TY - GEN A1 - Weiss, Nils T1 - Reverse Engineering and Weaponizing OBD Dongles T2 - Automotive Security Research Group, Stuttgart, Germany 2019, Meeting 22 Y1 - 2019 UR - https://www.meetup.com/de-DE/Automotive-Security-Research-Group-ASRG/events/261796924/ ER - TY - CHAP A1 - Weiss, Nils A1 - Schrötter, Markus A1 - Hackenberg, Rudolf ED - Hof, Hans-Joachim ED - Fritz, Mario ED - Krauß, Christoph ED - Wasenmüller, Oliver T1 - On Threat Analysis and Risk Estimation of Automotive Ransomware T2 - ACM Computer Science in Cars Symposium : [CSCS '19) 08.10.2019, Kaiserslautern, Germany Y1 - 2019 SN - 9781450370042 U6 - https://doi.org/10.1145/3359999.3360492 SP - 1 EP - 9 PB - ACM CY - New York, NY, USA ER - TY - CHAP A1 - Pozzobon, Enrico A1 - Weiss, Nils A1 - Renner, Sebastian A1 - Hackenberg, Rudolf T1 - A Survey on Media Access Solutions for CAN Penetration Testing T2 - ACM Computer Science in Cars Symposium (CSCS), 2nd, 2018, Munich, Germany N2 - Controller Area Network (CAN) is still the most used network technology in today's connected cars. Now and in the near future, penetration tests in the area of automotive security will still require tools for CAN media access. More and more open source automotive penetration tools and frameworks are presented by researchers on various conferences, all with different properties in terms of usability, features and supported use-cases. Choosing a proper tool for security investigations in automotive network poses a challenge, since lots of different solutions are available. This paper compares currently available CAN media access solutions and gives advice on competitive hard-and software tools for automotive penetration testing. KW - CAN KW - Penetration Testing KW - Benchmarks Y1 - 2018 UR - https://cscs.mpi-inf.mpg.de/files/2018/09/05-A-Survey-on-Media-Access-Solutions-for-CAN-Penetration-Testing.pdf // 10.1145/3273946.3273949 ER - TY - GEN A1 - Weiss, Nils T1 - Vulnerabilities of OBD2 Dongles T2 - RCAR Annual Conference, 2018, Munich, Germany Y1 - 2018 ER - TY - GEN A1 - Weiss, Nils A1 - Pozzobon, Enrico T1 - IOT Backdoors in Cars T2 - IT Security Conference Troopers19, 2019, Heidelberg, Germany N2 - Connecting cheap IoT devices to the safety-critical network of a car can be an extremely bad idea, but at least it allows us to hack together our own automotive gadget. This talk explains the complete procedure involved in transforming a cheap OBD GSM dongle designed for fleet management into a open source automotive hacking tool. First, the hardware reverse engineering is demonstrated, showing how each component is interconnected and working together. With this knowledge, it was possible to capture the communication of the GSM module and understand the OTA protocol used by this dongle, which can be used to extract the firmware. A quick reverse engineering of the software will show that no cryptographic authentication is used for the OTA updates, and therefore a pirate GSM BTS can be used to obtain remote code execution. After that, a new open source firmware is written for the device, which can easily be extended and controlled remotely with the LUA scripting language. Examples on how hacking this dongle remotely can affect the safety of the driver will be also given. Y1 - 2019 UR - https://troopers.de/troopers19/agenda/mud7fn/ ER - TY - GEN A1 - Weiss, Nils T1 - Vulnerabilities of Connected Cars and beyond T2 - Applied Research Colloquium, 2019, Università Padua, Italy Y1 - 2019 ER - TY - CHAP A1 - Hackenberg, Rudolf A1 - Weiss, Nils A1 - Renner, Sebastian A1 - Pozzobon, Enrico T1 - Extending Vehicle Attack Surface Through Smart Devices T2 - SECURWARE 2017 : The Eleventh International Conference on Emerging Security Information, Systems and Technologies, 11th, 2017, Rome, Italy N2 - Modern cars include more and more features that first emerged from the consumer electronics industry. Technologies like Bluetooth and Internet-connected services found their way into the vehicle industry. The secure implementation of these functions presents a great challenge for the manufacturers because products originating from