Static Analysis of Android Apps Interaction with Automotive CAN

Abstract

Modern car infotainment systems allow users to connect an Android device to the vehicle. The device can then interact with all hardware components of the car. This can for instance provide new interaction mechanisms to the driver. However, this can also be misused, becoming a major security breach into the car, with subsequent security concerns: the Android device can both read sensitive data (speed, model, airbag status) and send dangerous commands (brake, lock, airbag explosion). Moreover, this scenario is unsettling since Android devices are usually connected to the cloud, opening the door to remote attacks from malicious users or the cyberspace. The OpenXC platform is an open source API that allows Android application to interact with the car's hardware. In this article, we study this library and show how it can be used to create injection attacks. Moreover, we introduce a novel static analysis that identifies such attacks before they occur in real life. This analysis has been implemented in the Julia static analyzer and finds injection vulnerabilities in actual apps published in the Google Play marketplace.

A Multi-Tier Security Analysis of Official Car Management Apps for Android

“…They examined more than 20 infotainment apps available in Google Play at that time, and concluded that nearly 80% of them were potentially vulnerable. Panarotto et al [11] examined the OpenXC library (http://openxcplatform.com/ (accessed on 20 February 2021)), which provides Android apps with a way, i.e., API, to interact with the car's hardware, and showed how this library can be exploited in the context of injection attacks. Furthermore, the authors proposed a static analysis approach which, according to the authors, nips such attacks in the bud.…”

Static analysis for discovering IoT vulnerabilities

“…This approach has been widely applied to the detection of SQL injections in Web applications [66], leakages of sensitive data [26,27], etc. A first attempt to apply such approach to a scenario similar to IoT was performed by Mandal et al [47] and Panarotto et al [58], that utilized this approach to detect leakages and injection vulnerabilities in Android automotive apps [49]. Huuck [40] discussed the use static code analysis to detect some of these types of issues.…”