@misc{Weiss, author = {Weiss, Nils}, title = {Reverse Engineering and Weaponizing OBD Dongles}, series = {Automotive Security Research Group, Stuttgart, Germany 2019, Meeting 22}, journal = {Automotive Security Research Group, Stuttgart, Germany 2019, Meeting 22}, language = {de} } @inproceedings{WeissSchroetterHackenberg, author = {Weiss, Nils and Schr{\"o}tter, Markus and Hackenberg, Rudolf}, title = {On Threat Analysis and Risk Estimation of Automotive Ransomware}, series = {ACM Computer Science in Cars Symposium : [CSCS '19) 08.10.2019, Kaiserslautern, Germany}, booktitle = {ACM Computer Science in Cars Symposium : [CSCS '19) 08.10.2019, Kaiserslautern, Germany}, editor = {Hof, Hans-Joachim and Fritz, Mario and Krauß, Christoph and Wasenm{\"u}ller, Oliver}, publisher = {ACM}, address = {New York, NY, USA}, isbn = {9781450370042}, doi = {10.1145/3359999.3360492}, pages = {1 -- 9}, language = {en} } @inproceedings{PozzobonWeissRenneretal., author = {Pozzobon, Enrico and Weiss, Nils and Renner, Sebastian and Hackenberg, Rudolf}, title = {A Survey on Media Access Solutions for CAN Penetration Testing}, series = {ACM Computer Science in Cars Symposium (CSCS), 2nd, 2018, Munich, Germany}, booktitle = {ACM Computer Science in Cars Symposium (CSCS), 2nd, 2018, Munich, Germany}, abstract = {Controller Area Network (CAN) is still the most used network technology in today's connected cars. Now and in the near future, penetration tests in the area of automotive security will still require tools for CAN media access. More and more open source automotive penetration tools and frameworks are presented by researchers on various conferences, all with different properties in terms of usability, features and supported use-cases. Choosing a proper tool for security investigations in automotive network poses a challenge, since lots of different solutions are available. This paper compares currently available CAN media access solutions and gives advice on competitive hard-and software tools for automotive penetration testing.}, language = {en} } @misc{Weiss, author = {Weiss, Nils}, title = {Vulnerabilities of OBD2 Dongles}, series = {RCAR Annual Conference, 2018, Munich, Germany}, journal = {RCAR Annual Conference, 2018, Munich, Germany}, language = {en} } @misc{WeissPozzobon, author = {Weiss, Nils and Pozzobon, Enrico}, title = {IOT Backdoors in Cars}, series = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, journal = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, abstract = {Connecting cheap IoT devices to the safety-critical network of a car can be an extremely bad idea, but at least it allows us to hack together our own automotive gadget. This talk explains the complete procedure involved in transforming a cheap OBD GSM dongle designed for fleet management into a open source automotive hacking tool. First, the hardware reverse engineering is demonstrated, showing how each component is interconnected and working together. With this knowledge, it was possible to capture the communication of the GSM module and understand the OTA protocol used by this dongle, which can be used to extract the firmware. A quick reverse engineering of the software will show that no cryptographic authentication is used for the OTA updates, and therefore a pirate GSM BTS can be used to obtain remote code execution. After that, a new open source firmware is written for the device, which can easily be extended and controlled remotely with the LUA scripting language. Examples on how hacking this dongle remotely can affect the safety of the driver will be also given.}, language = {en} } @misc{Weiss, author = {Weiss, Nils}, title = {Vulnerabilities of Connected Cars and beyond}, series = {Applied Research Colloquium, 2019, Universit{\`a} Padua, Italy}, journal = {Applied Research Colloquium, 2019, Universit{\`a} Padua, Italy}, language = {en} } @inproceedings{HackenbergWeissRenneretal., author = {Hackenberg, Rudolf and Weiss, Nils and Renner, Sebastian and Pozzobon, Enrico}, title = {Extending Vehicle Attack Surface Through Smart Devices}, series = {SECURWARE 2017 : The Eleventh International Conference on Emerging Security Information, Systems and Technologies, 11th, 2017, Rome, Italy}, booktitle = {SECURWARE 2017 : The Eleventh International Conference on Emerging Security Information, Systems and Technologies, 11th, 2017, Rome, Italy}, publisher = {IARIA}, isbn = {978-1-61208-582-1}, pages = {131 -- 135}, abstract = {Modern cars include more and more features that first emerged from the consumer electronics industry. Technologies like Bluetooth and Internet-connected services found their way into the vehicle industry. The secure implementation of these functions presents a great challenge for the manufacturers because products originating from the consumer industry can often not be easily transferred to the safety-sensitive traffic environment due to security concerns. However, common automotive interfaces like the diagnostics port are now also used to implement new services into the car. With dongles designed to read out certain vehicle data and transfer it to the Internet via the cellular network, the owner can access information about gas consumption or vehicle location through a mobile phone app, even when he is away from the car. This paper wants to emphasize new threats that appear due to the ongoing interconnection in modern cars by discussing the security of the diagnostics interface in combination with the use of an Internet-connected dongle. Potential attack vectors, as well as proof-of-concept exploits will be shown and the implications of security breaches on the safe state of the vehicle will be investigated.