The Spectre Looms Over Us Still

The Spectre attack has been an unexpected danger to our security since January of this year. It’s an attack on most modern processors that use speculative execution to leak sensitive information to a potential attacker. Speculative execution allows processors to execute instructions in parallel, and in cases where instructions are dependent upon the results of other instructions, tries to predict which instructions are likely to take place. When there are hundreds of instructions to run, predictions provide a significant gain in performance. The Spectre attack starts by miss training the processor with processes that will cause erroneous speculative executions which also create covert side channels for exfiltration. Then the attacker has the victim perform an action that usually is allowed and requests sensitive information. Permissions are not checked until the instructions are committed so it has no problem reading the sensitive information and modifying the cache state in a vulnerable way. The attacker then retrieves that information despite the erroneous instructions being discarded.

Researchers at University of California, Riverside (UCR) have discovered a new form of the attack named SpectreRSB that uses the Return Stack Buffer (RSB) instead of the Branch target Buffer to acquire and smuggle sensitive information. Instead of causing the Branch Predictor to miss speculate onto a poisoned branch, SpectreRSB poisons the return address of the RSB. 

Intel already has a patch but only on the Core-i7 Skylake and later processors. The patch is called RSB refilling and it fills the RSB with a benign address whenever there is a switch to the Kernel. Some of the proposed attacks in the UCR paper can bypass RSB refilling, but the researchers believe their proof of concept attacks are unlikely to be practical because of the difficulty in implementing the gadget that smuggles the return address to a recoverable cache. 
Sources: 
https://securityaffairs.co/wordpress/74698/hacking/spectrersb-attack.htmlhttps://arxiv.org/pdf/1807.07940.pdfhttps://www.bleepingcomputer.com/news/security/researchers-detail-newcpu-side-channel-attack-named-spectrersb/

More Vulnerabilities in the Smart Home

Researchers at Cisco Talos recently spent some time probing the Samsung SmartThings Hub, a device designed to be the center of your smart home. They discovered a number of vulnerabilities that allow remote information leakage up to arbitrary remote code execution. The device is designed to communicate with a range of devices over Ethernet, Z-Wave, Bluetooth, and Zigbee. These devices could be smart locks, IP cameras, alarm systems, thermostats and more.

The researchers found a total of 20 vulnerabilities in the hub. They noted that while each of the vulnerabilities by themselves might not have a great impact on the security of the device, in many cases the vulnerabilities can be chained together to form a complete exploit. Three vulnerability chains were identified that allows an attacker to have complete control over the device.

The first chain allows for remote code execution on the hub. By using a vulnerability that allows for the execution of arbitrary SQL queries an attacker would be able to trigger a different vulnerability that allows for memory corruption. Specially crafted queries would allow the attacker to execute arbitrary code via this attack vector. The second chain allows the attacker to get a glance inside the ‘hubCore’ process of the device, leaking sensitive information. This is accomplished via a vulnerability that allows an empty file to be created anywhere on the device. While at first glance this vulnerability doesn’t seem impactful, the researchers learned that creating this empty file in a specific location causes the ‘hubCore’ process to crash and create a memory dump.
 
The third vulnerability in this chain allows for the capture of this information over the network. The last of the 3 chains allows for remote code execution with no prior authentication. This chain relies on sending specially crafted queries to the ‘video-core’ process running on the device. A vulnerability in the HTTP pipeline allows the requests to reach the vulnerable service with an arbitrary payload that triggers a buffer overflow, allowing for remote code execution. While the third exploit chain requires no authentication, the first two have varying requirements depending on a number of factors. In some cases anyone holding a valid OAuth bearer token can talk to the remote servers in order to trigger some of the vulnerabilities. Malicious apps designed for the hub can also be used to trigger the exploits.
Cisco Talos reported all the found vulnerabilities to Samsung. Samsung responded by fixing the bugs and pushing a firmware update to all connected SmartThings Hubs. While the hubs are designed to update automatically, it is always a good idea to verify the firmware version currently running and update manually if necessary.

