HEXACON2024 – 0-click RCE on the IVI component by Mikhail Evdokimov

**Summary:**
The video discusses a talk given by Mikov, a senior security researcher, regarding a zero-click remote code execution vulnerability demonstrated on the Alpine H9 infotainment system at a security competition in Tokyo. The presentation covers Bluetooth internals, the exploitation process, and the timeline of findings that led to achieving root access via a reverse shell on the system.

**Keypoints:**

The speaker introduces himself as a senior security researcher specializing in reverse engineering and vulnerability research, particularly in Bluetooth technologies.

The focus is on the Alpine H9 infotainment system, which supports CarPlay and Android Auto and can interface with various connections, including Bluetooth.

The speaker provides a background on Bluetooth internals, explaining the protocol layers and the process of establishing Bluetooth connections between devices.

A significant highlight is the discovery of a use-after-free vulnerability within the Bluetooth stack of the Alpine system, which allows for reliable code execution over Bluetooth without user interaction.

The exploit involves manipulating Bluetooth data packets and heap memory management to achieve arbitrary read and write capabilities.

The exploitation strategy utilizes heap overflow techniques to manipulate the Bluetooth stack’s memory and execute a reverse shell.

The final exploit provides stability improvements that led to a 96% success rate, enabling root access and the ability to control the infotainment system remotely.

The speaker details the timeline of the vulnerability discovery, from initial research to the development of the exploit, and notes the lack of a patch from Alpine despite the vulnerability being reported.

The implications of the exploit allow for broader attacks on connected devices, such as obtaining personal information or controlling vehicle functionalities.

The presentation concludes by emphasizing the potential attack surface in proprietary Bluetooth stacks and the overall experience of participating in the competition.