Bryans, Jeremy

Cheah, Hun

Fowler, Daniel S.

Shaikh, Siraj

Modern automotive platforms are cyber-physical in nature and increasingly connected. Cybersecurity testing of such platforms is expensive and carries safety concerns, making it challenging to perform tests for vulnerabilities and refine test methodologies. We propose a testbed, built over a Controller Area Network (CAN) simulator, and validate it against a real-world demonstration of a weakness in a test vehicle using aftermarket On Board Diagnostic (OBD) scanners (dongles)

Coventry University Pure Portal

  Towards A Testbed for Automotive Cybersecurity  Fowler, DS, Cheah, H, Shaikh, S & Bryans, J  Author post-print (accepted) deposited by Coventry University’s Repository  Original citation & hyperlink:  Fowler, DS, Cheah, H, Shaikh, S & Bryans, J 2017, 'Towards A Testbed for Automotive Cybersecurity' Paper presented at 10th IEEE International Conference on Software Testing, Verification and Validation, Tokyo, Japan, 12/03/17 - 17/04/17 https://dx.doi.org/10.1109/ICST.2017.62    Publisher: IEEE DOI      10.1109/ICST.2017.62ISBN     978-1-5090-6032-0 ESBN    978-1-5090-6031-3     © 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.  Copyright © and Moral Rights are retained by the author(s) and/ or other copyright owners. A copy can be downloaded for personal non-commercial research or study, without prior permission or charge. This item cannot be reproduced or quoted extensively from without first obtaining permission in writing from the copyright holder(s). The content must not be changed in any way or sold commercially in any format or medium without the formal permission of the copyright holders.   This document is the author’s post-print version, incorporating any revisions agreed during the peer-review process. Some differences between the published version and this version may remain and you are advised to consult the published version if you wish to cite from it.   Towards A Testbed for Automotive CybersecurityDaniel S. Fowler, Madeline Cheah, Siraj Ahmed Shaikh and Jeremy BryansCentre for Mobility and Transport Research, Coventry University, Coventry, CV1 5FB, UKEmail: {fowlerd3,cheahh2,siraj.shaikh,jeremy.bryans}@coventry.ac.ukAbstract—Modern automotive platforms are cyber-physical innature and increasingly connected. Cybersecurity testing of suchplatforms is expensive and carries safety concerns, making itchallenging to perform tests for vulnerabilities and refine testmethodologies. We propose a testbed, built over a Controller AreaNetwork (CAN) simulator, and validate it against a real-worlddemonstration of a weakness in a test vehicle using aftermarketOn Board Diagnostic (OBD) scanners (dongles).I. INTRODUCTIONThe Controller Area Network (CAN) is a well established,fault tolerant and reliable communications system, widely usedfor command and control in cars. It is designed for datatransmission between Electronic Control Units (ECUs) usedthroughout a vehicle. However, CAN was designed prior tothe widespread introduction of vehicular wireless interfaces.There is highly cited research [1], [2] on the cybersecurityvulnerabilities of the wireless interfaces, CAN and ECUs invehicles. The research has increased the interest in huntingfor vulnerabilities in automobile systems, however, it hasgiven vehicle manufacturers a new testing problem. Researchby the Cybersecurity Group at Coventry University, alongwith vehicle testing specialists HORIBA MIRA, is addressingautomotive security testing.II. PROBLEM DEFINITIONVehicle manufacturers can no longer regard their productsas isolated systems, due to the wireless and sensor connectivityof the modern car. This connectivity adds a safety consid-eration, can a vehicle manufacturer ensure their cars remainsafe when subjected to cyber attacks? Such interfaces aresusceptible to abuse by malicious adversaries. To mitigate this,controls and countermeasures need to be introduced, but it isnecessary to target where and how these might be placed. Thisis informed in part through testing for vulnerabilities.Comprehensive safety design and functional testing ofvehicle systems is part of the normal life cycle of a car [3].However, the new cybersecurity threat to connected vehiclesmeans manufacturers must test for a vehicle’s cyber attackresilience. Organisations have begun to address this issue withthe J3061 guidelines [4]. Despite this, research tends to bedirected toward finding vulnerabilities and little is directedtowards the practicalities of automotive cybersecurity testing.The testing of computer systems that form a major part ofvehicle functionality can be automated. Automated tests usu-ally look for the presence of specified behaviours, rather thanthe absence of undesirable ones [5]. Therefore, the discoveryof novel or lateral flaws would need a study of a real system,since cybersecurity