TY - CHAP A1 - Weiss, Nils A1 - Renner, Sebastian A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - Automated Threat Evaluation of Automotive Diagnostic Protocols T2 - ESCAR USA, 2021, Virtual N2 - Diagnostic protocols in automotive systems can offer a huge attack surface with devastating impacts if vulnerabilities are present. This paper shows the application of active automata learning techniques for reverse engineering system state machines of automotive systems. The developed black-box testing strategy is based on diagnostic protocol communication. Through this approach, it is possible to automatically investigate a highly increased attack surface. Based on a new metric, introduced in this paper, we are able to rate the possible attack surface of an entire vehicle or a single Electronic Control Unit (ECU). A novel attack surface metric allows comparisons of different ECUs from different Original Equipment Manufacturers (OEMs), even between different diagnostic protocols. Additionally, we demonstrate the analysis capabilities of our graph-based model to evaluate an ECUs possible attack surface over a lifetime. KW - Automotive Diagnostic Protocols KW - Security Metrics KW - Automated Network Scan Y1 - 2021 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:bvb:898-opus4-29882 ER - TY - CHAP A1 - Weiss, Nils A1 - Renner, Sebastian A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - Transport Layer Scanning for Attack Surface Detection in Vehicular Networks T2 - CSCS '20: Computer Science in Cars Symposium N2 - In the beginning of every security analysis or penetration test of a system, information about the target has to be gathered. On IT-Systems a port scan is usually performed as a first step of an investigation. Since the communication protocols differ in automotive systems, generic port scanning tools can’t be used for a security analysis of CANs. More complex protocols have a higher likelihood of implementation errors and bugs. On CAN networks, such payloads are transferred through International Standard Transport Protocol (ISO-TP) communication. We designed a new methodology to identify ISO-TP endpoints in automotive networks. Every of these endpoints can provide exploitable application layer protocols and therefor has to be considered during penetration testing and security analysis. We contribute a new scan approach for the automated evaluation of possible attack surfaces in automotive CAN networks which has a higher coverage and multiple advantages than state of the art approaches. KW - automotive networks KW - network scan KW - attack surface detection KW - automation Y1 - 2020 U6 - https://doi.org/10.1145/3385958.3430476 IS - 7 SP - 1 EP - 8 CY - Feldkirchen ER - TY - JOUR A1 - Weiss, Nils A1 - Pozzobon, Enrico A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - Automated Reverse Engineering of CAN Protocols JF - Neural Network World N2 - Car manufacturers define proprietary protocols to be used inside their vehicular networks, which are kept an industrial secret, therefore impeding independent researchers from extracting information from these networks. This article describes a statistical and a neural network approach that allows reverse engineering proprietary controller area network (CAN)-protocols assuming they were designed using the data base CAN (DBC) file format. The proposed algorithms are tested with CAN traces taken from a real car. We show that our approaches can correctly reverse engineer CAN messages in an automated manner. Y1 - 2021 U6 - https://doi.org/10.14311/NNW.2021.31.015 SN - 1210-0552 VL - 31 IS - 4 SP - 279 EP - 295 ER -