Sources: 

https://blog.talosintelligence.com/2018/07/samsung-smartthings-vulns.htmlhttps://www.csoonline.com/article/3292942/security/researchers-reveal-20vulnerabilities-in-samsung-smartthings-hub.html

 https://www.securityweek.com/samsung-patches-critical-vulnerabilitiessmartthings-hub 

Ransomware

No More Ransomware Web Site

https://www.nomoreransom.org/en/index.html
is a site you should save in your favorite.

This site has lost of resources to help you deal with
ransomware.

Ransomware is malware that locks your computer and mobile
devices or encrypts your electronic files. When this happens, you can’t get to
the data unless you pay a ransom. However, this is not guaranteed, and you
should try this site for a solution 1st.

The site has Crypto Sheriff an upload page where you can
submit a file and the site may give you a solution on how to remove the ransomware
Part of the site has solution for many types of ransomware.

How to prevent a
ransomware attack?

1. Back-up! Back-up! Back-up! Have a recovery system in
place so a ransomware infection can’t destroy your personal data forever. It’s
best to create two back-up copies: one to be stored in the cloud (remember to
use a service that makes an automatic backup of your files) and one to store physically
(portable hard drive, thumb drive, extra laptop, etc.). Disconnect these from
your computer when you are done. Your back up copies will also come in handy
should you accidentally delete a critical file or experience a hard drive
failure.

2. Use robust antivirus software to protect your system from
ransomware. Do not switch off the ‘heuristic functions’ as these help the
solution to catch samples of ransomware that have not yet been formally
detected.

3. Keep all the software on your computer up to date. When
your operating system (OS) or applications release a new version, install it.
And if the software offers the option of automatic updating, take it.

4. Trust no one. Literally. Any account can be compromised,
and malicious links can be sent from the accounts of friends on social media,
colleagues or an online gaming partner. Never open attachments in emails from
someone you don’t know. Cybercriminals often distribute fake email messages
that look very much like email notifications from an online store, a bank, the
police, a court or a tax collection agency, luring recipients into clicking on
a malicious link and releasing the malware into their system.

5. Enable the ‘Show file extensions’ option in the Windows
settings on your computer. This will make it much easier to spot potentially
malicious files. Stay away from file extensions like ‘.exe’, ‘.vbs’ and ‘.scr’.
Scammers can use several extensions to disguise a malicious file as a video,
photo, or document (like hot-chics.avi.exe or doc.scr).

6. If you discover a rogue or unknown process on your
machine, disconnect it immediately from the internet or other network
connections (such as home Wi-Fi) — this will prevent the infection from
spreading.

Other resources

If you are a member of InfraGard look at the resource here as well.

 

Apache Releases Security Updates for Apache Tomcat

The Apache Software Foundation has released security updates to
address vulnerabilities in Apache Tomcat versions 9.0.0.M9 to 9.0.9,
8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. A remote
attacker could exploit one of these vulnerabilities to obtain sensitive
information.

NCCIC encourages users and administrators to review the Apache security advisories for CVE-2018-8037 and CVE-2018-1336 and apply the necessary updates

Bluetooth Vulnerability

  Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange.

Overview

Bluetooth firmware or operating system software drivers may not
sufficiently validate elliptic curve parameters used to generate public
keys during a Diffie-Hellman key exchange, which may allow a remote
attacker to obtain the encryption key used by the device.


Description

CWE-325: Missing Required Cryptographic Step – CVE-2018-5383

Bluetooth utilizes a device pairing mechanism based on
elliptic-curve Diffie-Hellman (ECDH) key exchange to allow encrypted
communication between devices. The ECDH key pair consists of a private
and a public key, and the public keys are exchanged to produce a shared
pairing key. The devices must also agree on the elliptic curve
parameters being used. Previous work on the “Invalid Curve Attack”
showed that the ECDH parameters are not always validated before being
used in computing the resulted shared key, which reduces attacker effort
to obtain the private key of the device under attack if the
implementation does not validate all of the parameters before computing
the shared key.

In some implementations, the elliptic curve parameters are not all
validated by the cryptographic algorithm implementation, which may allow
a remote attacker within wireless range to inject an invalid public key
to determine the session key with high probability. Such an attacker
can then passively intercept and decrypt all device messages, and/or
forge and inject malicious messages.

