This talk is about the journey on owning the infotainment system of NIO EC6.
In addition to a step-by-step instruction for building exploit chains that enable a remote root shell, I'll share some interesting discoveries: controlling windows and doors, debugging via USB port, subsystem communication mechanisms, and two new vulnerabilities that could be used for persistent root escalation.
The demo utilizes the exploit chain to take over the vehicle.
Published in 2022 via MOSEC.