BMW, Ford, Nissan Hacked: use vulnerable modems

Problems with BMW, Ford, Infiniti and Nissan vehicles. A team of three security researchers discovered two security flaws in TCU (telematics control unit) components contained in various models αυτοκινήτων που συνδέονται στο διαnetwork.

TCUs are 2G modems που αποστέλλουν και λαμβάνουν δεδομένα από το εσωτερικό σύστημα ενός αυτοκινήτου. Χρησιμοποιούνται σαν διεπαφή μεταξύ του αυτοκινήτου και των εργαλείων απομακρυσμένης διαχείρισης, όπως οι web panels και οι εφαρμογές για cell phones.

The researchers found the defects in the TCU manufactured by Continental AG, and more specifically TCUs using the S-Gold 2 (PMB 8876) cellular baseband chipset.

Thus, according to a notice issued by the Department of Homeland Security (DHS), the following car models use vulnerable TCUs:

Both defects involve a buffer Overflow in the TCU element that processes the AT commands (CVE-2017-9647) and a flaw that allows attackers to run code via one of the internal elements of the TCU (baseband radio) (CVE-2017-9633).

In the first vulnerability, the attacker would need physical access to the target car, while the latter may take advantage of remote locations. The exploits code (Proof-of-concept or PoC) is available for both defects.

The car makers involved said the defects allow attackers only access to the car's entertainment system and not to critical operations such as braking, engine control or vehicle doors.

BMW said it would "provide service to affected customers" and Nissan said it would turn off 2G modems (TCUs) for all affected customers for free. This measure also applies to owners of Nissan-owned Infiniti cars.

Ford said it started disabling all 2G modem from last year, 2016. The company has told ICS-CERT that there are very few 2G modems on the market.

Security researchers Mickey Shkatov, Jesse Michael and Oleksandr Bazhaniuk from McAfee's Advanced Threat Research Team presented their findings at the DEF CON security conference held in Las Vegas last week. (PDF)