CANNON: Reliable and Stealthy Remote Shutdown Attacks via Unaltered Automotive Microcontrollers

Abstract

In the automotive security sector, the absence of a testing platform that is configurable, practical, and userfriendly presents considerable challenges. These difficulties are compounded by the intricate design of vehicle systems, the rapid evolution of attack vectors, and the absence of standardized testing methodologies. We propose a nextgeneration testing platform that addresses several challenges in vehicle cybersecurity testing and research domains. In this paper, we detail how the Vehicle Security Engineering Cloud (VSEC) Test platform enables easier access to test beds for efficient vehicle cybersecurity testing and advanced (e.g., penetration, fuzz) testing and how we extend such test beds to benefit automotive security research. We highlight methodology on how to use this platform for a variety of users and use cases with real implemented examples.

CAN Bus Intrusion Detection Based on Auxiliary Classifier GAN and Out-of-distribution Detection

“…Bloom [7] present Weeping-CAN, a refinement of the bus-off attack that is more stealthy and can evade detection. Kulandaivel et al [30] present CANnon, which leverages the peripheral clock gating feature to insert arbitrary bits at any time instance. A future research topic is the detection and mitigation of this type of stealthy attack, which may require secure network architectures [8], physical-layer IDS, and secure transceivers.…”

Detecting CAN Attacks on J1939 and NMEA 2000 Networks

“…An address hijack attack claims an existing ECU's network address to prevent it from speaking [25]. Other attacks like the bus-off attack and CANStomper solution produce CAN errors to disable individual messages and eventually stop an ECU from transmitting [8], [15], [22]. This paper improves upon this work by cancelling out messages without producing an error frame, and having the transceiver enter an off state within one message, as described in Section 5.…”

“…The modality-based timing approach is an improvement on existing CAN timing based IDS approaches as it removes the assumption that messages are strictly periodic. An assumption that is known to be false for some subset of messages [22]. While postdetection-analysis can reveal aperiodic false positives [9], it does not provide a security guarantee to those messages.…”

CANova: A hybrid intrusion detection framework based on automatic signal classification for CAN

“…Strong adversaries, besides all the described attacks, can also perform more sophisticated masquerade attacks: the attacker may have control of the specific ECU that sends the target packets, or they may implement a drop attack against the transmitting ECU and send malicious packets, in both cases preserving the perceived frequency of the attacked CAN ID. It is important to note that the second implementation of this attack is not trivial and requires a strong adversary with full IDs and packets knowledge (obtained either through CAN DBC files or extensive reverse engineering) and fine-grained packet injection capabilities regarding CAN frame frequency and format, (e.g., the attacks proposed by Tron et al [4] and Kulandaivel et al [32]). In fact, placing a legitimate node into bus-off state, or shutting down the legitimate node, implies that all the IDs sent by that particular node will be missing from the bus.…”