3 ms·
They're private subnets, right? From the paper:[0] > Looking at the network configuration of the Uconnect system we can see that it has several interfaces used
by mirimir 7y ago
They're private subnets, right? From the paper:[0]
> Looking at the network configuration of the Uconnect system we can see that it has several interfaces used for communications. It has an interface for the internal Wi-Fi communications, uap0, and another PPP interface, ppp0, presumably used to communicate with the outside world, via Sprint’s 3G services.
# ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33192
inet 127.0.0.1 netmask 0xff000000
pflog0: flags=100<PROMISC> mtu 33192
uap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
address: 30:14:4a:ee:a6:f8
media: <unknown type> autoselect
inet 192.168.5.1 netmask 0xffffff00 broadcast 192.168.5.255
ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1472
inet 21.28.103.144 -> 68.28.89.85 netmask 0xff000000
> The 192.168.5.1 address is the address of the Uconnect system to any hosts connected to the Wi-Fi access point. The IP address 68.28.89.85 is the one that anyone on the Internet would see if the Uconnect system connected to them. However, port 6667 is not open at that address. The 21.28.103.144 address is the actual address of the interface of the Uconnect facing the Internet, but is only available internally to the Sprint network.
> After a little experimentation, it was observed that the PPP interface’s IP address would change each time the car was restarted, but the address space always fell within two class-A address blocks: 21.0.0.0/8 or 25.0.0.0/8, which are presumably the address space Sprint reserves for vehicle IP addresses.
So these are basically huge LANs that anyone with a suitably tweaked Sprint baseband modem can access.
0) http://illmatics.com/Remote%20Car%20Hacking.pdf http://illmatics.com/Remote%20Car%20Hacking.pdf