Exploit Story Reverse Shells on the Road Hacking Vehicle Infotainment

### Overview Presented at the Secure Our Streets conference as an 'Exploit Story', automotive cybersecurity researcher Abhay Vishnoi (Lead Security Researcher at KPIT India) demonstrates how vehicle infotainment systems can be compromised to establish a persistent reverse shell and potentially interact with the vehicle's CAN bus. The presentation explores hardware and network attack surfaces, privilege escalation techniques, firmware extraction, and the real-world implications of compromising in-vehicle infotainment (IVI) systems.

### Key Topics - **Infotainment Attack Surfaces**: Examining entry points including USB, Bluetooth, Wi-Fi, UART, open network ports, and over-the-air (OTA) update mechanisms. - **Access and Privilege Escalation**: Transitioning from locked or restricted shells (via UART or ADB) to full root/superuser access. - **Firmware Carving and Modification**: Desoldering or tearing down eMMC flash chips, analyzing binaries, extracting boot images and VBmeta partitions, and patching via Magisk. - **Persistence and Post-Exploitation**: Injecting custom BusyBox binaries, establishing persistent netcat reverse shells via init scripts, defacing boot logos, and exfiltrating personally identifiable information (PII). - **CAN Bus Interaction and Defense-in-Depth**: Assessing the risks of CAN service manipulation and discussing production mitigations such as hardware protection, network isolation, and secure firmware design.

### Technical Details - **Hardware & Firmware Extraction**: For systems where UART is locked or ADB is unavailable, the speaker detailed hardware teardown methods. Using tools like TNM programmer on desoldered eMMC chips (demonstrated on a Rockchip-based unit) or software like SP Flash Tool for MediaTek SoCs (specifically MT8163), researchers can extract full flash dumps (`MIMMC.bin`). Using `binwalk` and `dd`, researchers carve out crucial partitions like the kernel, boot image, and `vbmeta` image. To bypass Android Verified Boot (AVB), the boot image is patched (e.g., via Magisk) alongside modified `vbmeta` to disable verification checks before sideloading via Fastboot. - **Network Exploitation & Live Demo**: In the live demonstration of an aftermarket Android-based infotainment unit, the device's IP (`10.167.88.36`) was scanned using Nmap, revealing open port `5555` (ADB). After connecting directly via ADB, the presenter uploaded an ARMv7-compatible custom BusyBox binary to `/data/local/tmp` (a typically writable directory). A netcat listener was started (`0766`) to establish a reverse shell back to a Kali Linux terminal. Persistence can be achieved by placing the reverse shell command into system init/daemon scripts under `/etc`. - **CAN Bus and Data Risks**: Post-exploitation reconnaissance revealed running CAN services such as `com.nw.kan`. The speaker noted that while aftermarket units often lack full CAN utilities without custom DBC files, compromising CAN services in production or fleet vehicles (such as a previous test against an electric bus) allows attackers to kill critical services or inject messages. Furthermore, compromised units expose sensitive PII including contacts, emails, microphone feeds, and IP camera streams.

### Takeaways Aftermarket and connected infotainment systems frequently lack robust default security, often leaving debugging interfaces like ADB or UART accessible. Once a reverse shell is established, attackers can achieve persistence, modify firmware, steal personal user data, and manipulate CAN communication interfaces. Mitigating these risks in production requires rigorous defense-in-depth: hardening hardware against physical debugging/readout, enforcing Android Verified Boot, maintaining strict network isolation between IVI and safety-critical vehicle buses, and applying regular secure OTA patches.