A security researcher had to gain root access to his car's infotainment system to move its clock back one hour after daylight saving time ended.
Rasmus Moorats owns a 2014 Renault Latitude. When he bought it used, the previous owner warned him that the navigation map SD card was needed to change the time. He did not believe it, and since the maps were badly out of date, he went without the card. When the clocks changed, the in-dash display was an hour off. Of its two settings menus, one covered Bluetooth and the phonebook. The other refused to open and showed "No maps detected!" every time.
Moorats chose to reverse engineer the system. He found a customized Linux-based TomTom operating system running on a Samsung chip. He extracted and analyzed the firmware, built an emulated copy of the head unit in QEMU (software that imitates a device's hardware), reversed its scripting engine, and found a number of vulnerabilities. The key move, drawn from his day job with kernel exploits, was to get the kernel to run his script rather than the userland software that normally handles it. That gave him root access.
The payoff was small. The time settings sat in /mnt/flash/settings.dat, in a custom binary format. According to Moorats' blog post, the system has no concept of time zones. It reads the time from GPS and stores the local offset as a number of minutes. His was 180, or three hours. He changed it to 120.
The episode shows how a settings screen can be gated behind an unrelated component. The clock needed no maps, yet the menu would not open without them. The actual fix was one edit to one value, and the hard part was getting to the file. Cars with a physical dial or a plain menu skip that problem entirely. In this one, a missing SD card turned an ordinary seasonal chore into a firmware exercise.