
Note: Certain functions require special permissions from Audi, such as position update via GPS.
Credit for initial API discovery go to the guys at the ioBroker VW-Connect forum, who were able to figure out how the API and the PIN hashing works. Also some implementation credit to davidgiga1993 of the original AudiAPI Python package, on which some of this code is loosely based.
Use this API with care. If you use it wrong (e.g. too many logins, repeated login attempts with wrong password, ...) your account may get blocked.
Use the PIP package manager
pip install audiconnectpy
Or manually download and install the last version from github
git clone https://github.com/cyr-ius/audiconnectpy.git
python setup.py install
# Import the audiconnectpy package.
from audiconnectpy import AudiConnect
async def main():
async with ClientSession() as session:
api = AudiConnect(session, VW_USERNAME, VW_PASSWORD, COUNTRY, SPIN)
await api.async_update()
print(api.vehicles)
if __name__ == "__main__":
loop = asyncio.get_event_loop()
loop.run_until_complete(main())
Have a look at the example.py for a more complete overview.
Audiconectpy is based on the new Carnet ID API that was introduced with the new series of ID cars. If you use another car or hybrid you probably need to agree to the terms and conditions of the My Audi interface. Easiest to do so is by installing the My Audi app on your smartphone and login there. If necessary you will be asked to agree to the terms and conditions.
Inspired by :
FAQs
Provides asynchronous authentication and access to Audi Connect
We found that audiconnectpy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.