Security Researcher Jailbreaks Car Infotainment to Adjust Clock After Missing SD Card

The Problem: Missing SD Card Prevents Clock Adjustment

A security researcher, Rasmus Moorats, encountered an issue with his 2014 Renault Latitude where he could not adjust the car's clock. The car's infotainment system required the original navigation map SD card to access the time adjustment settings. Moorats had purchased the car used and was aware of the missing SD card, but did not anticipate it would prevent a basic function like changing the time.

Initial Attempts and Error Messages

When daylight saving time arrived, Moorats attempted to adjust the in-car display, which was an hour off. The infotainment system offered two settings menus. One allowed Bluetooth and Phonebook adjustments, which was irrelevant. The second settings menu, intended for other configurations, consistently displayed an error message: "No maps detected!" when accessed, preventing any further interaction.

Reverse Engineering the Infotainment System

Moorats, leveraging his security research skills, decided to reverse engineer the system. He discovered the head unit operated on a customized Linux-based TomTom operating system powered by a Samsung SoC. His process involved extracting and analyzing the firmware, setting up a QEMU environment for the device, and reversing the scripting engine. This analysis revealed several vulnerabilities within the system.

Gaining Root Access and Modifying Time Settings

A key breakthrough came when Moorats realized he could use kernel exploit techniques to execute his own script, rather than relying on userland execution. This approach granted him root-level access to the infotainment system. With root access, he located the date and time settings in /mnt/flash/settings.dat, stored in a custom binary format. He observed that the system did not inherently manage time zones but stored a local offset in minutes. Moorats changed this offset from 180 to 120, successfully correcting the car's clock.