Break Points
Smart Car Attacks
Jack Ganssle
5/23/2010 10:53 PM EDT
A fascinating paper (“Experimental Security Analysis of a Modern Automobile”) by a cast of thousands demonstrates that at least some modern cars can be attacked with quite devastating results.
Today’s cars are basically some mechanical bits that support a huge array of electronics. The latter is composed of Electronic Control Units (ECUs) that are unsurprisingly all interconnected by one or more busses. What is amazing is how deeply these units interact.
For instance, in some vehicles the doors are unlocked and seatbelts pre-tensioned just before a crash. Others use the radio to generate all of the clicks, beeps and groans that alert the driver to various conditions.
Communications between ECUs is over CAN busses, with a low-speed bus to handle relatively unimportant functions (e.g., door locks) and a high speed bus for safety-critical functions like braking. Some ECUs require both busses, creating a bridge between them that can have unintentional vulnerabilities.
In the paper the authors talk little about attack entry points; they refer vaguely to one wireless threat uncovered during their experiments, but mostly used the OBD-II under-dash connector to monitor inter-ECU communications and inject their own bits of nastiness.
But they seem to have little doubt that networking capabilities like OnStar and the coming Interneting of the highways will provide plenty of entry points for the bad guys to exploit. Aftermarket add-ons that connect to the OBD-II or counterfeit ECUs could also create openings into the busses.
One might think that CAN would provide some authentication, but the paper shows that those supported by the standard are often modified or disabled by the ECU designers. And, CAN is very subject to DoS attacks, which can so flood traffic that important messages never get through.
One gets the feeling that they had a lot of fun running the experiments; for instance, they could pop the trunk, honk the horn, display messages on the dashboard (like a count-down to destruction accompanied by increasingly threatening noises over the radio), change all of the lighting, and continuously squirt windshield wiper fluid.
More perilously, at speed it wasn’t hard to lock a single front brake, or even disable braking entirely. An alarming quote: “we were able to release the brakes and actually prevent our driver from braking; no amount of pressure on the brake pedal was able to activate the brakes.”
I found two takeaway messages from the paper. First, security needs to be Job One for automotive engineers. And second, all of us in the embedded world should start thinking very hard about our products. Are they compromisable? Does it matter? For many the answer to the latter is “no,” but I think one should be wary of a glib “no.”
Jack G. Ganssle is a lecturer and consultant on embedded development issues. He conducts seminars on embedded systems and helps companies with their embedded challenges. Contact him at jack@ganssle.com. His website is www.ganssle.com.
|
|
|
|
|
krwada
5/24/2010 2:05 PM EDT
Nothing will happen until some kind of disaster occurs. Then, the reaction will be a huge 180 kneejerk reaction in the opposite direction.
Thus is the state of human nature
Sign in to Reply
mad_b
5/25/2010 7:46 AM EDT
Hey Jack, nice points here. In the present time, more and more care must be taken to avoid removing some key control points from the mechanical simplicity that always has been done efficiently: braking. The idea of a non functional brake caused by a "software bug" scares me a lot. As an example, ABS breaks should have a kind of independent, atomic, automatic "watch dog" that would let the breaks working pedal only in case of embedded system failure, and I think we are far, far away ( :-) ) from having a reliable control system that would fully replace the "old" mechanical solutions for braking. This is just one example where people want to complicate things "just for fun".
Lissandro, Computer engineer, embedded software and systems since 1994.
Sign in to Reply
ken a
5/25/2010 9:40 AM EDT
I distrust electronically connected cars for a different reason.
I bought a used "gadgety" high end car that rhymes with hack. After a year, I spent $600 to be able to start the car because the anti theft electronics malfunctioned. (The car had to be towed!)
I can not set the preset for the automatic set adjustment, which is tied to the 1st and 2nd set of keys.
The dashboard does not light at night because a sensor failed, and there is no override. Thus I have to point a flashlight at the speedometer. The automatic headlights, a.k.a. twilight sentinel, no longer works either.
The automatic door lock/unlock also does not work.
The great computer randomly gives me false positives and false negatives on fluid levels. I also can not recharge the A/C because it shuts off the compressor, which you need running in order to refill it.
Not only do I have to incur expense and deal with the frustration of an inferior design; I also have to pay taxes to bail out the manufacturer.
Perhaps all these problems are a result of poor electro/mechanical design and not firmware, but in this case, the firmware has no manual override, and it gets in the way of an otherwise functional car.
Sign in to Reply
Abrahim
5/26/2010 6:06 AM EDT
well in my opinion, the critical functions like brakes shud nvr be acceible over the com links anyway .. nor shud their functionality be trusted to a processing element which has other things to do .. these shud be catered to by a dedicated MCU which can have a very restricted communication link to a central MPU.
but frankly speakin if not complex things like regenerative braking or ABS is involved, i wud rather stick to a mechnical rod !!
Sign in to Reply
micro_engineer
5/27/2010 8:41 AM EDT
I think it's a little bit silly to presume someone will go around connecting a device to your vehicle in order to do harm via the "security weaknesses" in the various subsystems.
Not exactly a pressing issue!
Sign in to Reply
micro_engineer
5/27/2010 8:44 AM EDT
I should not I meant "unless someone should go around connecting to your vehicle..."
Also, sometimes a basic electromechanical system is FINE and RELIABLE vs. a more complex design. There are quite a few drawbacks to increasing the complexity of a vehicle's design.
Sign in to Reply
pteryx
6/2/2010 4:32 AM EDT
On railways the critical safety systems are doubled or tripled. Sometimes even the software run on the redundant functional blocks must be original (written by different person and using different algorithms) so that the possibility of software failure could be reduced. The price of this extra safety is increasing the probability of "fault", when you have three systems where the function could be done by one. The advantage is that you really know when something goes wrong.
Of course, nothing is quite safe in the case of deliberate attack, but having trippled the critical busses and critical systems would make the attack much harder. However, I think that the main failure of car producers and road operators now is not the passive embedded safety, but the lack of integrated active safety systems. For example, in a train you know the state of traffic lights few kilometers before you can physically see them ...
Sign in to Reply
WKetel
6/2/2010 12:58 PM EDT
For quite a few years, already, thieves have been able to copy the RKE signals and get into cars. Now with OBD2 they will be able to shut down a car in order to hijack it. WHO wants to be responsible for that? Once the door is opened to outsiders, by means of RF communications, or perhaps IR, security will no longer exist. It will be an era that makes the Toyota Unexplained Accelerations seem like "the good old days". The best choice is, and will continue to be, to have NO communications with the busses accessible from outside. Limit all of this inter-vehicle communication to verbal communication with drivers. Sort of like CB radio, only perhaps shorter range and some means to limit noise. It would need to include an identity signal, though, to avoid being abused by those who choose anonymous abuse as their entertainment.
Sign in to Reply
KrystalP
6/11/2010 3:53 AM EDT
This electronic control unit has several advantages as well, but its price is quite expensive. Getting a loan still could be more affordable than attempting to preserve an auto older than 1970. As years have gone on, more and more automobiles are utilizing digital" target="_blank" style="">href="http://www.cardealexpert.com/news-information/the-expert-explains/electronic-control-units/">digital controls; initially started in the 70's. From the anti-lock brakes to the fuel injection systems ECU, digital control units, are the key factor in functioning ability. Besides comfort and efficiency, these controls can cause prices to sky rocket. These chips aren't cheap and a big amount of money might be required to cover the price of fixing one particular of these if they break.
Sign in to Reply