1. Mazda Toolbox For Windows
2. Mazda Toolbox For Mac

Mazda cars with next-gen Mazda MZD Connect infotainment systems can be hacked just by plugging in a USB flash drive into their dashboard, thanks to a series of bugs that have been known for at least three years.

Mazda Service Info provides US and Canadian independent automotive repair facilities with subscription based access to Mazda's service information and diagnostics. The information available on this site is intended for vehicles distributed within the North American market only. Checked Map Version. It says Version: February 2018 up to date Latest available: February 2018 If I purchased the car in 2017, how could it indicate that i have the latest version? I haven't done any updates. 2015 Mazda 3 GS sedan.

The issues have been discovered and explored by the users of the Mazda3Revolution forum back in May 2014. Since then, the Mazda car owner community has been using these 'hacks' to customize their cars' infotainment system to tweak settings and install new apps. One of the most well-designed tools is MZD-AIO-TI (MZD All In One Tweaks Installer).

Part 1: Virtual Machine If you already know how to do this or are already on Ubuntu/Linux skip to part 2 These are instructions for Windows 10 and Ubuntu 16.04(64-bit) but any recent Mac OS and Linux distro should work just as well. Mazda Toolbox is an application that enables you to see all available updates, download the necessary files from the internet, and upload updates and new content to your infotainment system. It can also be used to create and restore backups.

The knowledge shared through these two projects has been the base of mazda_getInfo, a project put together by Bugcrowd application security engineer Jay Turla, which automates Mazda car hacks.

Research started out as a curiosity

Speaking to Bleeping Computer, Turla said he started working on the project after recently purchasing a Mazda car.

'I just wanted to check what were the possible attack vectors for my car,' Turla told Bleeping. 'I also want to test my car just for my personal research as I enjoyed my first visit at the Car Hacking Village during DEF CON 24 in Vegas last year. I also have a couple of friends in the Philippines who are currently into car hacking research.'

Turla's mazda_getInfo, which he open sourced on GitHub last week, allows anyone to copy a collection of scripts on their USB flash drive, insert it into their car's dashboard, and execute malicious code on the car's MZD Connect firmware.

During his tests, Turla executed simple attacks like printing text on the car's dashboard or echoing terminal commands. Since MZD Connect is a *NIX-based system, anyone can create scripts and execute more intrusive attacks.

In an email, Turla shared how his project works under the hood.

Turla says that his script is just perfect to re-enable SSH support in the MZ Connect system after the feature has been disabled in previous firmware updates.

USB attack executes automatically

Furthermore, the attack executes automatically right after the user inserts the USB inside a car's dashboard.

'No need for a user interaction, you just need to insert the USB flash drive in the USB port of your car,' the researcher told Bleeping Computer. 'Imagine an autoplay feature on Windows which executes a script directly.'

Despite this benefit, the attack has its downsides. For example, the car must be in accessory mode, or the engine must be running, before the script would execute. This automatically means you can't use the infotainment flaws to start the car's motor and hijack cars.

Nonetheless, the researcher doesn't rule out such scenarios, admitting he only scratched the surface with this issue.

'It is possible although I don't have a PoC about it,' he said in an email. Nonetheless, the researcher said that some malicious hackers could create a botnet for Mazda cars. Below is a sample config for the dataRetrieval_config.txt file, which the researcher shared via email as an example:

Furthermore, Turla says one of his work managers believes these flaws could be abused to install RATs (Remote Access Trojans) on Mazda cars.

Other researchers who looked at the MZD Connect firmware shared this opinion. 'That CMU [Car Multimedia Unit] is full of remote exec bugs,' wrote security researcher Aris Adamantiadis‏ on Twitter. 'If you connect it to WiFi you can have a [read only] access to the CAN bus through network DBUS,' he added.

USB attack loophole closed in recent firmware update

All of this is possible because the bugs allow users to execute unauthorized code on their infotainment unit, which in infosec terms means 'anything goes,' if the attacker has the skill and knowledge to write the proper code.

