PerfektBlue Bug Chain Exposes Cars to Bluetooth Hacking

A set of critical Bluetooth flaws in software that helps cars connect to phones and other devices could enable attackers to remotely take control of car infotainment systems used by major automakers including Mercedes-Benz, Skoda and Volkswagen, new research shows.

See Also: Frost Radar™ on Healthcare IoT Security in the United States

The vulnerability chain, dubbed PerfektBlue by PCA Security, was discovered in a widely used Bluetooth software stack developed by OpenSynergy called Blue SDK. The flaws allow a previously paired device to trigger a remote code execution attack with just one user interaction – such as clicking a prompt – potentially giving attackers control over the infotainment system’s functions such as audio, navigation and access to personal data.

Modern vehicles are built with multiple interconnected computer systems, or “car networks.” The infotainment system is connected to this network and typically communicates with other vehicle components through shared data pathways, such as Ethernet or CAN bus. These pathways are supposed to have digital “checkpoints” – gateways or firewalls that control what the in-vehicle infotainment system can and cannot communicate with.

But not all manufacturers design these checkpoints the same way. In some cars, the infotainment system is allowed to exchange data too freely with other systems. That means once attackers gain access to the infotainment system – the initial beachhead – they can attempt to pivot into deeper parts of the vehicle’s digital infrastructure. If attackers gain control of the infotainment system through a Bluetooth vulnerability such as PerfektBlue, they can use that foothold to try sending unauthorized commands into the wider vehicle network.

The attack hinges on access through a device that was previously paired to the car’s Bluetooth system – typically a driver’s smartphone. This pairing allows a higher level of trust and access within the system, bypassing many of the security checks required for first-time or untrusted connections. Exploiting PerfektBlue requires the attacker to be within Bluetooth range of the target vehicle – typically about 10 meters. If an attacker still possesses or can spoof a previously paired device – or in some cases, recover data from one – they can exploit the connection trust to bypass reauthentication steps and trigger the exploit simply by being nearby. In some cases, attackers could also plant a small Bluetooth-enabled device near the vehicle in a parking lot or garage to carry out the attack without remaining physically present.

The PerfektBlue exploit chain consists of four vulnerabilities that work in concert to bypass security and execute arbitrary code. PCA Security privately disclosed technical details to affected vendors, relevant authorities and placeholder CVEs have been requested but are not yet public. The flaws include a memory corruption issue that allows an attacker to destabilize or redirect program execution, a logic flaw in how input lengths are validated in Bluetooth communications, a method to escalate system privileges after gaining a foothold and a bug that allows reconnection by a previously paired or spoofed device without user interaction.

Collectively, these vulnerabilities reduce the attack surface normally protected by pairing restrictions, memory safety checks and privilege separation inside the infotainment system. With just one poorly timed tap by a driver – such as accepting a prompt on their screen – an attacker within

Bluetooth range could execute arbitrary code, potentially gaining access to the microphone, GPS data or even telematics systems. In certain vehicle architectures where infotainment system systems are insufficiently segmented, attackers may try to reach systems tied to physical safety functions.