SecTor 2025 | DriveThru Hacking: Now with Delivery

Why It Matters

Compromised dash‑cams give attackers real‑time video, location and vehicle control, turning a common consumer gadget into a privacy and safety threat for drivers worldwide.

Key Takeaways

• Many dash cams ship with default or unchangeable passwords, exposing them.
• Shared hardware and firmware let one exploit compromise many models.
• Attack flow uses drive‑thru Wi‑Fi scanning to steal footage within seconds.
• Researchers demonstrated remote root access via unauthenticated upload endpoints on dash cams.
• Some dash cams expose live streams publicly, leaking personal location and conversations.

Summary

The video presents a research project titled “Drive‑Thru Hacking: Now with Delivery,” demonstrating how dash‑cam devices can be compromised when a vehicle stops at a drive‑through. The team, led by Benjamin So and colleagues, scanned over 1,000 Wi‑Fi SSIDs in Singapore, purchased more than 20 dash‑cams from 16 brands, and built an automated tool that discovers, authenticates, extracts, and exfiltrates video footage within the brief window a car spends in a drive‑through lane.

Their findings show that eight‑in‑ten dash‑cams are installed, many manufactured in Asia, and a majority share identical hardware and firmware. Fifteen of the twenty‑two tested units shipped with the same default password, and four brands used immutable passwords, making unauthenticated Wi‑Fi access trivial. The researchers also uncovered unprotected API ports, unauthenticated upload endpoints, and hard‑coded credentials that enable full root control, video download, and even remote battery sabotage.

Notable demonstrations include spoofing a trusted device’s MAC address to bypass pairing, using port‑knocking on custom API ports (7778/7779) to retrieve video and audio streams, and uploading a CGI web shell to gain root on model K. They also highlighted a misconfiguration where dash‑cam mobile apps expose live feeds to anyone, revealing owners’ routes, home addresses, and private conversations.

The work underscores a systemic lack of security hygiene in the dash‑cam market, where cost and video quality are prioritized over authentication and firmware integrity. Manufacturers face urgent pressure to enforce unique passwords, secure OTA updates, and disable default Wi‑Fi access, while consumers should treat dash‑cams as potential attack vectors that can compromise personal privacy and vehicle safety.

Original Description

In-car dash cameras (dashcams) are now standard in modern vehicles, often encouraged by insurers to support claims. But without strong security, they pose a serious privacy and attack risk.

This talk introduces the latest iteration of DriveThru Hacking, targeting over two dozen dashcam models via an automated, vendor-agnostic tool that extracts footage, GPS data, and conversations in minutes. A new online service enables controlled testing via license-based red (attack) and blue (defense) modes. Blue deploys hardening and a lightweight IPS to block known threats.

We will also explore SIM-enabled dashcams with 4G, where attackers escalate privileges from local access and establish outbound C2 beacons - turning mobile dashcams into roaming footholds. Unlike IoT devices locked to a home, these are exposed everywhere the vehicle goes.

We will close with practical countermeasures for manufacturers, defenders, and regulators navigating an increasingly connected automotive world.

By:

George Chen | Security Architect,

Alina Tan | Co-founder, HE&T Security Labs

Chee Peng Tan | Lead Cybersecurity Analyst

Benjamin Cao | Incident Response Lead

Presentation Materials Available at:

https://blackhat.com/sector/2025/briefings/schedule/?#drivethru-hacking-now-with-delivery-47398