According to the MZF-AIO-TI project, the USB code execution flaws have been fixed with MZD Connect firmware version 59.00.502, released last month. Cars that have not been updated to this version are most likely open to attacks, albeit there are no reports of this issue being abused in any other way except to tweak infotainment dashboards.

Contacted by Bleeping Computer, Mazda dispelled any fears that this issue could have been used for anything dangerous.

Mazda Connect controls a very limited number of functions within a Mazda vehicle and cannot be accessed remotely over a Wi-Fi signal, leaving any threat of hacking by USB to cause minimal damage at very worst and nothing that couldn’t be reversed. From the vehicle standpoint, Mazda Connect can control limited vehicle feature settings, such as keyless entry, what information is shown on the Active Driving Display, when the vehicle reacts to lane departure, etc. But tampering with any of these features does not gain control over the vehicle's steering, acceleration or braking.

Below is a list of Mazda car models known to feature the MZD Connect system:

Mazda CX-3
Mazda CX-5
Mazda CX-7
Mazda CX-9
Mazda2
Mazda3
Mazda6
Mazda MX-5

Turla told Bleeping Computers he plans to continue his research on car vulnerabilities.

'I'm probably gonna try a Tesla Model S, Honda City 2017, or a Mitsubishi Montero Sport 2017,' the expert said. 'Hope I could get some hands-on testing on the dashboards or infotainment systems that will be displayed in the Car Hacking Village for DEF CON this year.'

'But I need some cash though, to have that kind of extensive research (a car is not cheap). I guess I will just borrow some of my friends' cars for testing.'

Last week, security researcher Aaron Guzman presented a method of hacking Subaru cars at a computer security conference in Australia.

Image credit: Jay Turla, Mazda

Article updated with Mazda comments.

Update your contents on your navigation system via Mazda Update Toolbox application

Here you can find, how to use the application

Get started

What is Mazda Update Toolbox?

You can update the full map in your navigation system with the help of the Mazda Update Toolbox. It is a free-of-charge software that allows you to download or purchase and install map updates onto your navigation SD card.

Basic Requirements

The Mazda Update Toolbox is quick and easy to install.

1. Make sure that your computer meets the minimum requirements:

   • Broadband internet connection is recommended
   • Operating system installed on your computer (Windows 7 or newer version; Max OS X 10.10, Mac OS X 10.11, macOS 10.12, macOS 10.13, macOS 10.14, macOS 10.15)

2. Make sure you have:

   • Mazda Connect SD Card (ejected from your vehicle’s Infotainment system)

Download the Mazda Update Toolbox

1. On https://mazda.welcome.naviextras.com select the region where you purchased your vehicle. You will be automatically navigated to the regional website.
2. Look for the Toolbox Download button under ‘How to Update’ section.
3. Click to download Mazda Update Toolbox.
4. Double-click on the file and on the pop-up window press run to start the installation.
   

   Note: On OSX version, you will find the downloaded installer file in the ‘Downloads’ folder. To start Mazda Update Toolbox, click on ’Mazda Update Toolbox’ icon in the ’Applications’ folder or start it from theLaunchpad.

5. Select your preferred language of the Installation Wizard.
6. To install the application, follow the on-screen instructions.

Start the Mazda Update Toolbox application

After starting the Toolbox, it will try to connect to the servers.

NOTE: If the connection fails, a warning screen is displayed. You can EXIT the application or TRY AGAIN. Toolbox will automatically attempt to connect to the server in every 270 seconds.

1. Insert the Mazda SD card into your computer.
2. If your SD card is recognized by the Toolbox you will be directed to the Login page.

NOTE: If your SD card is not recognized by the Toolbox, it might be damaged or some files corrupted/altered on the SD card. Please contact your Mazda Dealer. If your SD card is recognized but it is not compatible with this version of the Toolbox, you will be prompted to download the appropriate version of the Toolbox.

NOTE: At start, the Mazda Update Toolbox prompts you to update the software if there is a newer version available. If you choose to update, you will go through the same installation procedure as described above. You must be logged in to be able to update the software. If you are notified about an available update but can find no way to complete it, please contact your internet service provider.

