7 ms·

"sent image files" is an HD Radio function, and HD Radio is also known as NRSC-5, the standards document that describes it. There's an NRSC-5 encoder floating

"sent image files" is an HD Radio function, and HD Radio is also known as NRSC-5, the standards document that describes it. There's an NRSC-5 encoder floating around on Github, if you want to try your hand at it. Notably, it was implemented by an infosec firm, presumably because more garbage code like this is lurking everywhere, and it never gets proper testing because HD Radio is proprietary and its creators never intended an open-source encoder to exist. (To the point of hiding all sorts of details about the codec, but some educated guesses and comparison to similar codecs seem to have paid off.) So, in this case it just crashes the radios so they boot-loop, but how long until someone figures out a payload that can do more damage?

crystalmeph 5y ago
At some point, I think we have to start asking if the addition of non-critical features like having a favicon for each radio station is worth the increased attack surface.
- mbreese 5y ago
  Mixing the car radio and actual critical systems (backup camera) doesn't seem like a great idea. Especially when the car manufacturer doesn't control the entire system. I know nothing about the supply chain for car radios, but I wouldn't be surprised if it was all made by some secondary supplier, so Mazda doesn't even necessarily have the code to the section they need to patch. But, I'm honestly more surprised that it's a Mazda specific issue. I would have expected for the same bug to hit multiple infotainment systems.
  - walrus01 5y ago
    This may be pedantic but I wouldn't call a backup camera critical, people need to learn how to drive and parallel park without those aides. I sure would be pissed if I had a car with a backup camera and something like this bricked the big center screen in my car, however.
    - avidiax 5y ago
      A backup camera is required safety equipment (at time of sale) on new cars.
      - hallway_monitor 5y ago
        Great, another unneeded feature forced down our throats at additional cost to who? You guessed it, consumers!
        myself248 5y ago
        Yeah, drives me nuts. Some cars have really great rear visibility and should be exempt from the requirement. I understand it on SUVs and stuff though.
        zelos 5y ago
        Wouldn't the entire rear of the car and the rear seats have to be glass to exempt a car from having the camera? A bigger rear window wouldn't have let me see the toddler who'd wandered a short distance off from his parents in a car park and was standing right behind my car.
        myself248 5y ago
        Look at the split rear window on the Prius; it does exactly that. If the driver is tall and turning their neck, or short and using the center mirror, the sight-line from the driver's seat extends below the rear seats and down into what would ordinarily be the tailgate. You can't see the pavement under the bumper, but you can see a kid on a tricycle right behind the car. Personally I find rear view cameras to be quite disorienting. The view is quite distorted by the wide-angle lens and it's not clear where it can see and where it can't. Do I still have blind spots if I look at only the screen? Where are they? With a mirror I get an intuitive sense of what it can and can't see. Also, I expect the view to move when I move my head like in a mirror, which is part of what makes it so easy to get a sense of where the mirror can see. I suppose someday I'll get used to cameras, but today is not that day.
  - myself248 5y ago
    Yeahbut, they both need access to the same screen. And yes, it's all made by suppliers, and therein lies most of the trouble with cars today.
    - withinboredom 5y ago
      Electronic KVM switches are pretty ancient tech. So getting access to the screen/input between different hardware modules shouldn't be that complicated. They just don't want to pay for the parts and additional complexity.
  - nanidin 5y ago
    > I know nothing about the supply chain for car radios, but I wouldn't be surprised if it was all made by some secondary supplier, so Mazda doesn't even necessarily have the code to the section they need to patch. You are correct that in general the automotive OEM's farm out the various components of the vehicle to suppliers. In that case, they probably also have some sort of support contract in place that ensures the supplier will address issues like this in a timely manner for the duration of the warranty period for the vehicles it is included in.
  - tjohns 5y ago
    At least in my car (2013 Chevy Volt), the backup camera is on an internal KVM-type switch. The moment I switch into reverse the camera forcibly takes over the infotainment screen. You can occasionally see the signal flicker when the switch happens. But also… a backup camera is hardly critical equipment. It’s there for situational awareness (and a good idea), but doesn’t replace the mirror. And since nobody drives in reverse at high speed, stopping is always an option if it malfunctions.
    - genocidicbunny 5y ago
      On many newer cars, the backup camera is approaching critical equipment. With the rising safety standards, the visibility in cars, especially out the back, has gone down significantly. Incidentally, this is very apparent on the Mazdas that I've owned. My old old Protege had good visibility out the back, an early 10's 3 had passable visibility out the back, and the now handful-of-years-old 6 has atrocious visibility out the back, to the point where more than half the field of view is obscured.
      - kortilla 5y ago
        That’s still not critical. The backup camera is not used as a rear view mirror replacement and the ability to back up, let lone back up safely, is not required for safe operation of the vehicle. Brakes are critical, steering is critical. Reverse and everything that entails is not.
        ipython 5y ago
        Backup cameras are great for avoiding things low to the ground but do give a false sense of security. I managed to back into a fan box at about head level in a parking garage because I became too reliant on the camera alone. If I had turned around to look behind me I could have avoided a thousand dollar repair.
        alamortsubite 5y ago
        > Brakes are critical, steering is critical. Reverse and everything that entails is not. The statistic is that every year, in the U.S. alone, over 2000 kids are run over by vehicles reversing. I had to read what you wrote a half-dozen times, but in hindsight the dissonance makes perfect sense.
- berkes 5y ago
  I'm quite certain the dev teams here did ask themselves this. And decided it was worth it. (If my experience told me anything: Probably under some pressure of marketing or C-level)
nicbou 5y ago
Car ownership has become pretty interesting in the last few years.
avs733 5y ago
I'm less worried about somebody attacking more radio and more annoyed that radio stations have taken to using an information mechanism designed to tell me what I'm listening to and used it to serve ads. Unless we are calling serving unwanted ads as an attack. But in a broader sense, I am absolutely unsurprised that there is terrible security on automotive hardware and software. Things like this are one of my major personal concerns about self driving cars.

