Security Auditing & Data Extraction of Launch Diagnostic Systems

Investigating vulnerabilities in Android-based OBD2 scanners and intercepting Bluetooth VCI communications.

layout: page title: Security Auditing & Data Extraction of Launch Diagnostic Systems description: Investigating vulnerabilities in Android-based OBD2 scanners and intercepting Bluetooth VCI communications. img: assets/img/launch_project.png importance: 3 category: work —

Project Overview

This project involves a deep-dive security assessment of Launch (ThinkCar) diagnostic ecosystems. These devices consist of an Android-based application communicating with a Smart VCI (Vehicle Communication Interface) via Bluetooth. The research focuses on reverse engineering the communication protocol and extracting sensitive ECU data.

Android Reversing Bluetooth Low Energy (BLE) OBD-II Protocols

Attack Surface Analysis

The analysis is divided into three primary vectors to identify potential vulnerabilities:

1. Android Application Reverse Engineering

Most Launch tools run on a modified Android environment. By decompiling the APK files, I analyzed how the software handles firmware updates for the VCI and how it stores decrypted diagnostic databases.

  • Tools Used: JADX-GUI, Frida.
  • Focus: Logic flaws in the subscription verification and database decryption keys.

2. Bluetooth VCI Sniffing & Interception

The communication between the tablet and the OBD2 connector is a critical point. Using Ubertooth One and Wireshark, I captured the traffic to identify how diagnostic commands (UDS/KWP2000) are encapsulated in Bluetooth packets.

Analyzing Bluetooth HCI logs to intercept raw OBD-II commands sent to the vehicle.

3. Data Extraction & Firmware Analysis

Diagnostic tools often download “Car Brands” packages. This project explores the extraction of these packages to understand how the tool interprets specialized ECU responses that are not part of standard OBD-II.

Key Research Findings

Discovery: Many BLE-based diagnostic connectors lack strong pairing encryption, potentially allowing an unauthorized device to intercept vehicle data within range.
Vulnerability Area Risk Level Impact
BLE Pairing High Unauthorized data sniffing
Local Database Medium Reverse engineering of car logic
APK Security Medium Bypassing license restrictions

Workflow & Methodology

  1. Reconnaissance: Mapping the device’s hardware and identifying open ports.
  2. Traffic Analysis: Monitoring the handshake between the VCI and the ECU.
  3. Exploitation: Attempting to inject custom diagnostic PIDs to extract non-standard data.
The hardware setup: Launch VCI connected to an ECU bench for controlled testing.