hello everyone uh welcome to the talk today i'll be talking about an interesting finding that i
found in one of a connected car and uh i could able to hack into the car and i could do whatever
i could so uh the title of the presentation is remote exploration of honda cars i know most of
the speakers uh in car hacking village is going to talk about the honda cars so uh like uh it was
an accidental vulnerability that i found and during my uh research okay so before going to
the uh presentation let me introduce myself my name is muhammad shine i'm a knapsack engineer
i'm from india uh i'm also a uh occasional bug bounty hunter i have uh hall of fames in
top companies like google apple etc so i'm also uh the chapter lead of asrg kerala asrg is a
group that deals with automotive cyber security so i lead the chapter uh in kerala
and we have been uh like um conducting webinars talks uh in conferences like cocoon uh for the
past one year i'm also a volunteer at defcon travantram uh then i'm also an automotive
photographer so uh you could see my photographs uh in my instagram handle i have mentioned it here
so today uh i'll be talking about a vulnerability that i found in one of honda's cars and the
vulnerability was in its api with uh with which um which was uh connecting to the telematics controller
on the top of the car and i could hack into the telema the api and gradually into the car
so the car is a honda city fifth gen then okay before moving to the um
top of the car let's talk about the attack surface of a car like um like i'm not a car hacker but uh
it's my like i love uh what we're searching about automotive cyber security so uh most of the time
i work on uh the web application android application or ios uh vulnerabilities so uh
considering a car we could um briefly um break down it in the attack surfaces into
the wi-fi related attacks you know telematics attacks the mobile mobile application attack the
obd attacks so today uh we'll be talking about uh the app vulnerability that i found and i could
able to hack into the car so uh what are the advantages of mobile apps uh in automotive
industry the uh the best answer is like you know it is easy to use and it has a great interface so
uh anyone who uh knows to um would operate a mobile phone can would use the um
code or the interface in the application so uh he he or she could um interact with the car that's
why most of the car manufacturers are now uh moving to the mobile applications for controlling
the cars so uh so what is a connected car a connected car is one and it has its own connection
to the internet and uh that's like an iot device so when you connect your car to the internet it
gradually becomes an iot device so uh
you know that there are multiple devices that are connected to the internet right now like
the refrigerators even
everything everything uh is connected to the internet so
the uh cars car industry is also moving to the iot category
so uh there's a funny story uh like i started uh before starting um yeah focusing on the honda car
or the automotive hacking stuff i this was an article by um or this was a research by jos
carlos and he claims that he could uh hack into internet connected trucks so i was like i was
very much excited about this and i read the article and it was like uh he he used uh shodan the
internet connected um devices like that uh the browser the search engine that can be used to uh
track internet connected
uh devices the shordan site he used it to find uh the trucks or the telematics gateway units
of the trucks and uh the it was using a vulnerable protocol and not so secure protocol and it was a
telnet and he used those telnet protocol to uh to hack into the um the trucks so uh i was pretty
much amazed by reading this and after that i started researching about telematics control unit
so uh before that uh telematics gateway unit was the one uh that the researcher used to hack
a telematics gateway unit has high uh what performance than a telematics control unit
the telematics control unit is a embedded hardware that is used to connect your car
to the internet so after that i most of the research was on the telematics control unit
and i found that a car can be connected to another car or they can communicate each other
or car can be connected to the internet uh to mobile phones or etc so uh telematics control
uh unit was the main thing that what uh it does mean but i i have also like started researching
about the um the word bluetooth related attacks wi-fi related attacks but you know i uh in india
we don't have much hardware or uh there are problems while purchasing the stuffs that can
be used to correct so uh my
research what stick is gone with us with the um mobile applications
so uh i recreated that those attacks like it was simple i use uh shodan to uh
search the vulnerable um telematics gateway units and i got some and i was
like i was i researched about it or i played it with played with it sorry then i was like
yeah it's
cool so uh then there's an interesting thing that happened to me the next day when i opened
my laptop there was an interesting uh google uh uh advertisement uh it was like uh it was a
