California e-ink platemaker exploited to track equipped cars
(2023/01/10)
- Reference: 1673367489
- News link: https://www.theregister.co.uk/2023/01/10/california_digital_platemaker_exploited_to/
- Source link:
California's street-legal ink license plates only received a nod from the US government in October, but reverse engineers have already discovered vulnerabilities in the system allowing them to track each plate, reprogram them or even delete them at a whim.
In a blog post by security researcher Sam Curry, he describes a project targeting digital license plate maker Reviver put together with some friends, among several other [1]automotive security experiments .
The system of Reviver, maker of the only commercially available digital license plate on the market and the company behind the push for [2]E Ink plate legalization in California , caught Curry and his friends' attention because it included internal tracking tools for its plates.
[3]
"Since the license plate could be used to track vehicles, we were super interested in Reviver and began auditing the mobile app," Curry said.
[4]
[5]
Reviver plates began showing up on California roads in 2017 as part of a pilot program. Reviver said it deployed around 10,000 of them from 2017 until the pilot program was ended ahead of legalization.
One feature of the e-ink plates would be to notify owners if the vehicle was moved without their knowledge. If so, the plate could be changed to read STOLEN.
[6]
After a bit more digging and creation of a new Reviver account, Curry and friends found that their account was assigned a unique "company" JSON object that allowed them to add sub-users to their account.
Interestingly enough, several of the other JSON fields in the company object were also editable, including one that defined the account type as "CONSUMER." Other account types were unlisted in the mobile app, and so Curry and co turned to Reviver's password reset URL.
"We observed that the [password reset] website had tons of functionality including the ability to administer vehicles, fleets, and user accounts," Curry said.
[7]
JavaScript on the site also contained a full list of other roles, and the crew found they were able to edit their account type to be any they desired.
Curry and friends ultimately gained access to a role called REVIVER, which broke the password reset site's UI, cluing them in that it might actually be an administrator account not designed to interact with the consumer interface.
That turned out to be the case.
"We could take any of the normal API calls (viewing vehicle location, updating vehicle plates, adding new users to accounts) and perform the action using our super administrator account with full authorization," Curry said. The site also gave them access to fleet management functionality.
Trolling was also a possibility with the permissions Curry found he could grant himself. The REVIVER role aditionally granted access to any dealership that packaged the plates, allowing Curry to change the default images from DEALER to, well, whatever inappropriate phrase would fit.
Along with elevating the permissions on the account used in the experiment, Curry said the company role object, which gives permission to invite sub-users, allowed him to invite others with elevated permissions.
"An actual attacker could remotely update, track, or delete anyone's REVIVER plate," Curry said.
[8]OK, boomer? Gen-X-ers, elder millennials most likely to name their cars, says DVLA
[9]0ops. 1,OOO-plus parking fine refunds ordered after drivers typed 'O' instead of '0'
[10]Australian state adds AI number plate readers to GPS tracking of corona-quarantine busters
[11]Port of Hamburg to pave its roads with Cisco things
The vulnerability was reported to Reviver, which Curry said patched it "in under 24 hours."
The company confirmed this, telling The Register : "We are proud of our team's quick response," adding: "Our investigation confirmed that this potential vulnerability has not been misused. Customer information has not been affected, and there is no evidence of ongoing risk related to this report."
Reviver plates are street legal in California, Arizona and Michigan, and in the state of Texas for commercial vehicles only. Several other states are piloting the technology; at between $800 and nearly $1,000 for a two-year contract, hopefully Reviver is a bit more secure now than at launch. ®
Get our [12]Tech Resources
[1] https://samcurry.net/web-hackers-vs-the-auto-industry/
[2] https://www.theregister.com/2022/10/11/california_digital_license_plates/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/12/09/dvla_survey/
[9] https://www.theregister.com/2020/09/16/melbourne_typo_parking_fines/
[10] https://www.theregister.com/2020/04/09/australia_state_adds_ai_number/
[11] https://www.theregister.com/2015/06/04/port_of_hamburg_to_pave_its_roads_with_cisco_things/
[12] https://whitepapers.theregister.com/
In a blog post by security researcher Sam Curry, he describes a project targeting digital license plate maker Reviver put together with some friends, among several other [1]automotive security experiments .
The system of Reviver, maker of the only commercially available digital license plate on the market and the company behind the push for [2]E Ink plate legalization in California , caught Curry and his friends' attention because it included internal tracking tools for its plates.