Both Bluetooth low energy (LE) implementations of Secure Connections
Pairing in operating system software and BR/EDR implementations of
Secure Simple Pairing in device firmware may be affected. Bluetooth
device users are encouraged to consult with their device vendor for
further information.

Since the vulnerability was identified, the Bluetooth SIG has updated
the Bluetooth specifications to require validation of any public key
received as
part of public key-based security procedures, thereby providing a remedy
to the vulnerability from a specification perspective. In addition, the
Bluetooth SIG has added testing for this vulnerability within its
Bluetooth Qualification Program.  The Bluetooth SIG has also released a public statement regarding the vulnerability.

Impact

An
unauthenticated, remote attacker within range may be able to utilize a
man-in-the-middle network position to determine the cryptographic keys
used by the device. The attacker can then intercept and decrypt and/or
forge and inject device messages.


Solution

Apply an update

Both software and firmware updates are expected over the coming weeks.
Affected users should check with their device vendor for availability of
updates.

Vendor Information

Vendor Status Date Notified Date Updated
Apple Affected 18 Jan 2018 23 Jul 2018
Broadcom Affected 18 Jan 2018 19 Jun 2018
Intel Affected 18 Jan 2018 23 Jul 2018
QUALCOMM Incorporated Affected 18 Jan 2018 06 Feb 2018
Microsoft Not Affected 06 Feb 2018 20 Jul 2018
Android Open Source Project Unknown 18 Jan 2018 18 Jan 2018
Bluetooth SIG Unknown 06 Feb 2018 06 Feb 2018
Google Unknown 19 Mar 2018 19 Mar 2018
Linux Kernel Unknown 05 Mar 2018 05 Mar 2018

Another type of phishing attack

Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money), often for malicious reasons, by masquerading as a trustworthy entity in an electronic communication.

Here a new one that has started to circulate.
__________________________________________

You don’t know me and you’re thinking why you received this
e mail, right?

Well, I actually placed a malware on the porn website and guess what, you
visited this web site to have fun (you know what I mean). While you were
watching the video, your web browser acted as a RDP (Remote Desktop) and a
keylogger which provided me access to your display screen and webcam. Right
after that, my software gathered all your contacts from your Messenger, Facebook
account, and email account.

What exactly did I do?

I made a split-screen video. First part recorded the video you were viewing
(you’ve got a fine taste haha), and next part recorded your webcam (Yep! It’s
you doing nasty things!).

What should you do?

Well, I believe, $1900 is a fair price for our little secret. You’ll make the
payment via Bitcoin to the below address (if you don’t know this, search
“how to buy bitcoin” in Google).

BTC Address: XXXXXXXXXXXXX
(It is cAsE sensitive, so copy and paste it)

Important:

You have 24 hours in order to make the payment. (I have an unique pixel within
this email message, and right now I know that you have read this email). If I
don’t get the payment, I will send your video to all of your contacts including
relatives, coworkers, and so forth. Nonetheless, if I do get paid, I will erase
the video immidiately. If you want evidence, reply with “Yes!” and I
will send your video recording to your 5 friends. This is a non-negotiable
offer, so don’t waste my time and yours by replying to this email.

 
______________________________________________
 
FYI i wish they would learn to use a spell checker..
 
ONCE AGAIN,  IF YOU DO NOT KNOW THE SENDER DO NOT OPEN UP
THINK BERFORE YOU CLICK
 

CERT Advisory (ICSMA-18-179-01) Medtronic MyCareLink Patient Monitor

1. EXECUTIVE SUMMARY

  • CVSS v3 6.4
  • Vendor: Medtronic 
  • Equipment: MyCareLink Patient Monitor
  • Vulnerabilities: Use of Hard-coded Password, Exposed Dangerous Method or Function

2. RISK EVALUATION

If
exploited, these vulnerabilities may allow privileged access to the
monitor’s operating system. However, physical access to the MyCareLink
monitor is required. Additionally, these vulnerabilities may allow a
MyCareLink monitor, when operated within close physical proximity of an
implantable cardiac device, to read and write arbitrary memory values of
that device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following MyCareLink Monitors are affected:

  • 24950 MyCareLink Monitor, all versions,
  • 24952 MyCareLink Monitor, all versions.