it was about a connected car uh the uh okay sorry
it was a connected car uh the uh the我也
so i think i'm going to like i'm going uh
to
uh
three two one
hello everyone welcome to my talk uh today i'll be talking about a vulnerability that i found
in one of the connected costs and uh the title of my presentation is a remote exploitation of
contact us so this would be a research about me that was conducted a few months before
i i was able to hack into a honda car and by its vulnerable apis that was controlling the
telematics control unit so uh let's begin
okay uh let me introduce myself my name is muhammad shain i'm an application security
and i'm from india uh i'm also an occasional bounty hunter i have all things in uh companies
like uh google apple etc so uh yeah from this uh you could understand that i don't work in
the automotive industry so this is my uh first talk in uh automotive uh for something like
something that that is related to uh automotive so uh i'm also the chapter lead of asrg kerala
research group it's a group that deals with automotive uh security research uh automotive
uh vulnerabilities etc so i i uh like started uh this group um uh a year ago and uh currently
we have what we have um conducted workshop not for sorry workshops uh we have uh conducted
uh
a series of workshops and i'm also the chapter lead of asrg kerala research group
so i'm going to introduce myself my name is muhammad shain i'm an application security
engineer i'm an i'm also an occasional bounty hunter uh i'm the uh i'm also the chapter lead
sorry
okay
hello everyone welcome to the talk today i'll be talking about remote exploitation of
honda cars this was a recent vulnerability uh in a honda car that was found by me a few months
before
i um i was able to hack into a car through its vulnerable apis so uh before moving to this
session let me um introduce myself my name is mohammed shine i'm an application security
engineer and a bug bounty hunter i do book boundaries occasionally so uh yeah from my
title you could understand that i'm not a automotive security engineer like i mostly work
with uh work on um the web application mobile application security and automotive security is
some kind of like part-time or a free time job i research or i read about automotive security blogs
i watch videos uh in the hacking villages i love this stuff so uh then i'm also the chapter lead of
uh srg kerala and srg is automotive security research group b deals with automotive security
research and uh the vulnerabilities that affects automotive components etc i'm also the volunteer
at uh def counter random and also an automotive photographer if you uh love like car photos or
motorcycle photos you could uh you should visit my instagram profile i have mentioned it there
okay let's begin so uh the vehicle that that i have used for testing is a honda city trip channel
2020 uh 2020 model and uh the vulnerability uh was found three months before and now the
vulnerability is completely fixed so um this vulnerability uh was like it's not a vulnerability
that affects in the hardware component it was a software related software in tissue so it was very
uh it was a c bug so uh let's move
okay uh before uh talking about the vulnerability uh like i saw security uh or an appsec engineer
like we have multiple vulnerabilities like cross-site scripting uh sql injections etc so
but when i moved to the automotive side it was not like that you know different cars i have
different components and uh previously we had work we didn't have much technology that were
that was in um automotives but now like there are connected cars there are self-driving cars
there are adas etc so uh breaking down the attacking surface uh the thing that uh i like
mostly is the telematics control unit and the mobile applications there's a funny story behind
that i will be explaining it later but these are the common entry points or the attack points in a
car so mobile applications from those um attack
entry points will be like i'll be talking about the mobile applications both ios and android so and
why why um the car owners or the companies are adapting mobile applications to control their cars
the reason is pretty much simple it's because um it's easy to use so uh
everyone uses a mobile phone or a mobile application everyone knows how to operate
a mobile phone so it's pretty easy to handle a mobile application that has been connected to a
car so this is the main reason why the mobile there's a drastic increase in the mobile
applications or connected mobile applications to your car then uh what is a connected car
connected car is one it has on a which has its own connection to the internet so
you could remotely control the car or you could remotely track your car etc
so this is the story behind my uh finding my finding is pretty much very easy to find but
this is where it all begins i uh read uh an interesting blog by uh joe scalos notte and
he claims that uh he was able to hack into multiple trucks and the trucks through its
vulnerable telematics gateway unit or the tgs the uh reason uh or the vulnerability was
in its in the protocol that is telnet and it was an un uh authenticated telnet so he could uh
