OwnStar Wi-Fi attack now grabs BMW, Mercedes virtual keys

OwnStar Wi-Fi attack now grabs BMW, Mercedes, and Chrysler cars’ virtual keys

Remember OwnStar? Earlier this month, security researcher and NSA Playset contributor Samy Kamkar demonstrated a Wi-Fi based attack that allowed his device to intercept OnStar credentials from the RemoteLink mobile application—giving an attacker the ability to clone them and use them to track, unlock, and even remote start the vehicle. Kamkar discussed the details of the attack last Friday at DEF CON in Las Vegas, noting that the RemoteLink app on iOS devices had failed to properly check the certificate for a secure connection to OnStar's server, or—as is more common in mobile apps using HTTPS to access Web services—use a "pinned" certificate hard-coded into the application itself. OwnStar quickly resolved the issue with a RemoteLink app update.

But OwnStar has moved on to other targets. Today, Kamkar announced that he had adapted the tool to target applications for BMW Remote, Mercedes-Benz mbrace, and Chrysler's Uconnect services on Apple iOS devices. All three, he said in an exchange with Ars via Twitter, have the exact same vulnerability as the RemoteLink app did: "no pinned cert or even PKI/[certificate authority] validation. Trivial to attack an unadulterated mobile device."

The OwnStar device packs all the components required to execute this attack into a portable case that can be placed near a targeted vehicle. Like a virtual bear trap, it can capture the login credentials of a car owner using a mobile app to remotely unlock, lock, or start the vehicle, which can then be loaded onto a copy of the targeted mobile app on the attacker's own device—giving the attacker the ability to execute all of the functions of the telematics system on the targeted vehicle. And it's all because of a flaw that is all too common to mobile applications—reliance on a remote server's certificate being valid, regardless of what network the connection is over.

The type of man-in-the-middle attack Kamkar staged is a common exploit against mobile applications. Using an open source tool such as SSLStrip and a malicious Wi-Fi access point, an attacker can get a mobile device configured to connect to known Wi-Fi hotspots to pair with it. By default, for example, iOS devices on AT&T's mobile network will pair with hotspots with the SSID, "attwifi". But Kamkar's OwnStar device uses the mobile device's Wi-Fi probe requests for networks it has connected to in the past to create networks on the fly, and connect the victim to the Internet via a cellular data network.OwnStar can then act as a proxy for secure connections, offering a forged certificate for the remote server and then decrypting data sent up from the app.

Kamkar says he's only tested the attack on the iOS applications and that he's alerted BMW, Mercedes, and Chrysler of the vulnerability. Until the applications are patched, he recommends not using them—just in case someone is listening close by.

             

              News From :    http://www.linuxsecurity.com/content/view/165256/96/