Experimental Security Analysis of a Modern Automobile

By Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak N. Patel, Tadayoshi Kohno, Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham and 1 more. IEEE Symposium on Security and Privacy, 2010

516 citations recorded by the source corpus.

Modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled by dozens of digital computers coordinated via internal vehicular networks. While this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks. In this paper we experimentally evaluate these issues on a modern automobile and demonstrate the fragility of the underlying system structure. We demonstrate that an attacker who is able to infiltrate virtually any Electronic Control Unit (ECU) can leverage this ability to completely circumvent a broad array of safety-critical systems. Over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input\dash including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on. We find that it is possible to bypass rudimentary network security protections within the car, such as maliciously bridging between our car's two internal subnets. We also present composite attacks that leverage individual weaknesses, including an attack that embeds malicious code in a car's telematics unit and that will completely erase any evidence of its presence after a crash. Looking forward, we discuss the complex challenges in addressing these vulnerabilities while considering the existing automotive ecosystem.

Subfields: Electrical and Electronic Engineering, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/92a8fa2abcb2fb70126df4feb3ba0248221fe931

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Electrical and Electronic Engineering

In Information Systems

In Signal Processing

Citations in the corpus

Security and Privacy Vulnerabilities of In-Car Wireless Networks: A Tire Pressure Monitoring System Case Study (2010, background): “Lastly, we note related work on the security of a car’s computer system [26].”
A Survey of Physics-Based Attack Detection in Cyber-Physical Systems (2018, background): “There is a growing literature on the security of Cyber-Physical Systems (CPS), including the verification of control code by an embedded system before it reaches the Programmable Logic Controller (PLC), Remote Terminal Unit (RTU), or Intelligent Electronic Device (IED) [69], security of embedded dev”
Fingerprinting Electronic Control Units for Vehicle Intrusion Detection (2016, background): “Through a compromised ECU, the adversary can control the vehicle by injecting packets in the in-vehicle network [20, 23].”
Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving (2019, background): “ustness. 11 RELATED WORK Vehicle systems security. Numerous previous works explore security problems in vehicle systems and have uncovered vulnerabilities in in-vehicle networks of modern automobiles [22, 25, 36], infotainment systems [40], and emerging connected vehicle-based systems [23, 30, 48]. ”
A Survey of IoT-Enabled Cyberattacks: Assessing Attack Paths to Critical Infrastructures and Services (2018, unknown): “Infrastructures: Preliminary works [165] demonstrated”
Autonomous Cars: Research Results, Issues, and Future Challenges (2019, background): “munication, packet sniffing, packet fuzzing, jamming, and so on [181]–[184].”
A Survey of Intrusion Detection for In-Vehicle Networks (2020, background): “3) Attacks From Interfaces (Application Layer): Cyberat-tacks against vulnerabilities or protocol weaknesses of exter-nal networks and equipment have been covered by [4].”