Remotely Hacking a Car through an OBD-II Bluetooth Dongle

PRESENTATION:

In this presentation, we will first discuss the potential attack vectors that could be used to remotely attack a car. Next, we will give a brief introduction to the OBD-II Bluetooth dongle that we have tried to hack. We will discuss the various vulnerabilities that we have discovered on this dongle, including mobile apps, Bluetooth pairing, firmware, and hardware. We will explain how we leveraged a development backdoor to bypass the hardware protection and dump the firmware, tampered with the mobile apps, exploited Bluetooth communication, abused the over-the-air update mechanisms, and sent forged CAN bus messages to achieve remote car controlling.

PRESENTERS:

Aaron Luo is a security researcher at VicOne's Automotive Cyberthreat Research Lab. He joined VicOne's parent company, Trend Micro, in 2015. He is actively involved in the information security communities in Taiwan and frequently shares his experiences with academia, industry, government agencies, and international conferences.
Spencer Hsieh is a security researcher at VicOne’s Automotive Cyberthreat Research Lab. He joined VicOne’s parent company, Trend Micro, in 2009.
He has presented research at several security conferences. His areas of expertise include automotive cybersecurity, advanced persistent threat, malware analysis, and exploitation techniques. His current research focuses on areas of automotive cybersecurity and emerging threat.