Mirza madeinyugo

Help me identify possible tracking device found in my car

TL;DR

I found a non-OEM electronic gadget in my car. It is wired into the ignition, and contains a 435.10 MHz radio reciever, a microcontroller, and two relays. I suspect it might be a device that allows third parties to unlock the doors and start the car with a radio.

Details

I was driving my 2020 Honda Insight EX when it started to make the annoying sound of an electromechanical relay rapidly switching on and off. When I got home I looked under the dash and straight away I could see someone other than Honda had been in here. The first thing I saw was this surface-mounted switch that doesn't belong there.

Background

CVE-2022-21882 is a Win32K LPE vulnerability.
CVE-2022-21882 bypasses CVE-2021-1732.
Microsoft had patched CVE-2021-1732 back in February's patch tuesday of last year.
Microsoft had patched CVE-2022-21882 just recently in January's patch tuesday.
CVE-2022-21882's PoC is now public.

	#!/usr/bin/env bash
	#===========================================================================
	# Works only with the official image available in the Mac App Store.
	# Make sure you download the official installer before running this script.
	#===========================================================================

	# Change this at your desire. Sometimes this works out of the box, sometimes not.
	# Default size: ~16 GB
	DISK_SIZE="15361m"

	# Parameters for source and destination for the Image file
	# Current script is edited to put the same image on LockScreen and Wallpaper

	$WallpaperURL = "bloburl from azure" # Change to your fitting
	$LockscreenUrl = "bloburl from azure" # Change to your fitting

	$ImageDestinationFolder = "c:\temp" # Change to your fitting - this is the folder for the wallpaper image
	$WallpaperDestinationFile = "$ImageDestinationFolder\wallpaper.png" # Change to your fitting - this is the Wallpaper image
	$LockScreenDestinationFile = "$ImageDestinationFolder\LockScreen.png" # Change to your fitting - this is the Lockscreen image

	$source = "https://download01.logi.com/web/ftp/pub/techsupport/unifying/unifying252.exe";
	$destination = "c:\Temp\unify.exe";
	$checkInstalled = "C:\Program Files\Common Files\LogiShrd\Unifying\DJCUHost.exe";


	#Check if software is installed. If installed terminate script

	if ((Test-Path $checkInstalled)) {
	write-host "Software already installed"
	}

	#remove dell bloatware

	$remediationscript =@"
	REM UNINSTALL SCRIPT-----------------------------------------------------------------------------------------------------
	REM If you are looking to add applications to this list, search the registry for the string that is listed in the Programs and Features menu until you find the "UninstallString"
	REM These usually can be found in:
	REM HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\ and then the SID\Product folders.
	REM HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
	REM HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
	REM There may be multiple uninstall strings for the same application, add all of them here. As the dell applications are updated over time, the applicationID can change.

	::====================================================================
	:: Powershell script launcher
	:: ref: https://stackoverflow.com/questions/10137146/is-there-a-way-to-make-a-powershell-script-work-by-double-clicking-a-ps1-file
	::=====================================================================
	:MAIN
	@echo off
	for /f "tokens=*" %%p in ("%~p0") do set SCRIPT_PATH=%%p
	pushd "%SCRIPT_PATH%"

	powershell.exe -sta -c "& {.\%~n0.ps1 %*}"

	##########
	# Tweaked Win11 Initial Setup Script
	# Primary Author: Disassembler <disassembler@dasm.cz>
	# Modified by: alirobe <alirobe@alirobe.com> based on my personal preferences.
	# Modified by: @DanielLarsenNZ - based on my personal preferences. Some additions for Windows 11
	# Version: 2.12.2, 2021-12-11
	# Primary Author Source: https://github.com/Disassembler0/Win10-Initial-Setup-Script
	# Tweaked Source: https://gist.github.com/alirobe/7f3b34ad89a159e6daa1/
	# Tweak difference:
	#

	using namespace System.Collections.Generic


	# Encapsulate an arbitrary command
	class PaneCommand {
	[string]$Command

	PaneCommand() {
	$this.Command = "";
	}

	##################################################################
	#
	# Requires Windows PowerShell v2 - v5
	# Will not work in PS 7+ due to lack of ParsedHtml functionality
	#
	##################################################################

	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
	$skuPage = Invoke-WebRequest "https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-service-plan-reference"

Mirza madeinyugo

Help me identify possible tracking device found in my car

TL;DR

Details

Background

Detection