Exploiting Bluetooth from your car to the bank account$$

Exploiting Bluetooth from your car to the bank account

Speakers: Yso; Martin Strohmeier

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=MS582wba46E

Overview

This talk, presented by Martin Strohmeier on behalf of his student Yso (Vladislav), delves into the pervasive and often overlooked security vulnerabilities inherent in Bluetooth Classic implementations within modern vehicles. The research, primarily conducted by Yso for his master's thesis at ETH Zurich, exposes a significant gap in automotive security: despite the known insecurity of older Bluetooth standards, car manufacturers continue to deploy vehicles with outdated and vulnerable Bluetooth stacks. The speakers highlight how these vulnerabilities can be exploited for purposes ranging from denial-of-service attacks to lateral movement within a car's complex systems, and even the interception of two-factor authentication (2FA) tokens.

The motivation for this extensive investigation stems from the Swiss Department of Defense's (DOD) need to secure its vast procurement of standard commercial vehicles. Unlike specialized military hardware, these everyday cars are equipped with Bluetooth by default, creating a substantial and unaddressed attack surface. The research demonstrates that even recent car models from 2022-2023 are susceptible to a multitude of known Bluetooth exploits, underscoring a critical failure in the automotive industry's approach to security.

The findings are highly significant because they expose a widespread and systemic problem affecting an estimated billion-plus cars globally. The research not only details the vulnerabilities but also presents a modular, open-source toolkit designed to systematically identify these flaws. This work serves as a stark warning to both manufacturers and consumers about the hidden dangers lurking in a seemingly innocuous feature, urging a re-evaluation of security practices in the automotive sector and a more proactive approach to patching known weaknesses.

Background

▶ Watch: Introduction of speakers and research background (0:00)

The genesis of this research lies in the unique challenges faced by organizations like the Swiss Cyber Defense Campus, part of the Swiss Department of Defense's procurement arm. When acquiring a wide array of systems, from IT infrastructure to vehicles, security testing often occurs too late in the lifecycle – after deployment. For systems with long life cycles, such as cars, demonstrating flaws in protocols or standards can take decades to translate into widespread changes, leaving deployed systems vulnerable for extended periods. This motivated a shift towards proactive vulnerability research, especially for ubiquitous technologies where alternatives are scarce.

Modern cars, including the "box standard run of the mill cars" procured by the DOD, are incredibly complex systems, featuring at least 19 distinct interfaces, from wired On-Board Diagnostics (OBD) ports to key fobs. Bluetooth is one such interface, and critically, it's virtually impossible to purchase a new car today without it. While recalls are standard for major safety issues, security vulnerabilities in automotive systems rarely trigger such expensive measures, leading to a sprawling and rarely patched attack surface once a car leaves the factory. Previous research on Bluetooth in cars has typically focused on isolated exploits in specific models, but a comprehensive, large-scale assessment of the breadth of existing Bluetooth exploits across different manufacturers was conspicuously absent.

The talk explicitly focuses on Bluetooth Classic, distinguishing it from Bluetooth Low Energy (BLE). Bluetooth Classic, despite its age, remains prevalent in automotive infotainment systems for functions like hands-free calling and media streaming. The Bluetooth technology stack itself is highly complex, designed to support a myriad of use cases through various profiles. These profiles include common ones like A2DP (Advanced Audio Distribution Profile) for music streaming and HFP (Hands-Free Profile) for calls. More critically, some profiles can grant full access to a paired phone's SIM card or allow extraction of messages, enabling hands-free communication within the car.

Bluetooth's security models further compound these issues. The talk outlines four primary pairing methods:

1. Legacy Pairing: Essentially offers no security.
2. Just Works: Simple pairing, but highly susceptible to Man-in-the-Middle (MITM) attacks.
3. Passkey Entry: More secure than Just Works, but recently demonstrated to be vulnerable to method confusion attacks, where an attacker can downgrade the pairing process.
4. Numeric Comparison: Currently the only known secure pairing option, requiring users to compare a numerical code on both devices.

Prior art indicates a significant landscape of Bluetooth vulnerabilities. By March 2022, over 108 distinct Bluetooth exploits were identified, leading to almost 650 CVEs. These vulnerabilities span critical categories including Remote Code Execution (RCE), memory leakage, Man-in-the-Middle (MITM) attacks, and Denial of Service (DoS). The pervasive nature of these known vulnerabilities, coupled with the automotive industry's slow adoption of security updates, set the stage for this critical research.

