Wednesday, December 11, 2024
Homecyber securityCritical Automative 0-Day Flaws Let Attackers Gain Full Control Over Cars

Critical Automative 0-Day Flaws Let Attackers Gain Full Control Over Cars

Published on

SIEM as a Service

Recent discoveries in the automotive cybersecurity landscape have unveiled a series of critical zero-day vulnerabilities that could allow attackers to gain full control over vehicle systems.

These vulnerabilities, highlighted in a presentation by security researcher Amit Geynis of PlaxidityX, underscore the urgent need for robust cybersecurity measures in the automotive industry.

Series of Vulnerabilities

The first vulnerability, labeled as “Vulnerability #1,” involves an arbitrary remote code execution over the Controller Area Network (CAN).

- Advertisement - SIEM as a Service

This vulnerability exploits a `memcpy` function in an Interrupt Service Routine (ISR), which operates with the highest privileges, allowing attackers to write directly to the return address on the stack and bypass stack canaries.

Analyse Any Suspicious Links Using ANY.RUN’s New Safe Browsing Tool: Try for Free

This can be leveraged to execute Return-Oriented Programming (ROP) attacks, giving attackers full control over the system.

The second vulnerability, “Vulnerability #2,” concerns a remote code execution (RCE) over IPsec and SOME/IP-SD protocols.

Through interface fuzzing, researchers found stack overflows that could lead to the program counter pointing to invalid memory areas, with no stack canaries in place to prevent this.

This vulnerability can be chained with others to gain full control over safety-critical resources.

Furthermore, “Vulnerability #3” highlights issues with shaky cryptography in mobile apps used for remote commands.

The use of non-random, derivable keys and hard-coded master keys makes it possible for attackers to bypass authentication and impersonate legitimate sources, such as the Telematics Control Unit (TCU).

Lastly, “Vulnerability #4” involves a remote and persistent vulnerability via cellular connections.

Attackers can use binary SMS messages to trigger communication with the backend and inject arbitrary executables into the system, potentially impacting safety-critical CAN bus communications.

The presentation reads that these findings are part of a broader trend of zero-day vulnerabilities in the automotive industry.

For instance, the Pwn2Own Automotive event, hosted by VicOne and Trend Micro’s Zero Day Initiative (ZDI), discovered 49 unique zero-day vulnerabilities, with VicOne products being the only ones capable of detecting 44 of these vulnerabilities.

The prevalence of such vulnerabilities underscores the importance of proactive cybersecurity measures.

VicOne emphasizes the need for early detection capabilities and holistic security approaches to mitigate these risks.

The company’s products, including xNexus, xCarbon, and xZETA, are designed to provide comprehensive threat intelligence and vulnerability management.

In a broader context, zero-day vulnerabilities are a critical concern across various industries.

Recent reports have highlighted vulnerabilities in Windows security functions, such as CVE-2024-38217, which allows attackers to bypass the Mark of the Web protections, and CVE-2024-38193, a privilege escalation vulnerability exploited by the Lazarus Group.

The automotive industry must take these threats seriously and invest in robust cybersecurity measures to protect against these vulnerabilities.

This includes regular security audits, penetration testing, and the use of advanced threat intelligence tools to detect and mitigate zero-day vulnerabilities before they can be exploited.

In conclusion, the recent discoveries of critical zero-day vulnerabilities in the automotive industry serve as a stark reminder of the need for enhanced cybersecurity.

By adopting a proactive and holistic approach to security, the industry can better protect against these threats and ensure the safety and integrity of vehicle systems.

Strategies to Protect Websites & APIs from Malware Attack => Free Webinar

Varshini
Varshini
Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Latest articles

Resecurity introduces Government Security Operations Center (GSOC) at NATO Edge 2024

Resecurity, a global leader in cybersecurity solutions, unveiled its advanced Government Security Operations Center...

Reserachers Uncovered Zloader DNS Tunneling Tactics For Stealthy C2 Communication

Zloader, a sophisticated Trojan, has recently evolved with features that enhance its stealth and...

US Charged Chinese Hackers for Exploiting Thousands of Firewall

The US Treasury Department's Office of Foreign Assets Control (OFAC) has sanctioned Sichuan Silence...

DMD Diamond Launches Open Beta for v4 Blockchain Ahead of 2025 Mainnet

DMD Diamond - one of the oldest blockchain projects in the space has announced the...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

DMD Diamond Launches Open Beta for v4 Blockchain Ahead of 2025 Mainnet

DMD Diamond - one of the oldest blockchain projects in the space has announced the...

Microsoft Patch Tuesday December 2024, 71 Vulnerabilities Fixed Including 1 Zero-day

In its final Patch Tuesday of 2024, Microsoft has released a significant security update...

Sophisticated Celestial Stealer Targets Browsers to Steal Login Credentials

Researchers discovered Celestial Stealer, a JavaScript-based MaaS infostealer targeting Windows systems that, evading detection...