A recent security breakthrough has revealed a method to execute root-level commands on the navigation system of a 2014 Renault Latitude. The compromised unit, a TomTom Carminat LIVE, operates on a custom-built Linux 2.6.28.10 system, highlighting vulnerabilities in outdated in-car software.
Discovering the Security Flaw
Security researcher Rasmus Moorats stumbled upon this flaw while attempting to adjust the clock post-daylight saving time in Estonia. The absence of a ‘Set time’ option and the inability to access the settings menu without an authentic map SD card led to further investigation. Analysts from NNS.ee identified the issue as stemming from how the unit processes a script file from the SD card.
The investigation revealed a series of minor vulnerabilities that, when combined, permitted full device control. This issue is not isolated, as similar risks have been documented in newer vehicles, such as the PerfektBlue Bluetooth vulnerabilities.
Mechanics of the Exploit
Despite being software from 2011, the system boasts significant security features, including read-only and ‘noexec’ partitions, alongside a DRM check for SD cards. However, Moorats employed an emulator to safely dissect the unit’s behavior, identifying a critical script file, master.script, which runs with root privileges.
The exploit was facilitated by two key commands: SHEX, which runs system programs without arguments, and LOG, which has a path traversal bug allowing unintended file access. By manipulating these commands, Moorats could exploit the system to execute root commands.
Implications and Future Risks
While the hack required physical access to the vehicle, the potential for misuse remains. A malicious actor could insert a prepped SD card, leveraging the system’s flaws. The broader issue lies in the design, where removable media is trusted, and scripts are executed with root access.
These vulnerabilities are not unique to older models. Recent discoveries in newer car systems, like the Nissan Leaf, show similar flaws. The persistence of these issues underscores the need for ongoing vigilance and updates in automotive software.
Protective Measures for Car Owners
Car owners are advised to avoid using unverified SD cards and USB devices in their vehicle’s head unit and to purchase map updates only from reputable sources. It’s also prudent to inquire with dealers about available security patches.
In conclusion, as vehicles continue to evolve technologically, so do the potential security risks. Ensuring robust security measures and regular updates is crucial for safeguarding against such vulnerabilities.