the consumer industry can often not be easily transferred to the safety-sensitive traffic environment due to security concerns. However, common automotive interfaces like the diagnostics port are now also used to implement new services into the car. With dongles designed to read out certain vehicle data and transfer it to the Internet via the cellular network, the owner can access information about gas consumption or vehicle location through a mobile phone app, even when he is away from the car. This paper wants to emphasize new threats that appear due to the ongoing interconnection in modern cars by discussing the security of the diagnostics interface in combination with the use of an Internet-connected dongle. Potential attack vectors, as well as proof-of-concept exploits will be shown and the implications of security breaches on the safe state of the vehicle will be investigated. KW - On-Board-Diagnostics KW - Cellular Network KW - Automotive Security Y1 - 2017 UR - https://www.thinkmind.org/articles/securware_2017_8_10_38014.pdf SN - 978-1-61208-582-1 SP - 131 EP - 135 PB - IARIA ER - TY - GEN A1 - Weiss, Nils A1 - Pozzobon, Enrico T1 - Automotive Penetration Testing with Scapy T2 - IT Security Conference Troopers19, 2019, Heidelberg, Germany N2 - This talk will provide a general overview on how Scapy can be used for automotive penetration testing. All present features of Scapy for automotive penetration will be introduced and explained. Also an overview of higher level automotive protocols will be given. As automotive penetration testing becomes more important, the lack of free tools for automotive network penetration testing led us to integrate new features in Scapy. Scapy is a well established framework for packet manipulation. The flexibility of Scapy allowed us to implement automotive interfaces (CAN) and automotive protocols (ISOTP, GMLAN, UDS, DoIP, OBD-II). This talk explains the basics of these automotive protocols, the workflow with Scapy for automotive network penetration testing. A live demonstration with some embedded hardware will be given. Y1 - 2019 UR - https://www.youtube.com/watch?v=7D7uNqPWrXw UR - https://troopers.de/downloads/troopers19/TROOPERS19_NGI_RT_Automotive_PenTesting_with_Scapy.zip ER - TY - CHAP A1 - Weiss, Nils A1 - Renner, Sebastian A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - Automated Threat Evaluation of Automotive Diagnostic Protocols T2 - ESCAR USA, 2021, Virtual N2 - Diagnostic protocols in automotive systems can offer a huge attack surface with devastating impacts if vulnerabilities are present. This paper shows the application of active automata learning techniques for reverse engineering system state machines of automotive systems. The developed black-box testing strategy is based on diagnostic protocol communication. Through this approach, it is possible to automatically investigate a highly increased attack surface. Based on a new metric, introduced in this paper, we are able to rate the possible attack surface of an entire vehicle or a single Electronic Control Unit (ECU). A novel attack surface metric allows comparisons of different ECUs from different Original Equipment Manufacturers (OEMs), even between different diagnostic protocols. Additionally, we demonstrate the analysis capabilities of our graph-based model to evaluate an ECUs possible attack surface over a lifetime. KW - Automotive Diagnostic Protocols KW - Security Metrics KW - Automated Network Scan Y1 - 2021 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:bvb:898-opus4-29882 ER - TY - JOUR A1 - Mauerer, Wolfgang A1 - Rexhepaj, Tanja A1 - Monkman, Gareth J. A1 - Sindersberger, Dirk A1 - Diermeier, Andreas A1 - Neidhart, Thomas A1 - Wolfrum, Dominik A1 - Sterner, Michael A1 - Heberl, Michael A1 - Nusko, Robert A1 - Maier, Georg A1 - Nagl, Klaus A1 - Reuter, Monika A1 - Hofrichter, Andreas A1 - Lex, Thomas A1 - Lesch, Florian A1 - Kieninger, Bärbel A1 - Szalo, Alexander Eduard A1 - Zehner, Alexander A1 - Palm, Christoph A1 - Joblin, Mitchell A1 - Apel, Sven A1 - Ramsauer, Ralf A1 - Lohmann, Daniel A1 - Westner, Markus A1 - Strasser, Artur A1 - Munndi, Maximilian A1 - Ebner, Lena A1 - Elsner, Michael A1 - Weiß, Nils A1 - Segerer, Matthias A1 - Hackenberg, Rudolf A1 - Steger, Sebastian A1 - Schmailzl, Anton A1 - Dostalek, Michael A1 - Armbruster, Dominik A1 - Koch, Fabian A1 - Hierl, Stefan A1 - Thumann, Philipp A1 - Swidergal, Krzysztof A1 - Wagner, Marcus A1 - Briem, Ulrich A1 - Diermeier, Andreas A1 - Spreitzer, Stefan A1 - Beiderbeck, Sabrina A1 - Hook, Christian A1 - Zobel, Martin A1 - Weber, Tim A1 - Groß, Simon A1 - Penzkofer, Rainer A1 - Dendorfer, Sebastian A1 - Schillitz, Ingo A1 - Bauer, Thomas A1 - Rudolph, Clarissa A1 - Schmidt, Katja A1 - Liebetruth, Thomas A1 - Hamer, Markus A1 - Haug, Sonja A1 - Vernim, Matthias A1 - Weber, Karsten A1 - Saßmannshausen, Sean Patrick A1 - Books, Sebastian A1 - Neuleitner, Nikolaus A1 - Rechenauer, Christian A1 - Steffens, Oliver A1 - Kusterle, Wolfgang A1 - Gömmel, Roland A1 - Wellnitz, Felix A1 - Stierstorfer, Johannes A1 - Stadler, Dominik A1 - Hofmann, Matthias J. A1 - Motschmann, Hubert A1 - Shamonin (Chamonine), Mikhail A1 - Bleicher, Veronika A1 - Fischer, Sebastian A1 - Hackenberg, Rudolf A1 - Horn, Anton A1 - Kawasch, Raphael A1 - Petzenhauser, Michael A1 - Probst, Tobias A1 - Udalzow, Anton A1 - Dams, Florian A1 - Schreiner, Rupert A1 - Langer, Christoph A1 - Prommesberger, Christian A1 - Ławrowski, Robert Damian ED - Baier, Wolfgang T1 - Forschungsbericht 2016 T3 - Forschungsberichte der OTH Regensburg - 2016 Y1 - 2016 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:bvb:898-opus4-13840 CY - Regensburg ER - TY - CHAP A1 - Weiss, Nils A1 - Renner, Sebastian A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - Transport Layer Scanning for Attack Surface Detection in Vehicular Networks T2 - CSCS '20: Computer Science in Cars Symposium N2 - In the beginning of every security analysis or penetration test of a system, information about the target has to be gathered. On IT-Systems a port scan is usually performed as a first step of an investigation. Since the communication protocols differ in automotive systems, generic port scanning tools can’t be used for a security analysis of CANs. More complex protocols have a higher likelihood of implementation errors and bugs. On CAN networks, such payloads are transferred through International Standard Transport Protocol (ISO-TP) communication. We designed a new methodology to identify ISO-TP endpoints in automotive networks. Every of these endpoints can provide exploitable application layer protocols and therefor has to be considered during penetration testing and security analysis. We contribute a new scan approach for the automated evaluation of possible attack surfaces in automotive CAN networks which has a higher coverage and multiple advantages than state of the art approaches. KW - automotive networks KW - network scan KW - attack surface detection KW - automation Y1 - 2020 U6 - https://doi.org/10.1145/3385958.3430476 IS - 7 SP - 1 EP - 8 CY - Feldkirchen ER - TY - CHAP A1 - Jahn, Sabrina A1 - Weiss, Nils A1 - Akcakoca, Ugur A1 - Mottok, Jürgen ED - Gómez Chova, L. ED - López Martínez, A. ED - Candel Torres, I. T1 - Under The Hood - A Concept for Virtualized Automotive Security Education T2 - EDULEARN21: Proceedings N2 - In recent years, our society faced a massive interconnection of computer-based everyday objects, which opens these items for cyber-attacks. Dependent on the physical capabilities, successful attacks can vary from data exposure or a loss of functionality to a threat to life and limb. Connected- and autonomous vehicles are extremely safety-critical systems with a huge damage potential. This global trend, together with existing and upcoming regulations (ISO 270xx, ISO 21434, UNECE WP.29, UNECE R155), and the lack of qualified professionals create a tension field for the entire automotive industry. Hence, new education concepts for engineers of safety-critical and connected systems are necessary to secure our daily and future systems against cyber-attacks and raise awareness and knowledge of the topic of IT-Security. Existing automotive security education