3.2 VULNERABILITY OVERVIEW

3.2.1    USE OF HARD-CODED PASSWORD CWE-259
The
affected product contains a hard-coded operating system password. An
attacker with physical access can remove the case of the device, connect
to the debug port, and use the password to gain privileged access to
the operating system
CVE-2018-8870 has been assigned to this vulnerability. A CVSS v3 base score of 6.4 has been assigned; the CVSS vector string is (AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
3.2.2    EXPOSED DANGEROUS METHOD OR FUNCTION CWE-749
The
affected product contains debug code meant to test the functionality of
the monitor’s communication interfaces, including the interface between
the monitor and implantable cardiac device. An attacker with physical
access to the device can apply the other vulnerabilities within this
advisory to access this debug functionality.
This debug
functionality provides the ability to read and write arbitrary memory
values to implantable cardiac devices via inductive or short range
wireless protocols. An attacker with close physical proximity to a
target implantable cardiac device can use this debug functionality.
CVE-2018-8868 has been assigned to this vulnerability. A CVSS v3 base score of 6.2 has been assigned; the CVSS vector string is (AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Dublin, Ireland

3.4 RESEARCHER

Peter Morgan of Clever Security reported these vulnerabilities to NCCIC.

4. MITIGATIONS

Medtronic
will release several rolling over-the-air product updates that will
mitigate the vulnerabilities described within this advisory. These
updates will be applied to devices automatically as part of standard,
reoccurring update processes. In addition, Medtronic has increased
security monitoring of affected devices and related infrastructure.
Medtronic
recommends users take additional defensive measures to minimize the
risk of exploitation of these vulnerabilities. Specifically, users
should:

  • Maintain good physical controls over the home monitor as the best mitigation to these vulnerabilities.  
  • Only
    use home monitors obtained directly from their healthcare provider or a
    Medtronic representative to ensure integrity of the system. 
  • Report any concerning behavior regarding their home monitor to their healthcare provider or a Medtronic representative. 

Medtronic has released additional patient focused information, at the following location:
https://www.medtronic.com/security
NCCIC
recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:

  • Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
  • When
    remote access is required, use secure methods, such as Virtual Private
    Networks (VPNs), recognizing that VPNs may have vulnerabilities and
    should be updated to the most current version available. Also recognize
    that VPN is only as secure as the connected devices.

NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations
observing any suspected malicious activity should follow their
established internal procedures and report their findings to NCCIC for
tracking and correlation against other incidents.
No known public
exploits specifically target these vulnerabilities. These
vulnerabilities are not exploitable remotely. High skill level is needed
to exploit.


Contact Information

For any questions related to this report, please contact the NCCIC at:

Email: [email protected]

CERT Advisory (ICSMA-18-107-01) Abbott Laboratories Defibrillator

1. EXECUTIVE SUMMARY

  • CVSS v3 7.5
  • ATTENTION: Exploitable remotely
  • Vendor: Abbott Laboratories
  • Equipment: Implantable Cardioverter Defibrillator and Cardiac Synchronization Therapy Defibrillator
  • Vulnerabilities: Improper Authentication and Improper Restriction of Power Consumption

MedSec
Holdings Ltd., has identified vulnerabilities in Abbott Laboratories’
(formerly St. Jude Medical) Implantable Cardioverter Defibrillator (ICD)
and Cardiac Synchronization Therapy Defibrillator (CRT-D). Abbott has
produced firmware updates to help mitigate identified vulnerabilities in
their eligible ICDs and CRT-Ds that utilize radio frequency (RF)
communications. A third-party security research firm has verified the
new firmware updates mitigate the identified vulnerabilities.
The
Food and Drug Administration (FDA) released a safety communication on
April 17, 2018, titled “Battery Performance Alert and Cybersecurity
Firmware Updates for Certain Abbott (formerly St. Jude Medical)
Implantable Cardiac Devices: FDA Safety Communication,” regarding the
identified vulnerabilities and corresponding mitigation. In response,
NCCIC is releasing this advisory to provide additional detail to
patients and healthcare providers.

