6 ms·

99% Invisible found out that Mazda has a bug in their radio that cannot parse special characters. See their article here: https://99percentinvisible.org/episode

99% Invisible found out that Mazda has a bug in their radio that cannot parse special characters. See their article here: https://99percentinvisible.org/episode/the-roman-mars-mazda-virus/ https://99percentinvisible.org/episode/the-roman-mars-mazda-...

CSSer 5y ago
Mazda’s response at the time was pretty disheartening too. Pay us for a firmware update and it’ll probably fix it. The owner said ‘no thanks’ because it was too expensive (and honestly ridiculous in principle in my opinion). Now Roman Mars, the owner of 99% Invisible, releases a separate version of every episode with “Mazda safe titles”
- pronlover723 5y ago
  Seems like he should do the opposite, Only release versions with Mazda unsafe titles with a note "Doesn't work on Mazda. Contact their customer support here to complain"
  - Talanes 5y ago
    It was the % in the show title that fouled up the Mazdas, so they were already doing that before the fix. Even then it was a nearly invisible problem for the podcast itself, not something that would have been significant enough to investigate and correct for if that wasn't also content for the show.
    - scim-knox-twox 5y ago
      > a nearly invisible problem 99% invisible
    - Cthulhu_ 5y ago
      The % sign broke mazda's infotainment system? That's really bad, I mean the % is even in the basic ascii character set. Unless they try to interpret titles as JS or HTML or something. That too would be bad.
      - fredoralive 5y ago
        % is used in C style format strings, which are famously a source of footguns.
        im3w1l 5y ago
        Primer on how to exploit it https://medium.com/swlh/binary-exploitation-format-string-vulnerabilities-70edd501c5be https://medium.com/swlh/binary-exploitation-format-string-vu...
        terom 5y ago
        That sounds like you would be able to exploit the bug... does it happen to use a libc that implements %n? If so, just include a payload in the title that fixes the bug by patching the code :)
        BoorishBears 5y ago
        You don't need to exploit it, at least you didn't before... They used to autorun specifically named files on a USB stick. Then some busybody journalists picked up on that and Mazda was forced to lock it down despite the fact that there is complete physical separation from safety systems, and that situations like this article are exactly where it helps.
        CSSer 5y ago
        Although I don't disagree with your thought here and that was actually the podcast host's/other contributor's original hunch too, this wasn't actually an issue with interpolation. I know it sounds bizarre, but the paraphrasing of the podcast hosts and comments from the infotainment system code author suggest that he was treating all strings as percent encoded[0] without any checks or guards in place. Since "% I" isn't a valid character reference, it chokes on it. [0]: https://datatracker.ietf.org/doc/html/rfc3986#section-2.1 https://datatracker.ietf.org/doc/html/rfc3986#section-2.1
      - exikyut 5y ago
        Oooooh. HackRF + open source DAB modulation stack + <carefully chosen combination of ASCII characters> = OTA... DoS? Jailbreak? Other miscellaneous interestingness? In an age where everything's a computer, FM radio is just just another source of unsanitised input.
  - bink 5y ago
    Talk about cutting off your nose to spite your face.
  - renewiltord 5y ago
    That’s right. When a podcaster forces their stuff to not work on my car, I spend my time contacting the car company to get collective action through for change. I don’t hit the next button and listen to something else. This is how I and most other humans function.
    - scim-knox-twox 5y ago
      Probably. I started to unsubscribe every podcast with annoying ads or hosted at megaphone.fm, but I'm in minority.
    - gspr 5y ago
      He wasn't forcing it. He was just accurately using the title of his damn podcast. The suggestion is that he stop issuing a special Mazda-safe version. I agree, this is a problem for the makers of the broken radio. But Roman Mars is just a nice guy.
- dehrmann 5y ago
  > the owner of 99% Invisible Nit: he sold it. https://www.theverge.com/2021/4/26/22403852/siriusxm-roman-mars-99-percent-invisible-acquire-stitcher https://www.theverge.com/2021/4/26/22403852/siriusxm-roman-m...
  - CSSer 5y ago
    Ah, I see, so host and producer but not owner. Good to know!
aidenn0 5y ago
I have a Mazda, and it also parses ogg metadata strangely; if you have multiple fields starting with "ARTIST" then it will fill the artist field with all of them, but without erasing the buffer first. When I first loaded my music collection, it stuck in a reboot loop, so I have a script that sanitizes the metadata for exporting to my car
cipheredStones 5y ago
Maddeningly, that episode never arrives at the actual bug. Via a thread the Mazda owner posted on Reddit, I found this great writeup: https://github.com/Hamled/mazda-format-string-bug#readme https://github.com/Hamled/mazda-format-string-bug#readme TLDR: The problem is the `% In`, and specifically the `%n` - when printf sees that, it tries to store data in memory. Failing to do so, it crashes.
- unwind 5y ago
  This is so weird. I read [1] which someone linked to, and it all seems to make sense. But it doeesn't! I tried compiling this with gcc 11.2.0: #include <stdio.h> int main(void) { printf("%99 Invisible", NULL); return 0; } And it won't compile. I get: test.c: In function ‘main’: test.c:5:14: warning: unknown conversion type character ‘ ’ in format [- Wformat=] 5 | printf("%99 Invisible", NULL); | ^ test.c:5:10: warning: too many arguments for format [-Wformat-extra-args] 5 | printf("%99 Invisible", NULL); | ^~~~~~~~~~~~~~~ which I would expect; you can't have a field width (the "99") and then the space-padding flag; flags go first. Also I can't find any coverage of %I (capital 'I', as in "Invisible") in the manual page for printf(3) on that system but that might just be an old manual page, GCC does seem to recognize it. Removing the cruft and trying plain %In gives a warning, but I guess whoever built the car's radio UI ignores warnings. I guess it's possible that the system doesn't use a standard-compliant enough C library, so it's printf() implementation does something ... creative with this string. Anyway, classic case of the lovely foot-gunnery that is %n in the wild! Sorry for all the car owners, of course. :/ EDIT: A commenter pointed out that the above are "just warnings", oops. :) More oops on me for not spelling the freaking title correctly, of course it's "99%" and not "%99" .. .need more coffee, clearly. Sorry. For people less used to C, the error here more or less seems to boil down to passing an untrusted string as the special "format string" for the printf() function. That function will interpret the contents of the string, and the percent symbol is how its special formatting directives start. Characters following a percent symbol will cause it to do stuff. The proper fix is usally to change printf(string); to printf("%s", string); or use some other I/O function altogether. The above simply says "here's a string", by using the programmer-selected string "%s" as the format, instead of the untrusted string coming from the outside. [1] https://github.com/Hamled/mazda-format-string-bug#readme https://github.com/Hamled/mazda-format-string-bug#readme
hughrr 5y ago
My Citroen does that. If you connect to it with BT and play anything with Cyrillic characters in the title from Apple Music it trashes the display trying to render it.
- rwmj 5y ago
  My Toyota - a Japanese car - cannot display song titles in Japanese. I kind of assume this is a localisation issue rather than something that would happen in Japan though, although the car entertainment is terrible in many other ways too so who knows.
  - yftsui 5y ago
    Most likely because the embedded system does not use UTF-8, just like the phones before iPhone, a Nokia phone sold in US sometimes cannot even be flashed to display CJK characters due to CJK support require more ROM space.
  - salamandersauce 5y ago
    My Garmin watch is like that. If you want Japanese language support you have to buy the japanese model which is obiviously only for sale in Japan. So dumb that I can't just flash the japanese firmware on. Instead I have support for Russian which I have no need for.
oasisbob 5y ago
Wow. Not many automakers can claim to have an infotainment system notorious enough to get coverage on local public radio and a design-oriented podcast. Weird intersection.