systems have one common problem: All systems are hardware-based and therefore have very steep learning curves for beginners. Hardware-based systems, in general, are expensive in their initial costs, require regular maintenance, and add diverse operational difficulties independent of the aspired education goal. Additionally, the global pandemic increased the necessity of virtual education concepts for security training in cyber-physical systems. Therefore, we present a novel concept for the education of cyber-security professionals for automotive systems based on discovery and problem-based learning in a virtual learning environment (VLE). Our concept contains individual exercises focusing on the topics of vulnerabilities and attacks in automotive networks and systems. Each exercise relates those topics to the corresponding security goals and countermeasures for mitigation. The learners work collaboratively in a self-contained manner within the VLE to acquire the necessary information to answer questions or find a solution to the given problem. To consider the heterogeneous background (e.g. knowledge, experience, preconceptions) of the learners, the topics can be presented in different difficulties, enabling an adaptable learning environment and different learning trajectories within the exercises. The concept is based on a VLE, consisting of automotive networks and components, which simulate the behavior of a vehicle. This environment provides a hands-on, "real-life" scenario, which allows discovery and problem-based learning in a realistic, but cheap and scalable education environment. Furthermore, virtualization removes common difficulties, always present in training on real hardware. This aims to decrease complexity, prevent learning obstacles related to hardware handling, and enables a location-independent learning environment. The target group of our education concept is Bachelor and Master students of computer science, engineering (e.g. electrical engineering, mechatronics), or similar studies, and (experienced) engineers from the industry. In summary, our publication contains two contributions. We present an adaptable virtual learning environment for automotive security education, combined with an educational concept based on discovery and problem-based learning techniques. The goals of our concept are the education of cyber-security professionals for safety-critical, connected automotive systems and the support of life-long learning reaching from academic education to training in the industry. KW - automotive systems KW - discovery learning KW - higher education KW - inductive teaching KW - problem-based learning KW - security education KW - virtual learning environment Y1 - 2021 SN - 978-84-09-31267-2 U6 - https://doi.org/10.21125/edulearn.2021.1231 SN - 2340-1117 SP - 6109 EP - 6118 ER - TY - JOUR A1 - Weiss, Nils A1 - Pozzobon, Enrico A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - Automated Reverse Engineering of CAN Protocols JF - Neural Network World N2 - Car manufacturers define proprietary protocols to be used inside their vehicular networks, which are kept an industrial secret, therefore impeding independent researchers from extracting information from these networks. This article describes a statistical and a neural network approach that allows reverse engineering proprietary controller area network (CAN)-protocols assuming they were designed using the data base CAN (DBC) file format. The proposed algorithms are tested with CAN traces taken from a real car. We show that our approaches can correctly reverse engineer CAN messages in an automated manner. Y1 - 2021 U6 - https://doi.org/10.14311/NNW.2021.31.015 SN - 1210-0552 VL - 31 IS - 4 SP - 279 EP - 295 ER - TY - JOUR A1 - Pozzobon, Enrico A1 - Weiß, Nils A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - An evolutionary fault injection settings search algorithm for attacks on safe and secure embedded systems JF - Neural Network World (NNW) Y1 - 2023 U6 - https://doi.org/10.14311/NNW.2023.33.020 VL - 33 IS - 5 SP - 357 EP - 374 PB - Czech Technical University in Prague ER -