Critical Automative 0-Day Flaws Let Attackers Gain Full Control Over Cars

Recent discoveries in the automotive cybersecurity landscape have unveiled a series of critical zero-day vulnerabilities that could allow attackers to gain full control over vehicle systems.

These vulnerabilities, highlighted in a presentation by security researcher Amit Geynis of PlaxidityX, underscore the urgent need for robust cybersecurity measures in the automotive industry.

Series of Vulnerabilities

The first vulnerability, labeled as “Vulnerability #1,” involves an arbitrary remote code execution over the Controller Area Network (CAN).

This vulnerability exploits a `memcpy` function in an Interrupt Service Routine (ISR), which operates with the highest privileges, allowing attackers to write directly to the return address on the stack and bypass stack canaries.

Analyse Any Suspicious Links Using ANY.RUN’s New Safe Browsing Tool: Try for Free

This can be leveraged to execute Return-Oriented Programming (ROP) attacks, giving attackers full control over the system.

The second vulnerability, “Vulnerability #2,” concerns a remote code execution (RCE) over IPsec and SOME/IP-SD protocols.

Through interface fuzzing, researchers found stack overflows that could lead to the program counter pointing to invalid memory areas, with no stack canaries in place to prevent this.

This vulnerability can be chained with others to gain full control over safety-critical resources.

Furthermore, “Vulnerability #3” highlights issues with shaky cryptography in mobile apps used for remote commands.

The use of non-random, derivable keys and hard-coded master keys makes it possible for attackers to bypass authentication and impersonate legitimate sources, such as the Telematics Control Unit (TCU).

Lastly, “Vulnerability #4” involves a remote and persistent vulnerability via cellular connections.

Attackers can use binary SMS messages to trigger communication with the backend and inject arbitrary executables into the system, potentially impacting safety-critical CAN bus communications.

The presentation reads that these findings are part of a broader trend of zero-day vulnerabilities in the automotive industry.

For instance, the Pwn2Own Automotive event, hosted by VicOne and Trend Micro’s Zero Day Initiative (ZDI), discovered 49 unique zero-day vulnerabilities, with VicOne products being the only ones capable of detecting 44 of these vulnerabilities.

The prevalence of such vulnerabilities underscores the importance of proactive cybersecurity measures.

VicOne emphasizes the need for early detection capabilities and holistic security approaches to mitigate these risks.

The company’s products, including xNexus, xCarbon, and xZETA, are designed to provide comprehensive threat intelligence and vulnerability management.

In a broader context, zero-day vulnerabilities are a critical concern across various industries.

Recent reports have highlighted vulnerabilities in Windows security functions, such as CVE-2024-38217, which allows attackers to bypass the Mark of the Web protections, and CVE-2024-38193, a privilege escalation vulnerability exploited by the Lazarus Group.

The automotive industry must take these threats seriously and invest in robust cybersecurity measures to protect against these vulnerabilities.

This includes regular security audits, penetration testing, and the use of advanced threat intelligence tools to detect and mitigate zero-day vulnerabilities before they can be exploited.

In conclusion, the recent discoveries of critical zero-day vulnerabilities in the automotive industry serve as a stark reminder of the need for enhanced cybersecurity.

By adopting a proactive and holistic approach to security, the industry can better protect against these threats and ensure the safety and integrity of vehicle systems.

Strategies to Protect Websites & APIs from Malware Attack => Free Webinar