Security researcher had to jailbreak their car just to update the clock
A security researcher has revealed how they were forced to update the time on their car infotainment system using reverse engineering techniques. Of course, invasive tech surgery shouldn't be needed for this kind of basic routine daylight saving time tweaking task. However, Rasmus Moorats' 2014 Renault Latitude wouldn't allow him to adjust the time because the original navigation map SD card was missing.
Moorats had been warned. When he bought the used car, the previous owner noted that the SD card would be required to change the time on the in-car display. I didn't really find that believable," recalls the security researcher. They seem to have believed it was a skill issue of the prior owner and, because the maps it contained were chronically out of date, they decided to confidently decide they didn't need the SD card...
The time to adjust non-connected clocks to daylight saving time inevitably came, and Moorats decided to adjust the in-car time display, which had become an hour out of sync. Two settings menus were available via the in-dash system. One allowed the adjustment of Bluetooth and Phonebook settings - clearly no use here. But the second settings menu wouldn't produce any submenu. Instead, an error message "No maps detected!" popped up every time it was prodded.
With a certain set of skills under his belt, Moorats decided to just RE it," where RE = reverse engineer. He found out that the head unit ran a customized Linux-based TomTom operating system on a Samsung SoC. In brief, he extracted and analyzed the firmware, built a QEMU environment for the device, reversed the scripting engine, and uncovered a number of vulnerabilities affecting the system.
The breakthrough came in a brainwave, which seems to stem from experience with kernel exploit techniques during his day job. Instead of trying to get the userland to execute our script, why don't I get the kernel to execute our script instead?" pondered Moorats. The approach worked, rewarding Moorats with root-level access to the infotainment system.
The 2014 Renault Latitude owner subsequently discovered that the date & time settings were in /mnt/flash/settings.dat in a custom binary format. Interestingly, the system doesn't really have a concept of time zones at all," observed Moorats in the conclusion of his blog post. It gets the time from GPS and stores the local offset as a number of minutes. Mine was set to 180. I changed it to 120."