CSSer 5y ago

Mazda’s response at the time was pretty disheartening too. Pay us for a firmware update and it’ll probably fix it. The owner said ‘no thanks’ because it was too expensive (and honestly ridiculous in principle in my opinion). Now Roman Mars, the owner of 99% Invisible, releases a separate version of every episode with “Mazda safe titles”

pronlover723 5y ago
Seems like he should do the opposite, Only release versions with Mazda unsafe titles with a note "Doesn't work on Mazda. Contact their customer support here to complain"
- Talanes 5y ago
  It was the % in the show title that fouled up the Mazdas, so they were already doing that before the fix. Even then it was a nearly invisible problem for the podcast itself, not something that would have been significant enough to investigate and correct for if that wasn't also content for the show.
  - scim-knox-twox 5y ago
    > a nearly invisible problem 99% invisible
  - Cthulhu_ 5y ago
    The % sign broke mazda's infotainment system? That's really bad, I mean the % is even in the basic ascii character set. Unless they try to interpret titles as JS or HTML or something. That too would be bad.
    - fredoralive 5y ago
      % is used in C style format strings, which are famously a source of footguns.
      - im3w1l 5y ago
        Primer on how to exploit it https://medium.com/swlh/binary-exploitation-format-string-vulnerabilities-70edd501c5be https://medium.com/swlh/binary-exploitation-format-string-vu...
      - terom 5y ago
        That sounds like you would be able to exploit the bug... does it happen to use a libc that implements %n? If so, just include a payload in the title that fixes the bug by patching the code :)
        BoorishBears 5y ago
        You don't need to exploit it, at least you didn't before... They used to autorun specifically named files on a USB stick. Then some busybody journalists picked up on that and Mazda was forced to lock it down despite the fact that there is complete physical separation from safety systems, and that situations like this article are exactly where it helps.
      - CSSer 5y ago
        Although I don't disagree with your thought here and that was actually the podcast host's/other contributor's original hunch too, this wasn't actually an issue with interpolation. I know it sounds bizarre, but the paraphrasing of the podcast hosts and comments from the infotainment system code author suggest that he was treating all strings as percent encoded[0] without any checks or guards in place. Since "% I" isn't a valid character reference, it chokes on it. [0]: https://datatracker.ietf.org/doc/html/rfc3986#section-2.1 https://datatracker.ietf.org/doc/html/rfc3986#section-2.1
    - exikyut 5y ago
      Oooooh. HackRF + open source DAB modulation stack + <carefully chosen combination of ASCII characters> = OTA... DoS? Jailbreak? Other miscellaneous interestingness? In an age where everything's a computer, FM radio is just just another source of unsanitised input.
- bink 5y ago
  Talk about cutting off your nose to spite your face.
- renewiltord 5y ago
  That’s right. When a podcaster forces their stuff to not work on my car, I spend my time contacting the car company to get collective action through for change. I don’t hit the next button and listen to something else. This is how I and most other humans function.
  - scim-knox-twox 5y ago
    Probably. I started to unsubscribe every podcast with annoying ads or hosted at megaphone.fm, but I'm in minority.
  - gspr 5y ago
    He wasn't forcing it. He was just accurately using the title of his damn podcast. The suggestion is that he stop issuing a special Mazda-safe version. I agree, this is a problem for the makers of the broken radio. But Roman Mars is just a nice guy.
dehrmann 5y ago
> the owner of 99% Invisible Nit: he sold it. https://www.theverge.com/2021/4/26/22403852/siriusxm-roman-mars-99-percent-invisible-acquire-stitcher https://www.theverge.com/2021/4/26/22403852/siriusxm-roman-m...
- CSSer 5y ago
  Ah, I see, so host and producer but not owner. Good to know!

