Apparently, Mazda cars equipped with the next-generation Mazda MZD Connect system can be hacked with a simple USB flash drive.
The hack is possible thanks to a series of bugs that have been known for about three years. According to Bleeping Computer, the problem was discovered and tested by users of the Mazda3Revolution forum about three years ago. Since then, Mazda owners have been using these hacks to customize their infotainment systems, install new apps, and more.
Application security engineer Jay Turla developed the mazda_getInfo application, a project that automates Mazda car idles.
"I just wanted to check what the potential attack vectors were for my car and try it out on my car," Turla told Bleeping Computer.
The project is open-sourced and allows anyone with a USB flash drive to execute malicious code on a Mazda car.
"No user interaction is required, you just need to insert the USB drive into your car's USB port. Imagine an autoplay feature in Windows that directly executes a script," the researcher said.
However, before the script is executed, the car must be in accessory mode or the engine must be running.
Last month, Mazda released a firmware update (59.00.502) that fixes issues with MZD Connect. However, if your car hasn't been updated, it's still open to attack.
Mazda of course defends itself, saying that Mazda Connect can only control limited vehicle feature settings, such as keyless entry, what information is displayed in Active Driving, etc.
“Tampering with any of these features does not gain control of the vehicle’s steering, acceleration, or braking,” the company points out.
The models affected are the Mazda CX-3, CX-5, CX-7, CX-9, Mazda2, Mazda3, Mazda6 and Mazda MX-5.
https://github.com/shipcod3/mazda_getInfo
