Refine
Document Type
Is part of the Bibliography
- no (16)
Keywords
- automotive systems (2)
- Automated Network Scan (1)
- Automotive Diagnostic Protocols (1)
- Automotive Security (1)
- Benchmarks (1)
- CAN (1)
- Cellular Network (1)
- On-Board-Diagnostics (1)
- Penetration Testing (1)
- Security Metrics (1)
Institute
- Fakultät Elektro- und Informationstechnik (8)
- Fakultät Informatik und Mathematik (7)
- Labor Informationssicherheit und Complience (ISC) (7)
- Laboratory for Safe and Secure Systems (LAS3) (7)
- Research Center for Artificial Intelligence - RCAI (6)
- Hochschulleitung/Hochschulverwaltung (1)
- Research Center of Biomedical Engineering - RCBE (1)
- Research Center of Energy and Resources - RCER (1)
- Zentrum für Forschung und Transfer (ZFT ab 2024; vorher: IAFW) (1)
Begutachtungsstatus
- peer-reviewed (2)
IOT Backdoors in Cars
(2019)
Connecting cheap IoT devices to the safety-critical network of a car can be an extremely bad idea, but at least it allows us to hack together our own automotive gadget. This talk explains the complete procedure involved in transforming a cheap OBD GSM dongle designed for fleet management into a open source automotive hacking tool. First, the hardware reverse engineering is demonstrated, showing how each component is interconnected and working together. With this knowledge, it was possible to capture the communication of the GSM module and understand the OTA protocol used by this dongle, which can be used to extract the firmware. A quick reverse engineering of the software will show that no cryptographic authentication is used for the OTA updates, and therefore a pirate GSM BTS can be used to obtain remote code execution. After that, a new open source firmware is written for the device, which can easily be extended and controlled remotely with the LUA scripting language. Examples on how hacking this dongle remotely can affect the safety of the driver will be also given.
This talk will provide a general overview on how Scapy can be used for automotive penetration testing. All present features of Scapy for automotive penetration will be introduced and explained. Also an overview of higher level automotive protocols will be given.
As automotive penetration testing becomes more important, the lack of free tools for automotive network penetration testing led us to integrate new features in Scapy. Scapy is a well established framework for packet manipulation. The flexibility of Scapy allowed us to implement automotive interfaces (CAN) and automotive protocols (ISOTP, GMLAN, UDS, DoIP, OBD-II).
This talk explains the basics of these automotive protocols, the workflow with Scapy for automotive network penetration testing. A live demonstration with some embedded hardware will be given.
Modern cars include more and more features that first emerged from the consumer electronics industry. Technologies like Bluetooth and Internet-connected services found their way into the vehicle industry. The secure implementation of these functions presents a great challenge for the manufacturers because products originating from the consumer industry can often not be easily transferred to the safety-sensitive traffic environment due to security concerns. However, common automotive interfaces like the diagnostics port are now also used to implement new services into the car. With dongles designed to read out certain vehicle data and transfer it to the Internet via the cellular network, the owner can access information about gas consumption or vehicle location through a mobile phone app, even when he is away from the car. This paper wants to emphasize new threats that appear due to the ongoing interconnection in modern cars by discussing the security of the diagnostics interface in combination with the use of an Internet-connected dongle. Potential attack vectors, as well as proof-of-concept exploits will be shown and the implications of security breaches on the safe state of the vehicle will be investigated.
Controller Area Network (CAN) is still the most used network technology in today's connected cars. Now and in the near future, penetration tests in the area of automotive security will still require tools for CAN media access. More and more open source automotive penetration tools and frameworks are presented by researchers on various conferences, all with different properties in terms of usability, features and supported use-cases. Choosing a proper tool for security investigations in automotive network poses a challenge, since lots of different solutions are available. This paper compares currently available CAN media access solutions and gives advice on competitive hard-and software tools for automotive penetration testing.
Secure embedded bootloaders are the trust anchors for modern vehicles’ software. The secure software update process of ECUs is well-defined across the entire automotive industry. Every OEM has his own implementation, but follows the general software update process. This paper demonstrates code execution attacks by combining software and hardware weaknesses in secure automotive bootloaders. The attack can be performed entirely automated, no static code analysisis required. Random fault injection parameters were sufficient to obtain code execution in a reasonable time. All experiments were conducted with electromagnetic fault injection and without any hardware modifications of the targets. We successfully performed our attack on two entirely different gateway Electronic Control Units (ECUs) used in current vehicles (at the time of this research) from Volkswagen and BMW. As a result of this attack, consisting of a combination of a hardware and asoftware attack, the general secure software update process used in the automotive industry needs to be revised.
The evolution of cars from mechanical systems to rolling computers creates new requirements for safety and security engineering. Nowadays, every vehicle contains a safety-critical real-time communication network to fulfill its function. Especially the increasing connectivity of automotive systems enlarged the attack surface for cyber-attacks. Safety engineering in this area is well understood and studied for decades, though the security engineering of these systems needs further research.
This thesis introduces a black-box investigation process to analyze existing auto-motive systems and components and identifies security vulnerabilities in four different ECUs. Combined with a survey of published security research, vehicle-internal networks are identified as an extraordinary threat to the vehicle’s safety and security. The outstanding automation capabilities of security tests for these networks are leveraged in the second part of this thesis.
In order to create automated tools for automotive networks, a software foundation is necessary. As part of this thesis, a comprehensive open-source software framework for security testing in vehicular networks was developed and published. This aims to support further security research based on open and free software.
Novel tools for the automated identification and exploration of attack surfaces in automotive diagnostic protocol implementations are created and evaluated. These tools allow the creation of comparable attack surface metrics through black-box scans of arbitrary ECUs. Automata learning and system state reverse-engineering techniques highly increase the exploration capabilities of the presented tools. The exploration algorithm is tested on thirteen different ECUs from independent OEMs.
All gathered results are evaluated and discussed in the final part of this thesis.
Finally, open issues and further research based on this contribution are discussed.