weaknesses are hard to foresee in bothdesign and implementation; this would usually mean testingreal vehicles. The very nature of vehicles (high purchasecost, technical complexity, physical size) makes cybersecuritytesting costly in terms of both time and physical resources.Luxury cars are of most interest as they have the highestnumber and sophistication of computerised systems. However,financial restrictions might mean that older model vehicles orcomponents are used instead [1], [2]. This adversely affectssecurity research as countermeasures and test methodologiesthat are developed could be obsolete, incomplete, or inappro-priate. With these factors in mind how do interested partiesefficiently test cars for cybersecurity vulnerabilities?III. A POTENTIAL SOLUTIONThe complexity of automotive systems has long necessi-tated hardware-in-the-loop (HIL) test equipment to providean environment for out of vehicle design, development andtesting. HIL has recently been used to experiment with combi-natorial testing of automotive control systems [6]. The arrivalof connected and autonomous vehicles (CAV) increases thecomponent count in vehicles, and thus the challenge is tomaintain the security of the composite system.This initial case study uses a commercial HIL tool re-purposed as a cybersecurity testbed. The results indicate thata simulation solution is viable. To validate the assertion thata HIL tool is suitable for cybersecurity testing, the testbedwas used to evaluate a security threat from dongles as appliedto a real vehicle. It is important for research to address theincreasing testing complexity presented by CAVs and access tosuch testbeds can aid the implementation of J3061 guidelines.A. Case StudyThe legally mandated OBD port provides a direct connec-tion to a car’s CAN bus to provide diagnostic data. Donglesconnect to the OBD port, facilitating data communicationwith a car’s systems. Vehicle data available through the OBDport is neither encrypted nor typically access controlled. Thiscase study used OBD dongles for several reasons: first, priorresearch has shown that compromise through the OBD portis a real possibility [7]. Secondly, many studies consider theOBD port to be a viable target, both through wired [1] andwireless [8] means. Thirdly, remote access to the OBD portincreases the security risk as the adversary does not have tobe physically present within the vehicle cabin [9]. Finally,the OBD dongles themselves have little security [8]. Anexperiment in this research, performed on a small hatchbackfrom a major manufacturer, confirmed the existing threats tovehicles via such dongles.Five OBD dongles were connected in turn to the realtest vehicle. Each dongle was used to test message injectioninto the vehicle’s internal CAN bus. The vehicle producederrors and undesirable behaviours when non-standard diagnos-tic messages were introduced. Non-diagnostic CAN messageswere also injected directly and accepted by the vehicle. TheCAN message definitions for a vehicle are usually confidential,however, messages that have an effect on the vehicle can bereverse engineered given time and access to the vehicle. Theease of message injection from an external source highlightsthe essential need for security testing by vehicle manufacturers.The risk is also increased because the injections can happenfrom outside the vehicle, demonstrating that cars can no longerbe considered as closed boxes.B. TestbedThe testbed must be capable of faithfully reproducingthe behaviour of a vehicle network. A commercially avail-able compact, real-time, CAN simulator by Vector InformatikGmbH was used. The CAN data traffic can be monitored,captured and analysed, useful for the reverse engineering ofa vehicle. The CAN simulator can operate in HIL or standalone configurations allowing for both ECU and CAN networksimulation development without the need to have access toa vehicle. The developed simulation also mitigates the risks(such as potential damage to the vehicle) involved in securitytesting. The principle operation of the CAN simulator is basedaround descriptive databases that provide a virtual model of ve-hicles. Databases of in-production cars are difficult to acquire,however, the functional equivalent can be reverse engineered.The Vector simulator and software (CANoe) is an establishedindustry tool and therefore capable of producing an accuratemodel. The testbed is validated based on its capabilities andmechanisms for vehicle systems development and testing.A vehicle simulation is configured on the testbed. ABluetooth-enabled dongle is connected to an OBD port onthe simulator (via a custom made cable with external powerto replicate the vehicle power). An unauthorised pairing withthe dongle is performed. We then inject a CAN message thataffects an aspect of our simulated vehicle in an undesirablemanner. Messages could be