Vehicle cybersecurity still lacking: Ford Focus and Volkswagen Polo

Vehicles are becoming increasingly connected and complicated. The modules/equipment in the vehicle along with the connectivity makes the newer vehicles targets with many attack vectors. With these advances, the consumer would think cybersecurity would be the first thing on the engineer’s mind. Unfortunately, this is not always the case. It is likewise notable, there are many laws and statutes directed at the vehicles for emissions and other aspects of the vehicle. While these are indeed needed, there are no laws focused on the cybersecurity applied to vehicles. There is a handful of these in the works, however, at this stage, these are more voluntary and may be presented as more of a standard versus legislative action.

Successful breach

While these are noteworthy, generally, if an automobile the manufacturer does not have to or is strongly encouraged to, it is difficult to get the issue resolved and feature in the vehicle. A recent case in point involved a For Focus Titanium Automatic 1.0L and a Volkswagen Polo SEL TSI Manual 1.0L. These are both gas-powered vehicles and are very popular in Europe.

Researchers at Context Information Security were tasked with conducting a pentest of sorts on these two vehicles.

The research indicated there were rather serious cybersecurity flaws with the test vehicles. The researchers have reported these and are waiting until providing their test to the public as part of the responsible vulnerability disclosure process. This provides the manufactures time to correct or mitigate the issue, prior to sending the vulnerability, and how to attack it to anyone who has an internet connection.

Researcher’s attacks generalized

While the specifics are not available, the researchers did release general information regarding their successful attacks. As a recap, the subject vehicles, and nearly all others at this point use the Controller Area Network (CAN) to communicate between the modules in each vehicle. These communications are relevant for tire pressure, driving controls, braking, steering, etc. If this is successfully attacked, the driver and passengers assuredly are going to have a bad day. This area was one where the researchers were able to successfully access the Polo.

There was also another vulnerability with OTA (over the air) updates. The vehicles have a number of computers and programs located with the vehicle’s system. These at times need to be updated. Think of it like when you turn off your computer and the system warns you there are patches that need to be uploaded for your system. To have the owners all make appointments to drive their vehicles in every time there is an update is not a workable solution and would halt any work that would need to be done in the repair/maintenance portion of the garages at the dealerships. The researchers were able to tamper with these updates, thus adding the malicious functionality of changing the official update to whatever they would want.

The researchers also found a vulnerability with the infotainment unit in the vehicle. This, when successfully attacked, would enable or disable the vehicle’s traction control, tamper with the headlights, and holds a large amount of personal data (e.g. phone contacts, and location history). This attack was accomplished with a simple command. For this attack, the researchers or bad actors would need to have physical access. While this is a hurdle, it is not impossible, especially since this would only take approximately five minutes.

There were other tests done, with mixed results.

The researchers, curiously, were able to find the Wi-Fi credentials that apparently were for the computer systems on the Ford production line. This is a rather significant and truly bad thing to have that easily accessible.

Resources

Chllingsworth, L. (2020, April 15). Which? Identifies security risk in these road vehicles as hackers may steal your data. Retrieved from https://www.express.co.uk/life-style/cars/1269260/which-ford-volkswagen-car-security-safety-hackers-crime

Forrester, N. (2020, April 15). Latest ford and Volkswagen smart cars pose ‘serious’ privacy and security risk. Retrieved from https://securitybrief.asia/story/latest-ford-and-volkswagen-smart-cars-pose-serious-privacy-and-security-risk

Hull, R. (2020, April 8). Popular ford and vw cars found to have ‘serious security flaws’ with their connected systems putting personal data and safety at risk. Retrieved from https://www.thisismoney.co.uk/money/cars/article-8201733/Popular-Fords-VWs-security-flaws-connected-tech.html

Laughlin, A. (2020, April 9). We hacked ford focus and a volkswagen polo. Retrieved from https://www.which.co.uk/news/2020/04/we-hacked-a-ford-focus-and-a-volkswagen-polo/

