Connected Car - Cyber Security

A car is now a network of computers on wheels, and many of those computers have a radio. So a car can be attacked the same way as a computer, but the result can be physical. This page explains why cars became a target, where an attacker can get in, and how the industry now defends the car.

What is it ?

Simply put 'Automative Cyber Security is a topics / technologies that are trying to provent any types of hacking on your Car'. When you think of hacking with your PC or other computer system in your company, it usually be associated to stealing some digital information from your PC or system. However, Hacking a Car can be more serious because it can not only steal some digital information from your car but also physically hijack the car itself or physically manipulate the car in the way that you didn't intend. (You can find various videos on Youbube showing how they can hack into your car and manipulate the car against the driver's intention).

At early stage of automobile where the car is made up of purely mechnical component. The only way you can hack the car would be physically rob/steal the car.

But at the introduction of digital electronics (e.g, ECU) controlling various parts of the car, it introduced the possibility of hacking the car without physically stealing the car. For example, you can put a small electronic device attached to the car manipulating the command from the electronic controller to various parts of the vehicle.

After that internal communication network connecting the multiple control units in the car (like CAN bus or Vehicle Ethernet), it became possible that once you hijact the control of any one point in the car, you can hijact other parts of the car via the internal CAN bus or Ethernet.

Recently we got to have many components that are manipulated purely by the software and has connection to other part of control units that are physically manipulating the car. So once you can hack into those software based module and you can eventually hack into other control units that are physically manipulating various parts of the car.

Now a lot of Cars has various wireless modules that can communicate not only with various parts in side of the car but also with things out side of the car and some communicate miles, miles away from the car. What if somebody can use these wireless/cellular communication to hack into any one part of your car and hijack all the other parts through the internal car network.

Simply put, every components of the car are now connected internally and externally at the same time as illustrated below. Preventing all of those hacking is the subject of Automative Cyper Security. (The parts labed in Red is claimed to be the common targets of the automative hacking and the possibility of hacking those parts became extremly high even from far away from the physical location of the car using the wireless networks marked in Green Arrow)

Attack surface of a connected car: ECUs, wireless interfaces, Automotive Ethernet and Controller Area Network

Figure 1. Attack surface of a connected car. The wireless links reach the car from outside, and the internal networks connect every target to every other one.

External links : Cellular, GPS GLONASS and the roadside unit reach the car through Telematics, WLAN and the DSRC-Based Receiver (V2X).
Short range entry points : Smartphone, Bluetooth, Remote Key, Passive Keyless Entry and TPMS all use a radio that an attacker near the car can reach.
Physical ports : OBD II and USB give direct access to the internal networks when someone is inside the car.
Control units : Airbag ECU, ADAS System ECU, Lighting System ECU, Engine and Transmission ECU, Steering and Braking ECU and Vehicle Access System ECU physically control the car.
Internal networks : Automotive Ethernet and the Controller Area Network at the bottom connect the ECUs to each other.

Look at how the red labels connect to the two networks at the bottom of Figure 1. Every ECU sits on CAN or on Automotive Ethernet. So an attacker who enters through any radio link is only one network away from the ECUs that brake and steer.

A car hack can move metal : the same attack that steals data on a PC can steer or brake a car.
One entry point can reach every ECU : the internal network carries the attack from the weakest module to the critical ones.

What kind of Attack ?

First, I would recommend you to see this video (Reference [7],[8],[9],[10]). You will see a lot of real examples of the attack for the research purpose and exiting presentation. This will show you all the tricks to attack using CAN Bus.

Then, see this video (Reference [11]) and it will give you some insight on Cryptography in terms of hacking cars.

Before you watch them, let's sort the attacks by how close the attacker has to be. The first group needs physical access. An attacker plugs a device into the OBD II port under the dashboard, and from there sends frames onto the CAN bus. The second group works within radio range of the car. One example is a relay attack on Passive Keyless Entry. It extends the range of the key, so a thief can open and start the car. Another example is a false TPMS message. The third group works from anywhere, through the cellular link of the Telematics unit.

The third group is the one that changed the industry. In 2015 two researchers took control of a Jeep Cherokee on the highway through its cellular connected infotainment unit, as shown in Reference [15]. They moved from that unit onto the CAN bus and reached the steering and the brakes. The car maker recalled about 1.4 million vehicles to fix the software.

The attacks work because CAN was designed for a closed network. A CAN frame carries no sender address and no authentication. Every ECU on the bus receives every frame, and any node can send a frame with any identifier. So once an attacker controls one node, the other ECUs cannot tell the forged frames from the real ones.

The defences follow the same layers. A central gateway separates the networks, so that the infotainment unit cannot send frames to the braking ECU directly. Secure onboard communication adds a message authentication code to the important frames. Secure boot and signed over-the-air updates make sure that each ECU runs only software from the car maker. Regulation now requires this work. UNECE Regulation No. 155 requires a cyber security management system for type approval, and Regulation No. 156 covers software updates. ISO/SAE 21434 describes the engineering process behind them.

Attacks come in three ranges : physical access, radio range and remote access through the cellular link.
CAN trusts every frame : it has no sender authentication, so one compromised node can talk to all the others.
Defence is layered : gateways, authenticated messages, secure boot and signed updates, required now by UNECE R155 and R156.