Slashdot Mirror
Unpatchable 'Flaw' Affects Most of Today's Modern Cars (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: A flaw buried deep in the hearts of all modern cars allows an attacker with local or even remote access to a vehicle to shut down various components, including safety systems such as airbags, brakes, parking sensors, and others. The vulnerability affects the CAN (Controller Area Network) protocol that's deployed in modern cars and used to manage communications between a vehicle's internal components. The flaw was discovered by a collaborative effort of Politecnico di Milano, Linklayer Labs, and Trend Micro's Forward-looking Threat Research (FTR) team. Researchers say this flaw is not a vulnerability in the classic meaning of the word. This is because the flaw is more of a CAN standard design choice that makes it unpatchable.
So let me get this straight: If a component on the network starts sending out uncontrolled messaging that looks like a denial of service, or an out of control / perpetually errored state, the network corrects for this problem by disconnecting the component causing chaos. That sounds like the CAN network is doing exactly what it should be doing: maintaining the integrity of the shared network at the expense of disconnecting an infected or malfunctioning node. What am I missing?
Just because I can hook a shark from a boat, I do no offer to wrestle it in the water.
To perform this DOS attack, you must have a device physically connected to the CAN bus. If an attacker has that kind of access to your car, a DOS attack is not your biggest problem. The attacker could just as easily pump 120 volts into the bus and fry every component. Or leave a time bomb on the driver's seat.
This is nothing new, anyone who has developed a CAN device before knows this, no "shocking new research" needed. It was never designed to be secure, it was designed to be extremely resistant to noisy environments, and does a damn good job at it.
tl;dr if you are a political target, get an older car without an electric throttle body and electric power steering bullshit.
I am so sick of infosec nerds thinking they know more than the engineers at Ford, BMW, etc. About building cars. Coming up with new "vulnerabilities" - "I just need physical access to the car's OBD-II port with a laptop". Stick to Flintstones cars if you feel so insecure, the rest of us will drive fearlessly in luxury.
There is another approach. CAN traffic happens over a differential pair. I have a specially-constructed device that can jam CAN traffic. I call it a "paperclip." I bend it and plug it into both data lines on the OBD port and the network is dead.
We need to ban these dangerous hacking paperclips.
"-1 Troll" is the apparently the same as "-1 I disagree with you."
Well, you have found the problem: "not accessible from the outside."
Car makers have jumped on the "smart everything" revolution, so they built devices into the cars that can bridge CAN with cell phone networks (On-Star, for example). If you own the On-Star, you can do pretty much whatever you want.
The problem is not with CAN, however. The problem is with the typical crappy security between things that bridge CAN to other data sources.
The one thing to remember about CAN is that it is a SHARED BUS. There is no hub; the same wires go to all devices. This means that a compromised device can jabber and jam all traffic, continually send higher-priority traffic to eat up bandwidth, or even pretend to be any device that it wants to send false data. No protocol can stop this without going to a hub-style arrangement, which increases the amount of wiring. Decreasing wiring (and its cost and weight) was one of the prime reasons for inventing CAN -- to allow multiple devices to share the same wires, so if you want to use a hub, you might as well get rid of CAN and just go back to point-to-point wiring.
I can imagine changes to the PHY to stop the "jabbering idiot" problem, but nothing that would prevent the other attacks.
"-1 Troll" is the apparently the same as "-1 I disagree with you."
Almost all of the older machine control style buses have this exact flaw. NONE of them authenticate. All of them can be MITM very easily. Most IoT systems out there are predicated on the fact that they can do this.
You think it is bad? No, its worse than that. I try not to think about it much.
Doesn't bother me at all. With or without this flaw, people can sabotage your car. In this case, they have to have the technology, knowhow, access and motive to exploit the flaw. Why would they take the difficult path when there are much easier ways to F with your car?
Most IoT systems out there are predicated on the fact that they can do this.
