I think I'm getting the picture now, it uses the Onstar antenna for Enhanced Listening Experience. I could care less about that, and I think you are correct about having the radio on Sirius. If I have it on FM it may not display that message when I start the car initially. I don't have anything disconnected to my knowledge.
Thanks for the reply and info!

 

I called OnStar and told them do not want them to collect any data from my vehicle. I told them I don't want any of the free trials at all. I read an article that GM says collection has stopped, but I don't trust it because they already violated everyone's trust. I mainly did this because I don't want my hard braking and acceleration tracked and sold to data brokers (and subsequently to the insurance companies) as everyone finding this thread is probably aware of.

I get a "no OnStar connection available" warning message that only shows up when switching to Sirius XM, or when the car starts if Sirius XM was the last selected audio source when the car
was turned off. Is there any way to disable the OnStar warning when SiriusXM starts?

The OnStar light is off, was green before I requested all data reporting services be disabled. Wireless Android Auto is still fully functional from what I can tell. Wi-Fi Hotspot is still broadcasting signal and there is no option to turn it off, even though when looking it up I see it is possible in other GM vehicles. I can set a long password but that's about all I can do to make sure no one is trying to connect to my car's access point. I'd rather have this off but... Does the WiFi Hotspot need to stay on for the use of Wireless Android Auto? Upon doing research and observing my phone and the cars behavior, I discovered that Wireless Android auto uses WiFi because Bluetooth is not enough bandwidth. The WiFi Hotspot needs to be on for the phone to connect to for this purpose. But it must bypass the wireless authentication while it's connected to Bluetooth because I can change the password and never have to enter it. That being said, disabling the Hotspot feature may actually break Wireless Android Auto if I try. So I'll set the SSID to something funny and a 24 character gibberish password for now unless anyone has further insight into the matter.

 

"I get a "no OnStar connection available" warning message that only shows up when switching to Sirius XM, or when the car starts if Sirius XM was the last selected audio source when the car
was turned off. Is there any way to disable the OnStar warning when SiriusXM starts?" I dont think so. XM 360 L (described your owners manual) requires a connection to the internet. I think whenever XM is enabled as the source, its going to remind you that there is not internet connection.

" Wireless Android Auto is still fully functional from what I can tell. Wi-Fi Hotspot is still broadcasting signal and there is no option to turn it off, even though when looking it up I see it is possible in other GM vehicles. - " There is no option to turn it off. However, you must enable it to connect before it will connect to an external device or network. There is no evidence that it will connect to a network of opportunity without owner permission. In fact it would be a security risk if it did, and there is even a caution in the manual that warns not to connect to unknown networks. However, if you do allow it to connect, it is unclear how much data it will share, if any, via that path . We do know that it will receive OTA via the WifFi connection if you connect it.


."Does the WiFi Hotspot need to stay on for the use of Wireless Android Auto? Upon doing research and observing my phone and the cars behavior, I discovered that Wireless Android auto uses WiFi because Bluetooth is not enough bandwidth. The WiFi Hotspot needs to be on for the phone to connect to for this purpose. But it must bypass the wireless authentication while it's connected to Bluetooth because I can change the password and never have to enter it. " Yes every time you phone connects it uses BT to first establish the connection, but it quickly switches to WiFi to support the carplay capability. I believe that when you first connect it (the first time you ever connected it)r, you must authorize it on you device and in the car. Once authorized, it remembers that specific device, and your device remembers the car. No password needed after that. But anyway, you can go into the car menu and "forget" a device, and also go into a device (phone) menu and "forget" the car . Once done, you will need go through the process of authorizing the connection to your phone. That may require entry of a password - its been a while since I did that.

 

Well SiriusXM still works, I was listening to it while sitting in the car. I don't have the car connected to my home WiFi and don't intend to. I don't know what sort of updates a car should need after I buy it, but I believe you can do updates over WiFi if you're not paying for OnStar etc based on conversations I've seen in forums and Facebook groups in the past week since I've had the car.

