Search papers, labs, and topics across Lattice.
This study conducts a reverse engineering analysis of a firmware update for a Brake ECU in commercial vehicles, focusing on the S12X architecture. By performing differential binary analysis on the updater executable and extracted firmware images, the researchers identify changes that address undocumented vulnerabilities in legacy protocol processing. Notably, the analysis reveals that while the update aimed to remediate safety issues, it inadvertently introduced critical flaws, highlighting the dual nature of the patch as both a safety and security measure.
The firmware update intended to fix safety issues also introduced critical security flaws, revealing the complexities of patching legacy systems.
This paper presents a reverse engineering analysis of a firmware update for a commercial vehicle Brake ECU. We analyze the updater executable to extract firmware and perform differential binary analysis of the S12X architecture firmware images. Our research identifies specific changes in the recall that address undocumented vulnerabilities in legacy protocol processing. We demonstrate that the patched functionality contained critical flaws. The findings confirm the safety recall remediation was also a security patch.
