Default Credentials

Infotainment Default Credentials

Overview of the Vulnerability

The In-Vehicle Infotainment (IVI) system, is a central unit in an automotive vehicle's dashboard that centralizes information and entertainment systems and their controls. Misconfigurations in the IVI system can lead to security weaknesses. Default credentials in the IVI unit can be leveraged by an attacker to gain developer access to the system. From here, the attacker can cause the system to behave not as intended.

Business Impact

Default credentials in the IVI system can result in reputational damage and indirect financial loss for the business through the impact to customers’ trust in the security and safety of the automotive vehicle.

Steps to Reproduce

1. Port scan the IVI unit by leveraging {{application}} and {{hardware}}

2. Bruteforce default credentials on exposed service(s)

3. Login to service(s) and run {{action}}

4. Observe that {{action}} occurs as a result

Proof of Concept (PoC)

The image(s) below demonstrates the default password successfully authenticating an attacker into the infotainment system:

{{screenshot}}

Guidance

Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. Your submission must include evidence of the vulnerability and not be theoretical in nature. For an infotainment vulnerability, please include detailed instructions that can be followed to easily demonstrate and reproduce the issue. If data was found using Open Source Intelligence (OSINT), please provide steps to where and how it was found.

Attempt to completely stop the vehicle from functioning if the infotainment system controls a mechanical aspect of the vehicle. If this is possible, provide a full Proof of Concept (PoC) here.

Recommendation(s)

There is no single technique to remediate automotive security misconfigurations. However, implementing the right combination of defensive measures can prevent and limit the impact. Some best practices include the following:

• Develop and enforce secure configuration guidelines for the automotive system, incorporating guidelines for software, firmware, and network settings.

• Ensure that the vehicle's firmware is regularly updated with security patches and fixes to address known vulnerabilities and misconfigurations.

• Conduct regular security audits and assessments of the vehicle's configurations to identify and remediate any misconfigurations. Follow industry best practices and benchmarks for these.