Hacking a Head Unit with Malicious PNG
Demonstrates how reverse engineering an automotive real-time operating system uncovered image parser flaws exploitable via a crafted PNG file to backdoor head units.
Summary
Automotive In-Vehicle Infotainment Architecture
Modern automotive head units run complex operating systems that process user media, navigation data, and vehicular status. While many run Linux or Android, thousands of commercial vehicles utilize proprietary real-time operating systems (RTOS).
Reverse Engineering Automotive RTOS Firmware
Hardware extraction and reverse engineering of proprietary RTOS firmware revealed numerous undocumented diagnostic services, insecure memory management routines, and unhardened media parsing libraries.
Exploiting Image Parsers via Malicious PNG Payloads
Analyzing the built-in image rendering engine uncovered memory corruption vulnerabilities triggered during PNG header and chunk processing. Crafting a malformed PNG file delivered via USB allows arbitrary code execution and establishes an unauthenticated backdoor on the head unit.
Implications for In-Vehicle Security
Compromising head units provides a potential pivot point toward connected vehicle CAN buses, demonstrating the necessity of memory-safe parsing libraries and isolated sandboxes in automotive RTOS designs.
Related talks
Car Hacking Village·26 min
collin · oblivion
Reverse engineers a commercial odometer rollback tool, extracting locked STM32 firmware and showing how CAN messages are intercepted and rewritten.
Creator Stage·28 min
Justin Mott · Ava Petersen
Documents finding nine zero-day vulnerabilities in Vilo consumer home routers through UART interfacing, firmware reversing, and protocol analysis.
Creator Stage·19 min
Hyo Jin Lee · Hanryeol Park
Analyzes connected dash cams from global manufacturers, discovering shared OEM vulnerabilities, OS command injections, and custom protocol flaws.