A new application for old attack By DRP; Cybersecurity Lab Engineer
Vehicle security assessment (car hacking) being in earnest three to four years ago. The momentous occasion most associated with this was the Jeep attack (Greenberg, 2017). This has been well publicized in the print media, social media, YouTube, and many other placements. This act of research truly opened the eyes of not just the public, but also politicians and InfoSec personnel.
One area that continues to be an issue is with connected vehicles being vulnerable due to several factors, one of which is the link to the internet. This link has the potential to open a door widely to the vehicle, allowing the knowledgeable attacker the opportunity to exploit any vulnerabilities, both openly known and not yet well publicized. A recent vehicle attack was presented at the DIVMA security conference in Bonn, Germany (Greenberg, 2017).
Vulnerability
This particular attack is focused on the vehicle’s internal network and CAN. In effect, this takes the form of a DoS attack. This is present in the vehicles manufactured for years. Unfortunately, the attack and vulnerability is nearly a universal problem. The fundamental security issue for this attack is the CAN protocol. This allows for the vehicle’s components to communicate with each other within the vehicle’s network. This was designed for this and is within the standard operations. With the current level of technology with the vehicles, this attack is nearly impossible to detect.
The technology in the vehicles which are in service at this time is not designed to defend against this (Maggi, 2017). To defend against the DoS attack seemingly would not require a massive integration and a multitude of change orders. An issue within this implementation is finding the application(s) that may work in this environment, completing a successful proof of concept, and then implementing this within each OEM’s platform. With the level of administration and planning with this application, having this be an integral part of the vehicle’s technology platform may require this being planned on with the next generation.
Attack
The issue is with the CAN standard itself (Maggi, 2017). This particular attack works a bit different than the normal DoS attack that has plagued victims through the IoT botnet army. The attack seeks a frame or basic unit of communication. Once this is identified, the attacker would insert its own frame with a corrupted bit. This corrupted bit is substituted for another bit already present in the communication channel. The targeted vehicle component recognizes the bit is not correct, as it has been corrupted by the attacker.
The CAN protocol issues an error message to recall the message with the intentionally incorrect bit. These steps are repeated. The substantial number of errors creates a Bus Off state. In theory, the protocol should isolate a device that would be malfunctioning. This would stop the waterfall of other devices continuing to fail to post the initial device. The increase in the number of errors creates the Bus Off state.
The attacker may focus on the different modules in the vehicle for the attack. With a successful attack, the airbags, anti-lock brakes, door locks, or other areas in the vehicle may be disabled (Greenberg, 2017).
Remediation
In the non-vehicle realm, the remediation for this is not a complex issue to solve. There are a number of applications that may work well with the use case in the enterprise. These, while the code for the enterprise, accomplishes its task exceptionally well, do not work in the vehicle technology environment. To correct this and would require an update to the CAN standard (Maggi, 2017). There are many different configurations to attempt to correct this, including segmenting the network in the vehicle and encryption.
Reference
Greenberg, A. (2017, August 16). A deep flaw in your car lets hackers shut down safety features. Retrieved from https://www.wired.com/story/car-hack-sht-down-safety-features/
Kovacs, E. (2017, July 31). ICS-CERT warns of CANBus vulnerability. Retrieved from http://www.securityweek.com/ics-cert-warns-can-bus-vulnerability
Maggi, F. (2017, August 16). The crisis of connected cars: When vulnerabilities affect the CAN standard. Retrieved from http://blog.trendmicro.com/trendlabs-security-intelligence/connected-car-hack/
Palanca, A., Evenchick, E., Maggi, F., & Zanero, S. (2017, June 4). A stealth, selective, link-layer denial-of-service attack against automotive networks. Retrieved from https://link.springer.com/chapter/0.1007/978-3-319-60876-1_9
About the Author
DRP is a Cybersecurity Lab Engineer focused on securing the world for the users one module at a time. DRP’s interests include the intersection AI & ML and automotive cybersecurity.
