Rasmus Moorats wanted to change the clock on his 2014 Renault Latitude. The Set time option was missing, and the settings menu refused to open without a genuine map SD card. He ended up with root on the navigation unit.
A menu stored on removable media
The unit is a TomTom Carminat LIVE running a custom system on Linux 2.6.28.10. Writing up the work on November 2, Moorats found the menu definition itself lived on the SD card, so the unit could not reach its settings without one.
TomTom and Renault hardened it beyond what 2011 code usually gets: read-only partitions, signed updates.
Three lines and a core dump
Moorats built a QEMU emulator with a stub CAN bus to watch what the unit reads at boot. One file, master.script, is parsed by a program called ttn that runs as root. Its LOG command wrote to an unsanitized path, so adding ../ let a root process write anywhere.
He aimed that write at core_pattern, the Linux setting for what happens after a crash. He piped a shell and a script from the card into it, then launched dbus-monitor, which aborts on a machine with no system bus. The kernel ran the script as root.
The payload was three lines. He found the timezone offset in internal storage and moved it from 180 minutes to 120.
What the stunt actually shows
This is not remote. Someone must insert a prepared card, and the driver must approve the Execute master.script prompt. A rental, a shared car, or a shop visit supplies both.
The flaws are ordinary. Removable media is trusted at boot, the parser runs privileged, and paths go unvalidated. Head units outlive their support windows by a decade, so those mistakes sit in traffic long after anyone remembers the fix.
