A developer publishing as xwtk has released NEMESIS, an open toolkit that gains root on Hyundai Motor Group Gen5W infotainment systems. Hackaday covered the release on November 2.
What it opens
Gen5W units ship in many Hyundai and Kia models from roughly 2015 onward. Once NEMESIS is installed, owners run packages from a community store, including wireless Android Auto and Apple CarPlay on cars that shipped without them, plus turn-by-turn prompts on the driver cluster.
The build requires an Android-based unit with S5W_M in its software version string, and the car must support OTA updates. S5W_L hardware runs a different architecture and cannot be ported. Elantra, Forte, Ioniq 6, and every Canadian Hyundai Motor Group vehicle are excluded because their update schemes lack the flaw.
An unsigned path to root
The documentation says NEMESIS reuses the DSP update agent, which runs unsigned DSP OTA members as root. Installation walks the vehicle into Engineering Mode, opens USB Copy, selects Update DSP, then taps Update OTA. The head unit reboots with the toolkit in place on /system.
That is the security question, not the wireless CarPlay. A shipping vehicle accepts a file from a USB stick and executes part of it with the highest privilege because the update pipeline does not check what it is running.
Where the charge lands
Nothing here is remote; an attacker needs brief access to the USB port. But the property that lets an enthusiast enable a feature lets anyone with a prepared stick install code the owner never approved, with no signing boundary in between.
Hyundai has not published a response. Owners should treat an unattended car and an unfamiliar USB drive the way they would treat a handed-over laptop.