aidenn0 5y ago

I have a Mazda, and it also parses ogg metadata strangely; if you have multiple fields starting with "ARTIST" then it will fill the artist field with all of them, but without erasing the buffer first. When I first loaded my music collection, it stuck in a reboot loop, so I have a script that sanitizes the metadata for exporting to my car

cipheredStones 5y ago

Maddeningly, that episode never arrives at the actual bug. Via a thread the Mazda owner posted on Reddit, I found this great writeup: https://github.com/Hamled/mazda-format-string-bug#readme https://github.com/Hamled/mazda-format-string-bug#readme TLDR: The problem is the `% In`, and specifically the `%n` - when printf sees that, it tries to store data in memory. Failing to do so, it crashes.

unwind 5y ago
This is so weird. I read [1] which someone linked to, and it all seems to make sense. But it doeesn't! I tried compiling this with gcc 11.2.0: #include <stdio.h> int main(void) { printf("%99 Invisible", NULL); return 0; } And it won't compile. I get: test.c: In function ‘main’: test.c:5:14: warning: unknown conversion type character ‘ ’ in format [- Wformat=] 5 | printf("%99 Invisible", NULL); | ^ test.c:5:10: warning: too many arguments for format [-Wformat-extra-args] 5 | printf("%99 Invisible", NULL); | ^~~~~~~~~~~~~~~ which I would expect; you can't have a field width (the "99") and then the space-padding flag; flags go first. Also I can't find any coverage of %I (capital 'I', as in "Invisible") in the manual page for printf(3) on that system but that might just be an old manual page, GCC does seem to recognize it. Removing the cruft and trying plain %In gives a warning, but I guess whoever built the car's radio UI ignores warnings. I guess it's possible that the system doesn't use a standard-compliant enough C library, so it's printf() implementation does something ... creative with this string. Anyway, classic case of the lovely foot-gunnery that is %n in the wild! Sorry for all the car owners, of course. :/ EDIT: A commenter pointed out that the above are "just warnings", oops. :) More oops on me for not spelling the freaking title correctly, of course it's "99%" and not "%99" .. .need more coffee, clearly. Sorry. For people less used to C, the error here more or less seems to boil down to passing an untrusted string as the special "format string" for the printf() function. That function will interpret the contents of the string, and the percent symbol is how its special formatting directives start. Characters following a percent symbol will cause it to do stuff. The proper fix is usally to change printf(string); to printf("%s", string); or use some other I/O function altogether. The above simply says "here's a string", by using the programmer-selected string "%s" as the format, instead of the untrusted string coming from the outside. [1] https://github.com/Hamled/mazda-format-string-bug#readme https://github.com/Hamled/mazda-format-string-bug#readme

hughrr 5y ago

My Citroen does that. If you connect to it with BT and play anything with Cyrillic characters in the title from Apple Music it trashes the display trying to render it.

rwmj 5y ago
My Toyota - a Japanese car - cannot display song titles in Japanese. I kind of assume this is a localisation issue rather than something that would happen in Japan though, although the car entertainment is terrible in many other ways too so who knows.
- yftsui 5y ago
  Most likely because the embedded system does not use UTF-8, just like the phones before iPhone, a Nokia phone sold in US sometimes cannot even be flashed to display CJK characters due to CJK support require more ROM space.
- salamandersauce 5y ago
  My Garmin watch is like that. If you want Japanese language support you have to buy the japanese model which is obiviously only for sale in Japan. So dumb that I can't just flash the japanese firmware on. Instead I have support for Russian which I have no need for.

oasisbob 5y ago

Wow. Not many automakers can claim to have an infotainment system notorious enough to get coverage on local public radio and a design-oriented podcast. Weird intersection.