Key Findings

▶ Watch: Motivation for research: Government procurement security (2:00)

The central discovery of this research is the widespread and persistent vulnerability of modern car Bluetooth systems to a host of known exploits. The team successfully developed a Bluetooth test kit designed to systematically identify these vulnerabilities across various vehicle models and manufacturers. Utilizing this toolkit, they conducted extensive testing, dedicating approximately 40 hours to car assessments.

The results were alarming: a total of 73 distinct vulnerabilities were identified across the tested vehicles. Crucially, many of these were not newly discovered flaws but rather existing, well-documented exploits that car manufacturers had failed to patch. This highlights a significant lag in the adoption of security standards within the automotive industry. The research found that the median age of a Bluetooth version implemented in a car was seven years behind the actual release of the current Bluetooth standard. This substantial delay means that cars are being sold with Bluetooth stacks that are effectively decades out of date from a security perspective.

Contrary to expectations that newer cars would exhibit fewer vulnerabilities, the study revealed that even fairly new models from 2022 and 2023 were found to contain a significant number of vulnerabilities, including critical ones. While two specific new car models showed improved security, many others, including those from major manufacturers like Renault, Opel, and Volkswagen, were highly susceptible. Critical vulnerabilities, such as those enabling Remote Code Execution or significant data leakage, were notably prevalent in these brands. Denial of Service vulnerabilities were found across an even broader range of manufacturers.

The implications of these vulnerabilities extend beyond mere inconvenience. The research demonstrated the potential for lateral movement within a car's complex internal network, allowing an attacker to leverage a Bluetooth compromise to access other vehicle systems. Furthermore, a particularly concerning finding was the feasibility of establishing Man-in-the-Middle positions via Bluetooth to intercept two-factor authentication (2FA) tokens sent via SMS to a paired phone. This capability could allow attackers to bypass critical security measures for various online accounts. The team responsibly reported these findings to relevant phone manufacturers; notably, Google implemented a patch to address the issue, while Apple chose not to, leaving users of iOS devices potentially exposed to this specific attack vector when paired with vulnerable car systems.

Technical Deep Dive

▶ Watch: Problem: Unaddressed Bluetooth vulnerabilities in modern cars (4:00)

The technical core of this research revolves around the inherent weaknesses of the Bluetooth Classic protocol stack and its implementation in automotive infotainment systems. Unlike Bluetooth Low Energy (BLE), which often employs simpler profiles, Bluetooth Classic supports a wide array of profiles designed for richer data exchange, many of which introduce significant attack surfaces. Key profiles exploited or analyzed include:

• A2DP (Advanced Audio Distribution Profile): For streaming high-quality audio. While seemingly benign, flaws here can sometimes lead to DoS or memory corruption.
• HFP (Hands-Free Profile): Enables hands-free calling. This profile, along with its related Hands-Free Audio Gateway (HFA), often involves significant interaction with the paired phone's call management system.
• PBAP (Phone Book Access Profile): Allows the car system to access and display the phone's contact list. This can be abused for data exfiltration.
• MAP (Message Access Profile): Facilitates the car system's access to SMS messages, emails, and other notifications. This is critical for the 2FA token interception attack described.
• SIM Access Profile (SAP): Although less common in modern cars, this profile theoretically allows the car to act as a SIM card reader, granting deep access to the phone's cellular functions.

The security models employed for Bluetooth pairing are a critical point of failure. Legacy Pairing, the oldest method, offers virtually no cryptographic protection, making it trivial for an attacker to intercept communications or impersonate devices. Just Works pairing, while convenient, inherently lacks authentication during the pairing process, making it highly susceptible to passive Man-in-the-Middle (MITM) attacks. An attacker can simply spoof a device and intercept the unauthenticated key exchange. Passkey Entry, which requires users to enter a PIN, offers a higher level of security but has been shown to be vulnerable to method confusion attacks. In such an attack, a malicious device can trick the legitimate devices into downgrading to a less secure pairing method (e.g., Just Works) by misrepresenting its own I/O capabilities, thereby enabling an MITM attack. The only robust option identified is Numeric Comparison, where both devices display a six-digit number that users must visually verify, making MITM attacks significantly harder without user intervention.

