Re: CAN Bus Standard Vulnerability

Hi Freddy,

Why would you assume that automotive controller units don't have such a "safe critical mode"? I'm pretty confident that the great majority (if not all) of automotive controller units have proper failsafe design if communication with other critical nodes in a vehicle ceases. Cars and trucks don't explode or go berserk when an inhabitant of the local fauna decides that those CAN cables in your engine bay are yummy; they'll indicate the problem and change to the most conservative operating envelope necessary for safe operation (i.e. "limp mode"). 

The CAN nodes are pretty robust, as are the networks. Safety critical nodes tend to be connected through multiple (redundant) networks to prevent a single point of failure. On top of that, I see a lot of designs already where the easily accessible OBD connection is routed through a gateway (VAG is an example), in which case there is no direct access to the safety critical nodes. Constructors that offer a telematics gateway have been struggling with the security implications from that -- IMHO a telematics control unit should never be connected directly to a drivetrain network, but only through a secondary gateway device that limits access appropriately.

So yeah, if you have access to the physical layer of the drivetrain network, you can probably force a vehicle into some kind of degraded mode. But that's not much different from snipping a couple of wires at random in the engine bay...

The only real issue I see is that people tend to connect anything to the OBD plug, and if that device is insecure (and I'm afraid a lot of them are...) this could cause issues on the CAN network if the OBD is directly connected to your primary drivetrain network. I think we'll see far more gateway-based designs, isolating the diagnostics network from the drivetrain network mitigating this attack vector. 

Much ado about nothing, it seems.

cheers,
Bram
----- Oorspronkelijk bericht -----
Van: "Lars-Berno Fredriksson" <[email protected]>
Aan: [email protected], "canlist" <[email protected]>
Verzonden: Zaterdag 19 augustus 2017 21:57:04
Onderwerp: Re: [CANLIST] CAN Bus Standard Vulnerability

Hi John,

This just  shows how sloppy the automotive industry is. When I designed 
can systems, the system node generated an alert state if there were more 
that one error frame in 10.000 messages. If there were more than one in 
1000 messages, it went into a "safe critical" mode. The CAN feature of 
error counters is only for non-safety and non-time critical systems.

The first step in time- (and safety-) critical system design is to 
schedule every message that can be scheduled. Then you have a good start 
for a dependable system. A bonus is that you have made it at least an 
order of magnitude difficult to hack.

It is a shame that any car system could be hacked as showed! It shows 
that the system designer should have had another job, e.g., as a teacher 
in roman history.

Cheers,
Freddy
--
Archives and useful links: http://groups.yahoo.com/group/CANbus
Subscribe and unsubscribe at www.vector.com/canlist/
Report any problems to <[email protected]>