Regarding the rest of your post, I'm not referring to the car connecting to WiFi, but rather hosting an access point of its own. See below image. The car broadcasts its own access point that cannot be hidden and can only have its SSID changed and a 24 character alphanumeric password set. If my car is running, everyone around me wherever I am can search for WiFi on their phone/tablet/laptop/car and see "big dick randy" as an access point and try to connect to it. Because my car doesn't have Internet/OnStar, if they were to somehow compromise the password, they would not be able to use the Internet. But they would be wirelessly connected to my car and could do who knows what. I work in Cybersecurity and I do not want ANYONE trying to connect to my car or sniffing anything over the airwaves it may be sending out or sending it things it might be listening for. The car at this point is basically acting as a wireless router.

Regarding wireless android auto, thank you for explaining and confirming what I thought. When I connect to it, my phone's WiFi shows as connected to "big dick randy", AKA the network mentioned above. This is why I suspect that it's impossible to disable the access point and doing so would break wireless android auto anyway. That's just putting together the logical answer, but I'm not 100% certain it's true.

 

Can someone actually connect to your hotspot? You have the Share Hotspot Data disabled. Have you tested to see if the hotspot ID is being broadcast and, if it is, that you can actually connect to it?

 

I spent hours in my car going down every menu to turn everything off, WiFi, Hotspot, OTA, FUGM off…. That’s a good question…. Did I turn the Hotspot off? (not sure) and if it’s off does it still show up on devices looking for a network?

Thats a shifty/scary thought… any device would theoretically need to get past the password and maybe driver authorization?

I don’t remember but I do remember I hate this **** 🤦‍♂️ and would gladly give up car play android all of it to leave this crap out of my car. My phone works fine… don’t need my car to duplicate my phone…. Kind of like them to be separate…. it’s just not a big deal to get my phone screen to appear on the car infotainment screen… does this really change people’s lives?

 

"Well SiriusXM still works, I was listening to it while sitting in the car. I don't have the car connected to my home WiFi and don't intend to. I don't know what sort of updates a car should need after I buy it, but I believe you can do updates over WiFi if you're not paying for OnStar etc based on conversations I've seen in forums and Facebook groups in the past week since I've had the car." Yes, Sirius XM Radio Service and Sirius XM with 360 L are different XM features described in the manual. Sirius XM Radio works and receives satellite signals via the XM antenna that is part of the high frequency (multipupurpose) antenna under the left front fender. Its one-way, receive only. But you cant (according to the manual) access the special XM 360 L features that require an internet connection. The manual describes it like this: "SiriusXM with 360L interface has enhanced in-vehicle listening experience for subscribers. The experience now offers more categories and system learned recommendations toward discovering more personalized content. To use the full SiriusXM 360L program, including streaming content and listening recommendations, OnStar Connected Access is required......". This internet connection would also allow XM to share information via the 4G connection. I don't subscribe to any of it, so I can't really say more about it. What I'm saying is just what I can read in the Owners Manual and the Service Manual.

Regarding the rest of your post, I'm not referring to the car connecting to WiFi, but rather hosting an access point of its own. See below image. The car broadcasts its own access point that cannot be hidden and can only have its SSID changed and a 24 character alphanumeric password set. If my car is running, everyone around me wherever I am can search for WiFi on their phone/tablet/laptop/car and see "big dick randy" as an access point and try to connect to it. Because my car doesn't have Internet/OnStar, if they were to somehow compromise the password, they would not be able to use the Internet. But they would be wirelessly connected to my car and could do who knows what. I work in Cybersecurity and I do not want ANYONE trying to connect to my car or sniffing anything over the airwaves it may be sending out or sending it things it might be listening for. The car at this point is basically acting as a wireless router. Yes. I do understand the different connections. When you car acts as a hotspot, other devices see your car as an external network, to which they can connect. And connected devices show up under the menu item you posted, the WiFi hotspot. And that also is the way a device connects to support car play. The other "WiFi" connection is when your car connects to an external network or an external hotspot such as your phone in hotspot mode - and the connection shows up under the other menu item in the car - WiFi Networks. I have tested those connections. But...I would be surprised if a device could connect to your car "hotspot" without permission from the car. I think once it has been previously paired, it will remember the device even if you change passwords. You could test it with a device that was never paired, or you could forget a device and see if it will still connect. I don't think it will. During some of my testing, I did "forget" my phone in the car menus, and I had to re-pair it before it would connect.