Newsquest Digital Content Team. (2020, April). Ford and vw cars exposed to hackers after ‘serious’ security flaws. Retrieved from https://www.worcesternews.co.uk/news/regional/18389786.ford-vw-cars-exposed-hackers-serious-security-flaws/ and https://www.yorkpress.co.uk/news/national/uk_today/18378273.ford-vw-cars-exposed-hackers-serious-security-flaws/

Thomas, P. (2020, April 10). Popular ford and vw cars found to have ‘serious security flaws’ with their connected systems putting personal data and safety at risk. Retrieved from https://www.iaati.org/news/entry/popular-ford-and-vw-cars-found-to-have-serious-security-flaws-with-their-co

Qualcomm at it again

Android phones are in use across the planet. There is not a moment the sun is not shining on an android phone somewhere. The smartphone is a conglomerate of parts from multiple suppliers. It seems as though one of these suppliers had another issue recently. 

Android phones are known to have many, many viable attacks over the years. These seem to appear with regularity, unfortunately for the consumer. One of the latest Android Security Bulletins was published in August 2019. Of the many vulnerabilities noted, three involved the Qualcomm chip. 

These attacks were engineered to exploit a vulnerability with the Android kernel with the over the air (OTA) function. On a brighter note, for the attackers, these are partial remote attacks. Thus the attacker can’t be in the Carribean on the beach and remotely take over your phone. For this to work, the attacker and target are required to be on the same network. This significantly limits the target base for the attackers. This also, curiously, does not require user interaction, such as a phishing attack with malware. These are attacks with malicious packets OTA. This directly affects over a dozen chipsets. 

Fortunately for the user, patches for these have been made available. For CVE-2019-10538, this was modified with a patch for the Android OS source code. Fro CVE-2019-10540, this was modified with code in Qualcomm’s firmware. This is different than the Android OS in that the Qualcomm firmware is closed-source, in comparison to the Android open-source OS. 

Specifically for this issue, there are three CVE’s involved; CVE 2019-10538, -10539, and 10540. These are all buffer overflow attacks. With -10538, this affects the Qualcomm WLAN and Android kernel. The exploit uses packets coded specifically for this to the WLAN to overwrite parts of the kernel. Once successful, the attacker is able to run code with kernel privileges. For -10539, the issue is present with the WLAN firmware. This operates due to a lack of validation with the length check for the IE header limit. Lastly, for -10540, this is a modem into the kernel issue. This affects the Qualcomm WLAN also. The nuance with this is the issue is located within the modem firmware included with the chip from the manufacturer. To exploit this, the attacker begins with a particularly coded packet aimed at the device modem. This is able to work so well due to a lack of validation for the count value and the specifically coded packets. This also allows for code execution. 

In theory, you could chain -10538 and -10540 together. This would allow attackers to take complete control over the Android phones within the attacker’s WiFi. this full access allows for the attacker to install any app, or rootkit, exfiltrate sensitive data, and other completely malicious activities. 

This is not a training issue for the staff, but an issue with applying security within the SDLC. A portion of the issues could have been caught with cybersecurity applied through the project, and a thorough pentest. 

Resources

Bhatia, R. (2019, April 25). Qualcomm chips vulnerability puts android devices at risk. Retrieved from https:/www.securitynewspaper.com/2019/04/25/qualcomm-chips-vulnerability-puts-android-devices-at-risk/ 

Cimpanu, C. (2019, August 6). Qualpwn vulnerabilities in qualcomm chips let hackers compromise android devices. Retrieved from https://www.zdnet.com/article/qualpwn-vulnerabilities-in-qualcomm-chips-let-hackers-compromise-android-devices/ 

Kumar, M. (2019, August 6). New flaws in qualcomm chips expose mills of android devices to hacking. Retrieved from https://thehackernews.com/2019/08/android-qualcomm-vulnerability.html 

Paganini, P. (2019, April 28). Critical flaw in qualcomm chips exposes sensitive data for android devices. Retrieved from https://securityaffairs.com/wordpress/84612/hacking/qualcomm-flaw-android-devices.html    

Samsung Mobile. (2019, August). Android security updates. Retrieved from https://security.samsungmobile.com/securityUpdate.smsb 

Qualcomm. (2019, August 5). Security bulletins. Retrieved from https://www.qualcomm.com/compnay/product-security/bulletins