黑匣子双击：利用中间人攻击远程入侵汽车两次.pdf

1、#BHAS BlackHatEventsDouble Tap at the BlackboxHacking a Car Remotely Twice with MiTMYingjie Cao360 Vulnerability Research InstituteXinfeng ChenSIG Void Technology#BHAS BlackHatEvents#Yingjie Cao(YinJai_c)-Security researcher 360 Vulnerability Research Institute-Specialized in connected vehicle secur

2、ity-A full-chain exploiter of Blackberry QNX system,the most popular automotive OS-His work has been accepted by both industry and academia,including IEEE S&P and Blackhat Asia#Xinfeng Chen-Security researcher SIG Void Technology-Specialized in mobile security-Skilled at customizing AOSP to bypass a

3、pplication protections#BHAS BlackHatEventsThe Prologue01PART#BHAS BlackHatEventsThree years agoAutomotive Standard ConferenceTianfu Cup Chinese Pwn2Own2021,Autumn,Chengdu#BHAS BlackHatEvents15 days before Tianfu Cup 2021 registration-We were told there is an automotive track-We need to pick a top 10

4、 brand in China-Finally,we chose a brand with over 90,000 units sold in 2021-15 days left,with zero knowledge to the target-NO hardware,NO car-We need to find extremely easy approaches to pwn it#BHAS BlackHatEvents02PARTThe Car Hacking Landscape#BHAS BlackHatEventsChallenges of Hacking a CarSynaktiv

5、 triple-pwned Tesla Pwn2OwnTill today,few researchers can follow their work due to the extremely high technical bar.#BHAS BlackHatEventsSaving researchers walletPros:-Much affordable than purchasing a car-You can disassemble the chips,dumping firmwareCons-It still costs$100-$2000 to buy an IVI-No gu

6、arantee to boot up it-The sources of component vary,development version,factory version,disassembled version.Guangzhou,ChinaThe biggest second-hand car components market in China,maybe globally largest.You can find almost every category of car parts hereProsCons#BHAS BlackHatEvents-Much affordable t