Braking Bad : Remote Attack Vector Analysis on the MG Marvel R

Sammanfattning

Connected vehicles are becoming increasingly common, offering features like on-board cameras, advanced driver-assistance systems, and integrated multimedia features. These technologies make driving safer and more convenient, but they also create new opportunities for cyberattacks. This thesis takes a closer look at the MG Marvel R, specifically the Wi-Fi and Bluetooth systems of the car, to see how vulnerable it might be to remote attacks. We conducted a penetration test to identify exploitable weaknesses in these remote interfaces, applying the methodologies PatrIoT and DREAD. Our findings confirm that remote exploitation is not only theoretically feasible but actually achievable. For instance, we executed a man-in-the-middle attack to intercept user login credentials via a spoofed Amazon login page and identified out-of-bounds read vulnerabilities that, while currently limited to browser crashes, could be developed into a full chain of exploits that could compromise the in-vehicle infotainment system. This research highlights the risks associated with connected vehicles and sets the groundwork for future work. Whether it is building on our findings to develop a full chain of exploits or looking into other attack methods.