99% Invisible found out that Mazda has a bug in their radio that cannot parse special characters. See their article here: https://99percentinvisible.org/episode/the-roman-mars-mazda-...
Even then it was a nearly invisible problem for the podcast itself, not something that would have been significant enough to investigate and correct for if that wasn't also content for the show.
If so, just include a payload in the title that fixes the bug by patching the code :)
They used to autorun specifically named files on a USB stick.
Then some busybody journalists picked up on that and Mazda was forced to lock it down despite the fact that there is complete physical separation from safety systems, and that situations like this article are exactly where it helps.
[0]: https://datatracker.ietf.org/doc/html/rfc3986#section-2.1
HackRF + open source DAB modulation stack + <carefully chosen combination of ASCII characters> = OTA... DoS? Jailbreak? Other miscellaneous interestingness?
In an age where everything's a computer, FM radio is just just another source of unsanitised input.
The original articles issue is a HD Radio (not DAB) issue to do with images, although it might still be a string parse issue of some kind as it apparently involves "image files with no extension", so presumably filenames? So the RF side can indeed be fun on consumer electronics with modern digital standards. Another example is this claimed RCE over DVB-T: https://twitter.com/David3141593/status/1481963959532011520
Unlike DAB or DAB+ which are open standards with FOSS implementations out there.
The protocol itself is actually standardized: https://www.nrscstandards.org/standards-and-guidelines/docum...
It's just the audio codec that's proprietary, but it's basically just a slightly modified version of AAC so it's been decoded.
I doubt Xperi really cares, since HD Radio is a trademark so it's not like you could build, sell and market an "HD Radio" device without licensing from them anyway.
[0]: https://datatracker.ietf.org/doc/html/rfc3986#section-2.1
99% invisible
I agree, this is a problem for the makers of the broken radio. But Roman Mars is just a nice guy.
I started to unsubscribe every podcast with annoying ads or hosted at megaphone.fm, but I'm in minority.
Nit: he sold it.
https://www.theverge.com/2021/4/26/22403852/siriusxm-roman-m...
When I first loaded my music collection, it stuck in a reboot loop, so I have a script that sanitizes the metadata for exporting to my car
Weird intersection.
TLDR: The problem is the `% In`, and specifically the `%n` - when printf sees that, it tries to store data in memory. Failing to do so, it crashes.
I read [1] which someone linked to, and it all seems to make sense. But it doeesn't!
I tried compiling this with gcc 11.2.0:
#include <stdio.h>
int main(void)
{
printf("%99 Invisible", NULL);
return 0;
}
test.c: In function ‘main’:
test.c:5:14: warning: unknown conversion type character ‘ ’ in format [-
Wformat=]
5 | printf("%99 Invisible", NULL);
| ^
test.c:5:10: warning: too many arguments for format [-Wformat-extra-args]
5 | printf("%99 Invisible", NULL);
| ^~~~~~~~~~~~~~~
Removing the cruft and trying plain %In gives a warning, but I guess whoever built the car's radio UI ignores warnings.
I guess it's possible that the system doesn't use a standard-compliant enough C library, so it's printf() implementation does something ... creative with this string.
Anyway, classic case of the lovely foot-gunnery that is %n in the wild! Sorry for all the car owners, of course. :/
EDIT: A commenter pointed out that the above are "just warnings", oops. :) More oops on me for not spelling the freaking title correctly, of course it's "99%" and not "%99" .. .need more coffee, clearly. Sorry.
For people less used to C, the error here more or less seems to boil down to passing an untrusted string as the special "format string" for the printf() function. That function will interpret the contents of the string, and the percent symbol is how its special formatting directives start. Characters following a percent symbol will cause it to do stuff. The proper fix is usally to change
printf(string);
printf("%s", string);
[1] https://github.com/Hamled/mazda-format-string-bug#readme
"99% Invisible" produces the expected result: https://godbolt.org/z/Mc9zPKWdq
<source>:6:12: warning: format string is not a string literal (potentially insecure) [-Wformat-security]Just are just warnings, it builds fine despite them.