Car Hacking Village - Ken Munro - The Mitsubishi Hack Explained

### Architectural Anomaly: Wi-Fi on Wheels Modern connected vehicles typically communicate with mobile companion apps via cellular telematics modules routing data through secure OEM cloud servers. At 03:00, Ken Munro of Pen Test Partners reveals the startling design decision made by Mitsubishi for the Outlander PHEV (Plug-in Hybrid Electric Vehicle): to avoid recurring cellular data charges and SIM card fees, Mitsubishi chose to install an IEEE 802.11 Wi-Fi Access Point directly inside the vehicle. When an owner wishes to check battery status or pre-heat the cabin, their smartphone app connects directly to the car's local ad-hoc Wi-Fi network rather than traversing a cellular cloud gateway.

### Sniffing and Cracking the Vehicle Pre-Shared Key The security of the entire vehicle relies entirely on the WPA2 pre-shared key (PSK) protecting the car's Wi-Fi network. At 06:38, Munro explains the structural flaw in the network's credentials: - **Predictable SSID Format:** The vehicle broadcasts an easily identifiable SSID based on the vehicle model and MAC address (e.g., `REMOTEnnaaaa`), allowing wardriving attackers to pinpoint vulnerable vehicles parked on city streets. - **Weak Password Space:** The pre-shared key is a fixed 10-character alphanumeric password derived from a constrained character set. Using standard directional Wi-Fi antennas and modern GPU hash cracking clusters, an attacker can capture the WPA2 4-way handshake from a passing vehicle and brute-force the PSK in under four days—or within minutes using commercial cloud cracking rigs.

### Packet Analysis and Direct Binary Messaging Once authenticated to the vehicle's Wi-Fi network, an attacker is positioned directly adjacent to the car's wireless telematics control unit (TCU). At 08:32, the research team analyzes the network traffic, finding that the smartphone application communicates with the TCU using unencrypted binary UDP packets over port 51001. The protocol implements negligible authentication: commands require no session tokens, dynamic nonces, or cryptographic signatures. An attacker sniffing the link can trivially capture valid commands or craft custom UDP payloads to control vehicle subsystems.

### Kinetic and Security Impact: Lights, HVAC, and Car Alarms At 10:29, Munro demonstrates live exploitation scenarios achievable via the hacked Wi-Fi link: - **Disabling the Physical Theft Alarm:** The most severe vulnerability discovered is that the vehicle's acoustic anti-theft alarm system can be silenced and fully disabled over the Wi-Fi connection. An attacker can disable the alarm, smash the window or pick the mechanical door lock, and burglarize the vehicle without triggering horn blasts or siren notifications. - **Battery Depletion Attacks:** By continuously turning on heating and air conditioning units remotely, an attacker can drain the high-voltage traction battery overnight, leaving the hybrid vehicle immobilized and unable to start in electric mode. - **Firmware Flashing Risks:** At 13:43, the team explores the telematics module's firmware update routine, discovering that firmware images can be pushed directly over the Wi-Fi interface, potentially enabling persistent malicious firmware modification and bridging into the vehicle's internal CAN bus.

### Remediation, Disclosures, and Defensive Best Practices At 11:38, Munro discusses immediate temporary mitigations for Outlander PHEV owners: unregistering all mobile devices from the car's infotainment screen, which forces the internal Wi-Fi access point into a permanent sleep state. Following responsible disclosure, Mitsubishi engaged with the researchers, releasing a firmware patch that enforced longer, high-entropy pre-shared keys, secondary mobile PIN verification (highlighted at 22:32), and restricted Wi-Fi broadcast timeouts.

(AI summary — Gemini 3.8 Flash)