Stepping Stone to Car Hacking

Transcription

1 Stepping Stone to ar Hacking The Realistic Threat Model Movie

2 Liran Zwickel - Security researcher Who We Are nigmatos - Automotive yber Security Yannay Livneh - Security researcher Alex Fok TO

3 Agenda History State of the Art New Attack Vectors Applied Hacking

4 Legal Aspects of Automotive yber Research Digital Millennium opyright Act (DMA) - by President linton in 1998, generally prohibits modifying copyrighted software Section 1201 of the DMA effectively prohibits the reverse engineering of computer software for security research purposes, even if the researcher has purchased the software and owns the device October of 2015, the.s. opyright Office signed into law a new series of exemptions to the DMA that allow good-faith security research in a controlled environment designed to avoid any harm to individuals or to the public Due to a one-year delay in implementation, the DMA exemptions did not legally take effect until October 2016.

5 Automotive yber hallenges The number of known incidents is low pdates Distribution xpensive Long life cycle => low computation power Physical access protection is poor Lack of standardization

6 Attack Vectors SW pdates Vendror(S) loud Repair Shops Physical Intrusion Infotainment Wi-Fi\BT Telematics V2X ommunication TPMS OBD

7 ATOMOTIV YBR SRITY HALLNG omplete control through cellular. hrysler had to recall 1.4 M vehicles (2015) Ability to lock and unlock car as well as access to personal data through WiFi (2016) Autopilot & multiple car systems hacked through WiFi (2016) onnected onnected and Intelligent onnected and Super Intelligent

8 nhackable ars nhackable ars 1.1B 1.2B Hackable ars 65M Really?

9 Dumb is the New Smart s

10 AN Bus Automotive Networks Queen Selected Security challenges Lack of device authentication Lack of content authentication Who sent this message?

11 The Architecture VI OM loud Internet The Internet OBD

12 Vector Attacks Analysis - Yannay

13 nhackable

14 ar Hacking Objectives ontrol critical functions Sabotage Private information theft OM deception

15 The Architecture OM loud Internet The Internet O B D

16 The Architecture OM loud Internet The Internet O B D

17 Trust Model

18 Potential Attack Surfaces Internet Rogue ars

19 The Internets

20 Internet to loud Looks Promising Most objectives achieved Full scale OM loud Internet The Internet

21 Feasible IoT Old Machines Distributed Objectives: 1 hop away Internet to Repair Shop

22 Repair Shop to VI asy By design Badly Secured All objectives achieved O B D

23 Rogue ar

24 ar to VI asy, asy, asy All objectives achieved an it scale? O B D

25 Plan for Scale Rogue car attacks VI VI attacks car ar attacks another VI??? Profit

26 Weird Bonus Vectors

27 Trusted Input Direct Access VI to loud OM loud Internet The Internet

28 ar to loud O B D OM loud Internet The Internet

29 cosystem Research 101 OM loud web research VI embedded research ar AN and and stuff

30 Applied Hacking - Liran

31 Quick review VI (Diagnostic Device)

32 Quick review VI (Diagnostic Device)?

33 AN BS (OR: I have access to the car. Now what?)

34 AN? What is AN? Developed by Bosch in 1983 Standardized in 1993 by The ISO (International Organization for Standardization) Fast (p to 1Mbps) heap Reliable Yo! an you turn on the head lights? Yup. I m on it

35 AN? What is AN?

36 AN? What is AN?

37 AN Message Field name Length (bits) Purpose Start-of-frame 1 Denotes the start of frame transmission Identifier (green) 11 A (unique) identifier which also represents the message priority Remote transmission request (RTR) (blue) 1 Must be dominant (0) for data frames and recessive (1) for remote request frames (see Remote Frame, below) Identifier extension bit (ID) 1 Must be dominant (0) for base frame format with 11-bit identifiers Reserved bit (r0) 1 Reserved bit. Must be dominant (0), but accepted as either dominant or recessive. Data length code (DL) (yellow) 4 Number of bytes of data (0 8 bytes) [a] Data field (red) 0 64 (0-8 bytes) Data to be transmitted (length in bytes dictated by DL field) R 15 yclic redundancy check R delimiter 1 Must be recessive (1) AK slot 1 Transmitter sends recessive (1) and any receiver can assert a dominant (0) AK delimiter 1 Must be recessive (1) nd-of-frame (OF) 7 Must be recessive (1)

38 AN Message 123 # # fd 3e 3f 23 ff ff ff ff Dice nigmatos Research Software

39 AN Message Types Sensor Messages Rain Sensor Gear Mode Speed Seatbelt Sensor Its not raining Its not raining Its not raining Its raining! Actuators Turn on Washers Move Side Mirrors OK! Turn on those washers! onfigurations Lock doors in high speeds Disable the rain sensor!

40 Possible Attacks Actuators onfigurations - Starting the ngine - Disable Parking Sensor - Pressing the Breaks - Turning on Indicators - Pressing the Gas - Disable Reverse amera - Disabling ar Alerts (oil, water, etc) - Folding Side Mirrors - Starting Washers - Automatic Door Locking at High Speeds - Wasting all Washer Fluid (muhaha!) - etc - Automatic Breaks (according to motion sensor) - Infotainment Voltage Time After Switch-off - Automatic Washers Not good enough VI (Diagnostic Device) - nable Video in Motion - etc

41 onnecting To The AN Bus - OBD On-board diagnostics (OBD) is an automotive term referring to a vehicle's self-diagnostic and reporting capability. OBD Messages: - ngine RPM (0x) - Vehicle speed (0xD) - Throttle position (0x11) - ngine run time (0x7F)

42 DS Protocol nified Diagnostic Services (DS) is a diagnostic communication protocol in the electronic control unit () specific communication - Reset - Read DT Information - lear Diagnostic Information - Firmware pgrade

43 DS Firmware pgrade Diagnostic Session ontrol(0x2) Diagnostic Session ontrol(ak) Security Access Request Diagnostic Device Security Access hallenge (3d,1f,29,41) Security Access Response (1d,2f,9d,a1) Security Access Granted Bla bla Bla bla Bla bla Bla bla

44 DS Firmware pgrade Request Download Request Download(AK) Diagnostic Device Transfer Data Transfer Data Transfer Data Transfer xit Transfer xit(ak)

45 VI Version 1 VI Version 1 alculating (using a decoding function that is located on the device) Access Request hallenge Response

46 VI Version 2 Hey, give me the decode function for this specific decode function VI Version 2 alculating (using a decoding function received from the cloud) Access Request hallenge Response

47 Summary VI (Diagnostic Device)

48 Summary VI (Diagnostic Device)

49 Summary - Alex

50 The Architecture Internet OM loud The Internets O B D O B D n Server V2X

51 What Next? Further Vendors Research Solutions Short term bandage (Security Review, hardening) Long term implement vehicle security solutions ooperation, cooperation, cooperation

52 Questions @yannayli

53 Thank You