Backdooring of Real Time Automotive OS Devices
summary
A buffer overflow in a CAN‑FD handler copies a 64‑byte CAN‑FD frame into a smaller buffer, letting attackers overwrite pointer primitive so a subsequent frame writes anywhere. The vulnerable code runs in an interrupt in supervisor mode, enabling a ROP call to leak AES keys, placement of 32‑byte RH850 shellcode into an executable copy location, and use of an existing watchdog kick routine to avoid reboots. Attackers map the LED GPIO to blink proof of concept, disable the MPU via a writable register, fragment payloads into a code cave, and trigger a persistent backdoor by patching a periodic task with a magic‑number hook.
AI-written summary · about
chapters (13)
- 0:00Introduction to speakers
- 0:45Automotive background
- 2:21The research challenge
- 4:08Compromising embedded systems
- 6:15Technical details of the ECU
- 8:35Buffer overflow vulnerability
- 10:45Information leak exploit
- 12:48Arbitrary code execution
- 14:37Bypassing the watchdog timer
- 17:19Demonstration and results
- 18:44Persistent malware creation
- 21:28Malware trigger mechanism
- 24:18Impact and conclusion
related talks
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
41mSecrets Of Simos18: REng The Secure Boot Mechanism Of An ECU
41mIt's easier to break than to patch: a stealthy DoS attack on CAN
40mUnlocking the Drive: Exploiting Tesla Model 3
51mArm IDA and Cross Check: Reversing the Boeing 787's Core Network
51m0-days & Mitigations: Roadways to Exploit and Secure Connected BMW Cars