Thieves Discovered Using Hacking Tool Disguised As A JBL Portable Speaker To Steal Cars

A new form of carjacking has been discovered by UK-based automotive cybersecurity researcher Ian Tabor, which allows thieves to break into keyless vehicles using a special hacking tool to spoof the security system. One particular version of this device, he noted, could appear as a seemingly harmless portable speaker from JBL.

What led to Tabor researching the matter was actually caused by his own experience of losing his Toyota RAV4 last year. The first few attempts of the theft were even documented by the researcher on Twitter, where he assumed that these were merely acts of senseless vandalism on his car. More specifically, Tabor tweeted that vandals have torn off its front left-side bumper and partially dismantled the headlight not once but twice in three months. 

The third time, unfortunately, was the charm for the thieves as the RAV4 went missing a few days after the second attempt. This incident prompted Tabor to investigate how his car was stolen, together with fellow automotive security expert Dr. Ken Tindell. Their findings have been published as a detailed report via the latter’s Canis Automotive Labs blog on Github.

In their research, it is discovered that the carjackers are using a new and sophisticated approach called CAN (Controller Area Network) Injection, which exploits a newly found vulnerability in 2021 Toyota RAV4 vehicles dubbed as CVE-2023-29389. This particular flaw automatically trusts messages from other ECUs (electronic control units), allowing physically proximate attackers to drive a vehicle by accessing its CAN bus and then sending a forged key validation message. However, thieves are first required to pull away the bumper in order to expose the car’s headlight connector to access the ECU, hence the presumed vandalism attempts.

What’s even more concerning is that such methods, which have been documented on video by the way (shown above), would reportedly take only two minutes to break into keyless vehicles. Upon further digging on Youtube, crime forums and even the dark web, Tabor discovered that thieves have been using CAN Injection tools that are sold online as emergency start devices. These are originally intended for use by owners or automotive professionals when a car’s key fob is lost, stolen, or otherwise unavailable.

As mentioned earlier, one version of this hacking tool, which both security experts purchased for reverse engineering purposes, came in the form of a fake JBL portable speaker – a disguise that can easily fool any unsuspecting individual or authority if uninspected. Our own research has found that other similar tools are also available as generic key fobs and, of all things, a certain retro handset. Of course, we won’t link our discoveries here due to obvious reasons, and we do not condone the use of such equipment.

According to Tindell, pressing the play button on the fake JBL portable speaker will trigger it to send out a CAN message burst that instructs the targeted vehicle’s ECU to unlock its doors. Of course, with the car believing that the false key is valid, thieves are also given access to its Push Start function and are able to drive off.

While the attack was successfully replicated on a Toyota RAV4, it is still possible that something similar could occur on other vehicles using the same technology and architecture. Tabor and Tindell have alerted Toyota regarding the vulnerability, but have yet to receive any acknowledgement or response from the automaker.

Around 60,000 Victims Reportedly Affected By China’s Hacking Of Microsoft Email Servers

The mass hacking of Microsoft Exchange email servers that the software giant has blamed on China is much worse than first thought. One former US official who’s familiar with the ongoing investigation told Bloomberg that at least 60,000 victims were affected across the globe.

The scale of the cyber attacks has the Biden administration scrambling, with top officials urging organisations to patch immediately while also determining if they were compromised. Latest victims reportedly include the European Banking Authority, senior citizen homes, and even an ice-cream company, Bloomberg said.

Microsoft initially described the attacks as “limited and targeted”. But according to the BBC, Brian Krebs, an industry expert, said that the attacks had “dramatically stepped up” since Microsoft’s announcement of the breach last week.

Now the question is how the new US president will respond. The New York Times (NYT) said that the Biden administration had already planned to hit Russia with cyber attacks and economic sanctions in retaliation for earlier hacking incidents. But confronting Russia and China, both nuclear powers, at the same time might prove to be a tad risky – suffice to say.

According to the NYT, the hackers exploited US law that prevents its intelligence agencies from probing systems based in the country. Since the hackers operated from leased virtual private servers (VPS) in the US, the government was caught unaware until a private company – Microsoft, in this latest case – sounded the alarm.

Microsoft Accuses China Of Hacking Email Servers And Accounts

Microsoft today revealed that government-backed hackers in China exploited previously unknown vulnerabilities to compromise its mail server software (Microsoft Exchange) and access email accounts, the BBC said.

After observing the hackers’ targets, tactics and procedures, Microsoft determined that they belonged to Hafnium, a state-sponsored group based physically in China but operating primarily from leased virtual private servers (VPS) in the US.

According to Microsoft, Hafnium tends to go after infectious disease researchers, law firms, higher education institutions, defence contractors, policy think tanks, and NGOs.

Given the COVID-19 pandemic, hacking for infectious disease research data perhaps shouldn’t be surprising. In the past, Russian and North Korean hackers have been blamed for attempts to steal vaccine data.

The BBC noted that this was the eighth time in 12 months that Microsoft had publicly blamed state-sponsored groups for hacking incidents.

China’s official response was rather predictable.

“China wishes relevant media and companies take a professional and responsible attitude, and base characterizations of cyber-attacks on ample evidence, rather than groundless guesses and accusations,” said Chinese foreign ministry spokesperson Wang Wenbin, according to Reuters.

As the BBC noted, Microsoft is one of the few Western tech giants that has a significant, tangible presence in China. Google, Facebook, and Twitter are all blocked in China, but Microsoft’s Bing and LinkedIn are still available to the general population.

Unsurprisingly, Microsoft has now released software updates that address the vulnerabilities exploited by the hackers.