grab all the ips and he could simply award use the telnet protocol to hack into the truck so i
was like wow this is super and it's super cool because i know it's very easy to hack into a
truck so i from that day on which i started researching about the uh what the telematics
control units or the mobile applications or the apis that are interacting with the telematics
or the pcu etc so uh then
i began to think that okay uh the telematics gateway unit is something that is uh similar to
tcu but it is what it it handles much more uh throttle and uh so uh i uh what mostly i used
the google or the search in google to search about uh telematics and the all the stuff and
uh the reason why i'm telling about google is because there's a there's a thing behind it i'll
show you so uh after that i have created the attack
from the blog i used shardon to find the open ports in those telematics gateway units and
and i got able to work track those drugs like him so i was like whoa this is super cool it's
very easy to do a hack because you know i have seen research and automotive research that is
very complicated you know it's very automotive security is something that it's not like web
applications or the app set industry it's it's it's a little complicated due to the hardware
level stuff so i was i was like oh it's super cool and i i i was planning to do a similar research on
um mobile applications the vulnerabilities that are that affects the mobile applications
then uh yeah google ad the next day i got a google ad regarding a car that is found in my country
and uh this is a honda city fifth gen and this was the
the this is the first uh connected car in india so i was like wow this cool and i could see
a mobile app that has been uh found in the app store as well as the playstore then i uh started
uh what reading about the cars uh the car application uh it contains um more than 30
features so um basically the mobile application can be used to do anything to the car that means
like you could start the engine you could open your
the doors you could uh what you could open the boot everything so i was like wow what if i hacked
the mobile application if i hacked the mobile application yeah i could uh hack into the car
so that was my um that was the thing that was scratching my mind so i started researching on
the uh mobile application completely and these were the features of honda connected you could
uh see like there there's a tire deflation alert that means it contains a tpms and it contains um
almost um what everything that can be performing bigger and the interesting features were like uh
we could uh like we could uh start you know start the car the reason is like it is only possible in
the uh the automatic variant you know and uh you could unlock the doors you could uh even um
open the boot you could of track the car etc so these were the four things that that that i was
interested in then i went to uh about uh like i read about uh how the uh application controls
the cup just like uh it's uh there's a cloud server and that has been um controlling the car
and the uh request has been uh what going through the phone like so for example if you need to open
the uh open the door of the car you could press the button and
the mobile phone it sends an ip request to the server and it in it what connects all the it
interacts with the telematics control unit
so the first thing that i did was i downloaded the application and the mobile application and i
reversed it and i would decompile it completely and i i could see some api endpoints so after the
static analysis i couldn't find anything
interesting there were some api keys that was not useful so uh i what i free uh like i i sat for two
days for finding some parts and i didn't get anything the static analysis part and then i
moved to the dynamic analysis and i personally love dynamic analysis uh dynamic analysis is
where when uh we uh we run the application and find the vulnerability uh the application and the
notification process what happens and and the drive and uh how the uh the uh the data uh uh
uh and then have some uh security controls like uh root detection and ssl pinning so uh it's like uh you can't run this mobile application on a rooted or a jailbroken device it's a security control by the honda team but it is easily bypassable so the reason why they did this was like you know most of the security researchers or the attackers use rooted devices for testing these applications so
they yeah they by default place this as a security control so then ssl pinning is uh
it's a client-side security control that that is used to pin certificates and while running
the application uh the certificates were checked with the uh certificates that are placed in the
server so uh this doesn't allow uh what management attacks so you can't intercept the traffic of the
application so these were the only security controls that were placed in this mobile
application and uh tools for the trade for bypassing this you uh you can uh use a router
device or or emulators like genymotion or and tools uh trader uh for bypassing those controls
like route detection and ssl pinning and bobsuite or http toolkit can be used to analyze the traffic
