Projects:2019s1-105 Hacking CAN Bus - Revision history

A1685544: /* Method */

2019-10-29T18:02:23Z

‎Method

A1685544: /* Final Results */

2019-10-29T17:59:55Z

‎Final Results

A1685544: /* Final Results */

2019-10-29T17:59:42Z

‎Final Results

A1685544: /* Final Results */

2019-10-29T17:59:15Z

‎Final Results

A1685544: /* Current and Expected Results */

2019-10-29T17:42:46Z

‎Current and Expected Results

A1685544 at 12:28, 31 May 2019

2019-05-31T12:28:46Z

A1685544 at 12:24, 31 May 2019

2019-05-31T12:24:40Z

A1685544 at 12:10, 31 May 2019

2019-05-31T12:10:20Z

A1685544 at 11:53, 31 May 2019

2019-05-31T11:53:17Z

A1685544 at 11:37, 31 May 2019

2019-05-31T11:37:42Z

@@ Line 81: / Line 81: @@
 = Method =
-The research objectives will be achieved through the following method.
+The research objectives were achieved through the following method.
-:'''1.''' Identify the CAN message IDs associated with a vehicle dashboard function by reverse engineering the CAN bus message dumps collected from real-world data.
+:'''1.''' Identifying the CAN message IDs associated with a vehicle dashboard function by through a reverse engineering process of the the CAN bus message dumps collected from real-world data.
-:'''2.''' Create a systematic set of experiments to determine effective use of the CAN message in a deceptive attack.
+:'''2.''' Creating a systematic set of experiments to determine the most effective use of the CAN message in a deceptive attack.
-:'''3.''' Implement and demonstrate the attack in MOTS and MITM architectures in the testbed environment.
+:'''3.''' Implementing and demonstrating the attacks in both MOTS and MITM architectures in the testbed environment.
-:'''4.''' Create a device capable of executing all of the attacks by connecting:
+:'''4.''' Creating a device capable of executing all of the attacks by connecting:
 ::'''a.''' To the OBD-II port for the MOTS architecture
-::'''b.''' Between the dashboard and wiring loom for MITM architecture
+::'''b.''' Between the dashboard and wiring loom for MITM architecture.
 = Final Results =

← Older revision		Revision as of 17:59, 29 October 2019
Line 110:		Line 110:


−	In depth threat analysis is discussed in the research an concludes the potential for serious financial damage capabilities of the attacks. The results verify the vulnerabilities in CAN and implement serveral unique subtle, deceptive and damaging attacks in two different attack architectures. A conclusion is drawn to the strengths of the MOTS attack implementations over MITM.	+	:In depth threat analysis is discussed in the research an concludes the potential for serious financial damage capabilities of the attacks. The results verify the vulnerabilities in CAN and implement serveral unique subtle, deceptive and damaging attacks in two different attack architectures. A conclusion is drawn to the strengths of the MOTS attack implementations over MITM.

	= References =		= References =

@@ Line 98: / Line 98: @@
 = Final Results =
 :The testbed used in this research was created by former honours students of the University of Adelaide in 2018 and consists of four main ECUs and a dashboard from a 2016 Mazda2 [9]. By playing back real CAN data onto the testbed, gathered from logging CAN communications while driving, the CAN message ID that related to the dashboard’s odometer reading was identified. This is an undocumented finding that was used to develop a targeted MOTS attack by increasing the odometer.
@@ Line 106: / Line 109: @@
 :The attack demonstrated in the figure below shows the simulated vehicle driving at 50km/hr. The top photograph is during normal playback conditions of the CAN log file. The bottom photograph is during the speedometer attack execution. Attack execution refers to the same playback conditions, except that another CAN transceiver is executing SpeedoBias_MOTS.py attack code.
 In depth threat analysis is discussed in the research an concludes the potential for serious financial damage capabilities of the attacks. The results verify the vulnerabilities in CAN and implement serveral unique subtle, deceptive and damaging attacks in two different attack architectures. A conclusion is drawn to the strengths of the MOTS attack implementations over MITM.

