Security News > 2021 > May > Researchers Find Exploitable Bugs in Mercedes-Benz Cars
Following an eight-month audit of the code in the latest infotainment system in Mercedes-Benz cars, security researchers with Tencent Security Keen Lab identified five vulnerabilities, four of which could be exploited for remote code execution.
In addition to targeting the main infotainment head unit, the security researchers also analyzed Mercedes-Benz's T-Box, successfully exploited some of the identified attack scenarios, and even combined some of them to compromise the head unit even in real-world vehicles.
The Keen Team researchers discovered the use of an outdated Linux kernel that was susceptible to specific attacks, exposure via the included browser's JavaScript engine, and potential exposure to flaws in the Wi-Fi chip, Bluetooth stack, USB functions, or included third-party apps that communicate with remote servers.
Following the initial compromise, which involved setting up a persistent web shell with root privileges, the researchers were able to unlock specific car functions and the vehicle's anti-theft protection, inject a persistent backdoor, and even perform vehicle control actions.
By sending specific CAN messages, the researchers were able to control the ambient light in the vehicle, control the reading lights, open the sunshade cover and control the back-seat passenger lights, but were not able to take control of the vehicle.
In their report, the researchers describe both successful and unsuccessful attack attempts, while also providing extensive technical details of the hardware and software they tested.