so uh then i uh what i opened the application
uh via freda like i injected a script that can be used to bypass the ssl spinning as well as the
uh route detection so now the application is all uh ready to to be performed available so i
like this is the front page of the honda connector application and uh then they will there was a
field for mobile number so this is how the mobile application works first you are the user gives
his phone number and he will get an otp it's a one-time password
and he should enter it and he or she should integrate and then it moves to the m-pin m-pin
is a second layer of protection that can that uses the biometrics of the phone or a four-digit
number that is created by the user so this is how the app app functions so i uh yeah then i uh
i gave my number and i didn't get the award in the otp or something so i was like why then i uh
contacted the honda showroom
so i asked uh them about the application like uh actually i i i didn't uh tell or i didn't
tell them that i'm a security researcher i uh i call like a regular customer and i asked them
and i understood about the application so this this how the application performs uh
when you purchase the car they will set all the uh they will uh what configure all the number
in the car everything and they'll give you so only thing the user need to know is like to
log in with the otp or the m-pin sorry not the otp the m-pin and he could
use it to control the car so the next thing like uh i did was i contacted um any of my friends who
owns honda cars but most of them had a non-connected car that means it's not connected so
can't perform any attacks there so uh after that i got a friend who uh who gave me his car to test so
uh that was a connector
so i was like i was happy and i he gave his number and i uh i used uh what i uh bypassed uh
the otp thing this was the first thing i done i used freda to bypass it then
i unless the traffic so i was analyzing the traffic you could see the uh proud api honda
apis so this is the uh response the response contains a generated otp so that is a vulnerability
that was uh that's an easy vulnerability by the way so when you give the number the uh otb is uh
otb is that to be sent in the mobile phone but here the otp was reflected in the response
so it was very easy vulnerability so this was very easy what i did was like
i uh used five six one three the otp that's seen here and i uh entered that the next thing was the
forgot mp and since i used an emulator it didn't pop out the biometrics option it asked me for the
number so there was an option for forgot when you give the forgot empty option
it will ask for the phone number then i gave the phone number like again the otp
was leaking into the response so i could use this to reset the mp and i gave a symbol uh or
i gave a number like one two three four to redid it
set it then i could get into the car so this is how uh this was very this was pretty much simple
exploit and i could hack into the car easily so the next thing i was like i was like wow this is
super cool and i created some python scripts and uh i don't even need what complicated the
jenny motion stuff or a phone hi creating those scripts and i gave the phone number and i could
just click enter and i could start the car i could unlock the boot and i could i could unlock
the tower set for everything i it was really easy for me and uh i was like wow super cool hi
from an app sec engineer i'm more truly cyber select automotive like kind of stuff and it was
nice uh doing the research i could uh i could understand many uh things that is going behind
the car how the car controls or sorry how the app controls the car or
it uh communicates it was a funny process learning process then disclosure uh i reported this bug
to uh auto isaac first when i checked auto isaac it was the honda was listed in their
partner partnership so i reported to auto isaac but i didn't get any uh response uh for two days
so i contacted honda in getting after contacting them uh they uh they
called me and they called me and they asked me about the vulnerability or how i found the
vulnerability i took a call i scheduled a call with them and i demonstrated it and i basically
i showed everything that i found and they were happy so you know they they are they thanked me
and the vulnerability was fixed within two or three hours i guess so uh and uh i could i should
also speak about the uh the disclosure process you know most of the uh automotive companies uh
doesn't have a responsible disclosure process or in india that's a that's a main pro that that's
the main problem that is faced by security researchers here so when we find the vulnerability
they don't know where to report it and how to report so but honda team doesn't have a responsible
disclosure program but they uh what they were very um cooperative cooperated with me they um
uh they sat with me for hours to fix this vulnerability and now the car is totally safe and
thank you this is uh i hope uh this was uh an interesting talk and if you uh if you have any
doubts or clarification you can contact me this is my uh twitter handle uh thank you so much
you
you
you
you
you
you
you