~/talk

0-days & Mitigations: Roadways to Exploit and Secure Connected BMW Cars

on YouTube 51m
Talkat Black Hat USA 2019 · 2019-08-03..08-08· [security, embedded-and-hardware]

speakers

name:Zhiqiang Cai
links:none on file
name:Aohui Wang
links:none on file
name:Wenkai Zhang
links:none on file
name:Michael Gruffke
links:none on file
name:Hendrik Schweppe
links:none on file

resources

video:https://youtu.be/HS8MoFa0TNs
slides:none on file

summary

Researchers disclose multiple exploitable bugs: a race condition in the diagnostic service lets an attacker win a TOCTOU to write a signed update and get root via USB or OBD; a stack buffer overflow in navigation map update (no canary, ASLR off) yields code execution; a provisioning MD5/HTTP flaw plus hardcoded NGTP keys and SMS triggers let a fake GSM (USRP/OpenBTS) force updates, exploit an out‑of‑date WebKit UAF for a browser shell, escalate to CAN transmit and craft UDS to reach other ECUs; mitigations roll out OTA—86% first attempt, 96% after retries.

AI-written summary · about

chapters (10)

  1. 0:00Introduction and agenda
  2. 1:00Background and timeline
  3. 2:58BMW vehicle components
  4. 7:26Rooting the head unit
  5. 14:00Navigation update attack
  6. 16:27Telematic box exploitation
  7. 23:05Telematic box vulnerability
  8. 29:39Gateway and ECU attack
  9. 37:12BMW incident response
  10. 44:22Countermeasures and takeaway

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.