@inproceedings{WeissRennerMottoketal., author = {Weiss, Nils and Renner, Sebastian and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {Automated Threat Evaluation of Automotive Diagnostic Protocols}, series = {ESCAR USA, 2021, Virtual}, booktitle = {ESCAR USA, 2021, Virtual}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-29882}, pages = {20}, abstract = {Diagnostic protocols in automotive systems can offer a huge attack surface with devastating impacts if vulnerabilities are present. This paper shows the application of active automata learning techniques for reverse engineering system state machines of automotive systems. The developed black-box testing strategy is based on diagnostic protocol communication. Through this approach, it is possible to automatically investigate a highly increased attack surface. Based on a new metric, introduced in this paper, we are able to rate the possible attack surface of an entire vehicle or a single Electronic Control Unit (ECU). A novel attack surface metric allows comparisons of different ECUs from different Original Equipment Manufacturers (OEMs), even between different diagnostic protocols. Additionally, we demonstrate the analysis capabilities of our graph-based model to evaluate an ECUs possible attack surface over a lifetime.}, language = {en} } @inproceedings{WeissRennerMottoketal., author = {Weiss, Nils and Renner, Sebastian and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {Transport Layer Scanning for Attack Surface Detection in Vehicular Networks}, series = {CSCS '20: Computer Science in Cars Symposium}, booktitle = {CSCS '20: Computer Science in Cars Symposium}, number = {7}, address = {Feldkirchen}, doi = {10.1145/3385958.3430476}, pages = {1 -- 8}, abstract = {In the beginning of every security analysis or penetration test of a system, information about the target has to be gathered. On IT-Systems a port scan is usually performed as a first step of an investigation. Since the communication protocols differ in automotive systems, generic port scanning tools can't be used for a security analysis of CANs. More complex protocols have a higher likelihood of implementation errors and bugs. On CAN networks, such payloads are transferred through International Standard Transport Protocol (ISO-TP) communication. We designed a new methodology to identify ISO-TP endpoints in automotive networks. Every of these endpoints can provide exploitable application layer protocols and therefor has to be considered during penetration testing and security analysis. We contribute a new scan approach for the automated evaluation of possible attack surfaces in automotive CAN networks which has a higher coverage and multiple advantages than state of the art approaches.}, language = {en} } @inproceedings{PozzobonRennerMottoketal., author = {Pozzobon, Enrico and Renner, Sebastian and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {An optimized Bitsliced Masked Adder for ARM Thumb-2 Controllers}, series = {27th International Conference on Applied Electronics (AE): Sep 6, 2022 - Sep 7, 2022, Pilsen, Czech Republic}, booktitle = {27th International Conference on Applied Electronics (AE): Sep 6, 2022 - Sep 7, 2022, Pilsen, Czech Republic}, publisher = {IEEE}, doi = {10.1109/AE54730.2022.9919884}, pages = {4}, abstract = {The modular addition is used as a non-linear operation in ARX ciphers because it achieves the requirement of introducing non-linearity in a cryptographic primitive while only taking one clock cycle to execute on most modern architectures. This makes ARX ciphers especially fast in software implementations, but comes at the cost of making it harder to protect against side-channel information leakages using Boolean masking: the best known 2-shares masked adder for ARM Thumb micro-controllers takes 83 instructions to add two 32-bit numbers together. Our approach is to operate in bitsliced mode, performing 32 additions in parallel on a 32-bit microcontroller. We show that, even after taking into account the cost of bitslicing before and after the encryption, it is possible to achieve a higher throughput on the tested ciphers (CRAX and ChaCha20) when operating in bitsliced mode. Furthermore, we prove that no first-order information leakage is happening in either simulated power traces and power traces acquired from real hardware, after sufficient countermeasures are put into place to guard against pipeline leakages.