Remote Control Automobiles: Hacking The Snapshot Dongle

### Overview In this presentation, Corey Thune (senior researcher with Digital Bond Labs and former consultant with Southfork Security) explores the intersection of industrial control systems (ICS) and modern automobile security. Emphasizing that modern vehicles are essentially 4,000-pound critical control systems operating on public infrastructure, Thune investigates the security risks introduced when third-party dongles are plugged into vehicles' internal networks to stream telematics and driving data back to corporate networks.

### Key Topics - **Automotive and ICS Parallels**: Vehicle networks like the Controller Area Network (CAN bus) share significant architectural similarities with traditional ICS and SCADA networks. Both were historically treated as isolated systems and designed without built-in security controls. - **CAN Bus Vulnerabilities**: CAN bus is an unauthenticated, unencrypted broadcast network. Any device connected to it can send messages to critical safety components such as the engine control unit (ECU), brakes, or steering mechanisms. - **Third-Party OBD-II Dongles**: Devices like Progressive's Snapshot dongle plug directly into the federally mandated On-Board Diagnostics (OBD-II) port to collect driver data, bridging the vehicle's internal CAN network with external cellular networks (e.g., GPRS).

### Technical Details Thune conducted a hardware and firmware security assessment of the Progressive Snapshot dongle manufactured by Xirgo Technologies (Zirgo Tech): - **Hardware Teardown**: The device features a power regulation daughterboard, a CAN transceiver, a CAN bootloader to monitor wake states, an Atmel ARM CPU, an external flash chip, JTAG pads, and an off-the-shelf u-blox cellular daughterboard. - **Firmware Extraction & Analysis**: Thune extracted the firmware directly by pulling the flash memory chip with assistance from Robert Leale and reading it. Analysis was conducted using `strings` and IDA Pro (leveraging the `eyeball2` plugin by Reid Wightman). Strings revealed internal file paths referencing Minnesota-based development, project codename "ocarina", and underlying FreeRTOS firmware. - **Cellular & Logic Analysis**: Using a Saleae logic analyzer hooked up to the cellular board's UART interface, Thune monitored the AT commands exchanged between the CPU and cellular modem. The AT commands revealed that cellular network profile configuration lacked proper authentication, and communications utilized unencrypted channels like FTP rather than modern secure protocols. - **Lack of Defensive Controls**: The device lacked fundamental modern embedded security practices, including firmware signing, secure boot mechanisms, mutual authentication, and encrypted transit.

### Takeaways Thune concludes that third-party vendors are connecting insecure-by-design internal control networks to the wider internet without adopting foundational security mechanisms developed over the past decade. If an OBD-II dongle or backend carrier infrastructure is compromised, attackers could potentially pivot into the vehicle's CAN bus and issue unauthorized commands affecting vehicle operation. To mitigate these risks, Thune recommends hardware and software isolation—strictly limiting dongle firmware to read-only or constrained diagnostic CAN commands over segregated serial interfaces rather than allowing arbitrary bus communication.