2. RISK EVALUATION

Successful
exploitation of these vulnerabilities may allow a nearby attacker to
gain unauthorized access to an ICD to issue commands, change settings,
or otherwise interfere with the intended function of the ICD.
Impact
to individual organizations depends on many factors unique to each
organization. NCCIC recommends that organizations evaluate the impact of
these vulnerabilities based on their operational environment and
specific clinical usage.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following ICDs and CRT-Ds manufactured and distributed prior to April 19, 2018, are affected:

  • Fortify,
  • Fortify Assura,
  • Quadra Assura,
  • Quadra Assura MP,
  • Unify,
  • Unify Assura,
  • Unify Quadra,
  • Promote Quadra,
  • Ellipse,
  • Current,
  • Promote.

3.2 VULNERABILITY OVERVIEW

 

3.2.1   IMPROPER AUTHENTICATION CWE-287

The
device’s authentication algorithm, which involves an authentication key
and time stamp, can be compromised or bypassed, which may allow a
nearby attacker to issue unauthorized commands to the ICD or CRT-D via
RF communications.
CVE-2017-12712 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.2   IMPROPER RESTRICTION OF POWER CONSUMPTION CWE-920

The
ICDs and CRT-Ds do not restrict or limit the number of correctly
formatted “RF wake-up” commands that can be received, which may allow a
nearby attacker to repeatedly send commands to reduce device battery
life.
CVE-2017-12714 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Abbott is a U.S.-based company headquartered in Abbott Park, Illinois.
The
affected ICDs and CRT-Ds are implantable medical devices designed to
deliver high voltage electrical pulses to correct a fast or irregular
heartbeat. According to Abbott, these devices are deployed across the
healthcare and public health sector. Abbott indicates that these
products are used worldwide.

3.3 BACKGROUND

Abbott is a U.S.-based company headquartered in Abbott Park, Illinois.
The
affected ICDs and CRT-Ds are implantable medical devices designed to
deliver high voltage electrical pulses to correct a fast or irregular
heartbeat. According to Abbott, these devices are deployed across the
healthcare and public health sector. Abbott indicates that these
products are used worldwide.

3.4 RESEARCHER

MedSec Holdings Ltd., reported these vulnerabilities to Abbott Laboratories and NCCIC.

4. MITIGATIONS

Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
The
firmware update provides additional security to reduce the risk of
unauthorized access by bypassing authentication to the following high
voltage device families that utilize wireless radio frequency (RF)
communication: Fortify, Fortify Assura, Quadra Assura, Quadra Assura MP,
Unify, Unify Assura, Unify Quadra, Promote Quadra, and Ellipse.
The
firmware update can be applied to an eligible implanted ICD or CRT-D
via the Merlin PCS Programmer by a healthcare provider. Abbott and FDA
have recommended the update to all eligible patients at the next
regularly scheduled visit or when appropriate depending on the
preferences of the patient and physician. ICDs and CRT-Ds manufactured
beginning April 25, 2018, will have these updates preloaded on devices.
Abbott
states that firmware updates should be approached with caution. As with
any software update, firmware updates can cause devices to malfunction.
Potential risks include discomfort due to back-up VVI pacing settings,
reloading of previous firmware version due to incomplete upgrade,
inability to treat VT/VF while in back-up mode given high voltage
therapy is disabled, device remaining in back-up mode due to
unsuccessful upgrade, and loss of currently-programmed device settings
or diagnostic data. The Abbott Cybersecurity Medical Advisory Board has
reviewed this firmware update and the associated risk of performing the
update in the context of potential cybersecurity risk.
While not
intended to serve as a substitute for clinician judgment as to whether
the firmware update is advisable for a particular patient, the
Cybersecurity Medical Advisory Board recommends the following:

  • Healthcare
    providers and patients should discuss the risks and benefits of the
    cybersecurity vulnerabilities and associated firmware update during the
    next regularly scheduled visit or when appropriate depending on the
    preferences of the patient and physician. As part of this discussion, it
    is important to consider patient-specific issues such as pacemaker
    dependence, frequency of high voltage therapy, age of device, patient
    preference, and provide patients with the “Patient Communication.”
  • Determine
    if the update is appropriate given the risk of update for the patient.
    If deemed appropriate, install this firmware update following the
    instructions provided by the manufacturer.
  • The cybersecurity
    firmware update should be performed in a facility where appropriate
    monitoring and external defibrillation are readily available.

