Researchers at security auditing and threat analysis firm PCA Cyber Security (formerly PCAutomotive) have discovered critical vulnerabilities in a widely used Bluetooth framework that could be exploited to remotely compromise millions of vehicles via the PerfektBlue attack.
See also: Four VW executives found guilty in Dieselgate scandal
Researchers analyzed the Bluetooth framework BlueSDK, developed by OpenSynergy, and identified several vulnerabilities, including those that allow remote code execution, bypass of security mechanisms, and information leaks.
Demonstrating some of these vulnerabilities, they presented a form of attack called PerfektBlue, which allows a remote compromise of a car's infotainment system. From there, the attacker can locate the vehicle, record audio from the interior, and access the user's phone book data.
Additionally, the attacker could move laterally to other systems and potentially gain control over functions such as the steering wheel, horn, and windshield wipers. While this has not yet been proven in practice, previous research has shown that it is technically feasible for a hacker to move from the infotainment system to more critical vehicle systems.
See also: Volkswagen vehicle breach exposed owner's personal data
The PerfektBlue attack has been demonstrated on recent models of infotainment systems used in cars from Mercedes-Benz, Skoda and Volkswagen, as well as on products from another, unnamed OEM, which was only recently informed of the findings.
BlueSDK is found on millions of devices. The list includes not only vehicles, but also mobile phones and other portable devices, manufactured by dozens of major technology companies.
To carry out the attack, the hacker must be within range and able to pair their laptop with the targeted infotainment system via Bluetooth. In some cases, pairing can be done without any user interaction, while in others, confirmation is required or may not be possible at all.
The PerfektBlue vulnerabilities were reported to OpenSynergy in May 2024 and were assigned the codes CVE-2024-45434, CVE-2024-45431, CVE-2024-45432 , and CVE-2024-45433.
See also: Tesla: Temporarily suspends testing of Full Self-Driving (FSD) in China
The patches were created and distributed to customers as early as September 2024, but PCA Cyber Security waited until now to disclose them to ensure the fixes would be widely implemented.
Source: securityweek
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