The research's primary technical contribution is the development of a modular Bluetooth test kit. This toolkit is designed to automate the process of identifying known Bluetooth vulnerabilities. Its architecture is flexible, allowing new exploits to be added via YAML files, which define the attack parameters and expected responses. The basic setup for the toolkit involves:

• An Ubuntu-based laptop or virtual machine as the host for the testing software.
• Specific cables for connecting hardware components.
• A Nexus 5 phone: This older Android device is crucial because it allows researchers to gain fine-grained control over the Bluetooth stack through custom frameworks, enabling precise manipulation of Bluetooth packets and protocols required for many exploits. The relative difficulty in acquiring this specific, older hardware highlights a barrier to entry for similar research.
• An ESP Rover kit: Another piece of specialized hardware that provides additional capabilities for Bluetooth sniffing and injection.

The testing process itself, though automated in parts, presented several challenges. The black box nature of car infotainment systems means that internal workings are opaque, leading to potential false positives or false negatives in vulnerability detection. Furthermore, testing Denial of Service (DoS) vulnerabilities proved particularly time-consuming. If a DoS attack successfully crashes a car's entertainment or Bluetooth system, restarting it can be surprisingly arduous. The researchers reported instances where a car had to be locked, and the driver had to walk away for 20 minutes for the system to fully shut down and reset before further testing could commence. This significantly extends the time required to test multiple vulnerabilities, making efficient automation critical. Electric cars offered a slight advantage here, as they could be tested without the safety concerns of running an internal combustion engine for extended periods in enclosed spaces.

The most critical attack vector demonstrated was the Man-in-the-Middle (MITM) interception of 2FA tokens. This attack leverages the car's ability to access SMS messages from a paired phone via the MAP profile. By establishing an MITM position, an attacker can intercept incoming SMS messages, including those containing one-time passwords or verification codes for 2FA. This effectively bypasses a crucial layer of security, allowing an attacker to gain unauthorized access to accounts protected by SMS-based 2FA. The success of this attack underscores the severe real-world consequences of insecure Bluetooth implementations in vehicles.

Demo / Proof of Concept

▶ Watch: Understanding Bluetooth technology stack and profiles (6:00)

While the live presentation at DEF CON 32 did not feature a real-time, on-stage demonstration of an exploit due to the primary researcher's absence and technical difficulties with a pre-recorded video, the research itself constitutes a robust proof of concept. The core "demonstration" is the successful development and deployment of the Bluetooth test kit and its efficacy in identifying a high volume of vulnerabilities in real-world automotive systems.

The talk detailed the setup for the toolkit, explaining that it runs on any Ubuntu-based laptop or virtual machine and requires specific hardware components. The mention of a Nexus 5 phone and an ESP Rover kit as necessary for the full functionality of the toolkit illustrates the practical, hardware-centric nature of the exploits. The Nexus 5, specifically, is highlighted for its ability to allow researchers to control the Bluetooth stack at a low level, a critical capability for performing complex attacks like method confusion or targeted packet injection.

The most compelling proof of concept lies in the empirical results: the identification of 73 vulnerabilities across various car models, including critical RCE, memory leakage, MITM, and DoS flaws. The median seven-year lag in Bluetooth version adoption by manufacturers, and the presence of critical vulnerabilities in 2022-2023 car models, concretely demonstrate the widespread nature of the problem the toolkit was designed to expose. The successful responsible disclosure of the 2FA token interception vulnerability to phone manufacturers, and Google's subsequent patch, further validates the practical impact of the identified security flaws.

Although a direct, live exploit was not shown during this specific talk, the detailed explanation of the toolkit's architecture, its hardware requirements, the methodology for testing, and the extensive quantitative results serve as strong evidence that the demonstrated vulnerabilities are real and exploitable. The research effectively proves that a systematic approach can uncover a multitude of security weaknesses in a commonly deployed automotive technology.

Defensive Implications

▶ Watch: Bluetooth security models and existing vulnerabilities (8:00)

The findings of this research carry significant implications for various stakeholders, from automotive manufacturers to end-users and cybersecurity procurement agencies. Addressing the widespread Bluetooth vulnerabilities in cars requires a multi-faceted defensive strategy.

For automotive manufacturers, the primary imperative is to drastically accelerate the adoption of current Bluetooth standards and security practices. The median seven-year lag in Bluetooth version deployment is unacceptable and directly contributes to the persistence of known exploits. Manufacturers must prioritize:

• Timely Security Updates: Bluetooth modules should be treated as critical components requiring regular and prompt security patches, similar to other software in the vehicle. Over-the-air (OTA) update capabilities for infotainment systems are crucial for rapid deployment of fixes.
• Exclusive Use of Secure Pairing Methods: Where technically feasible, manufacturers should mandate and enforce the use of Numeric Comparison for all Bluetooth pairing, eliminating less secure options like Legacy Pairing and Just Works. Robust protections against method confusion attacks for Passkey Entry should also be implemented.
• Improved Isolation: Bluetooth modules should be architecturally isolated from critical vehicle systems. A compromise of the infotainment Bluetooth should not grant lateral movement capabilities to safety-critical or control systems within the car.
• Comprehensive Pre-Deployment Security Testing: Manufacturers must integrate rigorous security testing, including penetration testing against all interfaces, into their development lifecycle, ideally leveraging tools like the one developed in this research, before vehicles are shipped.
• Responsible Disclosure Program: Establishing and actively participating in vulnerability disclosure programs can help identify and address issues before they are exploited in the wild.