injected via the aftermarket deviceinto our model system and we were able to turn the headlightson and off (thus achieving undesirable behaviour), althoughthe headlight in our simulation “flickered”. This is similar tothe real world demonstration, where sending the message oncecaused the vehicle’s electronics to flicker once. This is causedby the fact that our message had to contend with continuouslygenerated ‘true’ messages from the attendant ECUs; behaviourthat our simulation also displayed. Additionally, we onlyconfigured the head light to respond. However, by creatingand linking other nodes together within our simulation, it ispossible to increase the complexity of the testbed functionality.IV. DISCUSSIONPerforming a cyber attack on a real vehicle and then thesimulator has given confidence to the ongoing research project,aimed at improving vehicle cyber defenses. Having a vehiclesimulator to study attacks and countermeasures has the advan-tage of reducing costs (material and time) and providing a safeenvironment to test techniques. The use of equipment commonin the industry validates the ability for manufacturers to beginimplementing the J3061 guidelines and bring secure design andtesting into existing engineering processes (designing securityinto system from the beginning rather than retrofitting). Theprimary concern is producing simulation with enough detail toallow for simulation accuracy. This should not be an issue formanufacturers as they have access to system design. A concernfor researchers who reverse engineer vehicle systems is thepossible omission of design subtleties. However, the testbedwill be developed to replicate real ECUs and vehicles withenough detail for it to be a useful cybersecurity testing tool.A. Further workWhilst most vehicular cybersecurity research has been di-rected towards revealing flaws, the cyber defensive capabilitiesof cars must not be forgotten. The direction of our futureresearch does consider vehicle cyber defense. This involvesadding detail to the simulator, then investigating tests (forattack and defense), analysing the properties of vehicularfirewalls, and investigating novel cyber defense solutions.B. PresentationThe presentation adds further detail to the research aims,tests and results. It provides additional information on theoperation and limitations of the CAN bus and discusses furtherthe cybersecurity threats to modern vehicles. The experimentswith the dongles are covered in greater depth and an overviewof simulator capabilities is given, showing how it can be usedfor automating and performing security testing.ACKNOWLEDGMENTWe are grateful to HORIBA MIRA for their support.REFERENCES[1] S. Checkoway, D. McCoy, B. Kantor, D. Anderson, H. Shacham, S. Sav-age, K. Koscher, A. Czeskis, F. Roesner, and T. Kohno, “ComprehensiveExperimental Analyses of Automotive Attack Surfaces.” in Proceedingsof 20th USENIX Security Symposium. San Francisco, CA: USENIXAssociation, Aug 2011, pp. 77–92.[2] C. Valasek and C. Miller, “Remote Exploitation of an Unaltered Passen-ger Vehicle,” Black Hat USA, vol. 2015, pp. 1–91, 2015.[3] D. Carlsson, “Development of an ISO 26262 ASIL D compliantverification system,” Ph.D. dissertation, Linko¨pings universitet,Linko¨ping, 2013. [Online]. Available: http://www.diva-portal.org/smash/get/diva2:612083/FULLTEXT01.pdf[4] SAE International, “J3061 - Cybersecurity Guidebook for Cyber-Physical Vehicle Systems,” Warrendale, p. 128, 2016. [Online].Available: http://standards.sae.org/wip/j3061/[5] H. H. Thompson, “Why security testing is hard,” IEEE Security andPrivacy, vol. 1, no. 4, pp. 83–86, 2003.[6] G. Dhadyalla, N. Kumari, and T. Snell, “Combinatorial Testing for anAutomotive Hybrid Electric Vehicle Control System: A Case Study,”2014 IEEE Seventh International Conference on Software Testing, Veri-fication and Validation Workshops, pp. 51–57, 2014.[7] K. Koscher, A. Czeskis, F. Roesner, S. Patel, T. Kohno, S. Checkoway,D. McCoy, B. Kantor, D. Anderson, H. Shacham, and S. Savage, “Ex-perimental Security Analysis of A Modern Automobile,” in Proceedingsof the 2010 IEEE Symposium on Security and Privacy. Oakland, CA:IEEE, May 2010, pp. 447–462.[8] D. K. Oka, T. Furue, L. Langenhop, and T. Nishimura, “Survey of VehicleIoT Bluetooth Devices,” in 2014 IEEE 7th International Conference onService-Oriented Computing and Applications. Matsue, Japan: IEEE,November 2014, pp. 260–264.[9] S. Woo, H. J. Jo, and D. H. Lee, “A Practical Wireless Attack onthe Connected Car and Security Protocol for In-Vehicle CAN,” IEEETransactions on Intelligent Transportation Systems, vol. 16, no. 2, pp.993–1006, 2015.

Towards A Testbed for Automotive Cybersecurity

https://pure.coventry.ac.uk/ws/files/23401723/PID4639955.pdf

Towards A Testbed for Automotive Cybersecurity

Abstract

Similar works

Full text

Available Versions

Coventry University Pure Portal