Researcher Hacks 2014 Renault Latitude Just to Fix Its Clock

A security researcher named Rasmus Moorats had to gain root access to the infotainment system of his 2014 Renault Latitude to correct the car’s clock after daylight saving time changed, according to Tom’s Hardware. The settings menu that controls the time would not open because the original navigation map SD card was missing.

Moorats described the process in a blog post. His fix ended with a single edited number in a settings file, but getting there required extracting firmware, building an emulator and finding security flaws in the car’s software.

A warning that went unheeded

When Moorats bought the used car, the previous owner told him the SD card was needed to change the time on the in-car display. He did not find that believable, he recalled. Because the maps on the card were badly out of date, he decided he could do without it.

When the clocks changed, the car’s display ended up an hour out of sync. The in-dash system had two settings menus. One covered Bluetooth and phonebook settings, which was no help. The other produced no submenu and instead showed the error “No maps detected!” each time he tried to open it.

How the clock got fixed

Moorats chose to reverse engineer the system, a process of taking software apart to understand how it works. He found that the head unit (the main screen and computer in the dash) runs a customized Linux-based TomTom operating system on a Samsung chip. He extracted and analyzed the firmware, built a QEMU environment (software that imitates the hardware so the system can be tested on a computer) and reversed the system’s scripting engine. That work turned up a number of vulnerabilities.

The breakthrough came from his experience with kernel exploits, which is part of his day job. “Instead of trying to get the userland to execute our script, why don’t I get the kernel to execute our script instead?” he wrote. The approach gave him root-level access, the highest level of control over the system.

With that access he located the date and time settings in a file at /mnt/flash/settings.dat, stored in a custom binary format.

Why it matters: the car has no time zones

Moorats noted in his conclusion that the system “doesn’t really have a concept of time zones at all.” It takes the time from GPS and stores the local offset as a number of minutes. His was set to 180, and he changed it to 120.

The case shows how a missing accessory can lock out a basic setting in a car’s built-in software. Tom’s Hardware noted that a task as routine as a daylight saving adjustment should not call for this kind of invasive work. The report does not say whether Renault or TomTom has responded, or whether other vehicles with the same system are affected by the vulnerabilities he found.

Source: Tom's Hardware