Log-in and Registration

Log-in

1. Start Mazda Update Toolbox (from Start menu or in case of OSX operating system, from ´Application’ folder or from the Launchpad)
   Insert your Mazda SD card into your computer.
2. Click on
3. Enter your email address and password
4. Once you are successfully logged in, your email address will be shown on the top right area of all Mazda Update Toolbox screens

Registration

1. Choose to create a new account. Enter your name, select the country of your residence, provide your email address and a password (min. 6 – maximum 32 characters)
   

   NOTE: If your email address is already used for any Toolbox application, there is no need to register again, but please try to log in with it. If you forgot the password, require a new one by clicking on the Forgotten Password link.

2. Tick the box to sign-up to receive notifications about the availability of new map updates.
3. Read the Terms and Conditions and tick the box to accept it.
4. To verify your account, click on the email we sent to your email address
   

   NOTE: In case you wish to create a corporate account, please choose button ‘I am a corporate user”. You will be asked to complete the form and provide your company’s Tax registration number. If your company is registered in the EU and has an EU Tax number, you will be able to purchase content without VAT. Insert the Mazda original SD card (provided with the vehicle’s navigation system).

5. Toolbox will automatically recognize the SD card.

Download and install map updates or updates from your subscription

1. Login and insert your SD card.

   Toolbox automatically checks if you are eligible for any updates and if yes, it lists the available contents (Available Updates screen). If there aren’t any available contents, or your SD card is up-to-date, you will be redirected to Home screen.

   NOTE: Alternatively, you can always reach the [Available Updates] screen from the HOME screen.

   You will see:

   • the current content version installed on your SD card
   • the validity of your subscription
   • Free updates and extras that you are eligible for

2. Click on

   • All the contents that you are eligible for will be updated.
   • Wait until the process finishes, i.e. a message with successful installation appears.

Settings

Help menu

The Help screen contains the Frequently Asked Questions and Resource documents (e.g. Terms and Conditions, Privacy Policy , etc.). Help menu is accessible from the Side Bar.

The FAQ page is hosted on the official Mazda Connect mapupdate website and it will open in your default browser. The Toolbox will remain open in the background.

In the Resources section you can also check the software version of your Mazda Connect navigation system.

Account menu

The Account menu is accessible from the Side Bar.

It contains:

1. Settings:

   1. You can change your email address by clicking on Change Email
   2. You can delete your Mazda Update Toolbox account by clicking on Delete Account.
      

      NOTE: Once you delete your account, you cannot log-in any longer or download contents, however, all the contents downloaded already to your Mazda SD card will remain. If you wish to update your navigation map in the future, you will need to create a new account in the Mazda Update Toolbox.

2. Notification subscription preferences

   You can subscribe to receive email notifications about new map updates / map system updates.

   You can change your subscription preferences by adding or removing the tick from the checkbox next to 'Subscribe to newsletter'. Click on to save the changes.

3. Language selection

   Toolbox application is available in different languages depending on the selected region: Czech, Croatian, Danish, Dutch, English, Estonian, Finnish, French, German, Hungarian, Italian, Latvian, Lithuanian, Norwegian, Polish, Portuguese, Romanian, Russian, Slovenian, Slovakian, Spanish, Swedish, Turkish, Ukrainian.

   The current (chosen) language is highlighted in the middle. You can change the current language selection by clicking on another one from the list.

Backup/Restore contents

Mazda Toolbox For Windows

You can back up the contents of your Mazda Connect navigation device or restore the device to a previous state.

Access the Backup/Restore function from the Side Bar.

Backup

1. Click on Backup to save the current contents on your SD card.
2. Provide a name for your backup file in the field form.
3. Click on Backup button to start the process and wait until it finishes.

Restore

1. Click on Restore if you want to recover an older version of the contents.
2. If you have already done a backup before, Toolbox will display the available files.
3. Choose the backup file you wish to restore and wait until the process finishes.

Mazda Toolbox For Mac

NOTE: The Restore process might take several minutes. Once the process is initiated it cannot be cancelled.