That's only one flaw in IoT. There are many others especially when consumer and commercial products connect to the vendor's central management instead of to the customer's central management. Those flaws include having to have an untrusted device on one's network that has to be able to communicate with the Internet, having software that might not be readily patched yet may be running on a consumer-grade OS, and any vulnerabilities affecting the vendor's central management.
Daktronics, I'm looking at you.
Do not look into laser with remaining eye.
Except that as infotainment systems get more complex and more heavily integrated with the vehicle's CANBUS system and with the Internet via cellular networks, suddenly the possibility that someone can sabotage your car without having ever come within a thousand miles of you becomes a real prospect. Now add drive-by-wire where the vehicle controls are just inputs and the computer more directly controls acceleration, braking, and even steering, and you've got a recipe for a disaster if someone figures out how to exploit all models of a manufacturer with the same flaw. Imagine if all Honda Accords with lane-departure and adaptive cruise control suddenly accelerate at full-speed for five seconds then suddenly turn fifteen degrees to the left. If an attack like that was successful it would probably hurt or kill thousands of people.
Do not look into laser with remaining eye.
This exploit may require local access, but the more constant connectivity there is in cars, the higher the risk of remote exploits. Then, instead of one person fucking with one other person's car locally at 3am, one person can fuck with 60 million people's cars from across the world.
Centralization is something both companies and consumers are in love with, but it brings major risk factors.
Because all they need to do is send a malicious RDS message through the FM network to a vulnerable car radio. Many radios are on the CANBUS these days, and it is highly unlikely that the developers of the radio software care about security or that secure channels for expedient software updates were designed in.
However, there are much more exciting things that you can do once you're on the CANBUS, instead of just shutting down ABS.
Finally! A year of moderation! Ready for 2019?
Yeah, but the CAN bus isn't remote. It is the local backbone between the various computers in a car. I had always been under the impression it was not secure it was assumed any hardware on it was trusted.
But it requires LOCAL access. They could remotely disable the brakes after first installing a remote controlled device into the car. For christ sake, they could do that anyway, if they have local access and can install things in the car, they could just disable the brakes....
Stop it, just stop. Stop connecting networked systems to the ECU, it's fuggin stupid. Stop being stupid.
The vulnerability affects the petrol tank that's deployed in modern cars and used to hold fuel that runs the vehicle's internal components. The flaw was discovered by college students everywhere, and involves pouring sugar into it. Researchers say this flaw is not a vulnerability in the classic meaning of the word. This is because the flaw is more of a petrol tank standard design choice that makes it unpatchable.
Then there's the "penknife in the side wall of the tires" flaw, the "pull the distributor cap/spark plugs/ignition wiring flaw", the ...
>you are into fully autonomous driving ...
I didn't see anything about that - all they initially mentioned was "drive by wire", where there's no direct mechanical linkage between the driver and the car - something which is becoming increasingly common. Just that, and an internet-connected... anything on the same bus, and a hijacker could potentially crash the car at will. Lane assist, etc. might make the attack easier, but then again all they really have to do is spoof the gas pedal sending a "maximum acceleration" signal for a while, and then spoof a "steering wheel is turning".
--- Most topics have many sides worth arguing, allow me to take one opposite you.
There's just a "tiny" problem with that... It's called segmentation and encrypted traffic. A number of American and Japanese manufacturers don't really protect their CAN bus traffic at all, but European manufacturers have generally been doing this for well over a decade. Segmenting the CAN bus network is something specially the Germans started doing a long time ago, thou less as an anti-sabotage measure and more as an anti-theft measure when they found that eastern European car thieves were opening doors by connecting the side view mirror's CAN bus port and getting the ignition going by connecting to the CAN bus port in the front passenger footwell. Encryption is a specialty of Volvo's as they tend to have all the data going in the CAN bus encrypted and it's a long and complicated process to get the system to renew the encryption keys whenever you need to replace something that needs to communicate over the CAN bus. Seriously thou, reading this feels like reading an article from a few years ago when people went crazy over the Jeep hack.
"Why should I want to make anything up? Life's bad enough as it is without wanting to invent any more of it."