'The script hinted at RSA signing being used, but unfortunately the key used for that was not in the source code,' the anonymous poster explained in a blog post back in May that was brought to our attention by a reader this week. 'greenluigi1' thus needed to find the RSA private key to get any further. The updater would use the private key's corresponding RSA public key to check the data was signed using the correct secret private key. That meant 'greenluigi1' could use the AES key to decrypt the firmware images, modify them, and then use the script to re-encrypt the images using the AES key and package it all up into a password-protected ZIP for Hyundai's IVI update system to ingest.īut it wasn't going to be that easy: some part of the supplied data, at least, would need to be cryptographically signed using an RSA private key, and the car hacker didn't have it. This information could also be used to decrypt the images.

The script included the necessary ZIP password for the system update archives, along with an AES symmetric Cipher-Block-Chaining (CBC) encryption key (a single key rather than an RSA asymmetric public/private key pair) and the IV (initialization vector) value to encrypt the firmware images. Turns out the encryption key in that script is the first AES 128-bit CBC example key listed in a NIST document As luck would have it, 'greenluigi1' found on Mobis's website a Linux setup script that created a suitable ZIP file for performing a system update.

Model maker systems crack