Podcast
Root Causes 240: Hyundai Production Private Key Found in How-to Manual


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
September 7, 2022
A white hat researcher recently defeated a production automobile's PKI by searching for the private key on Google. Join us as we describe the implementation error making this possible and how it might have come about.
Podcast Transcript
Lightly edited for flow and brevity.
So at the highest level, you can imagine that there’s software in your car. Just about every car right now has, in fact, a pile of software, within your dashboard but also, even within the engine management system, so the computers that run your engine. Anyway, it has become common practice after a whole lot of black hats, where white hat researchers have shown you can take control of cars because they’re just so darn computerized and also connected, that firmware running these embedded computers can be messed with, and what I mean messed with, I mean replaced with malicious firmware or all kinds of other techniques that the bad guys or the white hat researchers have. So, it’s a very good practice to be able to Code Sign that software to make sure that it’s legit. The genuineness of the firmware on these computer systems is very, very important.
Basically, white hat researcher taking a look directly at the firmware of one of these embedded systems in a car, said, I don’t know where I’ve seen this before or whatever it was. They essentially did a Google search on once they saw a piece of this embedded software and then determined the private key that had signed the firmware was directly out of the example manual from NIST, in other words, 800-38A, which is basically, here’s how you implement PKI 101. And it was literally directly out of that book. In other words, somebody at Hyundai, and believe me, I’m not picking on companies. Computers are hard, Tim. We know this. But it was them. They were listed in this article. First of all, there’s the WOW moment of realizing somebody decided to take a published example in probably one of the most widely read PKI, how to do PKI manuals there is; guidance in terms of how to perform PKI and chose to use not just the technique but chose to use the exact private key example out of the book.
It’s a demonstration of fundamental misunderstanding of what that guidance was trying to give you. It wasn’t trying to give you, here’s the private key everybody in the world should use, it was an example of here’s what a private key looks like, don’t use this but, this is what it is going to look like. Somebody at Hyundai decided to use it literally.
Quite often, you would use that, you would hook into that just to say okay, that’s obviously a genuine part that comes from a specific factory, but now for the purposes of what I’m doing with PKI in terms of either encryption or signing or whatever it is you're doing cryptographically, you will then provide you own key pair, and so in this case, wow, did you ever miss that.
And even if this were a public/private key pair that had not been published in a place where people can find it, at the end of the day, you're rolling forward with a firmware with a software update system using a private key that was provided to you by an outside party, if this did come from an OEM. If this came from an OEM, then someone decided we’re gonna use this private key that was given to me outside my organization and you shouldn’t do that either, because that now means your private key is exposed.

