Today I came upon some news weird enough to justify a post on this long-dormant blog. Ars Technica reports that it “began on January 30 and afflicted Mazdas from model years 2014 to 2017 when the cars were tuned to the local NPR station, KUOW 94.9. At some point during the day’s broadcast, a signal from KUOW caused the Mazdas’ infotainment systems to crash—the screens died and the radios were stuck on 94.9 FM.”
That shouldn’t be possible, right? A broadcast FM signal is just frequency-modulated audio. It might deafen you or damage the speakers, but it shouldn’t make the receiver stop working! Well, actually, it isn’t just audio. Broadcasters can optionally use the Radio Broadcast Data System (RBDS), which supports encoded digital data. It uses a 57 kHz subcarrier, well above the limits of human hearing. The data is encoded at 1187.5 bits per second, a strange-sounding number that yields 48 cycles of the subcarrier for every bit. Error correction codes bring the effective data rate down to 730 bits per second.
RDBS carries several types of information, including station identification, clock time, song titles or other text, traffic alerts, and images. The last one is where the problem lay.
As Ars Technica explains it, certain Mazda infotainment systems in model years 2014 to 2017 identified image files by their extension. If it saw .jpg or .png in the file name, it knew what to do with it. But KUOW broadcast some otherwise valid images with no extension in their name. That’s a problem, but it shouldn’t destroy receiving equipment. The bug was on Mazda’s side; the receiver had no idea what to do with a file lacking an extension. Ignoring the file would have been reasonable. Instead, according to a comment,
The very simplified version is that the head unit loaded this image into its cache and tried to decode it, hit the software bug, locked up and watchdog rebooted. The first thing it does when it reboots is tries to decode the image, and locks up and reboots, forever.
That’s doubly bad. First it crashes when it gets an unrecognized file; second, when it reboots, it reprocesses the bad data that made it crash. Forever.
You should be able to fix the problem with a cold reboot, right? An authorized service center should be able to do that. Apparently not. Ars Technica says:
From there, the infotainment systems became trapped in a rebooting loop, never successfully completing the task. When afflicted owners took their cars to be checked at local Mazda dealers, they were told that the “connectivity master unit” was dead and needed to be replaced.
The price of a replacement unit is $1,500. Fortunately, Mazda is offering free replacements to those afflicted by this situation.
It sounds like something out of a science fiction story. A pirate broadcaster could take advantage of this bug to send out a malicious signal, wrecking the receivers of drivers who go station-surfing. When everything contains a computer, everything is potentially vulnerable to sloppy coding.
Like this:
Like Loading...
Related
Mad File Format Science 
How broadcast FM can wreck your receiving system
Today I came upon some news weird enough to justify a post on this long-dormant blog. Ars Technica reports that it “began on January 30 and afflicted Mazdas from model years 2014 to 2017 when the cars were tuned to the local NPR station, KUOW 94.9. At some point during the day’s broadcast, a signal from KUOW caused the Mazdas’ infotainment systems to crash—the screens died and the radios were stuck on 94.9 FM.”
That shouldn’t be possible, right? A broadcast FM signal is just frequency-modulated audio. It might deafen you or damage the speakers, but it shouldn’t make the receiver stop working! Well, actually, it isn’t just audio. Broadcasters can optionally use the Radio Broadcast Data System (RBDS), which supports encoded digital data. It uses a 57 kHz subcarrier, well above the limits of human hearing. The data is encoded at 1187.5 bits per second, a strange-sounding number that yields 48 cycles of the subcarrier for every bit. Error correction codes bring the effective data rate down to 730 bits per second.
RDBS carries several types of information, including station identification, clock time, song titles or other text, traffic alerts, and images. The last one is where the problem lay.
As Ars Technica explains it, certain Mazda infotainment systems in model years 2014 to 2017 identified image files by their extension. If it saw .jpg or .png in the file name, it knew what to do with it. But KUOW broadcast some otherwise valid images with no extension in their name. That’s a problem, but it shouldn’t destroy receiving equipment. The bug was on Mazda’s side; the receiver had no idea what to do with a file lacking an extension. Ignoring the file would have been reasonable. Instead, according to a comment,
That’s doubly bad. First it crashes when it gets an unrecognized file; second, when it reboots, it reprocesses the bad data that made it crash. Forever.
You should be able to fix the problem with a cold reboot, right? An authorized service center should be able to do that. Apparently not. Ars Technica says:
The price of a replacement unit is $1,500. Fortunately, Mazda is offering free replacements to those afflicted by this situation.
It sounds like something out of a science fiction story. A pirate broadcaster could take advantage of this bug to send out a malicious signal, wrecking the receivers of drivers who go station-surfing. When everything contains a computer, everything is potentially vulnerable to sloppy coding.
Share this:
Like this:
Related