@@ Line 100: / Line 100: @@
 :The testbed used in this research was created by former honours students of the University of Adelaide in 2018 and consists of four main ECUs and a dashboard from a 2016 Mazda2 [9]. By playing back real CAN data onto the testbed, gathered from logging CAN communications while driving, the CAN message ID that related to the dashboard’s odometer reading was identified. This is an undocumented finding that was used to develop a targeted MOTS attack by increasing the odometer.
-:To develop a MITM attack, the real-time message handling architecture presented in [8] shall be used. The aim will be to incorporate speedometer and dashboard indicator attacks in both architectures and develop frameworks for attacking vehicles of other manufacturers. The results will be verified in a more realistic environment using two devices: one to transmit simulated driving messages and the other to read and send malicious messages. A potential complication is how the simulated driving messages will be competing on the CAN bus with the malicious injected messages.
+[[File:Figure Comparison Speedometer normal operation and operation while attacked.png|thumb|Comparison of speedometer normal operation and operation while attacked]]
-Using MITM architecture, the attack demonstrated in the figure below shows the simulated vehicle driving at 50km/hr.
+In depth threat analysis is discussed in the research an concludes the potential for serious financial damage capabilities of the attacks. The results verify the vulnerabilities in CAN and implement serveral unique subtle, deceptive and damaging attacks in two different attack architectures. A conclusion is drawn to the strengths of the MOTS attack implementations over MITM.
 = References =

@@ Line 97: / Line 97: @@
-= Current and Expected Results =
+= Final Results =
 :The testbed used in this research was created by former honours students of the University of Adelaide in 2018 and consists of four main ECUs and a dashboard from a 2016 Mazda2 [9]. By playing back real CAN data onto the testbed, gathered from logging CAN communications while driving, the CAN message ID that related to the dashboard’s odometer reading was identified. This is an undocumented finding that was used to develop a targeted MOTS attack by increasing the odometer.
 = References =

← Older revision		Revision as of 12:28, 31 May 2019
Line 20:		Line 20:

	'''Figure 2:''' Man-in-the-middle attack architecture		'''Figure 2:''' Man-in-the-middle attack architecture
		+
		+	:The research presented in this paper will evaluate the effectiveness of subtle attacks as an undocumented cybersecurity threat for automotive CAN systems. These attacks will be developed in both MOTS and MITM architectures in a vehicle testbed environment. The research intends to highlight new threat scenarios and foster the development of new system solutions for automotive cybersecurity.

← Older revision		Revision as of 12:24, 31 May 2019
Line 12:		Line 12:
	:The attack architectures that will be considered are man-on-the-side (MOTS) and man-in-the-middle (MITM), where the attacking device is physically connected to the CAN bus. The MOTS architecture attaches the attacker’s device to the CAN bus directly to read and insert new messages on the network (see Figure 1). In MITM, the attacking device is inserted between an existing ECU and the CAN bus, allowing it to listen, broadcast and intercept messages (see Figure 2).		:The attack architectures that will be considered are man-on-the-side (MOTS) and man-in-the-middle (MITM), where the attacking device is physically connected to the CAN bus. The MOTS architecture attaches the attacker’s device to the CAN bus directly to read and insert new messages on the network (see Figure 1). In MITM, the attacking device is inserted between an existing ECU and the CAN bus, allowing it to listen, broadcast and intercept messages (see Figure 2).

		+
		+	[[File:MOTS.PNG\|800px\|'''Figure 1:''' Man-on-the-side attack architecture]]
		+
		+	'''Figure 1:''' Man-on-the-side attack architecture
		+
		+	[[File:MITM.PNG\|800px\|'''Figure 2:''' Man-in-the-middle attack architecture]]
		+
		+	'''Figure 2:''' Man-in-the-middle attack architecture

