Problems in BMW, Ford, Infiniti and Nissan vehicles. A team of three security researchers discovered two security flaws in the TCU (telematics control unit) components that are included in various models of internet-connected cars.
TCUs are 2G modems that send and receive data from a car's internal system. They are used as an interface between the car and remote management tools, such as web panels and mobile apps.
The researchers found the flaws in TCUs manufactured by Continental AG, and more specifically in TCUs that use the S-Gold 2 cellular baseband chipset (PMB 8876).
So according to a notice issued by the Department of Homeland Security (DHS), the following car models use vulnerable TCUs:
[su_box title=”Vehicles affected” box_color=”#c3f200″ title_color=”#000″ radius=”0″]
BMW models manufactured between 2009-2010
Ford (a recall program for 2G modems has been running since 2016 and so the problem exists in a limited number of vehicles equipped with the P-HEV.
Infiniti 2013 JX35
Infiniti 2014-2016 QX60
Infiniti 2014-2016 QX60 Hybrid
Infiniti 2014-2015 QX50
Infiniti 2014-2015 QX50 Hybrid
Infiniti 2013 M37 / M56
Infiniti 2014-2016 Q70
Infiniti 2014-2016 Q70L
Infiniti 2015-2016 Q70 Hybrid
Infiniti 2013 QX56
Infiniti 2014-2016 QX 80
Nissan 2011-2015 Leaf[/su_box]
The two flaws concern a buffer overflow in the TCU component that processes AT commands (CVE-2017-9647) and a flaw that allows attackers to run code via one of the TCU's internal components (baseband radio processor) (CVE-2017-9633).
The first vulnerability would require an attacker to have physical access to the target vehicle, while the second can be exploited from remote locations. Proof-of-concept (PoC) exploit code is available for both flaws.
The car manufacturers involved said the flaws allow attackers to access only the car's infotainment system, and not critical functions such as braking, engine control or vehicle doors.
BMW said it would “provide service to affected customers” and Nissan said it would deactivate 2G modems (TCUs) for all affected customers free of charge. This measure also applies to owners of Nissan-owned Infiniti cars.
Ford said it began disabling all 2G modems last year, in 2016. The company told ICS-CERT that there are now very few cars with 2G modems on the market.
Security researchers Mickey Shkatov, Jesse Michael, and Oleksandr Bazhaniuk from McAfee's Advanced Threat Research Team presented their findings at the DEF CON security conference held in Las Vegas last week. (PDF)
