Ford SYNC 3 infotainment vulnerable to drive-by Wi-Fi hijacking Ford has suggested owners of vehicles equipped with its SYNC 3 infotainment system disable the Wi-Fi lest someone nearby exploits a buffer-overflow vulnerability and hijacks the equipment. According to [PDF] Texas Instruments, maker of the vulnerable Wi-Fi chipset in Ford vehicles, the flaw merits a 9.6 on the 10-point CVSS …
Is it possible for these genisuses to design an MMU immune to buffer overflows. No, don't tell me how that's not possible.
-------
if( rsnIeIdx >= 3
{
TRACE(pHandle->hReport, REPORT_SEVERITY_ERROR, "MLME_PARSER: Number of RSN IEs exeeds 3\n");
return TI_NOK;
}
-------
In the same way that the mobile phone has turned into a pocket entertainment centre the least of whose functions is actually making phone calls, the car has turned into an entertainment centre with wheels; actually going somewhere in it seems to be low on the list of design priorities... what is the actual point of all this connectivity, and in what way is the driving experience improved by it?
in what way is the driving experience improved
What's that got to do with a platform ultimately intended to provide ongoing revenue from subscriptions and "optional" extras? Though which in reality is likely to be unusable by the time the vehicle reaches its second owner.
It reminds me of the early days of mobile phones when the networks thought they would earn a fortune from being the billing intermediary for lots of value-added services.
They connect these units to the canbus so that they can read engine data and use that for their fancy mpg indicator and stuff like that. The canbus was never designed to be secure and I doubt you can properly firewall parts off.
So much of cars is digital now, there hasn't been a mechanical linkage between the accelerator and the fuel injectors in a long time, breaks are still mechanical but have ABS which is controlled by the computer and some modern cars use full electric power steering with no mechanical linkage.
I can't speak for Sync 3, but Sync 2 (which was ironically Windows-based) actually is isolated.
There is no information from the driving computer (e.g. speedo, mileometer, etc.) that propagates into the Sync 2 system anywhere at all. Even the controls on the steering wheel are separated - cruise control etc. on the left,and entertainment volume, phone etc. on the right. You have the clock on one but not another, the GPS on one but the instrument speedo on the other, and so on.
The Sync 2 handles bluetooth, wifi (for sharing local connections only), satnav (entirely offline) and - oddly - aircon and as far as I know contains no connection to the car's buses. If you want to replace the Sync 2 with Android units, you basically have to plug in an OBD adaptor to get anything like that. You don't have to plug in to control aircon, for instance, but you do if you want OBD information.
Given that you can upgrade the Sync 2 to the Sync 3 in many models, I would suspect that this is actually the case going forward too, unless such an upgrade involves a far more drastic rewire than people are letting on.
And I have personal experience of the Sync 2 because I had the unit fail on me while driving. At first the music was skipping and being odd, then I lost control of the entertainment. Then the unit powered down and I lost aircon. But at no point was the dashboard computer (the one behind the steering wheel that handles and displays MPG, driving settings, etc.) affected, and nor were any driving functions.
Turned out that the SD card just needed replacement, but the whole entertainment system just bugged out and fell over, while I was driving along happily.
Apart from that one incident (resolved with a non-corrupt SD card), it was pretty solid.
But Ford Sync has been through a number of iterations now - QNX, Windows, etc. I'm just going to leave mine on Sync 2 until the car dies, I think. I don't even really use the satnav any more as it costs £150+ (or some piracy) to update the maps and they only surface once every year or so. They can't quite seem to get it right and I don't think throwing it all out and starting again each time is helping.
That said, it does everything I want it to do which is connect to my phone, play music, turn on the air-con and get out of my way.
From what I remember from having a poke at mine, the interface to the car was one PCB, the main processor is a different PCB, and there's a sort of shared memory datapool structure between them with fixed functionality/variable definitions.
So the operating system not only had no access to a CAN interface but the data that it could access was predefined and it had no way to vary it.
So I guess more of a data diode than a firewall?
This is why cars should be "dumb". This is being found when the cars are still relatively new, what is when a similar fault is found in a 10 year old or a 20 year old car?
Cars have a much longer life than consumer electronics and unless the manufacturers are willing to invest in long term security, they should leave the vehicles as dumb as possible, at least in terms of accessability from outside the vehicle.
...the issue doesn't make their cars unsafe to drive.
Translation: There has been no official recall issued for this, so we're going to do fuck all about it as usual. We're Ford, we don't give a rat's arse about our customers. Just ask Ralph Nader.
Real meaning: You're safe until somebody works out a CANBUS exploit that'll run on the hardware.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