Abbott’s
older generation devices (i.e., Current and Promote) are not capable of
accepting the firmware update due to technology limitations. If
healthcare providers and patients have any concerns relating to device
cybersecurity for those patients implanted with Current/Promote devices,
providers have the option to permanently disable the RF communication
capability in the device. However, if this option is selected, the
patient can no longer be monitored remotely using an RF Merlin@home
transmitter. For most patients, permanently disabling RF is not
advisable given the proven benefits and improved survival associated
with home monitoring.
Therefore, the Medical Advisory Boards recommends the following:

  • Healthcare
    providers and patients should discuss the risks of cybersecurity
    vulnerabilities and benefits of remote monitoring at the next regularly
    scheduled visit or when appropriate depending on the preferences of the
    patient and physician.
  • If deemed appropriate, RF communication
    may be permanently disabled during an in-clinic device interrogation
    with the Merlin programmer software.

Patients and healthcare providers with questions can call the dedicated hotline at 1-800-722-3774 (U.S.) or visit https://www.sjm.com/cyberupdate  for more information.
Battery
Performance Alert and Cybersecurity Firmware Updates for Certain Abbott
(formerly St. Jude Medical) Implantable Cardiac Devices: FDA Safety
Communication: FDA Safety Communication is available at the following
location:
https://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm604706.htm
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available in the ICS-CERT Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT website.
No known public exploits specifically target these vulnerabilities. High skill level is needed to exploit.


Contact Information

For any questions related to this report, please contact the NCCIC at:

Email: [email protected]
Toll Free: 1-888-282-0870

Keen Security Lab Finds 14 Security Vulnerabilities in BMW Vehicles

The Chinese cybersecurity research team known as Keen Security Lab has disclosed 14 security vulnerabilities affecting a range of BMW vehicles. Eight of the flaws affect the infotainment system, four affect the Telematics Control Unit (TCU), and two affect the Central Gateway Module (CGM). The TCU handles remote communication in the vehicle, such as the ability to unlock the doors remotely. The CGM handles communication between the different subsystems and dispatches the communications appropriately across different Controller Area Network (CAN) buses. 

Most vehicle vulnerabilities found in the past have relied on having physical access to the vehicle. These types of vulnerabilities could be triggered by plugging in a malicious USB device or accessing diagnostic ports inside the vehicle. While vulnerabilities requiring physical access can still be dangerous, the risk of compromise is much lower than a remote vulnerability.

In order to identify remote vulnerabilities, the research team setup their own mock GSM cellular network in order to middleman the traffic coming from the vehicle. By capturing and analyzing the traffic from the vehicle they were able to find a flaw in the ConnectedDrive service. This flaw was exploited by the team to gain a root shell on the vehicle’s head unit. The team also attacked the Bluetooth functionality of the head unit to explore different avenues of remote exploitation. While they were not able to gain remote access via Bluetooth, they were able to cause the head unit to reboot at will by sending malformed packets to it. This vulnerability however requires the system to be in pairing mode for successful exploitation.

The flaws discovered in the various subsystems can be chained together to impact the vehicles in a more meaningful way than just requiring a reboot of the head unit. For example one could send arbitrary messages to the vehicles Engine Control Unit (ECU), which is the brain of the vehicles drive system. These vulnerabilities in the hands of sufficiently motivated and technical attackers could possibly result in takeover of the exploited vehicle. The team found that the exploits discovered were able to be triggered even when the vehicle is in motion.

BMW was notified of the vulnerabilities found in advance of the team’s publication of their findings. BMW acknowledged the team’s findings and has begun rolling out fixes to the systems which can be updated via over the air updates. Some systems cannot be patched in this method however and require the vehicles to be brought to a dealer to be updated.

Sources:
     https://thehackernews.com/2018/05/bmw-smart-car-hacking.html
 https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_ Cars_by_KeenLab.pdf
 https://www.helpnetsecurity.com/2018/05/23/hack-bmw-cars/