PerfektBlue: Universal 1-click Exploit to Pwn Automotive Industry - Mercedes-Benz, Volkswagen, Skoda, and others

No ratings

Presented at Power of Community 2025 by

Mikhail Evdokimov

Security awareness in the automotive domain has been rising throughout the past few years. This has been possible due to the published vulnerability research on transport vehicles conducted by companies such as KeenLab, Synacktiv, PCAutomotive, and others, as well as the introduction of automotive-oriented security competitions like ZDI did for Pwn2Own in 2024. Still to this day, one of the main entry points to a vehicle's internal systems, from an attacker's point of view, is In-Vehicle Infotainment (IVI) system which is central to a car's entertainment, navigation, and connectivity functions. This talk covers the PerfektBlue exploitation attack - a set of critical memory corruption and logic vulnerabilities found in BlueSDK Bluetooth stack that can be chained together to obtain over-the-air Remote Code Execution (RCE) on millions of transport vehicles manufactured by different vendors with all the standard security mitigations enabled. You will be guided through the entire vulnerability research process, from the initial vulnerability discovery to building a sophisticated exploitation chain to get RCE on multiple real targets. The session begins with an overview of Volkswagen, Mercedes-Benz, and Skoda IVI systems, followed by an introduction to the Bluetooth stack architecture implemented in BlueSDK framework. Once the basic information is given, we delve into the discovery and exploitation phases describing how a UAF vulnerability can be turned into the Arbitrary Address Write (AAW) primitive, along with the memory leak via the logic bugs' chain. After this, we put it all together to obtain the Arbitrary Address Read (AAR) primitive used to achieve execution of arbitrary functions any number of times that leads to RCE on IVI systems. In conclusion of the exploitation section, we shed light on how to tune the exploit for other targets, followed by a discussion of the broader implications of these findings. Our talk ends with information on how we identified other potentially vulnerable devices using public resources, and the possible risks PerfektBlue poses to the end-users.