Investigations into failures in smart cars systems have been very useful in detecting errors that could put passengers and drivers at risk. An example of this is the work of researchers Charlie Miller and Chris Valasek, who proved able to shut down a Jeep’s engine remotely in the middle of a road in 2015. Since then, multiple teams of researchers have tried to replicate this work, finding all kinds of results.
In the latest edition of the virtual Black Hat security conference, the Team of Investigators Sky-Go Team of the car research unit in Qihoo 360 reported the discovery of at least 10 vulnerabilities in Mercedes-Benz E-Class cars that could allow the vehicle to open and light up remotely.
As specialists point out, most modern cars have Internet connection systems, giving passengers access to entertainment, navigation, and more. However, like any other device connected to the network, cars are exposed to remote risks.
For starters, researchers built a test bench to reverse engineer auto components for vulnerabilities, focusing more on mechanical parts than integrated software. The cornerstone of the research is the Telematics Control Unit (TCU) of Class E cars: “This is the most important part of the connected car, as it allows internet connection,” the Sky-Go Team report says.
Manipulating the TCU file system allows access to a root shell, so researchers got a way to execute high-privilege commands by accessing the internal parts of the target car.
The TCU file system also stores sensitive vehicle information, such as passwords or certificates. Modifying this information would allow for subsequent intrusions that would bypass the authorization mechanisms: “The car certificate for the Region of China has a particularly weak password,” says Minrui Yan, leader of the investigation.
Although in their investigation the experts concluded that the safety of the car was good, their defenses are not impenetrable: “Back-end support is required secure enough to avoid more complex attack variants, although we are aware that it is impossible to launch the perfect car; at least, in the case of Mercedes-Benz, the security of their systems has improved considerably,” the researchers conclude.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.