Telematics torched in BMWs, Infinitis, Nissan Leaf and some Fords A bunch of mid-age Ford, Infiniti, Nissan and BMW v
Telematics torched in BMWs, Infinitis, Nissan Leaf and some Fords
A bunch of mid-age Ford, Infiniti, Nissan and BMW vehicles are carrying around a vulnerable chipset from Infineon that America’s ICS-CERT reckons is easy to exploit.
The BMWs went on sale between 2009 and 2010, the affected Infiniti models were built between 2013 and 2015 and there’s a chance Nissan Leafs manufactured between 2011 to 2015 have bugs. A handful of Ford hybrids may also be in trouble.
In IT terms a 2009 product is close to end-of-life; a car that age might still be covered by an extended warranty (and in Australia, by parts of the 10-year statutory warranty).
Infineon’s contribution to the problem is a 2G baseband chipset, the S-Gold 2 (part number PMB 8876), used by upstream German vendor Continental to produce telematics control units (TCUs).
The first vulnerability is a stack-based buffer overflow that ICS-CERT says is only exploitable by an attacker with physical access to the car.
Old-timers will get nostalgic and weepy at this point: the vulnerability is exposed by the modem’s AT command set. As detailed in this DEFCON presentation (PDF), the commands are AT+STKPROF, AT+XAPP, AT+XLOG and AT+FNS.
The second â which is remotely exploitable if you can get a 2G connection â lets an attacker âaccess and control memoryâ for âremote code execution on the baseband radio processor of the TCU.â
The discoverers, McAfee researchers Mickey Shkatov, Jesse Michael and Oleksandr Bazhaniuk, note in the presentation that the exploits for the firmware in question were outlined by Ralf-Philip Weinmann in the iOS Hacker’s Handbook in 2016.
So, as ICS-CERT says, âpublic exploits are availableâ.
The best mitigation, it seems, is to deactivate the TCU, which Nissan and Infiniti and Ford (since last year) are implementing; BMW told ICS-CERT it will put a program in place for customers. Â®