Regarding wireless android auto, thank you for explaining and confirming what I thought. When I connect to it, my phone's WiFi shows as connected to "big dick randy", AKA the network mentioned above. This is why I suspect that it's impossible to disable the access point and doing so would break wireless android auto anyway. That's just putting together the logical answer, but I'm not 100% certain it's true. I did not look to see if the car hotspot can be disabled. But I do think other devices can't connect to it without permission. I see you noted you were in cybersecurity, so I'm sure you know that there are often workaround - so I would not say its "impossible" to connect - but I think one would have to by pass the normal security features.

 

Mine is "NSA Surveillance Car", but my security work tends more towards the hardware side of things

 

Yup, you can see "big dick randy" on the list of access points as long as the car is on. People on their phones at a car meet looking for WiFi will see this. No way to hide it. Haven't tried connecting with my laptop but good little exercise to try. Since I have no OnStar signal, they wouldn't be connecting to the Internet, but they would be able to "Talk" to my infotainment system after connecting to it. Same way if I sit outside your house with a laptop and connect to your bluetooth speaker, I can start sending it music. Or connect to your router and tell it to shut off. It's more complicated than that but not trying to put anyone to sleep with "work talk."

I'm not sure what this could accomplish, it's not like a Tesla where you can control the driving functions remotely but being that the infotainment system has an operating system, memory, hard drive... I could theoretically load nasty stuff into memory, onto the hard drive and execute scripts, or just poke around in the data on the hard drive and possibly steal some info. I'm not familiar with the vulnerabilities, exploits, and consequences of a post-exploitation scenario, but I could research them and learn more about the operating system and how to make it do things it's not supposed to do. It's just another computer just like a Windows Laptop, a Linux server in Amazon Web Services, an iPhone, or the controllers for traffic lights and the dot matrix roadway signs. All can be hacked, compromised, whatever you want to call it, and being wirelessly accessible (especially with your everyday WiFi protocol) just means someone can do that without standing in front of it or plugging into it.

But... do I care that much? You have to evaluate the likelihood along with the consequences/impact. Even if I figure something bad out, the likelihood with a 24-character password of someone connecting is low. And what can I do about it if I did care that much? Rip out the antenna and mess up other functionality? Give GM a report on their vulnerability they missed and do their jobs for them hunting for vulnerabilities in their software? Have GM blame a third party that developed the infotainment system and its operating system?

I love android auto and it's one of the technologies I actually WANT, but now they have it integrated into things I DON''T want...

 

Another reason I never connect my phone to my car…. I don’t want my contacts loaded into my car to be available to hackers or a dealer employee who is pissed and ready to quit so they have nothing to lose from routing around in customers vehicles…

I love high performance cars and driving. I have no interest in connectivity…. Sports cars are to disconnect and enjoy the power of man, machine and the open road…..

 

While it would be nice to be able to turn off the Wi-Fi hotspot entirely, people are making it sound like random strangers are able to connect to it. Simply not true. While WPA2 encryption may not be ideal, you REALLY need to know your **** and have specialized tools and a great deal of time to hack it, and there's no pay off for that investment. Without knowing your password, all people are going to see is the SSID of the wifi network, There's not much they can do with that. For all practical purposes, there's not really a security issue here.

 

I was hoping it was WPA2 and not WEP, lol. I agree with everything you said and going back to the risk vs reward model for an attacker, there's really nothing worth anyone's time to gain from trying to use tools like aircrack-ng to compromise your password and connect to your car. Maybe if they had uninterrupted access to it for a week, but not sitting idle at a car meet or parking lot. I've already put this down as something I'm not going to invest more time into for this car, too many other things to worry about as a new owner.

 

I'm a little surprised that there isn't an option to turn off the wi-fi hotspot on a 2024. I have the capability to turn it off on my 2020 (as I remember).