For cybersecurity procurement agencies like the Swiss Department of Defense, the research underscores the necessity of incorporating stringent security requirements into tender processes. This includes:

• Mandating Current Bluetooth Standards: Requiring vehicles to be equipped with the latest, most secure Bluetooth versions and profiles.
• Auditable Security Practices: Demanding evidence of robust security development life cycles (SDLs) from manufacturers, including regular security audits and penetration testing reports.
• Specific Patching Commitments: Requiring manufacturers to commit to ongoing security updates for the lifespan of the vehicle, not just at the point of sale.

For individual car owners and end-users, while they have less control over the inherent security of their vehicle's Bluetooth, they can adopt best practices to mitigate risks:

• Disable Bluetooth When Not in Use: Minimizing the exposure window reduces the chance of an opportunistic attack.
• Be Cautious During Pairing: Always verify pairing requests and ensure the numeric comparison codes match exactly. Avoid "Just Works" pairing whenever possible.
• Limit Data Sharing: Be mindful of the permissions granted to the car's infotainment system (e.g., access to contacts, messages). Revoke unnecessary permissions if possible.
• Avoid Sensitive Communications: If possible, avoid receiving highly sensitive information, such as 2FA tokens via SMS, on a phone paired with a car's Bluetooth system, especially if the phone manufacturer (like Apple, in the specific case mentioned) has not patched known vulnerabilities. Use app-based 2FA or hardware tokens instead.
• Stay Informed: Be aware of security advisories related to their specific car model and ensure any available software updates are installed.

Ultimately, the defensive implications point towards a systemic change in how the automotive industry approaches cybersecurity for common technologies like Bluetooth, moving from a reactive, recall-driven model to a proactive, security-by-design approach that accounts for the long lifecycle of vehicles.

Key Takeaways

• Widespread and Persistent Vulnerabilities: Modern cars, including models from 2022-2023, harbor numerous known Bluetooth Classic vulnerabilities, demonstrating a critical failure in automotive security patching and standard adoption.
• Significant Bluetooth Version Lag: Car manufacturers are, on average, seven years behind the current Bluetooth standard, leaving a vast attack surface open to well-documented exploits.
• Effective, Open-Source Toolkit: A custom-built, modular Bluetooth test kit capable of identifying 73 distinct vulnerabilities across various car models was developed, proving that systematic assessment is feasible.
• Critical Attack Vectors: Exploitable vulnerabilities range from Denial of Service and Remote Code Execution to Man-in-the-Middle attacks capable of intercepting 2FA tokens sent via SMS, posing direct threats to user accounts.
• Urgent Call for Manufacturer Action: Automotive manufacturers must prioritize timely security updates, adopt secure pairing methods (Numeric Comparison), and implement better isolation between Bluetooth and critical vehicle systems.
• User Vigilance is Crucial: Car owners should be aware of Bluetooth risks, disable the feature when not needed, be cautious during pairing, and consider alternative 2FA methods for sensitive accounts.

About the Speaker(s)

Yso (Vladislav) is the primary researcher behind this extensive work. He completed his master's degree in cybersecurity at ETH Zurich, where he initiated this project. Described by Martin Strohmeier as "the wizard behind all this stuff," Yso is an accomplished bug bounty hunter with exceptional technical skills, and he is actively seeking new professional opportunities in the cybersecurity field.

Martin Strohmeier is a security researcher and scientist at the Swiss Cyber Defense Campus, which functions as part of the procurement arm for the Swiss Department of Defense. His background is deeply rooted in systems security, with extensive experience hacking various transportation systems, including aviation, space, cars, and trains. His previous work includes research on electric charging systems, documented at brokenwire.fail. Although he had never focused on Bluetooth prior to this project, his expertise in critical infrastructure security provided the strategic context and guidance for Yso's deep dive into automotive Bluetooth vulnerabilities.