}, language = {en} } @misc{WeissPozzobon, author = {Weiss, Nils and Pozzobon, Enrico}, title = {Automotive Penetration Testing with Scapy}, series = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, journal = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, abstract = {This talk will provide a general overview on how Scapy can be used for automotive penetration testing. All present features of Scapy for automotive penetration will be introduced and explained. Also an overview of higher level automotive protocols will be given. As automotive penetration testing becomes more important, the lack of free tools for automotive network penetration testing led us to integrate new features in Scapy. Scapy is a well established framework for packet manipulation. The flexibility of Scapy allowed us to implement automotive interfaces (CAN) and automotive protocols (ISOTP, GMLAN, UDS, DoIP, OBD-II). This talk explains the basics of these automotive protocols, the workflow with Scapy for automotive network penetration testing. A live demonstration with some embedded hardware will be given.}, language = {en} } @inproceedings{WeissRennerMottoketal., author = {Weiss, Nils and Renner, Sebastian and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {Automated Threat Evaluation of Automotive Diagnostic Protocols}, series = {ESCAR USA, 2021, Virtual}, booktitle = {ESCAR USA, 2021, Virtual}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-29882}, pages = {20}, abstract = {Diagnostic protocols in automotive systems can offer a huge attack surface with devastating impacts if vulnerabilities are present. This paper shows the application of active automata learning techniques for reverse engineering system state machines of automotive systems. The developed black-box testing strategy is based on diagnostic protocol communication. Through this approach, it is possible to automatically investigate a highly increased attack surface. Based on a new metric, introduced in this paper, we are able to rate the possible attack surface of an entire vehicle or a single Electronic Control Unit (ECU). A novel attack surface metric allows comparisons of different ECUs from different Original Equipment Manufacturers (OEMs), even between different diagnostic protocols. Additionally, we demonstrate the analysis capabilities of our graph-based model to evaluate an ECUs possible attack surface over a lifetime.}, language = {en} } @misc{MauererRexhepajMonkmanetal., author = {Mauerer, Wolfgang and Rexhepaj, Tanja and Monkman, Gareth J. and Sindersberger, Dirk and Diermeier, Andreas and Neidhart, Thomas and Wolfrum, Dominik and Sterner, Michael and Heberl, Michael and Nusko, Robert and Maier, Georg and Nagl, Klaus and Reuter, Monika and Hofrichter, Andreas and Lex, Thomas and Lesch, Florian and Kieninger, B{\"a}rbel and Szalo, Alexander Eduard and Zehner, Alexander and Palm, Christoph and Joblin, Mitchell and Apel, Sven and Ramsauer, Ralf and Lohmann, Daniel and Westner, Markus and Strasser, Artur and Munndi, Maximilian and Ebner, Lena and Elsner, Michael and Weiß, Nils and Segerer, Matthias and Hackenberg, Rudolf and Steger, Sebastian and Schmailzl, Anton and Dostalek, Michael and Armbruster, Dominik and Koch, Fabian and Hierl, Stefan and Thumann, Philipp and Swidergal, Krzysztof and Wagner, Marcus and Briem, Ulrich and Diermeier, Andreas and Spreitzer, Stefan and Beiderbeck, Sabrina and Hook, Christian and Zobel, Martin and Weber, Tim and Groß, Simon and Penzkofer, Rainer and Dendorfer, Sebastian and Schillitz, Ingo and Bauer, Thomas and Rudolph, Clarissa and Schmidt, Katja and Liebetruth, Thomas and Hamer, Markus and Haug, Sonja and Vernim, Matthias and Weber, Karsten and Saßmannshausen, Sean Patrick and Books, Sebastian and Neuleitner, Nikolaus and Rechenauer, Christian and Steffens, Oliver and Kusterle, Wolfgang and G{\"o}mmel, Roland and Wellnitz, Felix and Stierstorfer, Johannes and Stadler, Dominik and Hofmann, Matthias J. and Motschmann, Hubert and Shamonin (Chamonine), Mikhail and Bleicher, Veronika and Fischer, Sebastian and Hackenberg, Rudolf and Horn, Anton and Kawasch, Raphael and Petzenhauser, Michael and Probst, Tobias and Udalzow, Anton and Dams, Florian and Schreiner, Rupert and Langer, Christoph and Prommesberger, Christian and Ławrowski, Robert Damian}, title = {Forschungsbericht 2016}, editor = {Baier, Wolfgang}, address = {Regensburg}, organization = {Ostbayerische Technische Hochschule Regensburg}, doi = {10.35096/othr/pub-1384}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-13840}, language = {de} }