Blogs & Stories

SpiderLabs Blog

Attracting more than a half-million annual readers, this is the security community's go-to destination for technical breakdowns of the latest threats, critical vulnerability disclosures and cutting-edge research.

Discovering BMW Car Systems: Getting Started

Since I love both (in)security and cars, it is notuncommon for me to mix those things on a regular basis. I am a very happy ownerof a beautiful BMW F30 (chassis code) 320i 2013, so far, my second bimmer. Thisis a 2.0 turbo four-cylinder engine producing 184hp and 270Nm, it is quite a niceride.

It is no surprise that newer cars use many electronicelements inside and my car is not an exception: there are two components that onecould possibly take control of: the ECU (Engine Control Unit) and the BMWiDrive.

ECU(Engine Control Unit)

ECU is a common hardware on all cars and is beingaround for a long time. It controls all functions in the car including engine,interior, multimedia, and others. In this case, we can access it utilizing anOBDII>ETHERNET cable:


Figure 1: OBDII > ETHERNET cable

The connection is hidden on the driver's side (despitethe fact that this is not a secret at all to most, if not all car repair shopsand smog-check stations):

Figure 2: OBDII port on the car

It provides a TCP/IP connection (establishing IPs forthe car and the laptop) and with that one should be able to modify manyparameters on the car, very risky but draws the most curious ones' attention.The application needed to establish this TCP/IP connection (E-Sys for F**chassis) is not free and neither easy to manipulate but can be done after someresearch.


The iDrive on the other hand is a complete multimediasystem that also includes Internet access. At this point things started to getinteresting, the multimedia is able to connect using Bluetooth (IEEE 802.15.x) inconjunction with the personal access (é esse o nome em inglês?) from an iPhonefor example.

To initiate the research it is necessary to setup anenvironment, in my case I have utilized an iPhone with 3G Internet connection,a computer and their bluetooth connections:


Figure 3: Bluetooth connections


Figure 4: Scanning iDrive ports

No ports opened, at least so far, I did not find anyservice that could be enabled and maybe exploited. My iDrive is not the mostadvanced, Internet access is only good for accessing RSS feeds and a weatherwebsite however in other versions of iDrive now found on BMW 335i, 5, 6 and 7series, it is possible to browser websites, access social networks, etc.hopefully another feature can be reached. The good news are that the extensionfor the usual iDrive (1 and 3 series) can be retrofitted.

This is a very simple blog post just to present the car's connectionsand indicating how anyone can get it started for testing. That is definitely avery extensive topic and demands a lot of study and research but very promisingin the security field since many features were/are being developed to combinecellphones/computers and cars (Ex: Siri from iPhone).

I am planning on writing more about my experience with both ECU (E-Sys)and iDrive and how other hacks are being done by some performance vendors.