crystalmeph 5y ago

At some point, I think we have to start asking if the addition of non-critical features like having a favicon for each radio station is worth the increased attack surface.

mbreese 5y ago
Mixing the car radio and actual critical systems (backup camera) doesn't seem like a great idea. Especially when the car manufacturer doesn't control the entire system. I know nothing about the supply chain for car radios, but I wouldn't be surprised if it was all made by some secondary supplier, so Mazda doesn't even necessarily have the code to the section they need to patch. But, I'm honestly more surprised that it's a Mazda specific issue. I would have expected for the same bug to hit multiple infotainment systems.
- walrus01 5y ago
  This may be pedantic but I wouldn't call a backup camera critical, people need to learn how to drive and parallel park without those aides. I sure would be pissed if I had a car with a backup camera and something like this bricked the big center screen in my car, however.
  - avidiax 5y ago
    A backup camera is required safety equipment (at time of sale) on new cars.
    - hallway_monitor 5y ago
      Great, another unneeded feature forced down our throats at additional cost to who? You guessed it, consumers!
      - myself248 5y ago
        Yeah, drives me nuts. Some cars have really great rear visibility and should be exempt from the requirement. I understand it on SUVs and stuff though.
        zelos 5y ago
        Wouldn't the entire rear of the car and the rear seats have to be glass to exempt a car from having the camera? A bigger rear window wouldn't have let me see the toddler who'd wandered a short distance off from his parents in a car park and was standing right behind my car.
        myself248 5y ago
        Look at the split rear window on the Prius; it does exactly that. If the driver is tall and turning their neck, or short and using the center mirror, the sight-line from the driver's seat extends below the rear seats and down into what would ordinarily be the tailgate. You can't see the pavement under the bumper, but you can see a kid on a tricycle right behind the car. Personally I find rear view cameras to be quite disorienting. The view is quite distorted by the wide-angle lens and it's not clear where it can see and where it can't. Do I still have blind spots if I look at only the screen? Where are they? With a mirror I get an intuitive sense of what it can and can't see. Also, I expect the view to move when I move my head like in a mirror, which is part of what makes it so easy to get a sense of where the mirror can see. I suppose someday I'll get used to cameras, but today is not that day.
- myself248 5y ago
  Yeahbut, they both need access to the same screen. And yes, it's all made by suppliers, and therein lies most of the trouble with cars today.
  - withinboredom 5y ago
    Electronic KVM switches are pretty ancient tech. So getting access to the screen/input between different hardware modules shouldn't be that complicated. They just don't want to pay for the parts and additional complexity.
- nanidin 5y ago
  > I know nothing about the supply chain for car radios, but I wouldn't be surprised if it was all made by some secondary supplier, so Mazda doesn't even necessarily have the code to the section they need to patch. You are correct that in general the automotive OEM's farm out the various components of the vehicle to suppliers. In that case, they probably also have some sort of support contract in place that ensures the supplier will address issues like this in a timely manner for the duration of the warranty period for the vehicles it is included in.
- tjohns 5y ago
  At least in my car (2013 Chevy Volt), the backup camera is on an internal KVM-type switch. The moment I switch into reverse the camera forcibly takes over the infotainment screen. You can occasionally see the signal flicker when the switch happens. But also… a backup camera is hardly critical equipment. It’s there for situational awareness (and a good idea), but doesn’t replace the mirror. And since nobody drives in reverse at high speed, stopping is always an option if it malfunctions.
  - genocidicbunny 5y ago
    On many newer cars, the backup camera is approaching critical equipment. With the rising safety standards, the visibility in cars, especially out the back, has gone down significantly. Incidentally, this is very apparent on the Mazdas that I've owned. My old old Protege had good visibility out the back, an early 10's 3 had passable visibility out the back, and the now handful-of-years-old 6 has atrocious visibility out the back, to the point where more than half the field of view is obscured.
    - kortilla 5y ago
      That’s still not critical. The backup camera is not used as a rear view mirror replacement and the ability to back up, let lone back up safely, is not required for safe operation of the vehicle. Brakes are critical, steering is critical. Reverse and everything that entails is not.
      - ipython 5y ago
        Backup cameras are great for avoiding things low to the ground but do give a false sense of security. I managed to back into a fan box at about head level in a parking garage because I became too reliant on the camera alone. If I had turned around to look behind me I could have avoided a thousand dollar repair.
      - alamortsubite 5y ago
        > Brakes are critical, steering is critical. Reverse and everything that entails is not. The statistic is that every year, in the U.S. alone, over 2000 kids are run over by vehicles reversing. I had to read what you wrote a half-dozen times, but in hindsight the dissonance makes perfect sense.
berkes 5y ago
I'm quite certain the dev teams here did ask themselves this. And decided it was worth it. (If my experience told me anything: Probably under some pressure of marketing or C-level)

nicbou 5y ago

Car ownership has become pretty interesting in the last few years.

avs733 5y ago

I'm less worried about somebody attacking more radio and more annoyed that radio stations have taken to using an information mechanism designed to tell me what I'm listening to and used it to serve ads. Unless we are calling serving unwanted ads as an attack. But in a broader sense, I am absolutely unsurprised that there is terrible security on automotive hardware and software. Things like this are one of my major personal concerns about self driving cars.