4 ms·

For those curious, I skimmed the transcript and basically a "%" followed by a "I" in an audio file name cause a weird shutdown behavior on the infotainment syst

by GrifMD 5y ago

For those curious, I skimmed the transcript and basically a "%" followed by a "I" in an audio file name cause a weird shutdown behavior on the infotainment system.

derbOac 5y ago
I have a different model car and I've been noticing a similar thing since getting a new phone, where sometimes it will just freeze and reboot when bluetooth is being used, and I can't quite figure out why. I thought it was random but am now wondering if there's a pattern I haven't noticed yet.
CSSer 5y ago
It’s just bad code and even worse error handling. The program runs a heartbeat that lets the rest of the car know all is well when things are running smoothly. When the program hangs, the heartbeat stops. When the heartbeat is interrupted for long enough, it’s programmed to reboot. With that in mind, when the owner queues up the podcast the system attempts to decode an unsanitized string (the podcast title) as if it were percent/URL encoded. When it encounters an error because “% I” is not a valid character reference, it hangs. The worst part is that the car owner was told that a firmware update would “likely” fix it but they would have to pay for it.
- hodgesrm 5y ago
  This seems like grounds for a class action lawsuit. Owners have been harmed by loss of car function and they are reasonably numerous.
- jmgao 5y ago
  No, it's a format string vulnerability.
  - CSSer 5y ago
    Go read this section of the transcript[0] [0]: https://99percentinvisible.org/episode/the-roman-mars-mazda-virus/transcript#:~:text=In%20a%20URL%2C%20certain%20characters%20are%20allowed%20and%20certain%20characters%20are%20not https://99percentinvisible.org/episode/the-roman-mars-mazda-....
    - jmgao 5y ago
      That section of the transcript is incorrect, despite being from someone who worked on it. It's obviously a printf bug because it only happens with %n with valid modifiers: https://www.reddit.com/r/gimlet/comments/bdxht4/hey_its_ben_from_the_reply_all_episode_140_i_have/el1lwb2/ https://www.reddit.com/r/gimlet/comments/bdxht4/hey_its_ben_...
      - CSSer 5y ago
        Despite the fact that he confirmed it’s not C code and despite the fact that the failure case has spaces in it which make it invalid? What am I missing here?
        jmgao 5y ago
        He's wrong, it is getting parsed in C. glibc happens to allow ' ' as a modifier to %n: https://gcc.godbolt.org/z/zaTnjzEY3 https://gcc.godbolt.org/z/zaTnjzEY3
withinboredom 5y ago
Now someone like Taylor Swift just needs to title a song with a whole bunch of known exploits to infotainment systems and we're all set.
david_allison 5y ago
https://github.com/Hamled/mazda-format-string-bug#readme https://github.com/Hamled/mazda-format-string-bug#readme

by GrifMD 5y ago

For those curious, I skimmed the transcript and basically a "%" followed by a "I" in an audio file name cause a weird shutdown behavior on the infotainment system.

derbOac 5y ago

I have a different model car and I've been noticing a similar thing since getting a new phone, where sometimes it will just freeze and reboot when bluetooth is being used, and I can't quite figure out why. I thought it was random but am now wondering if there's a pattern I haven't noticed yet.

CSSer 5y ago

It’s just bad code and even worse error handling. The program runs a heartbeat that lets the rest of the car know all is well when things are running smoothly. When the program hangs, the heartbeat stops. When the heartbeat is interrupted for long enough, it’s programmed to reboot. With that in mind, when the owner queues up the podcast the system attempts to decode an unsanitized string (the podcast title) as if it were percent/URL encoded. When it encounters an error because “% I” is not a valid character reference, it hangs. The worst part is that the car owner was told that a firmware update would “likely” fix it but they would have to pay for it.

hodgesrm 5y ago
This seems like grounds for a class action lawsuit. Owners have been harmed by loss of car function and they are reasonably numerous.
jmgao 5y ago
No, it's a format string vulnerability.
- CSSer 5y ago
  Go read this section of the transcript[0] [0]: https://99percentinvisible.org/episode/the-roman-mars-mazda-virus/transcript#:~:text=In%20a%20URL%2C%20certain%20characters%20are%20allowed%20and%20certain%20characters%20are%20not https://99percentinvisible.org/episode/the-roman-mars-mazda-....
  - jmgao 5y ago
    That section of the transcript is incorrect, despite being from someone who worked on it. It's obviously a printf bug because it only happens with %n with valid modifiers: https://www.reddit.com/r/gimlet/comments/bdxht4/hey_its_ben_from_the_reply_all_episode_140_i_have/el1lwb2/ https://www.reddit.com/r/gimlet/comments/bdxht4/hey_its_ben_...
    - CSSer 5y ago
      Despite the fact that he confirmed it’s not C code and despite the fact that the failure case has spaces in it which make it invalid? What am I missing here?
      - jmgao 5y ago
        He's wrong, it is getting parsed in C. glibc happens to allow ' ' as a modifier to %n: https://gcc.godbolt.org/z/zaTnjzEY3 https://gcc.godbolt.org/z/zaTnjzEY3

withinboredom 5y ago

Now someone like Taylor Swift just needs to title a song with a whole bunch of known exploits to infotainment systems and we're all set.

david_allison 5y ago

https://github.com/Hamled/mazda-format-string-bug#readme https://github.com/Hamled/mazda-format-string-bug#readme