 

My 2021 does not have an option in the in car menu to turn of the vehicle's hotspot. However, my manual, and also the 2024 manual, indicates that the MyChevrolet Mobil App allow you turn the vehicle's hotspot on/off.

I did confirm also that I have options to forget devices - under Phones it shows phones I have connected with in the past and if I click the (i), for information, I can "forget" the phone. The same with networks I have connected with under the Networks menu. I can "forget" the networks.

When the hotspot menu is displayed, I have an option to "share data". The purpose of that, however, is to allow, or prevent, connected devices from using the data from the built in 4G connection, if you have a subscription. If you have no data plan, that item is irrelevant. Regardless, that item neither prevents, nor allows a device to connect - it only allows data to be shared or not shared with connected devices.

I continue to believe that the car will not allow a device to connect to the car hotspot without permission from in the car (the first time). And the same with the car connecting to external networks. It will not connect unless you ask it to. But once set up, for either type of connection it will automatically connect. To stop it, you must "forget" the device or network.

I do, however, believe its possible for a dealer to connect you car to a network for maintenance purposes or whatever - but I do not know if that is routinely done.

 

I verified that I can enable/disable the hotspot on my 2020. It is under Settings>Wi-Fi Hotspot. And this is from my 2020 Infotainment manual:
Wi-Fi Hotspot
Touch and the following may
display:
. Wi-Fi Services: This allows
devices to use the vehicle
hotspot.
Touch the controls on the
infotainment display to disable or
enable.

 

Yeah, I have that statement too in my manual - but I did not see it in the menu. I'll look again for it.

That statement seems missing from the 2024 manual, but it says this instead:

After initial set-up, your vehicle’s Wi-Fi
hotspot will connect automatically to your
mobile devices. Manage data usage by
turning Wi-Fi on or off on your mobile
device, using the myChevrolet mobile app,
or by contacting an OnStar Advisor. On
some vehicles, Wi-Fi can also be managed
from the Wi-Fi Hotspot menu.

 

It was the first hotspot setting on mine.

 

That assumption is correct… the C8 4G cellular connection is through AT&T.

Along the same lines… my wife’s phone has AT&T and struggles for signal at home however I have Verizon and it works fine…

 

I checked for updates through the infotainment screen using OnStar before I disabled it and was told there were none. I found pictures of other GM cars where they had an extra setting I don't have to turn it off. Does your 2020 have wireless Android auto? I have a theory that maybe the menu item isn't there to prevent me from breaking Wireless Android auto. Maybe it's because I already paired the phone using it then the option was taken away?For some reason wired Android auto doesn't work on my Galaxy Note 8. The phone disconnects and reconnects repeatedly and then gives an error that says something about the time and date not being correct on the car. I checked and that's not the case, so I'm guessing my dated phone with Android 9 is just too old to work with the car 🙄... Just like the MyChevrolet app which the play store tells me isn't compatible with my phone, meaning they only made it compatible with newer android versions than I have. And since those updates are pushed by carriers (I think), my phone is stuck on 9.

I just get in the car and connect to Bluetooth and wireless Android auto works, and then I plug my phone into the USB. Since GM decided to put the 12V in the least convenient spot possible for the driver. I like the wireless charging pad too, but wireless charging is slow compared to wired.
Here's a picture of my Settings > Wi-Fi Hotspot menu in my 2021 2LT. Notice there is no scroll bar. Since I disabled OnStar already, the website for myChevrolet indicates the car is not connected and therefore I can't access any settings related to it. I have not tried the mobile app because I have a Galaxy Note 8 that can't have newer than Android OS 9 without rooting and installing a custom ROM (too much work, I used to do it back in the day though). The app shows in the Google Play Store as not compatible with my phone.

 

You could be correct that they removed the option to turn off the hotspot when they added wireless AA/CarPlay. My 2020 only supports wired AA/CarPlay. It will be interesting to see if @Andybump responds on if he has the ability to disable the hotspot on his 2021 which supports wireless AA/CarPlay.