4 ms·

Mazda’s response at the time was pretty disheartening too. Pay us for a firmware update and it’ll probably fix it. The owner said ‘no thanks’ because it was too

by CSSer 5y ago

Mazda’s response at the time was pretty disheartening too. Pay us for a firmware update and it’ll probably fix it. The owner said ‘no thanks’ because it was too expensive (and honestly ridiculous in principle in my opinion). Now Roman Mars, the owner of 99% Invisible, releases a separate version of every episode with “Mazda safe titles”

pronlover723 5y ago
Seems like he should do the opposite, Only release versions with Mazda unsafe titles with a note "Doesn't work on Mazda. Contact their customer support here to complain"
- Talanes 5y ago
  It was the % in the show title that fouled up the Mazdas, so they were already doing that before the fix. Even then it was a nearly invisible problem for the podcast itself, not something that would have been significant enough to investigate and correct for if that wasn't also content for the show.
  - scim-knox-twox 5y ago
    > a nearly invisible problem 99% invisible
  - Cthulhu_ 5y ago
    The % sign broke mazda's infotainment system? That's really bad, I mean the % is even in the basic ascii character set. Unless they try to interpret titles as JS or HTML or something. That too would be bad.
    - fredoralive 5y ago
      % is used in C style format strings, which are famously a source of footguns.
      - im3w1l 5y ago
        Primer on how to exploit it https://medium.com/swlh/binary-exploitation-format-string-vulnerabilities-70edd501c5be https://medium.com/swlh/binary-exploitation-format-string-vu...
      - terom 5y ago
        That sounds like you would be able to exploit the bug... does it happen to use a libc that implements %n? If so, just include a payload in the title that fixes the bug by patching the code :)
        BoorishBears 5y ago
        You don't need to exploit it, at least you didn't before... They used to autorun specifically named files on a USB stick. Then some busybody journalists picked up on that and Mazda was forced to lock it down despite the fact that there is complete physical separation from safety systems, and that situations like this article are exactly where it helps.
      - CSSer 5y ago
        Although I don't disagree with your thought here and that was actually the podcast host's/other contributor's original hunch too, this wasn't actually an issue with interpolation. I know it sounds bizarre, but the paraphrasing of the podcast hosts and comments from the infotainment system code author suggest that he was treating all strings as percent encoded[0] without any checks or guards in place. Since "% I" isn't a valid character reference, it chokes on it. [0]: https://datatracker.ietf.org/doc/html/rfc3986#section-2.1 https://datatracker.ietf.org/doc/html/rfc3986#section-2.1
    - exikyut 5y ago
      Oooooh. HackRF + open source DAB modulation stack + <carefully chosen combination of ASCII characters> = OTA... DoS? Jailbreak? Other miscellaneous interestingness? In an age where everything's a computer, FM radio is just just another source of unsanitised input.
      - fredoralive 5y ago
        The % bug is a separate bug to do with a Podcasts's title, I suspect you just need a phone and an MP3 file with a suitably prepared title tag. The original articles issue is a HD Radio (not DAB) issue to do with images, although it might still be a string parse issue of some kind as it apparently involves "image files with no extension", so presumably filenames? So the RF side can indeed be fun on consumer electronics with modern digital standards. Another example is this claimed RCE over DVB-T: https://twitter.com/David3141593/status/1481963959532011520 https://twitter.com/David3141593/status/1481963959532011520
        RF_Savage 5y ago
        Even more sadly, HD Radio is a closed, propretiary format. Unlike DAB or DAB+ which are open standards with FOSS implementations out there.
        jaywalk 5y ago
        HD Radio is closed and proprietary, but there is at least one FOSS receiver out there: https://github.com/theori-io/nrsc5 https://github.com/theori-io/nrsc5 The protocol itself is actually standardized: https://www.nrscstandards.org/standards-and-guidelines/documents/standards/nrsc-5-d/nrsc-5-d.asp https://www.nrscstandards.org/standards-and-guidelines/docum... It's just the audio codec that's proprietary, but it's basically just a slightly modified version of AAC so it's been decoded.
        RF_Savage 5y ago
        My understanding was that the implementation was protected by patents. And can one call something a standard if the codec is not documented and needs to be reverse engineered?
    - jdmichal 5y ago
      Given other people saying there's Javascript and Opera involved, my guess is that the % is ending up unescaped in a URL.
    - CSSer 5y ago
      You're sort of on the right track if you're familiar with URL/percent encoding, actually. I have no idea why, but paraphrased comments by the podcast hosts from the code author (they contacted him) suggest that he was attempting to decode all incoming strings as if they were percent encoded[0] without any failsafes in place. Since "% I" isn't a valid character reference (or even hexadecimal), it chokes on it. [0]: https://datatracker.ietf.org/doc/html/rfc3986#section-2.1 https://datatracker.ietf.org/doc/html/rfc3986#section-2.1
- bink 5y ago
  Talk about cutting off your nose to spite your face.
- renewiltord 5y ago
  That’s right. When a podcaster forces their stuff to not work on my car, I spend my time contacting the car company to get collective action through for change. I don’t hit the next button and listen to something else. This is how I and most other humans function.
  - scim-knox-twox 5y ago
    Probably. I started to unsubscribe every podcast with annoying ads or hosted at megaphone.fm, but I'm in minority.
  - gspr 5y ago
    He wasn't forcing it. He was just accurately using the title of his damn podcast. The suggestion is that he stop issuing a special Mazda-safe version. I agree, this is a problem for the makers of the broken radio. But Roman Mars is just a nice guy.
dehrmann 5y ago
> the owner of 99% Invisible Nit: he sold it. https://www.theverge.com/2021/4/26/22403852/siriusxm-roman-mars-99-percent-invisible-acquire-stitcher https://www.theverge.com/2021/4/26/22403852/siriusxm-roman-m...
- CSSer 5y ago
  Ah, I see, so host and producer but not owner. Good to know!

