@inproceedings{PozzobonWeissMottoketal., author = {Pozzobon, Enrico and Weiß, Nils and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {Fuzzy fault injection attacks against secure automotive bootloaders}, series = {21th escar Europe : The World's Leading Automotive Cyber Security Conference (Hamburg, 15. - 16.11.2023)}, booktitle = {21th escar Europe : The World's Leading Automotive Cyber Security Conference (Hamburg, 15. - 16.11.2023)}, publisher = {Ruhr-Universit{\"a}t Bochum}, doi = {10.13154/294-10381}, url = {http://nbn-resolving.de/urn:nbn:de:hbz:294-103817}, pages = {20}, abstract = {Secure embedded bootloaders are the trust anchors for modern vehicles' software. The secure software update process of ECUs is well-defined across the entire automotive industry. Every OEM has his own implementation, but follows the general software update process. This paper demonstrates code execution attacks by combining software and hardware weaknesses in secure automotive bootloaders. The attack can be performed entirely automated, no static code analysisis required. Random fault injection parameters were sufficient to obtain code execution in a reasonable time. All experiments were conducted with electromagnetic fault injection and without any hardware modifications of the targets. We successfully performed our attack on two entirely different gateway Electronic Control Units (ECUs) used in current vehicles (at the time of this research) from Volkswagen and BMW. As a result of this attack, consisting of a combination of a hardware and asoftware attack, the general secure software update process used in the automotive industry needs to be revised.}, language = {en} } @phdthesis{Weiss, author = {Weiß, Nils}, title = {Security testing in safety-critical networks}, pages = {xiv, 126}, abstract = {The evolution of cars from mechanical systems to rolling computers creates new requirements for safety and security engineering. Nowadays, every vehicle contains a safety-critical real-time communication network to fulfill its function. Especially the increasing connectivity of automotive systems enlarged the attack surface for cyber-attacks. Safety engineering in this area is well understood and studied for decades, though the security engineering of these systems needs further research. This thesis introduces a black-box investigation process to analyze existing auto-motive systems and components and identifies security vulnerabilities in four different ECUs. Combined with a survey of published security research, vehicle-internal networks are identified as an extraordinary threat to the vehicle's safety and security. The outstanding automation capabilities of security tests for these networks are leveraged in the second part of this thesis. In order to create automated tools for automotive networks, a software foundation is necessary. As part of this thesis, a comprehensive open-source software framework for security testing in vehicular networks was developed and published. This aims to support further security research based on open and free software. Novel tools for the automated identification and exploration of attack surfaces in automotive diagnostic protocol implementations are created and evaluated. These tools allow the creation of comparable attack surface metrics through black-box scans of arbitrary ECUs. Automata learning and system state reverse-engineering techniques highly increase the exploration capabilities of the presented tools. The exploration algorithm is tested on thirteen different ECUs from independent OEMs. All gathered results are evaluated and discussed in the final part of this thesis. Finally, open issues and further research based on this contribution are discussed.}, language = {en} } @article{PozzobonWeissMottoketal., author = {Pozzobon, Enrico and Weiß, Nils and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {An evolutionary fault injection settings search algorithm for attacks on safe and secure embedded systems}, series = {Neural Network World (NNW)}, volume = {33}, journal = {Neural Network World (NNW)}, number = {5}, publisher = {Czech Technical University in Prague}, doi = {10.14311/NNW.2023.33.020}, pages = {357 -- 374}, language = {en} } @misc{MauererRexhepajMonkmanetal., author = {Mauerer, Wolfgang and Rexhepaj, Tanja and Monkman, Gareth J. and Sindersberger, Dirk and Diermeier, Andreas and Neidhart, Thomas and Wolfrum, Dominik and Sterner, Michael and Heberl, Michael and Nusko, Robert and Maier, Georg and Nagl, Klaus and Reuter, Monika and Hofrichter, Andreas and Lex, Thomas and Lesch, Florian and Kieninger, B{\"a}rbel and Szalo, Alexander Eduard and Zehner, Alexander and Palm, Christoph and Joblin, Mitchell and Apel, Sven and Ramsauer, Ralf and Lohmann, Daniel and Westner, Markus and Strasser, Artur and Munndi, Maximilian and Ebner, Lena and Elsner, Michael and Weiß, Nils and Segerer, Matthias and Hackenberg, Rudolf and Steger, Sebastian and Schmailzl, Anton and Dostalek, Michael and Armbruster, Dominik and Koch, Fabian and Hierl, Stefan and Thumann, Philipp and Swidergal, Krzysztof and Wagner, Marcus and Briem, Ulrich and Diermeier, Andreas and Spreitzer, Stefan and Beiderbeck, Sabrina and Hook, Christian and Zobel, Martin and Weber, Tim and Groß, Simon and Penzkofer, Rainer and Dendorfer, Sebastian and Schillitz, Ingo and Bauer, Thomas and Rudolph, Clarissa and Schmidt, Katja and Liebetruth, Thomas and Hamer, Markus and Haug, Sonja and Vernim, Matthias and Weber, Karsten and Saßmannshausen, Sean Patrick and Books, Sebastian and Neuleitner, Nikolaus and Rechenauer, Christian and Steffens, Oliver and Kusterle, Wolfgang and G{\"o}mmel, Roland and Wellnitz, Felix and Stierstorfer, Johannes and Stadler, Dominik and Hofmann, Matthias J. and Motschmann, Hubert and Shamonin (Chamonine), Mikhail and Bleicher, Veronika and Fischer, Sebastian and Hackenberg, Rudolf and Horn, Anton and Kawasch, Raphael and Petzenhauser, Michael and Probst, Tobias and Udalzow, Anton and Dams, Florian and Schreiner, Rupert and Langer, Christoph and Prommesberger, Christian and Ławrowski, Robert Damian}, title = {Forschungsbericht 2016}, editor = {Baier, Wolfgang}, address = {Regensburg}, organization = {Ostbayerische Technische Hochschule Regensburg}, doi = {10.35096/othr/pub-1384}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-13840}, language = {de} }