When Estonia switched to winter time on the night of October 24 to 25, 2026, Rasmus Moorats discovered that his 2014 Renault Latitude offered no obvious way to set the clock back. He had previously declined the former owner’s offer to buy the navigation system’s map SD card, doubting the claim that the time could not be changed without it. After searching the settings, he found that claim was accurate.
The car’s TomTom Carminat Live navigation system, released in 2011, relied on data stored on the SD card to load the appropriate menu configuration. Moorats used reverse engineering to investigate, finding the system’s root filesystem in online update files. The device ran a manufacturer-developed operating system based on Linux 2.6.28.10.
His analysis showed that the required settings could only be loaded from an original card. The system used digital rights management, which Moorats suspected was intended to protect map data from piracy. Rather than pay about €60 for a replacement card, he tried to work around the restriction.
After he was unable to hack the old Linux system as expected, Moorats used a technique he said is often employed in kernel exploits. He crashed the system and ran a script installed on his own SD card, allowing him to move the clock forward by an hour.
The method did not reveal a broadly exploitable security flaw: it required physical access to the vehicle and inserting an SD card. However, the incident highlights potential security weaknesses in older automotive software.
Sources: t3n.