@@ Line 1: / Line 1: @@
-''' Utilising a Vehicle Testbed Environment to Develop Deceptive CAN Bus Attacks
+''' Utilising a Vehicle Testbed Environment to Develop Deceptive CAN Bus Attacks'''
 '''
 == Introduction ==
-Cyber security concerns surrounding these vehicles are increasing, particularly with the introduction of Wi-Fi and other wireless vehicle services. Using these wireless services, adversaries can find their way on the CAN bus and gain control of the vehicle. In a different scenario, infiltrating a vehicle and connecting a device to subtly alter a vehicle’s display information, without any overt consequences, may result in an unaware user who, at best, might have a slight suspicion.
+:The controller area network (CAN) serial communications protocol has been widely used in the automotive industry for almost three decades. Within automotive vehicles, the CAN bus standard facilitates communication between all the electronic control units (ECUs) that manage a vehicle’s many functions. Access to the CAN by an adversary’s unauthenticated device allows it to listen, broadcast and intercept communications.
 = Definitions and Abbreviations =
@@ Line 21: / Line 36: @@
-= Research Questions =
+= Related Work and Motivation =
-* What are the benefits and limitations of a testbed environment for research in automotive security?
+:The exploitation of CAN vulnerabilities is a well-researched field. Articles [1, 2] illustrate the ability to control the dashboard, engine and other systems in a MOTS architecture via the OBD-II port of a working vehicle. Some MOTS attacks can remotely access the CAN bus through Bluetooth and cellular radio [3]. Article [4] analysed the remote attack surface of a 2014 Jeep Cherokee, which demonstrated remote engine and brake control of the vehicle. This was possible due to a vulnerability that allowed malicious messages to be injected onto the vehicle’s CAN.
-* How can the vulnerabilities of the CAN bus protocol be exploited in a testbed environment to perform targeted and deceptive attacks?
+:The MITM architecture was discussed in article [8], where a security auditing platform for OBD-II devices was created. Using its capability of blocking, forwarding and modifying CAN messages in real-time, the platform could be tested in an adversarial MITM attack between an ECU and the CAN bus.
-* What are the advantages and disadvantages of MOTS compared to MITM attack architectures?
+:Previous research has not sufficiently evaluated the impact of deceptive, targeted and subtle attacks on the vehicular CAN bus networks. This paper will address these concerns through threat modelling of both MOTS and MITM architectures in a testbed environment.
 = Objectives =
@@ Line 101: / Line 116: @@
-== Project Team ==
+= Project Team =
-=== Student Researchers ===
+== Student Researchers ==
 Stefan Smiljanic
 Charlie Tran
 == Project Supervisors ==
 Dr. Matthew Sorell

@@ Line 1: / Line 1: @@
-'''Utilising a testbed environment to develop and demonstrate man-in-the-middle deception attacks on the internal communication networks of modern vehicles'''
+''' Utilising a Vehicle Testbed Environment to Develop Deceptive CAN Bus Attacks
 '''
 Modern cars have multiple dedicated computers that control all of the car’s operations, such as the engine, braking, steering and entertainment. These computers are called electronic control units (ECUs) and communicate primarily by a highly vulnerable serial network, the CAN bus protocol.
@@ Line 8: / Line 9: @@
 The research presented in this paper discusses this type of security threat and the mistrust it can cause. The intent of the research is to assert the usefulness of a testbed environment in exploiting the vulnerabilities of the CAN bus protocol by developing and weaponizing a deceptive man-in-the-middle type attack.
-Charlie Tran
+= Research Questions =
-=== Project Supervisors ===
+* What are the advantages and disadvantages of MOTS compared to MITM attack architectures?
-Bradley Cooney (DSTG)
+= Related Work and Motivation =
-Daniel Coscia (DSTG)
+= Objectives =
-= Definitions and Abbreviations =
+:*Demonstrate and evaluate the attacks’ abilities to deceive or financially burden the victim
-* MITM -  Man-in-the-Middle
+:*Implement these MITM and MOTS attack architectures on the testbed
-* MOTS -  Man-on-the-Side
+:*Evaluate the vulnerabilities, threat scenarios and defence mechanisms
-* OBD  -  On Board Diagnostics
+:*Highlight the usefulness of the testbed environment in developing CAN bus attacks
-* How can the vulnerabilities of the CAN bus protocol be exploited in a testbed environment to perform targeted and deceptive attacks?
+The extended objectives are to:
-* What are the advantages and disadvantages of MOTS compared to MITM attack architectures?
+:*Create an attack framework for the implementation of the research on other vehicle models and manufacturers
 = Method =
-To be filled...
+The research objectives will be achieved through the following method.
 = References =
-To be filled...
+:'''[1]'''	K. Koscher, A. Czeskis, F. Roesner, S. Patel, T. Kohno, S. Checkoway, D. McCoy, B. Kantor, D. Anderson, H. Shacham, and S. Savage, “Experimental security analysis of a modern automobile“, 2010 IEEE Symposium on Security and Privacy, 2010, pp. 447–462.