}, language = {en} } @inproceedings{ThomeczekAttenbergerKolbetal., author = {Thomeczek, Ludwig and Attenberger, Andreas and Kolb, Johannes and Matoušek, V{\´a}clav and Mottok, J{\"u}rgen}, title = {Betrachtungen zu Latenzquellen und deren Beobachtung in POSIX-Systemen am Beispiel von Container-Runtimes}, series = {Echtzeit 2019}, volume = {35}, booktitle = {Echtzeit 2019}, editor = {Unger, Herwig}, publisher = {Springer Fachmedien Wiesbaden}, address = {Wiesbaden}, isbn = {978-3-658-27807-6}, doi = {10.1007/978-3-658-27808-3_12}, pages = {109 -- 118}, abstract = {Die am weitesten verbreiteten autonomen Systeme der Zukunft sind aller Voraussicht nach intelligente Fahrzeuge, welche selbst{\"a}ndig im Straßenverkehr navigieren und mit der Umgebung interagieren. Diese neuen Funktionen erfordern den Einsatz von performanten Mehrkernprozessoren sowie von komplexen (POSIX-kompatiblen) Betriebssystemen. Gleichzeitig erfordert der Einsatz im Automobil hohe funktionale Sicherheit (ASIL-Level), was unter anderem robuste Echtzeiteigenschaften der verwendeten Hard- und Software voraussetzt. Den Echtzeiteigenschaften steht die erh{\"o}hte Komplexit{\"a}t mit neuen Quellen f{\"u}r nichtdeterministische Latenzen gegen{\"u}ber. In diesem Paper pr{\"a}sentieren wir eine {\"U}bersicht {\"u}ber diese neuen Einflussfaktoren, und vermessen anschließend Containerlaufzeitumgebungen und deren Latenzverhalten. Wir zeigen dabei, das Netzwerkbr{\"u}cken unter Last erheblichen Einfluss (Faktor 4-5) auf die Netzwerklatenz aus{\"u}ben k{\"o}nnen.}, language = {de} } @inproceedings{ThomeczekAttenbergerKolbetal., author = {Thomeczek, Ludwig and Attenberger, Andreas and Kolb, Johannes and Matoušek, Vaclav and Mottok, J{\"u}rgen}, title = {Measuring Safety Critical Latency Sources using Linux Kernel eBPF Tracing}, series = {ARCS 2019: 32nd International Conference on Architecture of Computing Systems : workshop proceedings, May 20- 21, 2019, Technical University of Denmark, Copenhagen, Denmark}, booktitle = {ARCS 2019: 32nd International Conference on Architecture of Computing Systems : workshop proceedings, May 20- 21, 2019, Technical University of Denmark, Copenhagen, Denmark}, editor = {Trinitis, Carsten and Pionteck, Thilo}, publisher = {VDE VERLAG GMBH}, address = {Berlin}, isbn = {978-3-8007-4957-7}, pages = {8}, language = {en} } @article{WeissPozzobonMottoketal., author = {Weiss, Nils and Pozzobon, Enrico and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {Automated Reverse Engineering of CAN Protocols}, series = {Neural Network World}, volume = {31}, journal = {Neural Network World}, number = {4}, issn = {1210-0552}, doi = {10.14311/NNW.2021.31.015}, pages = {279 -- 295}, abstract = {Car manufacturers define proprietary protocols to be used inside their vehicular networks, which are kept an industrial secret, therefore impeding independent researchers from extracting information from these networks. This article describes a statistical and a neural network approach that allows reverse engineering proprietary controller area network (CAN)-protocols assuming they were designed using the data base CAN (DBC) file format. The proposed algorithms are tested with CAN traces taken from a real car. We show that our approaches can correctly reverse engineer CAN messages in an automated manner.}, language = {en} } @inproceedings{ThomeczekAttenbergerMatoušeketal., author = {Thomeczek, Ludwig and Attenberger, Andreas and Matoušek, V{\´a}clav and Mottok, J{\"u}rgen}, title = {Latenzen von POSIX Betriebssystemen im Kontext von Hypervisoren in Real-Time Systemen}, series = {Echtzeit und Sicherheit - Echtzeit 2018, Fachtagung des gemeinsamen Fachausschusses Echtzeitsysteme von Gesellschaft f{\"u}r Informatik e.V. (GI), VDI/VDE-Gesellschaft f{\"u}r Mess- und Automatisierungstechnik (GMA) und Informationstechnischer Gesellschaft im VDE (ITG), Boppard, 15. und 16. November 2018}, booktitle = {Echtzeit und Sicherheit - Echtzeit 2018, Fachtagung des gemeinsamen Fachausschusses Echtzeitsysteme von Gesellschaft f{\"u}r Informatik e.V. (GI), VDI/VDE-Gesellschaft f{\"u}r Mess- und Automatisierungstechnik (GMA) und Informationstechnischer Gesellschaft im VDE (ITG), Boppard, 15. und 16. November 2018}, isbn = {978-3-662-58095-0}, doi = {10.1007/978-3-662-58096-7_11}, pages = {99 -- 108}, abstract = {Neu eingef{\"u}hrte Funktionen in der Automobilindustrie, wie zum Beispiel das autonome Fahren, erfordern den Einsatz von performanten Mehrkernprozessoren sowie von komplexen (POSIXkompatiblen) Betriebssystemen. Im Rahmen des branchenspezifischen Preisdrucks kommt es zudem zu einer Konsolidierung von Steuerger{\"a}ten. Gleichzeitig erfordert der Einsatz im Automobil hohe funktionale Sicherheit (ASIL-Level), was unter anderem robuste Echtzeiteigenschaften der verwendeten Hard- und Software voraussetzt. Als Folge dessen werden zur Trennung von harten und weichen Echtzeitsystemen auf derselben Hardware Hypervisoren eingesetzt. Dieses Paper beleuchtet die Latenzauswirkungen diverser Softwarekonfigurationen auf Hardware der n{\"a}chsten Generation mithilfe eines vorgestellten Testsetups und dessen Ergebnissen.}, language = {de} } @article{PozzobonWeissMottoketal., author = {Pozzobon, Enrico and Weiß, Nils and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {An evolutionary fault injection settings search algorithm for attacks on safe and secure embedded systems}, series = {Neural Network World (NNW)}, volume = {33}, journal = {Neural Network World (NNW)}, number = {5}, publisher = {Czech Technical University in Prague}, doi = {10.14311/NNW.2023.33.020}, pages = {357 -- 374}, language = {en} }