Re: CAN Bus Standard Vulnerability

Hi Bram,

My reason for assuming is that the team demonstrated the vulnerability 
on at least one car.
(Think their device should be used as a must pass test for any vehicle 
intended to be used in public areas.)

My reason  for believe is further backed up by the fact that many cars 
have a direct access to the control network via the OBDII connector. No 
competent systems designer would allow that. Further, any unexpected 
message should lead to an emergency state.

Instead of addressing bit fault injections as a CAN hazard, the team 
should have been amazed that the control system still worked when they 
they created such bursts of error frames. The intrusion of a bit error 
injector in a CAN system is easily detected and should never lead to a 
DoS problem.

Cheers,
Freddy

On 2017-08-21 14:23, [email protected] wrote:
> Hi Freddy,
>
> Why would you assume that automotive controller units don't have such a "safe critical mode"? I'm pretty confident that the great majority (if not all) of automotive controller units have proper failsafe design if communication with other critical nodes in a vehicle ceases. Cars and trucks don't explode or go berserk when an inhabitant of the local fauna decides that those CAN cables in your engine bay are yummy; they'll indicate the problem and change to the most conservative operating envelope necessary for safe operation (i.e. "limp mode").
>
> The CAN nodes are pretty robust, as are the networks. Safety critical nodes tend to be connected through multiple (redundant) networks to prevent a single point of failure. On top of that, I see a lot of designs already where the easily accessible OBD connection is routed through a gateway (VAG is an example), in which case there is no direct access to the safety critical nodes. Constructors that offer a telematics gateway have been struggling with the security implications from that -- IMHO a telematics control unit should never be connected directly to a drivetrain network, but only through a secondary gateway device that limits access appropriately.
>
> So yeah, if you have access to the physical layer of the drivetrain network, you can probably force a vehicle into some kind of degraded mode. But that's not much different from snipping a couple of wires at random in the engine bay...
>
> The only real issue I see is that people tend to connect anything to the OBD plug, and if that device is insecure (and I'm afraid a lot of them are...) this could cause issues on the CAN network if the OBD is directly connected to your primary drivetrain network. I think we'll see far more gateway-based designs, isolating the diagnostics network from the drivetrain network mitigating this attack vector.
>
> Much ado about nothing, it seems.
>
> cheers,
> Bram
> ----- Oorspronkelijk bericht -----
> Van: "Lars-Berno Fredriksson" <[email protected]>
> Aan: [email protected], "canlist" <[email protected]>
> Verzonden: Zaterdag 19 augustus 2017 21:57:04
> Onderwerp: Re: [CANLIST] CAN Bus Standard Vulnerability
>
> Hi John,
>
> This just  shows how sloppy the automotive industry is. When I designed
> can systems, the system node generated an alert state if there were more
> that one error frame in 10.000 messages. If there were more than one in
> 1000 messages, it went into a "safe critical" mode. The CAN feature of
> error counters is only for non-safety and non-time critical systems.
>
> The first step in time- (and safety-) critical system design is to
> schedule every message that can be scheduled. Then you have a good start
> for a dependable system. A bonus is that you have made it at least an
> order of magnitude difficult to hack.
>
> It is a shame that any car system could be hacked as showed! It shows
> that the system designer should have had another job, e.g., as a teacher
> in roman history.
>
> Cheers,
> Freddy
> --
> Archives and useful links: http://groups.yahoo.com/group/CANbus
> Subscribe and unsubscribe at www.vector.com/canlist/
> Report any problems to <[email protected]>

begin:vcard
fn:Lars-Berno Fredriksson
n:Fredriksson;Lars-Berno
org:Kvaser AB
adr:;;Aminogatan 25A;Molndal;;43153;Sweden
email;internet:[email protected]
title:President
url:www.kvaser.com
version:2.1
end:vcard