[3]
"Since the license plate could be used to track vehicles, we were super interested in Reviver and began auditing the mobile app," Curry said.
[4]
[5]
Reviver plates began showing up on California roads in 2017 as part of a pilot program. Reviver said it deployed around 10,000 of them from 2017 until the pilot program was ended ahead of legalization.
One feature of the e-ink plates would be to notify owners if the vehicle was moved without their knowledge. If so, the plate could be changed to read STOLEN.
[6]
After a bit more digging and creation of a new Reviver account, Curry and friends found that their account was assigned a unique "company" JSON object that allowed them to add sub-users to their account.
Interestingly enough, several of the other JSON fields in the company object were also editable, including one that defined the account type as "CONSUMER." Other account types were unlisted in the mobile app, and so Curry and co turned to Reviver's password reset URL.
"We observed that the [password reset] website had tons of functionality including the ability to administer vehicles, fleets, and user accounts," Curry said.
[7]
JavaScript on the site also contained a full list of other roles, and the crew found they were able to edit their account type to be any they desired.
Curry and friends ultimately gained access to a role called REVIVER, which broke the password reset site's UI, cluing them in that it might actually be an administrator account not designed to interact with the consumer interface.
That turned out to be the case.
"We could take any of the normal API calls (viewing vehicle location, updating vehicle plates, adding new users to accounts) and perform the action using our super administrator account with full authorization," Curry said. The site also gave them access to fleet management functionality.
Trolling was also a possibility with the permissions Curry found he could grant himself. The REVIVER role aditionally granted access to any dealership that packaged the plates, allowing Curry to change the default images from DEALER to, well, whatever inappropriate phrase would fit.
Along with elevating the permissions on the account used in the experiment, Curry said the company role object, which gives permission to invite sub-users, allowed him to invite others with elevated permissions.
"An actual attacker could remotely update, track, or delete anyone's REVIVER plate," Curry said.
[8]OK, boomer? Gen-X-ers, elder millennials most likely to name their cars, says DVLA
[9]0ops. 1,OOO-plus parking fine refunds ordered after drivers typed 'O' instead of '0'
[10]Australian state adds AI number plate readers to GPS tracking of corona-quarantine busters
[11]Port of Hamburg to pave its roads with Cisco things
The vulnerability was reported to Reviver, which Curry said patched it "in under 24 hours."
The company confirmed this, telling The Register : "We are proud of our team's quick response," adding: "Our investigation confirmed that this potential vulnerability has not been misused. Customer information has not been affected, and there is no evidence of ongoing risk related to this report."
Reviver plates are street legal in California, Arizona and Michigan, and in the state of Texas for commercial vehicles only. Several other states are piloting the technology; at between $800 and nearly $1,000 for a two-year contract, hopefully Reviver is a bit more secure now than at launch. ®
Get our [12]Tech Resources
[1] https://samcurry.net/web-hackers-vs-the-auto-industry/
[2] https://www.theregister.com/2022/10/11/california_digital_license_plates/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y72ZracykDgCNYUUGwEvfgAAAEY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/12/09/dvla_survey/
[9] https://www.theregister.com/2020/09/16/melbourne_typo_parking_fines/
[10] https://www.theregister.com/2020/04/09/australia_state_adds_ai_number/
[11] https://www.theregister.com/2015/06/04/port_of_hamburg_to_pave_its_roads_with_cisco_things/
[12] https://whitepapers.theregister.com/
Re: Stick them on a Tesla.
Anonymous Coward
and send out statewide broadcasts of their position. Just so that other road users can avoid those Tesla occupiers who insist on driving everywhere on FSD and sleeping.
FWIW, here in the UK, I think that the Model 3 (Black naturally) has taken over from the BMW 3 Series as the drive of choice for the bonehead company car drivers who stick in lane 3(or 4 or 5) of motorways even if the road is clear.
Come on Cops you have the CCTV... why don't you prosecute them. It is not as it you have to go out in the rain and cold to nab them is it?
Solution in search of a problem
spuck
$800 - $1000 every two years to "manage" my license plate?
Someone please explain what advantage this has for anybody other than the manufacturer or the lobbyists who want this?
Re: Solution in search of a problem
Steve Davies 3
$800 - $1000 every two years to "manage" my license plate?
There are a lot of people in CA with more money than sense.
Soon to be coming to a state near you. Don't you just love progress when it is as useless as this?
Give me the old black and silver/white plates any day.
Stick them on a Tesla.
Just saying.