by CSSer 5y ago

pronlover723 5y ago

Seems like he should do the opposite, Only release versions with Mazda unsafe titles with a note "Doesn't work on Mazda. Contact their customer support here to complain"

Talanes 5y ago
It was the % in the show title that fouled up the Mazdas, so they were already doing that before the fix. Even then it was a nearly invisible problem for the podcast itself, not something that would have been significant enough to investigate and correct for if that wasn't also content for the show.
- scim-knox-twox 5y ago
  > a nearly invisible problem 99% invisible
- Cthulhu_ 5y ago
  The % sign broke mazda's infotainment system? That's really bad, I mean the % is even in the basic ascii character set. Unless they try to interpret titles as JS or HTML or something. That too would be bad.
  - fredoralive 5y ago
    % is used in C style format strings, which are famously a source of footguns.
    - im3w1l 5y ago
      Primer on how to exploit it https://medium.com/swlh/binary-exploitation-format-string-vulnerabilities-70edd501c5be https://medium.com/swlh/binary-exploitation-format-string-vu...
    - terom 5y ago
      That sounds like you would be able to exploit the bug... does it happen to use a libc that implements %n? If so, just include a payload in the title that fixes the bug by patching the code :)
      - BoorishBears 5y ago
        You don't need to exploit it, at least you didn't before... They used to autorun specifically named files on a USB stick. Then some busybody journalists picked up on that and Mazda was forced to lock it down despite the fact that there is complete physical separation from safety systems, and that situations like this article are exactly where it helps.
    - CSSer 5y ago
      Although I don't disagree with your thought here and that was actually the podcast host's/other contributor's original hunch too, this wasn't actually an issue with interpolation. I know it sounds bizarre, but the paraphrasing of the podcast hosts and comments from the infotainment system code author suggest that he was treating all strings as percent encoded[0] without any checks or guards in place. Since "% I" isn't a valid character reference, it chokes on it. [0]: https://datatracker.ietf.org/doc/html/rfc3986#section-2.1 https://datatracker.ietf.org/doc/html/rfc3986#section-2.1
  - exikyut 5y ago
    Oooooh. HackRF + open source DAB modulation stack + <carefully chosen combination of ASCII characters> = OTA... DoS? Jailbreak? Other miscellaneous interestingness? In an age where everything's a computer, FM radio is just just another source of unsanitised input.
    - fredoralive 5y ago
      The % bug is a separate bug to do with a Podcasts's title, I suspect you just need a phone and an MP3 file with a suitably prepared title tag. The original articles issue is a HD Radio (not DAB) issue to do with images, although it might still be a string parse issue of some kind as it apparently involves "image files with no extension", so presumably filenames? So the RF side can indeed be fun on consumer electronics with modern digital standards. Another example is this claimed RCE over DVB-T: https://twitter.com/David3141593/status/1481963959532011520 https://twitter.com/David3141593/status/1481963959532011520
      - RF_Savage 5y ago
        Even more sadly, HD Radio is a closed, propretiary format. Unlike DAB or DAB+ which are open standards with FOSS implementations out there.
        jaywalk 5y ago
        HD Radio is closed and proprietary, but there is at least one FOSS receiver out there: https://github.com/theori-io/nrsc5 https://github.com/theori-io/nrsc5 The protocol itself is actually standardized: https://www.nrscstandards.org/standards-and-guidelines/documents/standards/nrsc-5-d/nrsc-5-d.asp https://www.nrscstandards.org/standards-and-guidelines/docum... It's just the audio codec that's proprietary, but it's basically just a slightly modified version of AAC so it's been decoded.
        RF_Savage 5y ago
        My understanding was that the implementation was protected by patents. And can one call something a standard if the codec is not documented and needs to be reverse engineered?
  - jdmichal 5y ago
    Given other people saying there's Javascript and Opera involved, my guess is that the % is ending up unescaped in a URL.
  - CSSer 5y ago
    You're sort of on the right track if you're familiar with URL/percent encoding, actually. I have no idea why, but paraphrased comments by the podcast hosts from the code author (they contacted him) suggest that he was attempting to decode all incoming strings as if they were percent encoded[0] without any failsafes in place. Since "% I" isn't a valid character reference (or even hexadecimal), it chokes on it. [0]: https://datatracker.ietf.org/doc/html/rfc3986#section-2.1 https://datatracker.ietf.org/doc/html/rfc3986#section-2.1
bink 5y ago
Talk about cutting off your nose to spite your face.
renewiltord 5y ago
That’s right. When a podcaster forces their stuff to not work on my car, I spend my time contacting the car company to get collective action through for change. I don’t hit the next button and listen to something else. This is how I and most other humans function.
- scim-knox-twox 5y ago
  Probably. I started to unsubscribe every podcast with annoying ads or hosted at megaphone.fm, but I'm in minority.
- gspr 5y ago
  He wasn't forcing it. He was just accurately using the title of his damn podcast. The suggestion is that he stop issuing a special Mazda-safe version. I agree, this is a problem for the makers of the broken radio. But Roman Mars is just a nice guy.

dehrmann 5y ago

> the owner of 99% Invisible Nit: he sold it. https://www.theverge.com/2021/4/26/22403852/siriusxm-roman-mars-99-percent-invisible-acquire-stitcher https://www.theverge.com/2021/4/26/22403852/siriusxm-roman-m...

CSSer 5y ago
Ah, I see, so host and producer but not owner. Good to know!