现代汽车网络安全趋势

CharlieMiller,SecurityEngineer,TwitterChrisValasek,DirectorofSecurityIntelligence,IOActive Contents Introduction..................................................................................................................................... 3Putting ECUs on the bench ............................................................................................................. 4Capture traffic from a CAN bus.................................................................................................. 4(Optional destructive step) Observe ECU in its native environment.......................................... 4Power up ECU on the bench....................................................................................................... 5Hook up sensors and actuators.................................................................................................... 9Simulating CAN traffic from missing ECUs ............................................................................ 12Configuring Modules ................................................................................................................ 12Fake sensors .............................................................................................................................. 13Multiple ECUs on the bench..................................................................................................... 15OBD-II on the bench................................................................................................................. 16Troubleshooting Issues ............................................................................................................. 18Testing on the bench ..................................................................................................................... 19ECU isolation............................................................................................................................ 19ECU interrogation and flashing ................................................................................................ 19ECU sensor readings................................................................................................................. 20Attacks - CAN message injection ............................................................................................. 20Limitations ................................................................................................................................ 22Mobile testing platform................................................................................................................. 23Limitations ................................................................................................................................ 26Conclusion .................................................................................................................................... 27References..................................................................................................................................... 27 IntroductionExamining automotive networks for security vulnerabilities is fun and has real world safety implications. From the beginning, we wanted to do something that would allowas many researchers as possible to get involved in this emerging discipline. That is whywe released all of our tools and data from our previous research [1]. We shared exactly what hardware you would need, and provided software in order toinvestigate different cars as well as knowledge on how to evaluate the security ofvehicles and possibly develop attacks against them. However, while this was veryuseful to aspiring car hackers, it turns out that the most significant limiting factor isn’tknowledge, or the tools/data to start car hacking, but rather researchers do not typicallyhave a car at their disposal to hack on. While most of the research carried out in thisfield is non-destructive and could be performed on your main vehicle, it is still a riskyand potentially expensive proposition to mess with a vehicle you actually need. The following research was an attempt to reduce this barrier to entry so moreresearchers could get involved. We used what we learned, as well as stripping out theelectronics from our test vehicles, to figure out how to set up electronic control units(ECU) on a workbench. In this way, instead of buying a new car, in order to get started,a researcher could simply buy an ECU on Ebay and start playing with it. In other words,instead of paying $40,000 for a vehicle, a researcher can get started for a few hundreddollars. This research shows exactly how to get an ECU up and running and how to get it to astate where you can start to evaluate the security of the device. The paper proceeds toshow how to set up an environment very similar to that in the automobile, includingmultiple ECUs as well as sensors and actuators. In the end, depending on howambitious the researcher happens to be, we even dis