Kia Connect (the new app) do not work

benisen

Kia just launched a new app (to see battery charge, turn on climate, etc) and the first 1-2 days it worked fine. Then suddenly it didn't. I get the following error message:
https://drive.proton.me/urls/49KHDXK60R#ylUkX6xczFTP

It's also bold with "For your safety...". What. That is why I am using GrapheneOS.

However, anyone know if I can do anything to fix this?

fgafr

benisen

Hello,

Same problem here since the app updated this week. Unfortunately I don't think there's a solution except reporting to Kia that the way they check for OS integrity is biased and reports wrongfully that GOS is rooted.

This kind of subjective bas already been discussed on thé forum about other applications. If my memory is right it's related to attestation ans developpers not using hardware attestation that GOS fully supports.

The only way seems to report to developpers for them to change the way they check for OS integrity.

Hope this helps

MarcelloTogg

I noticed the same thing. Version 1.0.16 still works. I reinstalled it from an alternative app store. I sent a support message to Kia Connect Support. Please do the same. The more messages, the better.

fgafr

MarcelloTogg

Hello,

Also sent a message to the support.

I tried without success enabling exploit protection compatibility mode, but the app launched successfully when disabling secure app spawning, a solution proposed in a thread on this forum regarding another app.

Not sure about the security and privacy consequences of this setting.

benisen

MarcelloTogg

What alternative app store if I may ask?

And yes, I will write to Kia regarding this.

JuanCorbalan

fgafr
Good morning.
Could someone please tell me how to disable secure application generation? I can't find it in the Graphene OS menus.
Build number: 2025120401.

MarcelloTogg

benisen i installed the APP Form apkpure. Choose the Version .16 !

sigio

Same, kia app worked until earlier this week, and reports the following since today:

'A Security risk had been detected on your device. The service cannot be used." .... I've had this issue before (a year ago or so) on LineageOS, so I was glad it worked great again on Graphene. Lets hope there's a fix/workaround quickly.

fgafr

sigio
Hello,

A quick dix that seems to work is disabling the secure app spawning un exploit protection launch Kia app then enabling secure app spawning again.

Might do the job until Kia app is updated and as far as you trust enough this app to lower the exploit protection provided by GOS. Unfortunately I'm not able to evaluate the risks of this workaround.

MarcelloTogg

MarcelloTogg sorry, from apkpure...

ThisIsMe

MarcelloTogg

That might be a workaround for now, but the day will probably come where this version will not be accepted for connections from the Kia servers any longer.

But given Kia/Hyundai's IT-security history, it kinda fits, that they detect GrapheneOS as a security risk...

MarcelloTogg

I received a reply from Kia Connect. Quite cheeky: they told me to buy a mobile phone with original Google Android! Copy of the text (translated by Deepl).
Dear Sir
Thank you for your patience.
The Kia Connect app has been specially developed and optimised for use on devices running Google's official Android operating system. This ensures full functionality and compliance with our security standards.
If you are using a custom operating system such as GrapheneOS, you may unfortunately experience restrictions or limited usability of the app, as it may be identified as a security risk.
To use the Kia Connect app safely and without restrictions, we recommend that you use a device with the official Android operating system.
We hope this information is helpful and that you will soon be able to use the Kia Connect app as usual.
Kind regards,
Your Kia Connect Team

ThisIsMe

November update also broke the app for me. Wrote to Kia, got the same snarky response "sorry - but nothing we can do". I think this does not align with EU law , so I will see whether to involve a lawyer.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L0770

It worked, they patched and broke it. So, if you have the same problem, write to them and don't let it slide!

chinook

ThisIsMe probably this way: https://github.com/Hyundai-Kia-Connect/kia_uvo

ThisIsMe maybe the good angle would be to both point it's unnecessarily anti-consumer (forcing to use proprietary services while perfectly fine Hardware Attestation is rejected), and actually exposing you to the risk of theft or injury -- since Kia is forcing you to purchase another device directly supported by Google, you choose the cheapest supported one because come on, no one is spending another grand on a fancy car key, and that cheapest phones is (say), 10 years old and unpatched since 8 years, with, say, 50 critical RCEs and zero-click vulnerabilities.

(the exact oldest/cheapest phone that works would have to be found. I'll get myself one too :) )

fgafr

Got the same answer to use stock os. As long as it works I'll stick to the workaround of disabling secure app spawning launching the Kia app and enabling it again. This allows to use the app installed from the Play store

ThisIsMe

fgafr
doesn't work for me though - same error

benisen

Sad that KIA/Hyundai are so anti-comsumer. I guess they think that a few unhappy customers doesn't matter, and maybe they are right but seems like a small thing to make it work for us too.

Anyway, I realised that I can get almost everything working with the Home Assistant integration instead. At least they fuck that up too.

ThisIsMe

benisen
What do you mean with Home Assistant? How is this related to the Kia app? Now I'm confused.

ThisIsMe

chinook wow - that looks quite interesting. I shall try that! Thanks!

regarding theft - google "Kia gameboy" :D
Kia is not exactly a poster child when it comes to IT security - in fact, the EV6 was one of the most often stolen cars lately, if memory serves.

So I guess, their attestation / safetynet tries are just desperate ways to be able to say "we did what we could" later.

chinook

ThisIsMe

desperate ways to be able to say "we did what we could"

Wow, I didn't hear about 'Kia gameboy' - I was seriously considering getting Sportage, maybe I should postpone it ;D
But in the light of that maybe that's just a checkbox exercise from them? Maybe they got bollocked in some audit and now they're pretending they're "doing something?"

Of course any reasonable internal IT would show them this is stupid route (by proving how ancient + unpatched + rooted phone passes it), but hey, improvements for the next audit!

whoami

Since updating the Kia app to version 1.0.17, I keep getting a message saying that my device has an open bootloader. Which is obviously not true. It seems that a generic error message is being displayed?

I wrote to Kia Connect and received this reply.

Translated into English:
Dear Mr. XXX,
Thank you for your patience.
The Kia Connect app has been specially developed and optimized for use on devices running Google's official Android operating system. This ensures full functionality and compliance with our security standards.
If you are using a custom operating system such as GrapheneOS, you may unfortunately experience restrictions or limited usability of the app, as it may be identified as a security risk.
To use the Kia Connect app safely and without restrictions, we recommend using a device with the official Android operating system.
We hope this information is helpful and that you will soon be able to use the Kia Connect app as usual again.
Kind regards,
Your Kia Connect Team

I installed version 1.0.15 (68) via the Aurora Store. It works, but I can't say how long you can log in with this version.