Driving down the rabbit hole

### Scrapyard Automotive Research on a Budget At 00:00 and 03:04, Mickey Shkatov, Jesse Michael, and Alex Bazhaniuk describe building a functional automotive hacking testbed without an enterprise budget. Rather than purchasing a brand-new vehicle, the researchers scouted salvage auto yards, acquired disassembled electronic modules and wire harnesses from a wrecked 2015 Nissan Leaf, and successfully resurrected the drive-by-wire and telematics subsystems on their laboratory workbench (around 06:05).

### Dissecting the Telematics Control Unit (TCU) At 07:35 and 10:39, the team explores the Nissan Leaf's Telematics Control Unit (TCU), which connects the car to cellular networks for remote status checks and climate control. Upon opening the TCU enclosure and removing the SIM card (at 15:16), they discovered that the unit communicated over international GSM roaming networks and contained embedded URLs, unauthenticated web API endpoints, and direct serial AT command interfaces.

### Uncovering the Infineon Baseband Processor At 16:46 and 18:16, hardware inspection revealed that the TCU's cellular communications were handled by an Infineon baseband processor—the exact same chip architecture utilized years earlier in the original Apple iPhone and iPhone 3G. Despite being phased out of smartphones, the silicon had been repurposed in automotive supply chains without receiving crucial firmware updates or security mitigations.

### Remote Over-the-Air Baseband Exploitation At 19:46 and 21:18, the researchers detail how they leveraged publicly documented baseband vulnerabilities (from Ralf-Philipp Weinmann's research). Using a software-defined radio to establish a rogue GSM base station, they delivered a malformed cellular payload that triggered a remote stack-based buffer overflow, hijacking the ARM program counter (`r15`). This gave the team unauthenticated arbitrary remote code execution inside the TCU over the cellular air interface.

### Memory Dumping, Firmware Extraction, and Supply Chain Risk At 24:20 and 28:53, the speakers explain how they weaponized the baseband exploit to dump the processor's internal memory space in 13,000 incremental bursts, reconstructing the complete baseband firmware, cryptographic keys, and CAN messaging routines. Concluding from 31:53 to 37:57, they highlight the broader automotive supply chain risk: legacy, discontinued consumer chipsets harboring well-known public exploits frequently linger in vehicles for decades, demanding rigorous vulnerability lifecycle management from automakers.

(AI summary — Gemini 3.8 Flash)